Shamir's Secret Sharing

Shamir's secret sharing is a technique for dividing a secret into several pieces, called shares, so that any chosen minimum number of them can reconstruct the original while fewer reveal nothing about it. It is known as a threshold scheme: a "3-of-5" set-up creates five shares, any three of which recover the secret. The method was published by the Israeli cryptographer Adi Shamir, the "S" in the RSA algorithm of public-key cryptography, in a 1979 paper titled "How to Share a Secret". George Blakley independently published a similar scheme, based on geometry, the same year.

The scheme is widely used to protect high-value secrets such as master encryption keys, the root keys used in public-key infrastructure and the recovery data for crypto wallets. It is related to, but different from, a multisignature wallet, where several separate keys sign a transaction, and from multi-party computation, where the secret is never assembled in one place.

Imagine a treasure map torn into five pieces and given to five friends, with a special rule: any three pieces together show the whole map, but one or two pieces show nothing useful at all, not even a rough area. If two friends lose their pieces, the treasure can still be found. If a thief steals two pieces, the treasure stays safe.

The trick is mathematical rather than physical. Instead of tearing the map, the secret is hidden inside a curve, and each friend is given one point on that curve. You need enough points to redraw the curve and read off the secret.

To create a k-of-n scheme, the dealer picks a random polynomial of degree $k - 1$ whose constant term is the secret:

• $s$ is the secret, equal to $f(0)$.
• $a_1, \ldots, a_{k-1}$ are random coefficients chosen by the dealer.
• $k$ is the threshold, the number of shares needed to recover the secret.

Each participant $i$ receives the point $(i, f(i))$. Any $k$ points determine the polynomial exactly, using a method called Lagrange interpolation, and therefore reveal $s$. With fewer than $k$ points, every possible secret remains equally likely. In real systems the calculations are done in a finite field, a number system that wraps around at a large prime, so that shares leak no information through their size.

As a simple example, take a 2-of-3 scheme with the secret 7 and a random coefficient of 3, so $f(x) = 7 + 3x$. The shares are $(1, 10)$, $(2, 13)$ and $(3, 16)$. Someone holding $(1, 10)$ and $(3, 16)$ sees that the line rises by 16 − 10 = 6 over 2 steps, so the slope is 6 ÷ 2 = 3. Stepping back from $x = 1$ to $x = 0$ gives 10 − 3 = 7, the secret. A single share, such as $(2, 13)$, fits a line through any possible secret.

• Wallet backups. Some wallets split a seed phrase into several shares, following a standard published by the hardware wallet maker SatoshiLabs, so that a single lost or stolen backup does not cost or expose the funds. A hardware wallet that supports the standard can generate the shares directly as separate word lists, which users then store in different places, sometimes combined with cold storage in safes or bank boxes.
• Key ceremonies. Banks, custodians and certificate authorities split master keys stored in a hardware security module among several officers, so no single employee can use them alone.
• Inheritance planning. Crypto holders sometimes give shares to family members and a lawyer so that heirs can recover funds without any one person holding full control.
• Building block. Secret sharing underlies many MPC wallets and threshold signature schemes used by crypto custody firms.

The classic scheme has a weak moment: to use the secret, enough shares must be brought together and the full private key rebuilt on one device, which could be compromised at that point. Multi-party computation and threshold signatures avoid this by signing without ever reassembling the key. The basic scheme also trusts the dealer to create honest shares; verifiable secret sharing variants let participants check their shares are consistent. Practical risks include storing shares too close together, losing track of who holds which share, and using poorly reviewed software. Because a share looks like any other backup, labelling and recording the threshold also matter: heirs who find two shares but do not know that three are needed may give up. Some critics argue that, for most individuals, a well-protected single backup or a multisignature set-up is simpler and less error-prone.

• SLIP-0039: Shamir's Secret-Sharing for Mnemonic Codes