scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-31 18:48:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Shamir seals now come in two varieties: legacy and new-style. (#7694)

Browse Source 
Shamir seals now come in two varieties: legacy and new-style. Legacy
Shamir is automatically converted to new-style when a rekey operation
is performed. All new Vault initializations using Shamir are new-style.

New-style Shamir writes an encrypted master key to storage, just like
AutoUnseal. The stored master key is encrypted using the shared key that
is split via Shamir's algorithm. Thus when unsealing, we take the key
fragments given, combine them into a Key-Encryption-Key, and use that
to decrypt the master key on disk. Then the master key is used to read
the keyring that decrypts the barrier.
This commit is contained in:
ncabatoff
2019-10-18 14:46:00 -04:00
committed by GitHub
parent 8f8f05c598
commit afcba41190
30 changed files with 825 additions and 541 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
command/operator_generate_root_test.go
View File

@@ -325,7 +325,7 @@ func TestOperatorGenerateRootCommand_Run(t *testing.T) {
keys[len(keys)-1], // the last unseal key
})
if exp := 0; code != exp {
t.Errorf("expected %d to be %d", code, exp)
t.Fatalf("expected %d to be %d, out=%q, err=%q", code, exp, ui.OutputWriter, ui.ErrorWriter)
}
reToken := regexp.MustCompile(`Encoded Token\s+(.+)`)