Shamir Secret Sharing

Some secrets are too important to trust to one person or one location: the recovery key of a vault, the master password of a team account, a signing key. Shamir’s secret sharing, published by Adi Shamir in 1979, solves this with mathematics. You cut the secret into n shares, you choose a threshold k, and any k shares rebuild the secret while any k-1 shares reveal nothing about it, not even a hint. This page does the splitting and the rebuilding in your browser.

The idea in one picture

Think of a straight line. Two points fix a line; one point leaves a million lines possible. Hide the secret as the height where the line crosses a vertical axis, give each person a different point on the line, and any two people can reconstruct it while one person knows nothing. A threshold of three uses a curve of degree two (a parabola), which needs three points. For a threshold k, the tool picks a random polynomial of degree k-1 whose constant term is the secret, and each share is one point on it.

How the tool does it

Real implementations work with whole numbers modulo a prime or with bytes in a finite field. This one uses the field GF(256), the same arithmetic as AES, so each byte of the secret becomes the constant term of its own random polynomial. Shares therefore have exactly the length of the secret. Randomness comes from your browser’s secure generator. Because every byte is treated separately, the method leaks nothing even when a secret is very regular.

A worked 3-of-5 example

Press Sample. The page loads the secret “correct horse battery staple”, 28 bytes, with 5 shares and a threshold of 3, then Split produces five lines such as ows1-3-1-acccc409…cafc90-b939. Each starts with the format tag ows1, then the threshold 3, then the share number 1 to 5, then 56 hexadecimal digits of data (28 bytes) and a four-digit check code. The data differs every time you press Split, because the polynomials are random. Switch to Combine, paste any three of the five lines, and the page returns “correct horse battery staple” as text and as hex. Paste only two and it answers that 3 shares are needed and you entered 2.

Storing shares well

Give each share to a different person or place, and write it on paper or in separate, secure stores. Record the threshold with the shares so nobody has to guess. Test a recovery before you rely on it: combine shares from a different set of holders each time. Remember that shares are as sensitive as the secret once enough of them are together; a threshold of 2 of 3 held by one family in one house gives little protection.

Limits

The scheme protects confidentiality only. It does not prove a share is genuine, so a dishonest holder can give a false share and spoil the result unnoticed. Use it with a hash of the secret if you need to confirm the rebuilt value. The text format is specific to this tool, so keep the page’s address with your records, or note the method so that a developer can reimplement it.

Related tools

• AES Encryptor and Decryptor encrypts data so you only split a short key.
• Diceware Passphrase Generator makes a passphrase worth protecting this way.
• Password Generator creates random secrets to split.
• PBKDF2 and HKDF Calculator turns a rebuilt passphrase into a key.