FIPS
The Federal Information Processing Standard is a cryptography-focused certification standard for U.S. Government usage.
Hashicorp's Vault Enterprise supports the modes of FIPS compliance documented below.
FIPS 140-2 inside
Vault Enterprise now includes release flavors with FIPS 140-2 compliant cryptography built into the Vault binary. More information on these releases can be found on the FIPS 140-2 Inside page.
Seal wrap
Before our FIPS Inside effort, Vault depended on an external HSM for FIPS 140-2 compliance. This uses the Seal Wrap functionality to wrap security relevant keys in an extra layer of encryption.
Comparison of versions
The below table attempts to documents the FIPS compliance of various Vault operations between FIPS Inside and FIPS Seal Wrap. This table is by no means an official evaluation of either product; refer to the Leidos Letters of Attestation for that information.
| Feature | FIPS Inside | FIPS Seal Wrap |
|---|---|---|
| Entropy Augmentation | Not Supported | Yes |
| TLS Listener | Yes | No |
| Vault HA/DR/Raft TLS | Yes | No |
| Barrier Storage | Yes | No |
| Seal Wrapping of CSPs | With FIPS-Compliant HSM | With FIPS-Compliant HSM |
| SSH CA Operations | Yes with FIPS algorithms | No |
| Transit Operations | Yes with FIPS algorithms | With Managed Keys and FIPS-Compliant HSM |
| PKI Operations | Yes with FIPS algorithms | With Managed Keys and FIPS-Compliant HSM |
| KMIP (Key Creation & Use) | Yes with FIPS algorithms | No |
| Transform Tokenization | Yes | No |
| Vault Agent TLS & Internal Crypto | Yes | No |
| Vault to External Plugin TLS | Yes from Vault's side | No |
| Plugin to third-party service TLS | Yes from Vault's side | No |
| Auth Plugins' Internal Crypto | Yes with FIPS algorithms | No |