Shamir 秘密共享

The idea: a polynomial through the secret

Adi Shamir published the scheme in 1979 in two pages: How to Share a Secret, Communications of the ACM 22(11). Two points determine a line, three a parabola, and in general K points determine a polynomial of degree K − 1. To split a secret so that any K of N people can recover it, pick a random polynomial of degree K − 1 whose constant term is the secret, and give each person one point on it. Any K points determine the polynomial — Lagrange interpolation recovers it, and its value at zero is the secret. With K − 1 points, every possible secret is equally consistent with what you hold, so they reveal nothing at all. This is not "hard to break": it is information-theoretically impossible, whatever computing power the attacker has.

How this page does it

The arithmetic runs in the finite field GF(2⁸): the numbers are bytes, addition is XOR, and multiplication is polynomial multiplication modulo a fixed irreducible polynomial. Each byte of the secret gets its own random polynomial; every share holds one value per secret byte plus a final byte, its x-coordinate. A share is therefore one byte longer than the secret, and a 32-byte key gives 33-byte shares. The x-coordinates are distinct, never zero, and drawn at random, which is why the page shows each share's index.

The maths is done by privy-io/shamir-secret-sharing, a small, dependency-free, independently audited TypeScript implementation; the random coefficients come from the browser's secure random number generator (CSPRNG). Its share layout and field are the ones of HashiCorp Vault's unseal keys, so shares made here combine in Vault's implementation and the other way round. The example proves it: three shares produced by Vault's code recover their phrase on this page. SLIP-39 mnemonic shares used by some hardware wallets are a different format and are not compatible.

What Shamir's scheme cannot tell you

Combining shares always produces some value. With fewer than K shares, with one share of a different split, or with a share that lost a character, the result is simply a different value — no error, because the scheme carries no checksum. The page checks what can be checked — shares of equal length, distinct indexes, a non-zero index — and says plainly that it cannot confirm the result. Store a hash of the secret, or split something that verifies itself (a private key whose public key you know, an encrypted archive), to be sure of what you recovered. Schemes that detect cheating participants exist (verifiable secret sharing); this one is the classic, unauthenticated form.

Choosing K and N

N − K is how many shares you can lose; K − 1 is how many people can collude and learn nothing. Three of five survives two lost shares and resists two colluders; two of three is a common minimum for personal backups. K equal to N gives no redundancy at all — losing one share loses the secret — and the page warns about it. Splitting again creates entirely new shares: shares of different splits cannot be mixed, so retiring a share means splitting again and redistributing.

For a large secret, split a random key and encrypt the data with it, rather than splitting the data: every share is as large as the secret, and a 32-byte key is easier to write down than a document.

Why there is no share link

Every value on this page is secret: the secret itself, each share and the recovered result. The page makes no network request with them, keeps them only while it is open, and — unlike the other tools of the Lab — has no Share button at all. Copy each share straight to where it will be kept. Generating the secret to split? A random key from the key generator is a good start.