Provide our own custom unseal/root key to Vault

Vault
1

Hello.

Is there a way to provide our own unseal/root key to Vault?

Right now I understand the unsealing process(using Shamir’s algorithm) is this:

  1. Generate unseal keys
    vault operator init (Generates N unseal keys)

  2. Unseal vault (Use unseal keys to generate root key)
    vault operator unseal <unseal-key> (do this N times, provide different unseal key each time)

Unseal keys → Root key → Encryption keys.

Is there a way I can provide my own Unseal keys/Root key?
I have an algorithm to generate the key of my own and I want to provide it to unseal the vault.

Something like
vault operator init <my-unseal-key>

To clarify, my aim is to provide/control the mastery key to the vault.

2

No, this is but supported.

3

Sorry @maxb , didn’t get you.

Is this not supported currently? Is there any way we can achieve this?
Is there any future plan to support user-provided root/unseal keys?
And what algorithms are used currently to generate these keys?

4

No, user-provided unseal keys are not supported.

I do not work for HashiCorp, but I would not expect them to ever be supported.