Project: Vault (Provisioning / Key Management)
File: Vault_Compliance_Letter_signed.pdf

 
6841 Benjamin Franklin Drive    /   Columbia, MD 21046   /   tel: 443.367.7389   /    fax: 443.367.7970  leidos.com   November 8 , 2017  
 
HashiCorp  
101 2nd St #575  
San Francisco, CA  
94105  
 
To Whom It May Concern:  
 
Leidos completed its conformance review of the HashiC orp Vault v0. 9.0-beta1  (the “Product”) on  November 8 , 
2017; and has found that the Product faithfully integrates the following FIPS 140 -2 approved cryptographic 
module:  
 
1. Luna® PCI -E Cryptographic Module and Luna® PCI -E Cryptographic Module for Luna® SA (FIPS 140 -2 
Cert. #2427) .  This will be referred to as the “Integrated Cryptographic Module” throughout the 
remainder of this document.  
  
Specifically, under  the following assumptions:  
 
1. The Integrated Cryptographic Module  is initialized in a manner that is compliant  with its Security Policy.  
 
2. The Product is configured to use the Integrated C ryptographic Module via a ‘seal’  block specifying a seal 
type of ‘pkcs11’ in the Product’s configuration file.  
 
Leidos’ review confirmed that:  
 
1. All cryptographic operations  for encryption, decryption, message authentication code generation , 
message authentication code verification, and cryptographic key generation used in seal wrapping and 
unwrapping  are offloaded to the Integrated Cryptographic Module .  Secrets protected by seal  wrapping 
are protected by encryption and message authentication codes in a fashion that is compliant  to the FIPS 
140-2 guidance  for both Key Storage (as per FIPS 140 -2 IG 7.16) and Key Transport (as per FIPS 140 -2 
IG D.9).  
 
2. Secrets  and paths  designated as  “Always Seal Wrap” in the Product are protected using the Integrated 
Cryptographic Module  for seal wrapping .  The secrets and paths designated as “Always Seal Wrap” in the 
Product  include the following : 
 
a. The Keyr ing (core/keyring)  
b. The Keyring Update Entry  Path ( All files under core/upgrade/)  
c. The Master Key (core/master)  
d. The Recovery Key (core/recovery -key) 
e. Stored Barrier Keys (core/hsm/barrier -unseal -keys)  
f. Replication Token Generation Key (core/wrapping/jwtkey)  
g. Cluster Information ( core/cluster/local/info ) 
h. Replicated Cluster Information Path ( All files under core/cluster/replicated/)  
i. Replicated Cluster Information Path for Disaster Recovery ( All files under core/cluster/replicated -
dr/) 
j. Multi-Factor Authentication TOTP Keys Path ( All files under sys/mfa/totp keys/ ) 
 
3. When a backend is configured with seal wrapping enabled with the Product, all Keys and Critical Security 
Parameters  written to the backend are protected using the Integrated Cryptographic Module  for seal 
wrapping .  The Keys and Critical Security Parameters covered by seal wrapping include:  
  
6841 Benjamin Franklin Drive    /   Columbia, MD 21046   /   tel: 443.367.7389   /    fax: 443.367.7970  leidos.com  a. The CA Key (config/ca_bundle) used in the PKI secret  backend  
b. The Keys (policy/) and Key Archives  (archive/)  used in the Transit  secret backend  
c. The CA Key ( ca_private_key , config /ca_private_key ) and generated SSH RSA Keys (keys/) used 
in the SSH secret backend  
d. The Keys (key/) used in the TOTP secret backend  
e. All Storage Entries used in the KV backend  
f. AWS Access Keys (config/client) used in the AWS authentication backend  
g. LDAP Creden tials (config) used in the LDAP authentication backend  
h. Okta Credentials (config) used in the Okta authentication backend  
i. RADIUS Credentials (config) used in the RADIUS authentication backend  
j. AWS Root Credentials (config/root) used in the AWS secret backend  
k. Cassandra Credentials (config/connection) used in the Cassandra secret backend  
l. Consul Credentials (config/access) used in the Consul secret backend  
m. Database Credentials (config/*) used in the plugin -based Database secret backend  
n. MongoDB Credentials (confi g/connection) used in the MongoDB secret backend  
o. MSSQL Credentials (config/connection) used in the MSSQL secret backend  
p. MySQL Credentials (config/connection) used in the MySQL secret backend  
q. PostgreSQL Credentials (config/connection) used in the PostgreSQL  secret backend  
r. RabbitMQ Credentials (config/connection) used in the RabbitMQ secret backend  
 
4. The Product will not operate if the Integrated Cryptographic Module is missing or altered.  
 
Details of Leidos’ review, which consisted of source code review and operational testing, are obtainable by special 
request.  
 
Please note that for this review, Leidos only examined the Product features referenced above and while the 
Product may contain other features or functionality, Leidos did not examine these during its  review and makes no 
claims or representations regarding them.  Furthermore, the Cryptographic Module Validation Program (CMVP) 
has not independently reviewed Leidos’ analysis, testing, or results.  
 
The intention of this letter is to provide independent op inion that the Product correctly integrates and uses 
validated cryptographic modules within the scope of claims indicated above.   Leidos offers no warranties or 
guarantees with respect to the above described compliance review.  This letter does not imply a Leidos 
certification or product endorsement.  
Please let us know if you have any questions.  
 
Sincerely,  
 
Jason Tseng  
Leidos Cryptographic and Security Testing Laboratory  (CSTL) Lab Manager