func (c *Core) RecoveryRekeyInit(config *SealConfig) error {
	if config.StoredShares > 0 {
		return fmt.Errorf("stored shares not supported by recovery key")
	}
	if err := config.Validate(); err != nil {
		c.logger.Error("core: invalid recovery configuration", "error", err)
		return fmt.Errorf("invalid recovery configuration: %v", err)
	}
	if !c.seal.RecoveryKeySupported() {
		return fmt.Errorf("recovery keys not supported")
	}
	c.stateLock.RLock()
	defer c.stateLock.RUnlock()
	if c.sealed {
		return ErrSealed
	}
	if c.standby {
		return ErrStandby
	}
	c.rekeyLock.Lock()
	defer c.rekeyLock.Unlock()
	if c.recoveryRekeyConfig != nil {
		return fmt.Errorf("rekey already in progress")
	}
	c.recoveryRekeyConfig = config.Clone()
	nonce, err := uuid.GenerateUUID()
	if err != nil {
		c.recoveryRekeyConfig = nil
		return err
	}
	c.recoveryRekeyConfig.Nonce = nonce
	if c.logger.IsInfo() {
		c.logger.Info("core: rekey initialized", "nonce", c.recoveryRekeyConfig.Nonce, "shares", c.recoveryRekeyConfig.SecretShares, "threshold", c.recoveryRekeyConfig.SecretThreshold)
	}
	return nil
}
RecoveryRekeyInit is used to initialize the rekey settings for the recovery key
package vault
import (
	"bytes"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"github.com/hashicorp/go-uuid"
	"github.com/hashicorp/vault/helper/jsonutil"
	"github.com/hashicorp/vault/helper/pgpkeys"
	"github.com/hashicorp/vault/physical"
	"github.com/hashicorp/vault/shamir"
)
const (
	coreBarrierUnsealKeysBackupPath = "core/unseal-keys-backup"
	coreRecoveryUnsealKeysBackupPath = "core/recovery-keys-backup"
)
type RekeyResult struct {
	SecretShares    [][]byte
	PGPFingerprints []string
	Backup          bool
	RecoveryKey     bool
}
type RekeyBackup struct {
	Nonce string
	Keys  map[string][]string
}
func (c *Core) RekeyThreshold(recovery bool) (int, error) {
	c.stateLock.RLock()
	defer c.stateLock.RUnlock()
	if c.sealed {
		return 0, ErrSealed
	}
	if c.standby {
		return 0, ErrStandby
	}
	c.rekeyLock.RLock()
	defer c.rekeyLock.RUnlock()
	var config *SealConfig
	var err error
	if recovery {
		config, err = c.seal.RecoveryConfig()
	} else {
		config, err = c.seal.BarrierConfig()
	}
	if err != nil {
		return 0, err
	}
	return config.SecretThreshold, nil
}
func (c *Core) RekeyProgress(recovery bool) (int, error) {
	c.stateLock.RLock()
	defer c.stateLock.RUnlock()
	if c.sealed {
		return 0, ErrSealed
	}
	if c.standby {
		return 0, ErrStandby
	}
	c.rekeyLock.RLock()
	defer c.rekeyLock.RUnlock()
	if recovery {
		return len(c.recoveryRekeyProgress), nil
	}
	return len(c.barrierRekeyProgress), nil
}
func (c *Core) RekeyConfig(recovery bool) (*SealConfig, error) {
	c.stateLock.RLock()
	defer c.stateLock.RUnlock()
	if c.sealed {
		return nil, ErrSealed
	}
	if c.standby {
		return nil, ErrStandby
	}
	c.rekeyLock.Lock()
	defer c.rekeyLock.Unlock()
	var conf *SealConfig
	if recovery {
		if c.recoveryRekeyConfig != nil {
			conf = c.recoveryRekeyConfig.Clone()
		}
	} else {
		if c.barrierRekeyConfig != nil {
			conf = c.barrierRekeyConfig.Clone()
		}
	}
	return conf, nil
}
func (c *Core) RekeyInit(config *SealConfig, recovery bool) error {
	if recovery {
		return c.RecoveryRekeyInit(config)
	}
	return c.BarrierRekeyInit(config)
}
func (c *Core) BarrierRekeyInit(config *SealConfig) error {
	if config.StoredShares > 0 {
		if !c.seal.StoredKeysSupported() {
			return fmt.Errorf("storing keys not supported by barrier seal")
		}
		if len(config.PGPKeys) > 0 {
			return fmt.Errorf("PGP key encryption not supported when using stored keys")
		}
		if config.Backup {
			return fmt.Errorf("key backup not supported when using stored keys")
		}
	}
	if err := config.Validate(); err != nil {
		c.logger.Error("core: invalid rekey seal configuration", "error", err)
		return fmt.Errorf("invalid rekey seal configuration: %v", err)
	}
	c.stateLock.RLock()
	defer c.stateLock.RUnlock()
	if c.sealed {
		return ErrSealed
	}
	if c.standby {
		return ErrStandby
	}
	c.rekeyLock.Lock()
	defer c.rekeyLock.Unlock()
	if c.barrierRekeyConfig != nil {
		return fmt.Errorf("rekey already in progress")
	}
	c.barrierRekeyConfig = config.Clone()
	nonce, err := uuid.GenerateUUID()
	if err != nil {
		c.barrierRekeyConfig = nil
		return err
	}
	c.barrierRekeyConfig.Nonce = nonce
	if c.logger.IsInfo() {
		c.logger.Info("core: rekey initialized", "nonce", c.barrierRekeyConfig.Nonce, "shares", c.barrierRekeyConfig.SecretShares, "threshold", c.barrierRekeyConfig.SecretThreshold)
	}
	return nil
}