Shamir Secret Sharing

A wallet is an application or device for receiving and sending bitcoin. Anna wants a backup that survives losing some records. She chooses three of five: five different shares are created, and any three valid shares from that set recover the secret. She can lose two, but not three. The required number is the threshold; generally, k of n means k required shares out of n created, tolerating the loss of n−k. But the threshold cannot recognize Anna’s consent. If someone else obtains three shares, or their holders cooperate, they recover the same secret. A lower threshold makes recovery easier while reducing the group needed to do it without Anna. [1] [6]

Anna gains little by storing all five files in a single cloud account. Losing it or having it compromised affects every share at once. A backup needs sensible placement, a record of the method and its parameters, and a recovery check on a trusted device. If heirs are meant to use the plan, they must understand what to find and how to handle it safely. A fresh random splitting of the same secret S creates a new set; old and new shares must not be mixed. Yet a sufficient old set still recovers S. Resharing does not revoke an exposed usable backup or change the secret itself. [1] [4]

Ordinary recovery brings the entire secret back together on one device. If that device is compromised, an attacker may obtain it at that moment. If the secret is a Private Key—a secret numerical value used to create a digital signature authorizing a spend—its holder can then sign without further shares. Multisig instead requires multiple signatures under the conditions for that particular spend. Threshold signing also exists: with an additional MPC protocol, secure joint computation by several participants, shares can contribute to a signature without assembling the whole key. NIST distinguishes these cases. A Shamir share alone does not establish such a signing protocol. [3] [5] [6]

Two programs with Shamir in their names may not be able to read each other’s shares. Recovery needs matching mathematical operations, value encodings, share identifiers and set membership. SLIP-39 is a specific standard built on the method: it adds a wordlist for recording shares, metadata or supporting information, groups, encryption and error checks. The general principle is therefore not an instruction to split an existing Seed Phrase by hand. Before entrusting a wallet to a backup, you need to know the supported format and check that the intended procedure actually recovers it. [2]

With three of five, the effect of losing two shares is clear. A damaged or forged share, however, may make the basic calculation return a different secret instead of reporting an insufficient number. The method alone does not authenticate shares or establish that their creator acted honestly. Error detection, correction and verifiable secret sharing—ways of checking that sharing was performed correctly—are additional layers with their own assumptions. SLIP-39, for example, adds a checksum and a verification digest. That does not mean every application using Shamir Secret Sharing has the same checks, or that a correct checksum proves a trustworthy backup origin. [2] [5]

In the ideal scheme, fewer than k complete shares give an attacker no new information about the secret S, even with unlimited computation. A share is not a visible third of the original words. This property depends on proper randomness: the numbers used for splitting are chosen independently and with equal probability. Predictable numbers, reusing them or leakage from device memory change the situation. Additional checking data, such as the SLIP-39 digest, must also be assessed separately. And a weak original password does not stop being guessable by other means just because its backup was split. [1] [2]

To see the idea, take the small secret S=5 and the rule f(x)=5+3*x mod 17. Here mod 17 means taking the remainder after division by 17. Three shares are the pairs (1,8), (2,11), (3,14): the first number identifies a position, the second is the calculated value. The first two reveal an increase of 3 and the original secret 8−3=5. Any of the three possible pairs recovers that same five. Yet the point (1,8) alone fits every S from 0 to 16 if the increase is chosen as a=8−S mod 17. These tiny numbers illustrate the idea; they are not a backup design for a real wallet. [1]

The general rule is f(x)=S+a1*x+…+a(k−1)*x^(k−1). This expression is a polynomial; S is the secret and the other coefficients are independent, uniformly random elements of a finite field, a setting with precise rules for addition and multiplication. A share is (x,f(x)), with each x distinct and nonzero: x=0 would reveal S directly. From k points, Lagrange interpolation calculates f(0), the secret. Two copies of the same point add no new information. In a prime field GF(p), ordinary division is replaced by multiplication by a modular inverse, whose product with the divisor is 1. GF(256) also uses different arithmetic from simply taking remainders modulo 256; confusing the two would be an error. [1]