m6 powershell

Author: ned1313

m6/1-enable-transit-engine.ps1

@@ -0,0 +1,32 @@
+# We're going to enable the transit engine and then use it to encrypt some data
+
+# Make sure your Vault server container is up and running
+docker container ls
+
+# Let's set our vault env variables
+$env:VAULT_ADDR="https://127.0.0.1:8200"
+$env:VAULT_SKIP_VERIFY="true"
+
+# Make sure vault isn't sealed
+vault status
+vault login
+
+# Now let's enable the transit engine at the default path
+vault secrets enable transit
+
+# Is there anything to configure here? Let's run path-help to check
+vault path-help transit/
+
+# You can configure the caching strategy, which defaults to unlimited
+
+# Let's do some encryption work!
+
+# First we'll create an encryption key to use
+vault write -force transit/keys/ccid
+
+# Let's check out some info about the key
+vault list transit/keys
+vault read transit/keys/ccid
+
+# If you want to know more about these fields, use our friend path-help
+vault path-help transit/keys/ccid/config

m6/2-encrypt-data.ps1

@@ -0,0 +1,15 @@
+# Now that we have a key, let's encrypt some plaintext
+$plaintext=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("4444123412341234"))
+vault write transit/encrypt/ccid plaintext=$plaintext
+
+# We should capture that in JSON so it's easier to use
+$json_data = vault write transit/encrypt/ccid plaintext=$plaintext -format=json | ConvertFrom-Json
+
+# If we want to decrypt the data we need to submit the ciphertext with the version of the key
+# And we need to refer to the correct key
+vault write transit/decrypt/ccid ciphertext=$($json_data.data.ciphertext)
+
+# That value is still base64 encoded. Let's decode it.
+$decrypt_json = vault write transit/decrypt/ccid ciphertext=$($json_data.data.ciphertext) -format=json | ConvertFrom-Json
+$decoded = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($decrypt_json.data.plaintext))
+Write-Output $decoded

m6/3-rotate-keys.ps1

@@ -0,0 +1,32 @@
+# What if we want to rotate the encryption keys?
+vault write -force transit/keys/ccid/rotate
+
+# Let's get info about the key now
+vault read transit/keys/ccid
+
+# We can still decrypt data using the old key
+vault write transit/decrypt/ccid ciphertext=$($json_data.data.ciphertext)
+
+# If we try and encrypt a new piece of data, it will use the new key
+$plaintext=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("4444123412341234"))
+vault write transit/encrypt/ccid plaintext=$plaintext
+
+# Let's rotate the key a few more times
+vault write -force transit/keys/ccid/rotate
+
+# And we'll set the minimum version availble to 2
+vault write transit/keys/ccid/config min_decryption_version=2
+
+# If we try and decrypt our old ciphertext now, we'll get an error
+vault write transit/decrypt/ccid ciphertext=$($json_data.data.ciphertext)
+
+# The key is still there
+vault read transit/keys/ccid 
+
+# If we want to purge an older key, we need to set the min encryption version
+# and then we can trim the keys
+vault write transit/keys/ccid/config min_encryption_version=2
+vault write transit/keys/ccid/trim min_available_version=2
+
+# Now the key version 1 is gone and you can't get it back
+vault read transit/keys/ccid