eduKateSG · Information · The Gold Standard of Education
Split control of a secret without mistaking shares for redundant data
Choose the explanation you need, or follow all twelve chapters in order.
Full chapter index · Independent practice · Information subject guide
Secret sharing divides a secret into shares so that an authorised threshold can reconstruct it while fewer shares reveal no information under the scheme’s assumptions. It is useful for distributing trust over key custodians, locations or systems.
The idea is often confused with erasure coding. Both create pieces and tolerate some missing pieces, but their security goals differ. Erasure-coded shards add recoverability; ordinary source shards may expose data. Secret-sharing shares are designed so that an unauthorised subset does not reveal the secret.
This guide uses small finite-field examples for learning. Never protect a real key with hand-written arithmetic or copied teaching parameters. Use a reviewed protocol, maintained implementation, authenticated channels and an operational recovery ceremony.
Continue from The Gold Standard of Information within The Gold Standard of Education: learning that transfers into life and the How X Works learning library.
Full chapter index
See the mechanism · Chapters 1–2
Build the worked model · Chapters 3–5
Test what changes · Chapters 6–8
Check evidence and limits · Chapters 9–10
Practise and continue · Chapters 11–12
A threshold scheme is commonly written (t,n): create n shares and require at least t to reconstruct. A 3-of-5 design tolerates two unavailable shares and prevents one or two honest-but-curious holders from learning the secret.
That statement assumes correct implementation, secure randomness, confidential distribution and no leakage outside the scheme. If the original secret remains in a temporary file, splitting it later does not remove that copy.
Define the adversary and failure domains. Are holders merely unavailable, or can they send malicious shares? Can an attacker compromise several holders through one identity system? The threshold count is not a threat model by itself.
Evidence check: for State the security and availability goal, preserve the observation before the interpretation. Record the exact erasure unit and tolerated failure domain. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Shamir’s 1979 scheme works over a finite field. Put the secret in the constant term of a random polynomial of degree t−1. Evaluate the polynomial at n distinct non-zero x coordinates to create shares.
Any t points determine the polynomial through interpolation, revealing the constant term. Fewer than t points are consistent with every possible secret because missing coefficients can vary.
The field, coordinate rules, secret encoding and randomness must be specified. Ordinary integer arithmetic or floating-point interpolation does not preserve the scheme’s guarantees.
Evidence check: for Shamir’s polynomial construction, preserve the observation before the interpretation. Record k, m, shard order and coding profile. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Work modulo 17. Let secret s=5 and choose random slope a=4, giving f(x)=5+4x mod 17. Shares are (1,9), (2,13) and (3,0).
Any two points define the line. Using shares at x=1 and x=2, the slope is 4 and the intercept is 5 modulo 17. One point alone could lie on a line with any intercept because an appropriate slope can be chosen.
This tiny field is insecure and exists only to make the algebra visible. Real schemes need field sizes and encodings suitable for the secret and implementation.
Evidence check: for A two-of-three warm-up, preserve the observation before the interpretation. Record which position is missing and which values remain valid. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Still modulo 17, choose f(x)=5+2x+7x². Evaluating x=1 through 5 gives shares (1,14), (2,3), (3,6), (4,6) and (5,3). Any three distinct shares reconstruct the quadratic and secret 5.
The repeated y values do not make shares interchangeable. Each share includes its x coordinate. Combining y=6 twice without distinct coordinates contributes no new point.
The attached table lets a reader verify every modular result. A production test should use published vectors from the exact library and format.
| x | Raw value | Share y mod 17 |
|---|---|---|
| 1 | 14 | 14 |
| 2 | 37 | 3 |
| 3 | 74 | 6 |
| 4 | 125 | 6 |
| 5 | 190 | 3 |
Evidence check: for A three-of-five worked example, preserve the observation before the interpretation. Record survivor count and independence of repair equations. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
In ideal Shamir sharing with uniformly random coefficients, an unauthorised subset below t has information-theoretic privacy about the secret. For every candidate secret, compatible missing coefficients exist.
Operational metadata can still leak. Holder identities, recovery timing, share age and access logs may reveal sensitive context. Weak random-number generation can collapse the mathematical guarantee.
If the secret has structure or exceeds the field element, encoding must be defined. Many systems secret-share a uniformly random encryption key and encrypt the larger data rather than share a whole document directly.
Evidence check: for What fewer than the threshold learn, preserve the observation before the interpretation. Record field, matrix, padding and interoperability tests. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
An erasure code transforms data so enough shards can reconstruct it after loss. Systematic codes retain original data shards, so one shard can expose part of the content. The aim is storage efficiency and availability, not threshold confidentiality.
Secret sharing deliberately randomises shares so a sub-threshold set reveals nothing about the secret under the scheme. That secrecy usually costs more storage: each ideal share is about the size of the secret.
Both use finite-field interpolation in some constructions, which explains the family resemblance. Similar mathematics does not make the security contracts identical.
Evidence check: for Why this is not erasure coding, preserve the observation before the interpretation. Record source-block and symbol identifiers. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Basic Shamir sharing does not automatically identify a forged share. One incorrect input can reconstruct the wrong value. Authenticate share files, holder identities, coordinates and metadata.
Verifiable secret sharing adds commitments or proofs so participants can test consistency. Threshold signature protocols may keep the key distributed and compute without reconstructing it in one place.
NIST’s threshold-cryptography work emphasises distributed trust, robustness and active adversaries. Choose a scheme whose security model matches the operation, not simply one labelled “threshold.”
Evidence check: for Detect wrong or malicious shares, preserve the observation before the interpretation. Record integrity verification before and after decoding. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
A simple dealer knows the secret, chooses the polynomial and distributes shares. If the dealer is compromised or retains the coefficients, the threshold protection can be bypassed.
Distributed key generation lets participants jointly create shares without one party holding the full key. It is more complex and requires an authenticated protocol, complaint handling and clear participant membership.
Document setup trust separately from recovery trust. A ceremony with five holders may still depend entirely on one laptop used during creation.
Evidence check: for Dealer trust and distributed generation, preserve the observation before the interpretation. Record physical placement and correlated failure. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
CHAPTER 9 OF 12 · Check evidence and limits
9. Share placement and correlated compromise
Five encrypted files in one cloud account are one credential domain, not five independent custodians. Separate shares across organisations, devices, physical locations and administrators in a way that matches the threat model.
Balance secrecy and availability. A 5-of-5 design minimises collusion tolerance but fails if one holder is unavailable. A 2-of-5 design is highly available but gives any two holders full recovery power.
Model staff changes, disasters, legal access, coercion and time zones. The right threshold is organisational as well as mathematical.
| Design | Placement | Common event | Result |
|---|---|---|---|
| 3-of-5 | Three shares in one safe | One burglary | Threshold exposed |
| 3-of-5 | Five independent custodians | Two unavailable | Recovery still possible |
| 5-of-5 | Five custodians | One unavailable | Recovery blocked |
| 2-of-5 | Five custodians | Two collude | Secret exposed |
Evidence check: for Share placement and correlated compromise, preserve the observation before the interpretation. Record scrub interval, repair load and reduced-redundancy time. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
CHAPTER 10 OF 12 · Check evidence and limits
10. Lifecycle, rotation and recovery ceremonies
Shares need identifiers for scheme version, field, threshold, coordinate, checksum or authentication tag, creation time and secret generation. Store metadata without exposing the secret.
Test recovery in an isolated environment using a non-production secret. During real recovery, minimise copies, control output, record participants and securely remove temporary material. A successful interpolation that leaves the key in shell history is a failed ceremony.
Rotate shares when holders change or compromise is suspected. Some protocols support proactive resharing without changing the underlying secret; use a reviewed procedure rather than inventing coefficient transformations.
Recovery testing must not quietly lower the threshold. Teams sometimes keep an emergency master copy “just in case,” which restores a single point of compromise. If an escrow copy is required by policy, name it as another control with its own custodian, access rule and threat analysis. Do not advertise a distributed-trust property that the emergency path bypasses.
Destroying an obsolete share is also a protocol event. Confirm that backups, exports and retired devices are covered, then record the transition to the new share set without exposing either secret.
Plan for partial ceremonies. A holder may arrive with an unreadable medium, an outdated version or a valid share assigned to the wrong secret identifier. Validate metadata and authenticity before counting the share toward the threshold. Stop safely when the inputs disagree; repeated guessing can expose copies, confuse audit records and pressure operators into bypassing the controls the ceremony was meant to enforce.
Rehearse that stop condition as carefully as successful recovery.
Evidence check: for Lifecycle, rotation and recovery ceremonies, preserve the observation before the interpretation. Record metadata version, catalogue and recovery history. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Practice one: a 3-of-5 scheme stores three shares in one office safe. One burglary can meet the threshold. Redistribute across independent failure domains.
Practice two: two share files have the same x coordinate. They are not two independent points. Replace the duplicate through the authorised resharing process.
Practice three: four shares reconstruct a value but its authenticated digest fails. Stop. Preserve inputs, verify coordinates and use a robust or verifiable recovery process.
Transfer the idea to approvals carefully. Requiring three managers to authorise a payment resembles threshold governance, but it is not cryptographic secret sharing unless the key operation itself is distributed.
Evidence check: for Independent practice and transfer, preserve the observation before the interpretation. Record the failure pattern that exceeds the promise. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Can one share be backed up?
Yes, but every backup expands that holder’s compromise domain. Protect, inventory and rotate copies as part of the same share.
Are share files safe to email?
Not by default. Distribution needs authenticated, confidential channels and verified recipients.
Is secret sharing a backup?
It can improve availability of a secret, but it does not provide version history, application data recovery or protection from every correlated failure.
Should the secret ever be reconstructed?
Some uses require it; threshold cryptography can sometimes perform an operation without assembling the key in one place. Choose the system for the actual operation.
Authoritative reading includes Adi Shamir’s original How to Share a Secret, the NIST Multi-Party Threshold Cryptography project, and RFC 9591 on FROST threshold signatures. These sources describe different layers; do not treat a secret-sharing example as a complete threshold-signature protocol.
Continue with erasure coding and missing-data recovery and checksums and silent change. The next useful move is to write a recovery ceremony that names every holder, failure domain, authenticated input and place where the reconstructed secret could accidentally persist.
Evidence check: for FAQ, sources and the next useful move, preserve the observation before the interpretation. Record a test fixture decoded by the future system. Then state the inference, one credible alternative, and the additional observation that would distinguish them. This compact audit keeps a fluent explanation tied to evidence that another reader can inspect.
Changed-context transfer: repeat this chapter’s decision after changing one consequential condition while holding the others fixed. Calculate or predict what should change, name the threshold or mechanism, and compare with the original case. If the conclusion survives, state the range tested; if it reverses, explain why. Transfer is demonstrated by the changed case, not asserted from the first example.
Practical decision record: write one sentence for what is known, one for what remains uncertain, and one for the next safe action. Include the evidence owner, the latest useful decision time, and the condition that would stop or reverse the action. This turns a technical result into a reviewable choice without pretending uncertainty has disappeared.
Contents · Previous chapter · Return to the Information guide