Encrypted Message Re-Wrapping

00:03

in this video, we're going to understand the rewrap capability that the transit secret engine has.

00:09

We're going to do this by encrypting a secret using the current version of the M I six key.

00:14

Then we're gonna update that encryption key that the original encryption was using. We're gonna just exercise the decryption process. Just make sure that that still works because it was scripted with an old key. And then we're gonna re encrypt the secret using a new version of the key. Specifically, we're gonna be using the rewrap capabilities

00:35

starting out with the Web interface. Let's jump into the encryption as a service area and drive into the M I six key. Let's perform a few key actions. So we want to encrypt a particular message. Let's say, um,

00:51

agent que

00:54

Agent Q has a new laser beam,

01:00

and we're going to base 64 code that and go through the encryption. And let's copy this off as well.

01:10

Now, of course, we could do the decrypt operation, and we know that's gonna work out. But it's going to be a common situation within your company, just like you wrote. Take passwords, rotating the underlying encryption keys. Maybe you have a policy. You want to do it once 1/4 once a month, once a week, one today, whatever sort of frequency

01:26

it really is a good practice to be rotating these things. And that's a running theme is we've explored Baltin. Really? What are the fundamental tenants around?

01:34

How does it make things more secure, right? Rotating and changing passwords. So of course, we want to continue that even when we're using vault. And we want to rotate the underlying encryption key that the encryption, as a service is using. So this m I six encryption keys. So let's drill into that and look at the versions capability,

01:53

and we're gonna rotate. The encryption key

01:56

rotated all key actions using the latest version of the key. Great.

02:00

So now here's the current minimum version two. And so now we've created a new version of the encryption key.

02:07

So let's come back and to perform a few key actions, namely, let's train decrypt and we're gonna paste in the encrypted message that we just created. So one thing to note on this message is there's some texts pre pendant to it, and it's always gonna be there. It's a vault colon that's telling us Hey, this this is cipher text and it was encrypted

02:25

using vault.

02:28

It doesn't specifically say he this was encrypted using the m I six key. That's something that you need to keep track of. But what it does tell us is this was encrypted using V one, the version one off the M I six key in our particular case. So let's perform the decrypt operation using this message which was encrypted using version one

02:46

even though version two of the key exists.

02:51

And sure enough, it does decrypt because in the actual message itself, vault parses that and it recognizes. Okay, this is done using version one. I'm going to use the version one of the key to do the decryption,

03:02

and that's great for backwards compatibility. But there may be circumstances where maybe version one. That key somehow got out. It escaped, and we have great audit logs and balt and we figured out that somebody pulled it out of the system and they really shouldn't have. So then what are we going to do in this situation?

03:20

Well, eventually, what we need to do is is re encrypt

03:23

everything that was encrypted with the version one key with the version two key. And in order to do that,

03:30

we can either decrypt every single message that was encrypted with version one and then come back and re encrypt those with version two. Or we can use the rewrapped capability that vault itself provides. So in this case,

03:46

here's the version one encrypted information, and we're going to use the rewrap capability, and it's gonna re encrypt this using version two. So I go rewrap. And sure enough, here is the same key. Same message. But it's been encrypted using version two of the key. So if you come back and do a little decrypt

04:06

Okay, let's do that. And

04:09

hey, Agent Q has a new laser beam. So

04:13

why is this important and valuable this rewrap capability?

04:16

Well, by using this capability, the whole process of decrypting the message using version one of the key,

04:25

having it in a decrypted format and then re encrypting it using the version two key over the version three keer, whatever the latest key is, all of those actions take place on the vault server. So the decrypted version of this message doesn't need to transition back and forth over the wire. It doesn't need to be

04:44

provided in an unencrypted format to any sort of an application,

04:47

and that's very handy to really keep things on, lock down and just reduce the amount of time that this information is exposed in plain text.

04:57

So we're not totally done with this fictitious scenario because the key, his leaked version one of the keys leaked. That's why we're going through this whole rewrapped process. And once we're done updating the different data that was encoded with the version one of the key, there's a few different actions we can take.

05:14

It's drill into the key

05:15

edit encryption key. We can enable the deletion capability. And then, of course, we could delete that version of the key alternately if we want to keep version one around because the bad guy did get it. But we want to keep it around just in case we set the minimum decryption to Version two,

05:32

and we can enable some additional auditing capabilities

05:35

that will alert us if somebody attempts to decrypt the data using version one of the key and that way we can still go back and go through some other specific actions if we want to decrypt that data using version one of the key. But we will be alerted because from our perspective, version one of the key leaked and

05:55

that information is all suspects. So we re encrypted it with version two.