1. One administrator is one point of failure

A cryptographic boundary that only one person can open is only as trustworthy as that one person — and as resistant as that one person is to error, compromise, and coercion. The most carefully validated HSM in the world is undone if a single administrator can export the security domain, or be compelled to. Multi-person control removes the single human point of failure the same way the hardware removes the single software point of failure: by making the dangerous capability require more than one independent party, acting together.

2. The security domain and the quorum

An Azure Key Vault Managed HSM is bootstrapped by generating a security domain — the encrypted blob that binds the HSM partition to its key holders and is required to recover or migrate it. B5 Secure does not let any one party hold it. At initialization, the security domain is generated under a quorum of customer-supplied RSA key pairs and a threshold: a download of the domain encrypts it to those public keys, and any future recovery requires a defined minimum of the corresponding private keys to act in concert.

Concretely, you choose an M-of-N policy — for example, three of five designated key holders. No single holder, and no subset below the threshold, can reconstruct the domain. Microsoft itself is outside the quorum by construction, which is what makes the single-tenancy claim in FIPS 140-3 Level 3 meaningful rather than nominal: the operator cannot recover your keys because the operator was never in the quorum.

3. Shamir’s secret sharing, concretely

The threshold property comes from Shamir’s Secret Sharing (SSS). A secret is encoded as the constant term of a randomly chosen degree-(M−1) polynomial over a finite field; each holder receives one point on the curve. Any M points uniquely determine the polynomial — and therefore the secret — by interpolation, while any M−1 points reveal nothing about it: every candidate secret remains equally consistent with the shares held. The scheme is information-theoretically secure below threshold, not merely computationally hard, so a sub-quorum coalition gains no advantage even with unbounded compute.

// M-of-N quorum policy for the HSM security domain
quorum: {
  threshold: 3,            // M — shares required to act
  holders:   5,            // N — distinct key holders
  property:  "information-theoretic below threshold"
}
// 2 shares reveal nothing; 3 reconstruct; loss of 2 is survivable

Choosing M and N is a risk decision, not a default. A higher M raises collusion resistance but lowers availability (more holders must convene); a higher N−M margin raises resilience to lost or unavailable shares. B5 Secure documents the chosen policy as part of the control narrative so the trade-off is explicit and auditable.

4. Split knowledge and dual control

NIST’s key-management guidance (SP 800-57) names the two properties this delivers. Split knowledge: no single person knows or can derive the protected secret. Dual control (more generally, multi-party control): a critical operation requires the cooperation of two or more authorized parties. Together they defeat both the careless insider and the malicious one — neither can act alone, and neither holds enough to act if compromised. This is separation of duties applied at the cryptographic root, where it matters most.

5. The key ceremony, operationally

Multi-person control is enforced at the moments that matter: initialization (the security domain is generated and split among holders under the threshold policy), recovery or migration (restoring the domain to new hardware requires a quorum to convene and present their shares), and quorum change (rotating a holder or re-thresholding is itself a quorum action). Routine signing does not require a quorum — the HSM operates normally once activated — so the human ceremony is reserved for the genuinely dangerous transitions, keeping day-to-day throughput unaffected.

6. Coercion, loss, and collusion

The threshold design answers the three failure modes single-custody cannot:

• Coercion — pressuring one holder yields nothing; an attacker must compromise or coerce M independent people simultaneously, which is observable and far harder to do quietly;
• Loss — with an N−M margin, losing a holder’s share (departure, hardware failure, lost token) does not lock you out; the remaining quorum recovers and re-issues shares;
• Collusion — below M, colluding holders learn nothing (the information-theoretic guarantee), so the only path is a full-quorum conspiracy, which separation-of-duties policy and holder selection are designed to make implausible.

7. What an auditor sees

Multi-person key control is a named expectation in the frameworks financial counterparties test: PCI DSS Requirement 3 calls for split knowledge and dual control of key-management operations; SOC 2 CC6.1 looks for restricted, multi-party access to the most sensitive secrets; and SOX-style separation-of-duties controls map directly onto the M-of-N quorum. Because the policy is enforced by the HSM and evidenced by ceremony logs and key attestation, B5 Secure demonstrates the control rather than asserting it — the standard a serious review demands.