Overview
Shamir's Secret Sharing encodes the secret as the constant term of a random polynomial and gives participants points on that polynomial.
SpecializedSource checked
Shamir's Secret Sharing
Splits a secret into shares so only a threshold number of shares can reconstruct it.
Quick Facts
Compact metadata for implementation and discovery.
- Category
- Cryptography
- Difficulty
- Advanced
- Family
- Threshold Cryptography
- Tier
- Specialized
- Status
- Verified
- Review
- Source Checked
- Sources
- 1
- Formulas
- 1
- Relationships
- 3
- Code example
- Not ready
- Visualization
- Ready
Core Concepts
finite fieldpolynomial interpolationthreshold sharesconstant term
Quick facts
Complexity
Runtime and memory behavior at a glance.
Best
O(t)
Average
O(t^2)
Worst
O(t^2)
Space
O(t)
When to Use
- Use when a secret should require multiple independent holders to recover it.
- Use when key backup is a central requirement.
When Not to Use
- Avoid when simple encryption with one trusted key holder is sufficient.
- Avoid when a reviewed library or protocol already provides the needed security property.
What It Does
- Builds a random polynomial
- Distributes polynomial points
- Reconstructs the secret from enough shares
Use Cases
- Key backup
- Shared administrative control
- Disaster recovery secrets
Inputs
- Secret value
- Threshold
- Number of shares
Outputs
- Secret shares
- Reconstructed secret when threshold is met
Key Formulas (1)
Secret polynomial
f(x) = secret + a1·x + a2·x2 + … + a(t−1)·x(t−1)
f(x) = secret + a1*x + a2*x^2 + ... + a(t-1)*x^(t-1)Embeds the secret as the polynomial's constant term.
Pseudocode
- 1.Choose a random polynomial whose constant term is the secret
- 2.Evaluate the polynomial at distinct nonzero x values
- 3.Give one point to each participant
- 4.Use interpolation on threshold shares to recover the constant term
Canonical Example
- Input
- secret = 12, threshold = 3
- Output
- shares = points on a degree-2 polynomial
- Explanation
- Any three valid points can interpolate the constant term, which is the secret.
Implementation Notes
- Use finite-field arithmetic and authenticate shares before reconstruction in real systems.
- Do not implement production cryptography from scratch; use the entry to understand the mechanism.
- Keep a tiny example with expected output beside the implementation.
Common Pitfalls
- Using normal integer or floating-point arithmetic breaks the threshold security model.
- Confusing hashing, encryption, signing, and key derivation can create insecure designs.
- Not defining boundary, empty, or degenerate inputs before implementation.
Interactive Mechanism Walkthrough
Graph Frontier & Edge RelaxationShow a polynomial curve where any threshold number of points determines the secret intercept.
Step 1 of 4: Choose a random polynomial whose constant term is the secret
crypto-flowNotes
All arithmetic is done in a finite field, not with normal floating-point numbers.
Sources (1)
What each reference supports for this entry.
Explore Next
Good next jumps from the relationship graph, ranked for useful discovery.
Relationships
View full relationship pageUsed byThreshold Signature Scheme
Shamir's secret sharing is a common primitive for distributing signing authority in threshold schemes.
Related Algorithms
Tags
CryptographySecret SharingSecurityInterpolation