Seal and Unseal

Vault’s seal and unseal mechanism protects your data at rest by ensuring the encryption key is only accessible in memory when explicitly unlocked. Every time Vault starts, it launches in a sealed state. In this state, Vault knows where your data resides (via its configured storage backend) but cannot decrypt it until the master key is reconstructed.

Vault Sealed State

When Vault is sealed:

• Only vault status and the unseal operation are permitted.
• All other actions—reading or writing secrets, generating tokens, etc.—remain blocked.

Unsealing Vault reconstructs the master key, decrypts the in-memory encryption key, and allows normal operations. Sealing removes the encryption key from memory, requiring a fresh unseal to resume.

Why Seal Vault Manually?

Common reasons to seal Vault immediately include:

• Suspected exposure of unseal key shards (e.g., accidentally published in a public repo)
• Departure or unavailability of key-holding personnel
• Detection of network intrusion
• Malware or spyware discovered on Vault nodes

Sealing & Unsealing Methods

Vault supports three primary unseal mechanisms:

When Vault is initialized, the master key is split into multiple key shards using Shamir’s Secret Sharing. For example, Vault might create 5 shards with a threshold of 3. Each shard is handed to a different trusted individual.

To unseal:

1. Provide at least the threshold number of shards.
2. Vault combines them to reconstruct the master key.
3. The master key decrypts the encryption key in memory, and Vault transitions to an unsealed state.

Step-by-Step Demo

1. Verify sealed status:

   vault status
   # Key                Value
   # ---                -----
   # Seal Type          shamir
   # Sealed             true
   # Total Shares       5
   # Threshold          3
   # Unseal Progress    0/3
   

2. Submit two shards (order doesn’t matter):

   vault unseal <key-shard-1>
   # Unseal Progress: 1/3
   
   vault unseal <key-shard-2>
   # Unseal Progress: 2/3
   

3. Provide the third shard:

   vault unseal <key-shard-3>
   # Key                Value
   # ---                -----
   # Seal Type          shamir
   # Sealed             false
   # Total Shares       5
   # Threshold          3
   # Version            1.7.0
   # Storage Type       consul
   # Cluster Name       vault-cluster
   # Cluster ID         xxx-xxx-xxx-xxx
   # HA Enabled         true
   

Once unsealed, Vault displays runtime and cluster details and begins serving requests.

Best Practices for Key Shards

• Separate custody: Distribute shares so no single person holds the threshold.
• Encrypt at rest: Supply PGP public keys during initialization to encrypt each shard.
• Offline storage: Keep shards out of online systems and automated backups.
• Balance threshold: A higher threshold boosts security but may affect availability.

Links and References

• Vault Secrets Engines
• HashiCorp Vault Documentation
• Shamir’s Secret Sharing on Wikipedia
• AWS KMS
• Azure Key Vault
• Vault Transit Secrets Engine