Shamir’s secret sharing

In short: Shamir’s scheme splits a secret into n shares of which any k suffice to restore it, while fewer than k reveal nothing.

In more detail: Example “3 of 5”: five people each get a share. Two together learn nothing, three reconstruct the secret. This way keys can be secured in a distributed fashion without one person having sole access.

In Depth

• Mathematics: Exactly one polynomial of degree k−1 passes through k points. The secret is the value at x = 0. One picks a random polynomial with the secret as constant term and hands out n points on it.
• Restoring: With k points, Lagrange interpolation reconstructs the polynomial and thus the secret. Computation is done in a finite field.
• Security: Information-theoretic: with k−1 shares all secrets are equally likely.
• Use: Key ceremonies (for example the DNSSEC root key), vault systems (unsealing HashiCorp Vault), recovery of crypto wallets.
• Important: Keep shares safe and replace lost shares while the threshold is still reachable. The scheme does not protect against cheating by share holders; verifiable variants exist for that.

See also: random numbers