Decrypting Data after Recovery

alberk · October 6, 2022, 5:17am

Hi,
If I have a vault setup and have the recovery key and rebuild a new vault will it still decrypt data that was encrypted by the transit secrets engine. In another words, Is the encryption engine secret key generation Hierarchical Deterministic?

maxb · October 6, 2022, 5:23am

No, it is not.

When using auto-unseal, even after a restore from backup, the original auto-unseal method must still be online and accessible to unseal Vault.

The recovery key cannot recover the data.

(I think this makes it dangerously misnamed, personally.)

github.com/hashicorp/vault

Auto-unseal Recovery Keys should be able to unseal Vault

opened 07:06AM - 18 May 22 UTC

maxb

core/seal docs/learn

When you configure Vault with Auto-unseal, you get Recovery Keys. The name it…self makes a strong implication that their purpose is to recover Vault when the auto-unseal is down. But actually this turns out to be a false promise - they cannot! Recovery keys are actually only useful to prove to the Vault software that a quorum of administrators are acting together, to authenticate operations which require that. This is a pretty common question to come up over on discuss.hashicorp.com. I propose that something needs to be done to fix this misleading use of terminology, which has a high risk of causing data loss to users. I can imagine three possible ways to proceed: 1) Rename "Recovery keys" to "Administrator authentication keys" throughout the product and documentation. 2) Transition "Recovery keys" to genuinely enable recovery from a lost auto-unseal, by storing a second copy of the key material that is encrypted with the auto-unseal key, encrypted with the recovery key too. 3) Effectively, both: in a future version of Vault, support a user choice between "Auto-unseal with recovery keys" and "Auto-unseal with administrator authentication keys".

alberk · October 6, 2022, 5:26am

What this means is that to recovery I would need the backup?

maxb · October 6, 2022, 5:28am

Backup of what?

I don’t understand what you’re asking.

alberk · October 6, 2022, 5:43am

backup the Database of the vault. I know all the doc says use the consol but the more recent only say that flat file for storage is ok.

maxb · October 6, 2022, 9:31pm

You just introduced a lot of new concepts, and I’m finding it hard to understand you still.

Vault can use various different storage backends, and in your last message, I think you mentioned 3 different ones.

Vault has no database of its own unless you are using the Integrated Storage (Raft) backend.

Consul is another option, the traditional one. When using Consul, all the data is stored in Consul and that is what you back up.

There is also a flat file backend https://www.vaultproject.io/docs/configuration/storage/filesystem. Do take care that until Vault 1.11.1 / 1.10.5 / 1.9.8, it contained a serious bug which could leave the Vault data unrecoverable - Fix keyring file missing after Vault restart by shujun10086 · Pull Request #15946 · hashicorp/vault · GitHub.

Whichever storage backend you end up using, if you’re using auto-unseal (e.g. via transit), a backup is NOT ENOUGH to recover. You also need the original auto-unseal method to still exist and be working, or you backup CANNOT be decrypted.