I have been tasked with evaluating Vault in our company and the first question asked by an architect was:

If someone hacks our server, how can we prevent them from decrypting data stored in Vault?

Due to my limited knowledge of Vault, I am unable to answer this question in a way that would satisfy an architect's mind and quickly referred them to the docs however this still doesn't completely answer the question

I understand that "The master key is only retrievable by reconstructing the shares" but again, how does this stop someone from decrypting the data?

  • In order to read from the vault, a client needs to be authenticated. From what I can tell, if someone gains access to your server, they have as much access to the vault as any application using the vault that they can tamper with. If they have root access to the server running Vault, they can potentially pluck the encryption keys out of the vault process's memory. – Blender May 29 '15 at 15:05
  • @Blender do you have any links that support the last sentence in your answer? – user77572 May 29 '15 at 15:07
  • 4
    The following are not parts of the Vault threat model: Protecting against memory analysis of a running Vault. If an attacker is able to inspect the memory state of a running Vault instance then the confidentiality of data may be compromised. It's also said that "[sealing the vault] will throw away the encryption key and require another unseal process to restore it." (source), which I interpret as Vault keeping the encryption key around in memory while it's "unsealed". – Blender May 29 '15 at 15:09
  • [knowing nothing about Vault specifically] Where does Vault store its data, in a database? What happens if that gets stolen (ie the hard drive is copied)? – Mike Ounsworth May 29 '15 at 15:21
  • 2
    @MikeOunsworth: The docs say that Vault uses Shamir's Secret Sharing to split an encryption key into n parts, m of which are needed to "unseal" the vault when it's started. As for the data store, Vault first encrypts it with AES-GCM and then stores it in another place (mainly "the cloud"). – Blender May 29 '15 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy