Shamir's secret sharing

A company needs to secure their vault. If a single person knows the code to the vault, the code might be lost or unavailable when the vault needs to be opened. If there are several people who know the code, they may not trust each other to always act honestly.

SSS can be used in this situation to generate shares of the vault's code which are distributed to authorized individuals in the company. The minimum threshold and number of shares given to each individual can be selected such that the vault is accessible only by (groups of) authorized individuals. If fewer shares than the threshold are presented, the vault cannot be opened.

By accident or as an act of opposition, some individuals might present incorrect information for their shares. If the total of correct shares fails to meet the minimum threshold, the vault remains locked.

Shamir's secret sharing can be used to

• share a key for decrypting the root key of a password manager,[1]
• recover a user key for encrypted email access[2] and
• sharing of the passphrase used to recreate a master secret, which is in turn used to access a cryptocurrency wallet.[3]

Suppose that the secret to be shared is 1234 ${\displaystyle (S=1234)}$.

In this example, the secret will be split into 6 shares ${\displaystyle (n=6)}$, where any subset of 3 shares ${\displaystyle (k=3)}$ is sufficient to reconstruct the secret. ${\displaystyle k-1=2}$ numbers are taken at random. Let them be 166 and 94.

This yields coefficients ${\displaystyle (a_{0}=1234;a_{1}=166;a_{2}=94),}$ where ${\displaystyle a_{0}}$ is the secret

The polynomial to produce secret shares (points) is therefore:

${\displaystyle f(x)=1234+166x+94x^{2}}$

Six points ${\displaystyle D_{x-1}=(x,f(x))}$ from the polynomial are constructed as:

${\displaystyle D_{0}=(1,1494);D_{1}=(2,1942);D_{2}=(3,2578);D_{3}=(4,3402);D_{4}=(5,4414);D_{5}=(6,5614)}$

Each participant in the scheme receives a different point (a pair of ${\displaystyle x}$ and ${\displaystyle f(x)}$). Because ${\displaystyle D_{x-1}}$ is used instead of ${\displaystyle D_{x}}$ the points start from ${\displaystyle (1,f(1))}$ and not ${\displaystyle (0,f(0))}$. This is necessary because ${\displaystyle f(0)}$ is the secret.

In order to reconstruct the secret, any 3 points are sufficient

Consider using the 3 points${\displaystyle \left(x_{0},y_{0}\right)=\left(2,1942\right);\left(x_{1},y_{1}\right)=\left(4,3402\right);\left(x_{2},y_{2}\right)=\left(5,4414\right)}$.

Computing the Lagrange basis polynomials:

${\displaystyle \ell _{0}(x)={\frac {x-x_{1}}{x_{0}-x_{1}}}\cdot {\frac {x-x_{2}}{x_{0}-x_{2}}}={\frac {x-4}{2-4}}\cdot {\frac {x-5}{2-5}}={\frac {1}{6}}x^{2}-{\frac {3}{2}}x+{\frac {10}{3}}}$

${\displaystyle \ell _{1}(x)={\frac {x-x_{0}}{x_{1}-x_{0}}}\cdot {\frac {x-x_{2}}{x_{1}-x_{2}}}={\frac {x-2}{4-2}}\cdot {\frac {x-5}{4-5}}=-{\frac {1}{2}}x^{2}+{\frac {7}{2}}x-5}$

${\displaystyle \ell _{2}(x)={\frac {x-x_{0}}{x_{2}-x_{0}}}\cdot {\frac {x-x_{1}}{x_{2}-x_{1}}}={\frac {x-2}{5-2}}\cdot {\frac {x-4}{5-4}}={\frac {1}{3}}x^{2}-2x+{\frac {8}{3}}}$

Using the formula for polynomial interpolation, ${\displaystyle f(x)}$ is:

${\displaystyle {\begin{aligned}f(x)&=\sum _{j=0}^{2}y_{j}\cdot \ell _{j}(x)\\[6pt]&=y_{0}\ell _{0}(x)+y_{1}\ell _{1}(x)+y_{2}\ell _{2}(x)\\[6pt]&=1942\left({\frac {1}{6}}x^{2}-{\frac {3}{2}}x+{\frac {10}{3}}\right)+3402\left(-{\frac {1}{2}}x^{2}+{\frac {7}{2}}x-5\right)+4414\left({\frac {1}{3}}x^{2}-2x+{\frac {8}{3}}\right)\\[6pt]&=1234+166x+94x^{2}\end{aligned}}}$

Recalling that the secret is the free coefficient, which means that ${\displaystyle S=1234}$, and the secret has been recovered.

Using polynomial interpolation to find a coefficient in a source polynomial ${\displaystyle S=f(0)}$ using Lagrange polynomials is not efficient, since unused constants are calculated.

Considering this, an optimized formula to use Lagrange polynomials to find ${\displaystyle f(0)}$ is defined as follows:

${\displaystyle f(0)=\sum _{j=0}^{k-1}y_{j}\prod _{\begin{smallmatrix}m\,=\,0\\m\,\neq \,j\end{smallmatrix}}^{k-1}{\frac {x_{m}}{x_{m}-x_{j}}}}$

Although the simplified version of the method demonstrated above, which uses integer arithmetic rather than finite field arithmetic, works, there is a security problem: Eve gains information about ${\displaystyle S}$ with every ${\displaystyle D_{i}}$ that she finds.

Suppose that she finds the 2 points ${\displaystyle D_{0}=(1,1494)}$ and ${\displaystyle D_{1}=(2,1942)}$. She still does not have ${\displaystyle k=3}$ points, so in theory she should not have gained any more information about ${\displaystyle S}$. But she could combine the information from the 2 points with the public information: ${\displaystyle n=6,k=3,f(x)=a_{0}+a_{1}x+\cdots +a_{k-1}x^{k-1},a_{0}=S,a_{i}\in \mathbb {Z} }$. Doing so, Eve could perform the following algebra:

1. Fill the formula for ${\displaystyle f(x)}$ with ${\displaystyle S}$ and the value of ${\displaystyle k:f(x)=S+a_{1}x+\cdots +a_{k-1}x^{k-1}\Rightarrow {}f(x)=S+a_{1}x+a_{2}x^{2}}$
2. Fill (1) with the values of ${\displaystyle D_{0}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1494=S+a_{1}1+a_{2}1^{2}\Rightarrow {}1494=S+a_{1}+a_{2}}$
3. Fill (1) with the values of ${\displaystyle D_{1}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1942=S+a_{1}2+a_{2}2^{2}\Rightarrow {}1942=S+2a_{1}+4a_{2}}$
4. Subtract (3)-(2): ${\displaystyle (1942-1494)=(S-S)+(2a_{1}-a_{1})+(4a_{2}-a_{2})\Rightarrow {}448=a_{1}+3a_{2}}$ and rewrite this as ${\displaystyle a_{1}=448-3a_{2}}$.
5. Now, Eve can replace ${\displaystyle a_{1}}$ by (4) in (2): ${\displaystyle 1494=S+(448-3a_{2})+a_{2}\Rightarrow {}S=1046+2a_{2}}$ which leads her to the information that S is even.

This is a polynomial curve over a finite field – the order of the polynomial has seemingly little to do with the shape of the graph.

The above attack exploits constraints on the values that the polynomial may take by virtue of how it was constructed: the polynomial must have coefficients that are integers, and the polynomial must take an integer as value when evaluated at each of the coordinates used in the scheme. This reduces its possible values at unknown points, including the resultant secret, given fewer than ${\displaystyle k}$ shares.

This problem can be remedied by using finite field arithmetic. A finite field always has size ${\displaystyle q=p^{r}}$, where ${\displaystyle p}$ is a prime and ${\displaystyle r}$ is a positive integer. The size ${\displaystyle q}$ of the field must satisfy ${\displaystyle q>n}$, and that ${\displaystyle q}$ is greater than the number of possible values for the secret, though the latter condition may be circumvented by splitting the secret into smaller secret values, and applying the scheme to each of these. In our example below, we use a prime field (i.e. r = 1). The figure shows a polynomial curve over a finite field.

In practice this is only a small change. The order q of the field (i.e. the number of values that it has) must be chosen to be greater than the number of participants and the number of values that the secret ${\displaystyle a_{0}=S}$ may take. All calculations involving the polynomial must also be calculated over the field (mod p in our example, in which ${\displaystyle p=q}$ is taken to be a prime) instead of over the integers. Both the choice of the field and the mapping of the secret to a value in this field are considered to be publicly known.

For this example, choose ${\displaystyle p=1613}$, so the polynomial becomes ${\displaystyle f(x)=1234+166x+94x^{2}{\bmod {1613}}}$ which gives the points: ${\displaystyle (1,1494);(2,329);(3,965);(4,176);(5,1188);(6,775)}$

This time Eve doesn't gain any information when she finds a ${\displaystyle D_{x}}$ (until she has ${\displaystyle k}$ points).

Suppose again that Eve finds ${\displaystyle D_{0}=\left(1,1494\right)}$ and ${\displaystyle D_{1}=\left(2,329\right)}$, and the public information is: ${\displaystyle n=6,k=3,p=1613,f(x)=a_{0}+a_{1}x+\dots +a_{k-1}x^{k-1}\mod {p},a_{0}=S,a_{i}\in \mathbb {N} }$. Attempting the previous attack, Eve can:

1. Fill the ${\displaystyle f(x)}$-formula with ${\displaystyle S}$ and the value of ${\displaystyle k}$ and ${\displaystyle p}$: ${\displaystyle f(x)=S+a_{1}x+\dots +a_{3-1}x^{3-1}\mod 1613}$
2. Fill (1) with the values of ${\displaystyle D_{0}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1494\equiv S+a_{1}1+a_{2}1^{2}{\pmod {1613}}\Rightarrow {}1494\equiv S+a_{1}+a_{2}{\pmod {1613}}}$
3. Fill (1) with the values of ${\displaystyle D_{1}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1942\equiv S+a_{1}2+a_{2}2^{2}{\pmod {1613}}\Rightarrow {}1942\equiv S+2a_{1}+4a_{2}{\pmod {1613}}}$
4. Subtract (3)-(2): ${\displaystyle (1942-1494)\equiv (S-S)+(2a_{1}-a_{1})+(4a_{2}-a_{2}){\pmod {1613}}\Rightarrow {}448\equiv a_{1}+3a_{2}{\pmod {1613}}}$ and rewrite this as ${\displaystyle a_{1}\equiv 448-3a_{2}{\pmod {1613}}}$

There are ${\displaystyle p}$ possible values for ${\displaystyle a_{1}}$. She knows that ${\displaystyle [448,445,442,\ldots ]}$ always decreases by 3, so if ${\displaystyle p}$ were divisible by ${\displaystyle 3}$ she could conclude ${\displaystyle a_{1}\in [1,4,7,\ldots ]}$. However, ${\displaystyle p}$ is prime, so she can not conclude this. Thus, using a finite field avoids this possible attack.

Also, even though Eve can conclude that ${\displaystyle S\equiv 1046+2a_{2}{\pmod {1613}}}$, it does not provide any additional information, since the "wrapping around" behavior of modular arithmetic prevents the leakage of "S is even", unlike the example with integer arithmetic above.