open-vault/website/pages/docs/enterprise/hsm/behavior.mdx

---
layout: docs
page_title: Behavioral Changes - HSM Integration - Vault Enterprise
sidebar_title: Behavioral Changes
description: >-
  Vault Enterprise HSM support changes the way Vault works with regard to unseal
  and recovery keys as well as rekey and recovery operations.
---

# Vault Enterprise HSM Behavioral Changes

This page contains information about the behavioral differences that take
effect when using Vault with an HSM.

## Key Split Between Unseal Keys and Recovery Keys

Normally, Vault uses a single set of unseal keys to perform both decryption of
the cryptographic barrier and to authorize recovery operations, such as the
[`generate-root`](/api/system/generate-root)
functionality.

When using an HSM, because the HSM automatically unseals the barrier but
recovery operations should still have human oversight, Vault instead uses two
sets of keys: unseal keys and recovery keys.

## Unseal (Master) Key

Vault usually generates a master key and splits it using [Shamir's Secret
Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) to prevent a
single operator from being able to modify and unseal Vault (see more
information about Vault's security model
[here](/docs/internals/security)).

When using an HSM, Vault instead stores the master key, encrypted by the HSM,
into its internal storage. As a result, during an `init` command, the number of
key shares, threshold, and stored shares are required to be set to `1`, meaning
to not split the master key, so that the single key share is itself the master
key. (Vault does not do this automatically as it generally prefers to error
rather than change parameters set by an operator.)

Both rekeying the master key and rotation of the underlying data
encryption key are supported when using an HSM.

## Recovery Key

When Vault is initialized while using an HSM, rather than unseal keys being
returned to the operator, recovery keys are returned. These are generated from
an internal recovery key that is split via Shamir's Secret Sharing, similar to
Vault's treatment of unseal keys when running without an HSM.

Details about initialization and rekeying follow. When performing an operation
that uses recovery keys, such as `generate-root`, selection of the recovery
keys for this purpose, rather than the barrier unseal keys, is automatic.

### Initialization

When initializing, the split is performed according to the following CLI flags
and their API equivalents in the
[/sys/init](/api/system/init) endpoint:

- `recovery-shares`: The number of shares into which to split the recovery
  key. This value is equivalent to the `recovery_shares` value in the API
  endpoint.
- `recovery-threshold`: The threshold of shares required to reconstruct the
  recovery key. This value is equivalent to the `recovery_threshold` value in
  the API endpoint.
- `recovery-pgp-keys`: The PGP keys to use to encrypt the returned recovery
  key shares. This value is equivalent to the `recovery_pgp_keys` value in the
  API endpoint, although as with `pgp_keys` the object in the API endpoint is
  an array, not a string.

Additionally, Vault will refuse to initialize if the option has not been set to
generate a key but no key is found. See
[Configuration](/docs/configuration/seal/pkcs11) for more details.

### Rekeying

#### Unseal Key

Vault's unseal key can be rekeyed using a normal `vault operator rekey`
operation from the CLI or the matching API calls. The rekey operation is
authorized by meeting the threshold of recovery keys. After rekeying, the new
barrier key is wrapped by the HSM and stored like the previous key; it is not
returned to the users that submitted their recovery keys.

#### Recovery Key

The recovery key can be rekeyed to change the number of shares/threshold or to
target different key holders via different PGP keys. When using the Vault CLI,
this is performed by using the `-target=recovery` flag to `vault operator rekey`.

Via the API, the rekey operation is performed with the same parameters as the
[normal `/sys/rekey`
endpoint](/api/system/rekey); however, the
API prefix for this operation is at `/sys/rekey-recovery-key` rather than
`/sys/rekey`.