Task 6.1: Encrypt and decrypt secrets

• AThe orders key must be created with an RSA key type first

  Incorrect

  The default aes256-gcm96 key encrypts; the error concerns the input encoding.

• BThe plaintext must be base64-encoded before it is sent

  Correct

  Transit accepts any binary data, so it requires all plaintext to be base64-encoded.

• CThe request must name a key version, as in transit/encrypt/orders/v1

  Incorrect

  The latest version is used by default, and versions are not given as path segments.

• DThe request must add -wrap-ttl to wrap the plaintext in transit

  Incorrect

  Response wrapping wraps the response; it does not change how transit reads its input.

Encode with base64 on the way in and decode the plaintext that decrypt returns; transit never stores the data.

• AThe same base64-encoded context value for the tenant on both calls

  Correct

  With derivation enabled, every encrypt and decrypt request must provide a context, and decryption needs the context used to encrypt.

• BA base64-encoded nonce on the encrypt call only

  Incorrect

  A nonce was needed only for convergent keys created in Vault 0.6.1; derivation requires a context.

• CThe key_version parameter on both calls

  Incorrect

  This does not satisfy the context requirement of a derived key.

• DA context for the tenant on the encrypt call, which decryption reads from the ciphertext

  Incorrect

  Decrypt requests on a derived key must provide the context as well; Vault does not take it from the ciphertext.

Key derivation turns one named key into many by mixing in a caller-supplied context, so the caller must supply that context every time.

• Avault secrets enable transit/keys/orders

  Incorrect

  secrets enable mounts an engine; it does not create keys.

• Bvault kv put transit/keys/orders type=aes256-gcm96

  Incorrect

  kv commands are for KV engines, not transit.

• Cvault write -f transit/keys/orders

  Correct

  Writing to keys/<name> creates a named key; -f sends the request without data.

• Dvault write transit/encrypt/orders

  Incorrect

  An encrypt call needs plaintext; keys are created explicitly on keys/<name>.

Usually each application gets its own named key; the default type is aes256-gcm96.

• AA LIST of transit/keys, which returns each key's type and abilities

  Incorrect

  Listing returns only the key names.

• BA read of transit/config/keys, the mount's key configuration

  Incorrect

  It holds settings for the whole mount, not the abilities of each key.

• CAn attempt at transit/export/encryption-key/<name> for every key

  Incorrect

  Export works only for keys marked exportable, so it says nothing about the others.

• DA read of each key; the response includes supports_encryption

  Correct

  Reading a key returns its type and flags such as supports_encryption, supports_decryption and supports_signing.

A key read never returns key material: it shows the type, the versions with their creation times, and what the key supports, which makes it the safe way to audit existing keys.

• Aupdate on transit/encrypt/orders and on transit/decrypt/orders

  Correct

  Encrypt and decrypt are POST requests, which map to update, on each key's endpoint.

• Bread on transit/encrypt/orders and on transit/decrypt/orders

  Incorrect

  These endpoints take writes; read does not allow them.

• Cupdate on transit/keys/orders

  Incorrect

  That path manages the key's configuration, not encryption.

• Dcreate, read, update and delete on transit/*

  Incorrect

  This also lets the app reconfigure, rotate or delete every key.

ACLs let operators manage keys while applications only encrypt and decrypt with the keys they need.

• AOne encrypt request with all values joined into a single plaintext

  Incorrect

  That yields a single ciphertext, not one per value.

• BOne request whose batch_input lists every value

  Correct

  batch_input takes a list of items, each with its own base64 plaintext, in a single request.

• COne request to transit/datakey for all values

  Incorrect

  A data key is for local encryption; it does not encrypt the values.

• DOne request to transit/rewrap with the plaintexts

  Incorrect

  Rewrap takes existing ciphertext, not plaintext.

Batch input keeps per-item results, including per-item errors, in one round trip.