CipherLayer
Home / Tools / Shamir's Secret

Shamir Secret Sharing

Split a secret into N shares, recover with any K of them. Implemented over GF(256) using the AES Rijndael polynomial. Visualize the polynomial, run Lagrange interpolation step-by-step.

Polynomial viz Lagrange steps Share format GF(256) 0x11B polynomial

Inputs

Shares

// Shares will appear here Each share is a (x, y₁, y₂, ..., yₙ) tuple where x is the share index and yᵢ are byte-by-byte evaluations of a random degree-(K-1) polynomial over GF(256). Need any K shares to interpolate.
Schematic vs. computational secrecy. Shamir's scheme is information-theoretically secure: K-1 shares give an attacker zero bits of information about the secret (in the Shannon sense). This is stronger than AES, which is only computationally secure. The trade-off: Shamir's has no integrity check, so an attacker with access to shares can submit corrupted shares during recovery. Use a MAC on the shares if integrity matters.

Why this tool, and why this version

Shamir's Secret Sharing is the elegant 1979 construction that turns a secret into N pieces, any K of which can recover it. Its mathematical foundation is polynomial interpolation: a polynomial of degree K-1 is uniquely determined by K points. Below K points, there are infinitely many polynomials passing through those points — including all possible secret values. The secret is the constant term (y-value at x=0); each share is (x, f(x)) for a random degree-(K-1) polynomial.

Real implementations operate byte-by-byte over GF(256) — the field with 256 elements defined by the polynomial x⁸ + x⁴ + x³ + x + 1 (0x11B), the same irreducible polynomial AES uses. This keeps each byte independent: the secret "Hello" is split into 5 independent polynomials (one per byte). Recovery is 5 independent Lagrange interpolations at x=0. No big-number arithmetic, no modular inverse problems that get intractable in prime fields.

The polynomial visualization tab shows the actual coefficients and plotted points. For a 1-byte secret with K=3, you get degree-2 polynomials in GF(256). We plot the points (x, y) on a 2D plane — even though the field is finite, the visual intuition transfers: with 2 points you can't determine a quadratic; with 3 points you can.

The K-1 leak test demonstrates information-theoretic security empirically. You provide K-1 shares; we let you guess the secret; the answer reveals that your guess has no signal — knowing 2 of 3 shares tells you nothing about byte 73.

Who this is for

Custody of high-value secrets

A Bitcoin wallet seed, a master encryption key, a root CA private key. Split into 5 shares, require 3 to reconstruct, distribute to board members or geographically separated backups.

Threshold cryptography researchers

Shamir's is the building block for threshold signatures, distributed key generation, and multi-party computation. This tool implements the basic scheme correctly so you can build on it.

Students of applied cryptography

Visualizing the polynomial and Lagrange interpolation makes abstract algebra concrete. The K-1 leak test provides empirical evidence of information-theoretic security.

Frequently asked questions

What's the difference between this and multisig? ▶
Multisig requires multiple on-chain signatures; each signer has a complete private key. Shamir's splits one secret into multiple shares — no single share can sign alone. Multisig is on-chain (transparent, requires consensus support). Shamir's is off-chain (invisible to the protocol, works for any single-key scheme). They're complementary: you can Shamir-split a single key, then have multisig on the reconstructed key — though at that point you're back to "one key exists somewhere", which defeats Shamir's distribution property.
Can shares be reused? ▶
No — never reuse shares across different secrets. The polynomial that generated a given share is a function of (the secret, the random coefficients). If you reuse the same share for a different secret, an attacker who sees both secrets can recover the polynomial and thus the secret. Generate a fresh split for each secret.
What if I lose a share? ▶
As long as you still have K shares, you're fine. If you have N shares and lose one, you have N-1 — if N-1 ≥ K, you can still recover. If N-1 < K, the secret is lost (assuming the polynomial coefficients were truly random). This is the core value of N > K: redundancy. Standard practice: N = 3K/2 (e.g., K=3, N=5) gives a buffer.
Can an attacker tamper with shares during recovery? ▶
Yes — this is a known limitation. A single corrupted share produces a corrupted recovered secret, with no error indication. To detect tampering, compute a MAC (HMAC-SHA256) on each share and include it in the share metadata. During recovery, verify the MAC of every share before interpolating. If any MAC fails, reject that share. Alternatively, use Verifiable Secret Sharing (Feldman or Pedersen) which adds public commitments.
Why GF(256) and not a prime field? ▶
GF(256) lets you operate byte-by-byte: each byte of the secret gets its own independent random polynomial of degree K-1 over GF(256). Recovery is just byte-by-byte Lagrange interpolation. With a prime field like GF(p) for large prime p, you'd treat the secret as one big number and do arithmetic on multi-byte values — slower, more complex, and requires modular inverse computations that are heavier. GF(256) is also convenient because it's the same field AES operates in.
What does the share format look like? ▶
Each share is "x:bytes" where x is the share index (1-based, 1 byte) and bytes is the share value (one byte per secret byte, evaluated at x). For a 32-byte secret with K=3 and N=5, each share's value is 32 bytes. Total share size: 1 + 32 = 33 bytes per share. The share index prevents mix-ups between shares; it's part of the share metadata. Without it, you couldn't tell share-A-from-share-1 apart from share-A-from-share-2.

Limitations you should know