HashiCorp Vault 1.0 is the culmination of a journey that brings broad ecosystem integration, feature completeness, and enterprise readiness to the popular secrets management tool. Learn how to use new features like Auto Unseal and Batch Tokens.

1. Copyright © 2018 HashiCorp
Vault 1.0 - New
Features
Calvin Leung Huang - Software Engineer

2. s
Copyright © 2018 HashiCorp !2
Introduction

3. Copyright © 2018 HashiCorp
▪Auto-unseal
▪Seal migration
▪Batch tokens
Agenda
!3

4. s
Copyright © 2018 HashiCorp !4
Auto-unseal

5. Copyright © 2018 HashiCorp
Shamir Secret Sharing
▪ Protect master key
▪ Split Master Keys in to K shares
▪ Unsealing requires T keys to
meet unseal threshold
▪ Default: K=5 T=3
▪ Requires human intervention for
unseal on Vault startup
!5
Key Shares Master Key Encryption Key

6. Copyright © 2018 HashiCorp
▪ Initial release on enterprise for use with HSM modules
▪ Keys protected by an external mechanism
▪ No human intervention required
Auto-unseal
!6

7. Copyright © 2018 HashiCorp
Auto-unseal: HSM
▪ HSM Modules
▪ PKCS11 API to encrypt/decrypt
the master key
▪ Multiple encryption
mechanisms supported
– AES_CBC_PAD
– AES_CBC
– AES_GCM
– RSA_PKCS_OAEP
– RSA_PKCS
!7
Key Shares Master KeyEncryption Key

8. Copyright © 2018 HashiCorp
Auto-unseal: Cloud KMS Providers
▪ AWS KMS
▪ GCP Cloud KMS
▪ Azure Key Vault
▪ AliCloud KMS
!8
Key Shares Master Key Encryption Key

9. Copyright © 2018 HashiCorp
▪ Unseal keys not returned to the operator
▪ Recovery key shares returned instead
▪ Recovery keys are used for the following operations
– Trigger an auto-unseal
– Rekey
– Root token generation
Auto-unseal vs Shamir
!9

10. s
Copyright © 2018 HashiCorp !10
Demo

11. s
Copyright © 2018 HashiCorp !11
Seal migration

12. Copyright © 2018 HashiCorp
▪ Supports existing installations using Shamir
▪ Migration from Shamir to Auto-unseal
▪ Migration from Auto-unseal to Shamir
▪ Currently, only supported only in OSS due to:
– Sealwrap
– Replication
Seal migration
!12

13. s
Copyright © 2018 HashiCorp !13
Demo

14. s
Copyright © 2018 HashiCorp !14
Batch Tokens

15. Copyright © 2018 HashiCorp
▪ Authentication via auth methods to obtain a Vault token
▪ This applied to all service types, including those in microservice-
oriented and FaaS architectures
▪ As more users and services talk to Vault, overhead of token creation
becomes a problem
▪ Put a lot of pressure on Vault’s storage backend
Authentication
!15

16. Copyright © 2018 HashiCorp
▪ Token creation:
– 1 primary index, 1 parent index, 1 accessor index, 1 lease write
– 4 WAL (write-ahead-log) writes
▪ Token revocation:
– 4 deletes
– 4 WAL additional writes
– 8 WAL deletes
▪ Minimum 12 writes and 12 deletes per token
Lifecycle of a Token
!16

17. Copyright © 2018 HashiCorp
▪ Token info is encrypted
– Think of it as a JWT, but encrypted instead of signed
▪ Meant for batch jobs, single purpose, single use scenarios
▪ Not held in storage or in memory
▪ Different guarantees around lifetime and persistence
Batch Tokens
!17

18. Copyright © 2018 HashiCorp
Service Tokens vs Batch Tokens
!18
Service Tokens Batch Tokens
Can Be Root Tokens Yes No
Can Create Child Tokens Yes No
Can be Renewable Yes No
Can be Periodic Yes No
Can have Explicit Max TTL Yes No (always uses a fixed TTL)
Has Accessors Yes No
Has Cubbyhole Yes No
Revoked with Parent (if not orphan) Yes Stops Working
Dynamic Secrets Lease Assignment Self Parent (if not orphan)
Can be Used Across Performance Replication Clusters No Yes (if orphan)
Creation Scales with Performance Standby Node Count No Yes
Cost Heavyweight; multiple storage writes per token creation Lightweight; no storage cost for token creation

19. Copyright © 2018 HashiCorp
▪ Most tokens will not have children, unneeded parent entry
▪ Explicit revocation unnecessary since it can be trigger by TTL
▪ Mechanisms to (indirectly) revoke leases still exists
– Via lease ID
– Via parent token revocation
Acceptable Trade-offs
!19

20. s
Copyright © 2018 HashiCorp !20
Demo

21. Copyright © 2018 HashiCorp
▪ GCP KMS Secrets Engine
▪ OpenAPI Support
▪ Vault Agent Auto-auth via AppRole
▪ Kubernetes Projected Service Account Tokens
▪ UI: Response Wrapping
▪ Many more improvements!
Additional Features
!21

22. Thank you.
hello@hashicorp.comwww.hashicorp.com