49 lines
2.9 KiB
Plaintext
49 lines
2.9 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Vault Enterprise FIPS
|
|
description: An overview of FIPS compliance in Vault.
|
|
---
|
|
|
|
# FIPS
|
|
|
|
The [Federal Information Processing Standard](https://www.nist.gov/federal-information-standards-fips)
|
|
is a cryptography-focused certification standard for U.S. Government usage.
|
|
|
|
Hashicorp's Vault Enterprise supports the modes of FIPS compliance documented below.
|
|
|
|
## FIPS 140-2 Inside
|
|
|
|
Vault Enterprise now includes release flavors with FIPS 140-2 compliant
|
|
cryptography built into the Vault binary. More information on these releases
|
|
can be found on the [FIPS 140-2 Inside](/vault/docs/enterprise/fips/fips1402) page.
|
|
|
|
## Seal Wrap
|
|
|
|
Before our FIPS Inside effort, Vault [depended on](https://www.hashicorp.com/vault-compliance)
|
|
an external HSM for FIPS 140-2 compliance. This uses the [Seal Wrap](/vault/docs/enterprise/fips/sealwrap)
|
|
functionality to wrap security relevant keys in an extra layer of encryption.
|
|
|
|
## Comparison of Versions
|
|
|
|
The below table attempts to documents the FIPS compliance of various Vault
|
|
operations between FIPS Inside and FIPS Seal Wrap. This table is by no means
|
|
an official evaluation of either product; refer to the Leidos Letters of
|
|
Attestation for that information.
|
|
|
|
| Feature | FIPS Inside | FIPS Seal Wrap |
|
|
| :-------------------------------- | :----------------------- | :--------------------------------------- |
|
|
| Entropy Augmentation | Not Supported | Yes |
|
|
| TLS Listener | Yes | No |
|
|
| Vault HA/DR/Raft TLS | Yes | No |
|
|
| Barrier Storage | Yes | No |
|
|
| Seal Wrapping of CSPs | With FIPS-Compliant HSM | With FIPS-Compliant HSM |
|
|
| SSH CA Operations | Yes with FIPS algorithms | No |
|
|
| Transit Operations | Yes with FIPS algorithms | With Managed Keys and FIPS-Compliant HSM |
|
|
| PKI Operations | Yes with FIPS algorithms | With Managed Keys and FIPS-Compliant HSM |
|
|
| KMIP (Key Creation & Use) | Yes with FIPS algorithms | No |
|
|
| Transform Tokenization | Yes | No |
|
|
| Vault Agent TLS & Internal Crypto | Yes | No |
|
|
| Vault to External Plugin TLS | Yes from Vault's side | No |
|
|
| Plugin to third-party service TLS | Yes from Vault's side | No |
|
|
| Auth Plugins' Internal Crypto | Yes with FIPS algorithms | No |
|