Shamir's secret sharing

How five people can each hold part of a key that any three can unlock

Shamir's secret sharing splits a secret into n shares. Any k of them rebuild it, but fewer than k reveal nothing. For example, five managers each hold a share of a vault password, and any three can open the vault.

The trick is a curve. Turn the secret into a number s, and make it the height where a curve crosses x = 0. With k = 2 the curve is a straight line with a random slope. Each person gets one point on that line, such as (1, 8) or (2, 11).

Shamir's secret sharing

HashiCorp Vault needs several key holders before it unlocks

When HashiCorp Vault, a widely used password and secrets store, starts up, it stays locked. By default its master key is split into 5 shares, and any 3 must be entered to unlock it. No single administrator can open it alone.

Trezor hardware wallets offer a "Shamir Backup" for the same reason. The wallet's recovery words are split into several sets, so losing one set doesn't lose the money, and a thief who finds one set can't take it.

Shamir's secret sharing

Two points fix a line, but one point fits every possible secret

It works because k points fix exactly one curve of degree k−1. Two points fix one line, three fix one parabola. So any k shareholders can work out the curve together and read off f(0).

With only k−1 points, every possible secret still fits. Through the single point (1, 8) runs a line from (0, s) for any s. Since the maths wraps around at the prime p, every s is equally likely, so one share reveals nothing.

This is the difference from simply cutting a password into chunks. Each chunk would give away part of the password, and losing one chunk would lose the whole password.