Unsealing with Key Shards

In this guide, you’ll learn how HashiCorp Vault protects its master key using Shamir’s Secret Sharing algorithm. Vault splits the master key into multiple unseal keys (key shards), so no single person ever holds the entire master key. Each shard is entrusted to a different custodian, and only a quorum of shards can reconstruct the master key.

Distributing Key Shards

When Vault initializes (vault operator init), it generates a specified number of shares and a threshold number required to unseal. By default, Vault creates 5 shares and a threshold of 3.

Each key shard is distributed to a separate trusted individual (e.g., security team members or management).

Unsealing Process

When Vault is sealed, no operations can occur until enough unseal keys are submitted. Each submitted key shard increments the unseal progress. Once the threshold is reached, Vault reconstructs the master key, decrypts its encryption key, and transitions to the unsealed state.

1. Check Vault Status (Sealed)

$ vault status
Key                     Value
---                     -----
Seal Type               shamir
Sealed                  true
Total Shares            5
Threshold               3
Unseal Progress         0/3

2. Submit Unseal Shards

1. Submit first key → Unseal Progress 1/3
2. Submit second key → Unseal Progress 2/3
3. Submit third key → Unseal Progress 3/3 → Vault transitions to unsealed

3. Verify Vault Status (Unsealed)

$ vault status
Key                     Value
---                     -----
Seal Type               shamir
Sealed                  false
Total Shares            5
Threshold               3
Version                 1.7.0
Storage Type            consul
Cluster Name            vault-cluster
Cluster ID              xxx-xxx-xxx-xxx
HA Enabled              true

Key Shard Best Practices

Implement these practices to maintain strong security for your unseal keys:

Links and References

• Shamir’s Secret Sharing on Wikipedia
• HashiCorp Vault Documentation
• Vault Operator Init