What you receive
- Five shares, issued once during initial setup alongside the root access token and the wrapping key.
- Each share is hex-encoded. The rotation API hex-decodes them and rejects anything else, so store them exactly as issued — no re-encoding, no trimming.
- The shares reconstruct the recovery wrapping key, which is separate from the operational wrapping key you keep in your secret manager. See Two independent wrappings.
Storing and distributing shares
The threshold only buys you something if the shares are genuinely separated. Five shares in one password vault is a 1-of-1 scheme wearing a costume.- Separate custodians. Give each share to a different person, or place it in a different system — ideally both. Three should never be reachable by one individual acting alone.
- Separate systems. Avoid putting shares in the same store as the operational wrapping key. An attacker who reaches that store should not also obtain the recovery path.
- Document custody, not content. Record who holds which share and how to reach them. Never record the share values in that document.
- Plan for staff turnover. Reassign a custodian’s share when they leave. This is the most common way an organisation quietly drops below three.
Audit them on a schedule
Because a shortfall is invisible until you need the shares, verify availability rather than assuming it:- Confirm each custodian can still produce their share, at least annually.
- Confirm at least three are reachable within your target recovery time.
- Rehearse a wrapping key rotation — it exercises the same three-share path as recovery, on a running vault, with no risk to data.
Rotation does not reissue or invalidate shares. The same five remain valid for the life of the deployment, which is why their custody needs periodic review rather than a one-time setup step.
If you drop below three
For the full matrix, see What is recoverable.