• HashiCorp Developer

  • HashiCorp Cloud Platform
  • Terraform
  • Packer
  • Consul
  • Vault
  • Boundary
  • Nomad
  • Waypoint
  • Vagrant
Vault
  • Install
  • Tutorials
  • Documentation
  • API
  • Integrations
  • Try Cloud(opens in new tab)
  • Sign up
Vault Home

Documentation

Skip to main content
  • Documentation
  • What is Vault?
  • Use Cases

  • Browser Support
  • Installing Vault

  • Vault Integration Program
  • Vault Interoperability Matrix
  • Troubleshoot






  • Glossary

    • Overview
    • Replication
    • Automated Integrated Storage Snapshots
    • Automated Upgrades
    • Redundancy Zones
    • Lease Count Quotas
    • Entropy Augmentation
    • Seal Wrap
    • Namespaces
    • Performance Standbys
    • Eventual Consistency
    • Control Groups
    • Managed Keys
    • HCP Vault

  • Resources

  • Tutorial Library
  • Certifications
  • Community Forum
    (opens in new tab)
  • Support
    (opens in new tab)
  • GitHub
    (opens in new tab)
  1. Developer
  2. Vault
  3. Documentation
  4. Vault Enterprise
  5. Entropy Augmentation
  • Vault
  • v1.11.x
  • v1.10.x
  • v1.9.x
  • v1.8.x
  • v1.7.x
  • v1.6.x
  • v1.5.x
  • v1.4.x

»Entropy Augmentation

Note: This feature requires Vault Enterprise Plus.

Warning This feature is not available with FIPS 140-2 Inside variants of Vault.

Vault Enterprise features a mechanism to sample entropy (or randomness for cryptographic operations) from external cryptographic modules via the seals interface. While the system entropy used by Vault is more than capable of operating in most threat models, there are some situations where additional entropy from hardware-based random number generators is desirable.

To use this feature, you must have an active or trial license for Vault Enterprise. To start a trial, contact HashiCorp sales.

»Critical Security Parameters (CSPs)

Entropy augmentation allows Vault Enterprise to supplement its system entropy with entropy from an external cryptography module. Designed to operate in environments where alignment with cryptographic regulations like NIST SP800-90B is required or when augmented entropy from external sources such as hardware true random number generators (TRNGs) or quantum computing TRNGs are desirable, augmented entropy replaces system entropy when performing random number operations on critical security parameters (CSPs).

These CSPs have been selected from our previous work in evaluating Vault for conformance with FIPS 140-2 guidelines for key storage and key transport and include the following:

  • Vault’s root key
  • Keyring encryption keys
  • Auto Unseal recovery keys
  • TLS private keys for inter-node and inter cluster communication (HA leader, raft, and replication)
  • Enterprise MFA TOTP token keys
  • JWT token wrapping keys
  • Root tokens
  • DR operation tokens
  • Transit backend key generation and /random endpoint (/random only on Vault 1.11+)
  • PKI issuer key generation, but not for leaf certificate private keys
  • /sys/tools/random endpoint (Vault 1.11+)
  • SSH CA key generation, but not for key pair generation
  • KMIP uses EA for its TLS CA, server, and client certificates.

Enabling/Disabling

Entropy augmentation is disabled by default. To enable entropy augmentation Vault's configuration file must include a properly configured entropy and seal stanza for a supported seal type.

Tutorial

Refer to the HSM Integration - Entropy Augmentation tutorial to learn how to use the Entropy Augmentation function to leverage an external Hardware Security Module to augment system entropy.

Edit this page on GitHub

On this page

  1. Entropy Augmentation
  2. Critical Security Parameters (CSPs)
  3. Enabling/Disabling
  4. Tutorial
Give Feedback(opens in new tab)
  • Certifications
  • System Status
  • Terms of Use
  • Security
  • Privacy
  • Trademark Policy
  • Trade Controls
  • Give Feedback(opens in new tab)