Unconditional
SECRET SHARINGPrimitive

Shamir secret sharing

In plain words

Split a secret into pieces so that, say, any 3 of 5 pieces rebuild it, while 2 pieces reveal nothing at all. Like a vault that only opens when enough keyholders show up.

The idea: Two points fix a straight line. Hide the secret as the spot where a random line crosses the vertical axis, and give each person one point on the line. Any two people can draw the line and read off the secret. One person alone holds a point that lies on endless possible lines, each crossing at a different secret, so they learn nothing. For "any 3 of 5", use a curve that needs three points (a parabola), and so on.

Why it matters: Used to back up important keys and wallets without trusting any single person.

Two points fix a line
One share: any secret fits?Two shares: one linesecretthe share
The secret is where the line crosses the vertical axis. Each orange dot is one person's share. With one share, lines through it can cross anywhere, so every secret is equally possible. With two, there is exactly one line. Real Shamir sharing uses remainder arithmetic and can need any number of shares (three for a parabola, and so on).

The details

Split a secret into n shares so that any t of them rebuild it, while t - 1 shares reveal nothing at all[1].

The trick: hide the secret as the starting value of a random polynomial of degree t - 1 and hand out points on it. Two points fix a line, three fix a parabola, and with fewer points every secret is equally possible. Security is unconditional.

Where you meet it: backing up wallet seeds and root keys across several people or places, threshold signing, and inside secure multiparty computation.

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Nothing on the map depends on it: it is an end point, something people use directly.

References

  1. Adi Shamir. How to share a secret. Communications of the ACM, 1979. doi:10.1145/359168.359176