Shamir Secret Sharing — Splitting Secrets Like Treasure Map Pieces

1 2 3 4 5 6 7

difficulty levels — click green to claim

> SHAMIR SECRET SHARING

shamir difficulty: 3–7 also known as: K-of-N threshold scheme

The idea in plain English: Imagine you have a secret code and you want to give 5 friends pieces of it — but they need at least 3 friends together to reconstruct the full code. No 2 friends can figure it out alone. This is called a K-of-N threshold scheme (in this case, 3-of-5). How? You hide the secret as the y-intercept of a polynomial curve. A straight line (degree 1) needs 2 points. A parabola (degree 2) needs 3 points. Each "share" is a point on the polynomial curve. With enough points (K), you can recover the curve and read the secret at x=0.

Why this really exists: Shamir Secret Sharing (invented by Adi Shamir, the 'S' in RSA) is used in real security systems. Nuclear launch codes are split this way — no single person can launch. Cryptographic keys for cryptocurrency wallets are split across multiple locations. Company "root passwords" are shared among executives. It's a beautiful piece of applied math: provably secure, uses only polynomial interpolation.

▸ Concrete Example

Secret = 42 (the letter '*'). Let's use a parabola (degree 2, K=3) over the integers:

Choose polynomial: f(x) = 42 + 5x + 2x²
Secret = f(0) = 42

Create 5 shares (any 3 needed):
f(1) = 42 + 5 + 2 = 49 → share (1, 49)
f(2) = 42 + 10 + 8 = 60 → share (2, 60)
f(3) = 42 + 15 + 18 = 75 → share (3, 75)
f(4) = 42 + 20 + 32 = 94 → share (4, 94)
f(5) = 42 + 25 + 50 = 117 → share (5, 117)

Given 3 shares, reconstruct using Lagrange interpolation:
f(0) = 42 → ASCII 42 → '*'

The puzzle gives you enough shares (≥K). Interpolate to find f(0) = the secret ASCII code.

▸ How to Solve (Step by Step)

1. Get the shares [(x₁,y₁), (x₂,y₂), ...] from puzzle data

2. Use Lagrange interpolation to find the polynomial's value at x=0

3. The result is the secret — an ASCII code (or concatenation of codes)

4. Convert to character(s) → the answer word

def lagrange_interpolate(shares, x_target=0):
  result = 0
  for i, (xi, yi) in enumerate(shares):
    term = yi
    for j, (xj, _) in enumerate(shares):
      if i != j:
        term *= (x_target - xj) / (xi - xj)
    result += term
  return int(round(result))

secret = lagrange_interpolate(shares)
word = ''.join(chr(c) for c in secrets) # or just chr(secret)

▸ Real-World Applications

Cryptographic keys: Split a master key across multiple secure locations
Nuclear launch codes: No single person can initiate — requires multiple officers
Cryptocurrency wallets: Multi-sig wallets use threshold signatures (related idea)
Corporate secrets: Root passwords shared among executives using secret sharing

← Back to all ciphers