{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/1422","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/1422/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/1422/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/1422/events","html_url":"https://github.com/hashicorp/vault/issues/1422","id":155012024,"number":1422,"title":"Vault- Encrypt/decrypt with transit backend","user":{"login":"Niks-JJ","id":17048996,"avatar_url":"https://avatars.githubusercontent.com/u/17048996?v=3","gravatar_id":"","url":"https://api.github.com/users/Niks-JJ","html_url":"https://github.com/Niks-JJ","followers_url":"https://api.github.com/users/Niks-JJ/followers","following_url":"https://api.github.com/users/Niks-JJ/following{/other_user}","gists_url":"https://api.github.com/users/Niks-JJ/gists{/gist_id}","starred_url":"https://api.github.com/users/Niks-JJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Niks-JJ/subscriptions","organizations_url":"https://api.github.com/users/Niks-JJ/orgs","repos_url":"https://api.github.com/users/Niks-JJ/repos","events_url":"https://api.github.com/users/Niks-JJ/events{/privacy}","received_events_url":"https://api.github.com/users/Niks-JJ/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-16T11:34:33Z","updated_at":"2016-05-16T11:44:52Z","closed_at":"2016-05-16T11:44:52Z","body":"Referring to Documentation from Hashicorp:\r\n\r\n\"By default, Vault uses a technique known as Shamir's secret sharing algorithm to split the master key into 5 shares, any 3 of which are required to reconstruct the master key. The master key is used to protect the encryption key, which is ultimately used to protect data written to the storage backend.\"\r\n\r\nQuestion.\r\nSet up:\r\n\r\nDatacenter 1\r\n----------------\r\nMy Application-------> Vault1 for encrypt/decrypt\r\n\r\nDatacenter 2\r\nMy Application ---> Vault 2 for encrypt/decrypt\r\n\r\nBackend: File system\r\nTransit backed for encrypt/decrypt\r\n\r\nWhen DC 1 goes down, DC2 comes up and application should be able to decrypt data encrypted by vault 1 at DC1.\r\nAssumption: 1) All encrypt keys created in vault 1 are also created in vault2 using HTTP end point\r\ne.g. http://127.0.0.1:8200/v1/transit/encrypt/demo1\r\n2) Data storage of application gives access of all encrypted data in DC2 as transit backed do not store data just encrypts in transit.\r\n\r\nChild token is used to authenticate encrypt/decrypt i.e X-Vault-Token is a child token\r\n\r\nquestions:\r\n1) Master keys will be obviously different in two instances of vault.\r\nX-Vault-Token, as I understand, will also be different in vault 1 and vault 2.\r\n\r\nIs it true that all encrypted data in DC 1 can be decrypted is DC2 and it's value will remain same?\r\n\r\nUsually in cryptography, if cipher keys are same decrypt should give same result. But I have a doubt here because of the role of master key and X-Vault-Token.\r\n\r\nCan someone please reply.\r\n\r\nThanks\r\n\r\n\r\n\r\n"}}