Crypto Wiki

Shamir's Secret Sharing is an algorithm in cryptography. It is a form of secret sharing, where a secret is divided into parts, giving each participant its own unique part, where some of the parts or all of them are needed in order to reconstruct the secret.

Counting on all participants to combine together the secret might be impractical, and therefore we sometimes use the threshold scheme where any of the parts are sufficient to reconstruct the original secret.

Mathematical definition[]

Formally, our goal is to divide some data (e.g., the safe combination) into pieces in such a way that:

  1. Knowledge of any or more pieces makes easily computable.
  2. Knowledge of any or fewer pieces leaves completely undetermined (in the sense that all its possible values are equally likely).

This scheme is called threshold scheme. If then all participants are required to reconstruct the secret.

Shamir's secret-sharing scheme[]

File:3 polynomials of degree 2 through 2 points.svg

One can draw an infinite number of polynomials of degree 2 through 2 points. 3 points are required to define a unique polynomial of degree 2. This image is for illustration purposes only — Shamir's scheme uses polynomials over a finite field, not representable on a 2-dimensional plane.

The essential idea of Adi Shamir's threshold scheme is that 2 points are sufficient to define a line, 3 points are sufficient to define a parabola, 4 points to define a cubic curve and so forth. That is, it takes points to define a polynomial of degree .

Suppose we want to use threshold scheme to share our secret , without loss of generality assumed to be an element in a finite field .

Choose at random coefficients in , and let . Build the polynomial . Let us construct any points out of it, for instance set to retrieve . Every participant is given a point (a pair of input to the polynomial and output). Given any subset of of these pairs, we can find the coefficients of the polynomial using interpolation and the secret is the constant term .



The following example illustrates the basic idea. Note, however, that calculations in the example are done using integer arithmetic rather than using finite field arithmetic. Therefore the example below does not provide perfect secrecy, and is not a true example of Shamir's scheme.


Suppose that our secret is 1234 .

We wish to divide the secret into 6 parts , where any subset of 3 parts is sufficient to reconstruct the secret. At random we obtain 2 numbers: 166, 94.

Our polynomial to produce secret shares (points) is therefore:

We construct 6 points from the polynomial:

We give each participant a different single point (both and ).


In order to reconstruct the secret any 3 points will be enough.

Let us consider .

We will compute Lagrange basis polynomials:


Recall that the secret is the free coefficient, which means that , and we are done.


Some of the useful properties of Shamir's threshold scheme are:

  1. Secure: Information theoretic security.
  2. Minimal: The size of each piece does not exceed the size of the original data.
  3. Extensible: When is kept fixed, pieces can be dynamically added or deleted without affecting the other pieces.
  4. Dynamic: Security can be easily enhanced without changing the secret, but by changing the polynomial occasionally (keeping the same free term) and constructing new shares to the participants.
  5. Flexible: In organizations where hierarchy is important, we can supply each participant different number of pieces according to his importance inside the organization. For instance, the president can unlock the safe alone, whereas 3 secretaries are required together to unlock it.

See also[]

  • Secret sharing
  • Lagrange polynomial
  • Homomorphic secret sharing - A simplistic decentralized voting protocol.


  • Template:Citation.
  • Template:Citation.
  • Template:Citation.
  • Template:Citation.

External links[]

de:Shamir's Secret Sharing es:Esquema de Shamir fr:Partage de clé secrète de Shamir hu:Shamir-féle titokmegosztás ru:Схема разделения секрета Шамира