Overview

HashiCorp's Vault Enterprise HSM binary can use an HSM to perform the following:

• Master Key Wrapping: Vault protects its master key by transiting it through the HSM for encryption rather than splitting into key shares.

• Automatic Unsealing: Vault stores its HSM-wrapped master key in storage, allowing for automatic unsealing.

• Seal Wrapping: Provides FIPS key storage conforming functionality for Critical Security Parameters.

• Entropy Augmentation: Vault leverages HSM for augmenting system entropy via the PKCS#11 protocol.

This document describes how to store the Vault encryption key on a ProtectServer 3 HSM and leverage the HSM for entropy augmentation.

The benefits of securing the keys with a ProtectServer 3 HSM include:

• Secure generation, storage, and protection of the encryption keys on FIPS-validated hardware.

• Full life-cycle management of the keys.