Skip to content

Commit

Permalink
Vault documentation: updated key share/unseal images (#15526)
Browse files Browse the repository at this point in the history
* updated images

* added new image files
  • Loading branch information
taoism4504 authored May 20, 2022
1 parent f80c2a8 commit 74ac757
Show file tree
Hide file tree
Showing 6 changed files with 5 additions and 5 deletions.
4 changes: 2 additions & 2 deletions website/content/docs/concepts/seal.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ the unseal key.

## Shamir seals

![Shamir](/img/vault-shamir-storage.png)
![Shahir seals](/img/vault-shamir-seal.png)

The default Vault config uses a Shamir seal. Instead of distributing the unseal
key as a single key to an operator, Vault uses an algorithm known as
Expand Down Expand Up @@ -89,7 +89,7 @@ securing the unseal key from users to a trusted device or service. At startup
Vault will connect to the device or service implementing the seal and ask it
to decrypt the root key Vault read from storage.

![AutoUnseal](/img/vault-autounseal-storage.png)
![Auto unseal](/img/vault-auto-unseal.png)

There are certain operations in Vault besides unsealing that
require a quorum of users to perform, e.g. generating a root token. When
Expand Down
4 changes: 2 additions & 2 deletions website/content/docs/internals/architecture.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,9 @@ a root key. By default, Vault uses [Shamir's Secret
Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) to split the
root key into a configured number of shards (referred as key shares or unseal
keys). A certain threshold of shards is required to reconstruct the root key,
which is then used to decrypt the Vault's encryption key.
which is then used to decrypt the Vault's encryption key.

![Unseal keys](/img/unseal.png)
![Unseal keys](/img/vault-shamir-seal.png)

Refer to the [Seal/Unseal](/docs/concepts/seal#seal-unseal) documentation for
further details.
Expand Down
2 changes: 1 addition & 1 deletion website/content/docs/internals/rotation.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ to split the root key into 5 shares, any 3 of which are required to reconstruct
key. The root key is used to protect the encryption key, which is ultimately used to protect
data written to the storage backend.

[![Vault Shamir Secret Sharing Algorithm](/img/vault-shamir-secret-sharing.svg)](/img/vault-shamir-secret-sharing.svg)
![Key Rotate](/img/vault-key-rotate.png)

To support key rotation, we need to support changing the unseal keys, root key, and the
backend encryption key. We split this into two separate operations, `rekey` and `rotate`.
Expand Down
Binary file added website/public/img/vault-auto-unseal.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added website/public/img/vault-key-rotate.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added website/public/img/vault-shamir-seal.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 74ac757

Please sign in to comment.