but you can also just use Reed-Solomon and split the payload, the difference with Shamir is that you lose information-theoretic security (you lose it the moment you use encryption anyway) and the payload also needs to undergo an all-or-nothing-transform (AONT).
AONT transforms the entire payload into an encrypted blob which also serves as its own key, a withheld piece is a de facto encryption key. this is required because Reed-Solomon can have pathological cases where pieces leak information.
https://www.cloudflare.com/learning/dns/dnssec/root-signing-...
Yes, you can just GF(256), but if you're worried I'd also just use a prime field instead.
Your environment is unlikely to have all of that already, so you'll need to figure out equivalents for all those. But I think you're going to need a local service running as root and it's going to need to be able to tell the difference between distinct human users, if you want secure. Just typos is way easier.
> Reed-Solomon is an Erasure code
which shares the same math as Shamir > Those leakage models are gnarly.
AONT solves that by making any leak other than the totality meaninglessVibe-coded a little playground where you can generate secrets, see the polynomial, combine the secrets, and in general, play around:
https://bs.parity.io/ -- http://passguardian.com/ -- https://iancoleman.io/shamir/
Since Shamir Secret Sharing is information-theoretically secure (if you do not know k points from the k-out-of-n secret then all secrets are equally plausible even when bruteforcing), the bitsize of your field can be whatever you want (but obviously bigger than the bitsize of your secret, you can't hide 100 bits in a finite field of 5 elements).
Usually, you don't want an attacker to be able to bruteforce your secret (while the scheme is ITS, your secret typically isn't, e.g. the seed of your wallet), hence randomness can be added to your secret and the bitsize of the field is taken big enough to thwart these attacks.
Depending on your attack model, an 80-bits or 128-bits field is more than secure enough, hence a share bitsize slightly above 80 or 128 bits.
And regarding quantum computer, since the scheme is ITS no attacks can exist.
Fascinating how sometimes in different languages one word can have opposite meaning and the other times one word can have similar meaning.
I gave that to some members of my family and instruct them to give them to my wife in case I die.
Thanks a lot Sir.
Some secrets are too important to trust to one person, and too important to lose if that person disappears.
A company wants three officers present before the master key is used. A family wants account recovery to need more than one envelope. A team wants a backup that survives a missing member without handing anyone the whole thing.
Adi Shamir (the S in RSA), published a way to do this in 1979. Split a secret into pieces so that some number of them can recover it, and any smaller number reveals nothing at all. Not "is hard to crack." Reveals nothing.
The core idea fits on a page.
Start with something you already know: two distinct points determine exactly one straight line.
A single point does not. Infinitely many lines pass through one point, and each line crosses the vertical axis somewhere different.
Now hide a secret where a line crosses the vertical axis. Say the secret is the number 7. Draw a random line through that height. The slope is not important. It is just randomness that hides the secret.
Give each person one point from the line. Nobody gets the line itself.
A person with one point can draw many possible lines through it. Each line implies a different secret. Their share is compatible with every possible answer, so it tells them nothing useful by itself.
Put two points together and the line is fixed. Once you know the line, you can read the secret from where it crosses zero.
That is a 2-of-n secret sharing scheme. You can create as many points as you want, but any two are enough to recover the line.
For a higher threshold, use a curve with more bend.
A parabola needs three points to determine it. So if the secret is hidden where the parabola crosses the vertical axis, any three shares can recover the secret and any two cannot.
In general, a threshold of k uses a polynomial of degree k - 1.
Real implementations use finite-field arithmetic rather than graph paper, but the shape of the idea is the same. The secret is the value at zero. The random coefficients hide it. Each share is one point on the polynomial.
The useful part is not that the secret is hard to compute from too few shares. It is that too few shares contain no information about the secret. With one share missing, every possible secret is still possible.
We use this idea in Ente's Legacy Kit.
Although, our problem was not just "how do we split a secret?", but also "how do we make recovery possible without turning the split secrets into a permanent recovery key?"
Legacy Kit uses Shamir's scheme as one layer inside a larger flow. The cards don't carry the recovery key. They reconstruct a separate secret locally, which then participates in a server-mediated recovery — so issued cards can be revoked, and a lost card is not a permanent liability.
This post is only the math behind the "any two, never one" part.