The encyclopedia · Software & IT · Technical decision · 1979
Adi Shamir split a secret into shares so any k of n rebuild it and k-1 learn nothing
In 1979 Adi Shamir divided a secret into n pieces so any k rebuild it but k-1 reveal nothing, by hiding it as a polynomial's value at zero.
Massachusetts Institute of Technology
the move
Guarding anything important usually means one person holds it, which is a single point of failure, or everyone is trusted, which is worse. Splitting it into parts fails too: each part is real information, so thieves who pool parts lose nothing.
Shamir's 1979 scheme encodes the secret as the constant term of a random polynomial of degree k-1. A shareholder gets one point; the polynomial's intercept — the secret — is recovered by Lagrange interpolation from any k points, and is provably unrecoverable from k-1.
This makes the secrecy threshold exact rather than approximate. It is how a set of trustees or machines can jointly guard a key, sign, or unlock without anyone holding it alone, and it spreads in cryptography and distributed systems.
why it works
- A single custodian is one breach away from losing the asset; shares spread the risk.
- Threshold reconstruction is exact, not probabilistic, so security guarantees are provable.
- k-1 shareholders learn literally nothing, so no coalition below the threshold can cheat.
- It equates to a recoverable secret without a shared-key ceremony or a single authority.
what transfers
Do not split an asset into pieces and hand them out — that leaks. Hide the whole in one object and give each holder a view engineered so any threshold rebuilds it and a smaller group learns nothing.
what came after
Secret sharing became the backbone of threshold cryptography, multi-party signing, and key custody in cloud vaults and blockchains. It is used to split cryptographic keys so no one node holds a signing key, and to protect distributed systems against a single compromised component.
references
spotted an error? The archive wants to know.