EN
Back to the archive

The encyclopedia · Software & IT · Technical decision · 1979

Adi Shamir split a secret into shares so any k of n rebuild it and k-1 learn nothing

In 1979 Adi Shamir divided a secret into n pieces so any k rebuild it but k-1 reveal nothing, by hiding it as a polynomial's value at zero.

Massachusetts Institute of Technology

the move

Guarding anything important usually means one person holds it, which is a single point of failure, or everyone is trusted, which is worse. Splitting it into parts fails too: each part is real information, so thieves who pool parts lose nothing.

Shamir's 1979 scheme encodes the secret as the constant term of a random polynomial of degree k-1. A shareholder gets one point; the polynomial's intercept — the secret — is recovered by Lagrange interpolation from any k points, and is provably unrecoverable from k-1.

This makes the secrecy threshold exact rather than approximate. It is how a set of trustees or machines can jointly guard a key, sign, or unlock without anyone holding it alone, and it spreads in cryptography and distributed systems.

why it works

  • A single custodian is one breach away from losing the asset; shares spread the risk.
  • Threshold reconstruction is exact, not probabilistic, so security guarantees are provable.
  • k-1 shareholders learn literally nothing, so no coalition below the threshold can cheat.
  • It equates to a recoverable secret without a shared-key ceremony or a single authority.
the payoffHide the secret in a polynomial; shares are points on itinspired

what transfers

Do not split an asset into pieces and hand them out — that leaks. Hide the whole in one object and give each holder a view engineered so any threshold rebuilds it and a smaller group learns nothing.

what came after

Secret sharing became the backbone of threshold cryptography, multi-party signing, and key custody in cloud vaults and blockchains. It is used to split cryptographic keys so no one node holds a signing key, and to protect distributed systems against a single compromised component.

references

spotted an error? The archive wants to know.

same kind of clever