VAULT-ASSOCIATE-002 · Question #12
How many Shamir's key shares are required to unseal a Vault instance?
The correct answer is D. The threshold number of key shares. To unseal a Vault instance, the specific number of key shares known as the "threshold" is required, which is configured during initialization.
Question
Options
- AAll key shares
- BA quorum of key shares
- COne or more keys
- DThe threshold number of key shares
How the community answered
(41 responses)- A2% (1)
- B2% (1)
- C5% (2)
- D90% (37)
Why each option
To unseal a Vault instance, the specific number of key shares known as the "threshold" is required, which is configured during initialization.
Requiring all key shares would make the system too brittle, as the loss of a single share would prevent unsealing.
While a quorum generally implies a minimum number, in Shamir's Secret Sharing context for Vault, the specific term is 'threshold' and refers to the minimum number of shares required.
One or more keys is insufficient; a specific minimum number, the threshold, is necessary to reconstruct the master key.
Vault uses Shamir's Secret Sharing to split the master key into multiple shares. The `threshold` number of these shares, configured during Vault initialization, must be provided to reconstruct the master key and unseal the Vault instance.
Concept tested: Vault unsealing, Shamir's Secret Sharing threshold
Source: https://developer.hashicorp.com/vault/docs/concepts/seal#shamirs-secret-sharing
Topics
Community Discussion
No community discussion yet for this question.