HashiCorp Vault Associate (003) Question 217
Single answer8c Explain the uses of Shamir secret sharing and unsealingA company runs a production Vault cluster using Shamir seal. During a scheduled restart after maintenance, the operators need to make Vault available again without giving any one administrator the entire master key material. The security team has initialized Vault with 5 unseal key shares and a threshold of 3. Which action should the operators take to unseal the Vault cluster securely and correctly?
- A
Have any 3 of the 5 key custodians provide their unseal key shares to reconstruct the required key material and complete the unseal process
- B
Have 1 key custodian submit their unseal key share 3 times, because the threshold is 3
- C
Use the root token generated at initialization to unseal Vault, because root tokens can bypass the seal
- D
Retrieve all 5 key shares and combine them into the original master key, because Vault requires every share to unseal
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of how Shamir secret sharing is used in Vault's unseal process. In a Shamir-sealed Vault, the unseal key is split into multiple shares at initialization, and only the configured threshold number of distinct shares is needed to unseal. This design reduces the risk of a single person being able to unseal Vault alone and is a common control for separation of duties in production environments. The key point is that unsealing requires the threshold number of valid, unique shares, not all shares, and not a token. HashiCorp Vault documentation on initialization and unsealing explains that Vault can be initialized with a specified number of key shares and key threshold, and any subset meeting the threshold can be used to unseal the server.
- A. Correct.
Correct. With Shamir secret sharing, Vault splits the unseal key into multiple shares and requires only the configured threshold to unseal. In this case, any 3 of the 5 shares are sufficient. This supports separation of duties because no single custodian holds enough material to unseal Vault alone.
- B. Incorrect.
Incorrect. The threshold refers to the number of distinct shares required, not repeated submissions of the same share. Submitting the same share multiple times does not satisfy the threshold because each share represents only one part of the secret.
- C. Incorrect.
Incorrect. A root token is used for administrative API access after Vault is unsealed and available. It cannot unseal Vault. A common misconception is confusing authentication and authorization credentials with the unseal mechanism. When Vault is sealed, token-based access is not available for normal operations.
- D. Incorrect.
Incorrect. Vault does not require all shares when using Shamir secret sharing unless the threshold was specifically set equal to the total number of shares. Here, the threshold is 3, so collecting all 5 is unnecessary and weakens operational security by exposing more shares than needed.