Essentially, the password hashes are AES encrypted with a shamir secret key that is stored in memory, and on boot up can be unlocked by k of n administrators/po

Essentially, the password hashes are AES encrypted with a shamir secret key that is stored in memory, and on boot up can be unlocked by k of n administrators/power users logging in. It also presents a technique to weakly verify normal logins between bootup and when the k admins log in by essentially leaking a few bits of entropy of the user's hashed password. This only protects against attackers accessing the password database/file from disk, not from an attack that compromises memory and the key stored there on a running server. However, in the case that the key is compromised, this is no worse than best practices used today. Assuming the admins use strong passwords, this requires potential crackers to crack k strong admin passwords at once if they only have the file.