How Mathematics Splits a Secret Into Useless Pieces
Suppose an important key is kept in a single safe. The only copy can be lost, but making ordinary duplicates creates another compromise point every time. What is needed is a different arrangement: distribute data among several custodians so that a predetermined number can recover the secret, while a smaller group learns nothing useful about it. Adi Shamir described just such a threshold construction in 1979.
Two pages that changed key management
The paper “How to Share a Secret” occupied pages 612 and 613 of the November issue of Communications of the ACM. Shamir proposed representing the secret as a number and placing it in the constant term of a random polynomial of degree at most K−1. The polynomial is then evaluated at N distinct nonzero points, and each pair consisting of a point number and its value becomes a share.
Any K points uniquely determine a polynomial of degree at most K−1, so they are enough to evaluate it at zero and recover the secret. With only K−1 points, one equation is missing. For every possible secret in the field there is a compatible set of coefficients, and uniform random coefficients make all those possibilities equally likely. This is the precise probabilistic sense in which the classical scheme offers perfect secrecy below the threshold; it does not merely make a brute-force attack expensive.
Shamir's original construction performs the calculations modulo a prime p chosen larger than both the secret and the number of shares. This creates a finite field in which addition, multiplication, and division are exact, with no rounding errors, while each share remains comparable in size to the secret.
How it works in plain terms
Consider a teaching example with the secret 42 and a (3, 5) scheme: five shares are created and any three must recover the value. In the familiar geometric analogy, 42 is where a parabola crosses the Y axis, two other coefficients are random, and five points on the parabola are handed to the participants.
Three points determine one parabola and therefore reveal its value at x = 0. On an ordinary real-valued graph, infinitely many parabolas with different Y intercepts pass through only two points. That picture makes the threshold intuitive, but the actual algorithm does not work with a smooth curve or real coordinates. It uses a finite set of field elements, where the exact guarantee is that every possible secret remains equally likely.
Text is first encoded as a sequence of bytes. A separate polynomial with independent random coefficients is built for every byte, and all those polynomials are evaluated at the same share number x. A participant therefore receives one point number followed by a sequence containing one field value for every byte of the original text.
The formula: how the secret comes back
The browser tool uses GF(256), so one field element maps exactly to one byte. For a byte b, it constructs:
f(x) = b ⊕ a₁·x ⊕ a₂·x² ⊕ … ⊕ a_(K−1)·x^(K−1)
Here b = f(0), while the remaining coefficients come from the browser's cryptographic random generator. The ⊕ symbol denotes addition in GF(256), which is bitwise XOR; multiplication and exponentiation also follow field rules rather than ordinary integer arithmetic. Shares are evaluated at x = 1, 2, …, N, because a share at x = 0 would expose the constant term directly.
Recovery does not need to reconstruct every coefficient explicitly. Lagrange interpolation can evaluate the polynomial directly at zero:
b = ⊕ᵢ f(xᵢ)·Lᵢ(0),
where Lᵢ(0) = ∏_(j≠i) xⱼ / (xᵢ ⊕ xⱼ)
In a field of characteristic 2, subtraction is the same as addition, so the difference xᵢ − xⱼ is written as XOR. Distinct nonzero share numbers keep the denominator nonzero, and every nonzero field element has one multiplicative inverse.
The implementation represents GF(256) in the same way that FIPS 197 specifies for AES: binary polynomial products are reduced modulo the irreducible polynomial x⁸ + x⁴ + x³ + x + 1, written as 0x11b. Its multiplication and division tables use 3 as a primitive element. This does not mean that the tool encrypts data with AES; the two constructions merely use the same finite field.
Where it is used today
A well-documented production example is HashiCorp Vault. With a Shamir seal, Vault divides an unseal key into shares and requires the configured threshold to unlock the system. It does not split the whole secrets database; it distributes a relatively short key that protects the next layer of encryption keys.
The wallet ecosystem has SLIP-0039, a separate standard for mnemonic shares used to back up a master secret. It is not an ordinary BIP-39 phrase cut into groups of words, nor is it automatically compatible with every program that implements polynomial secret sharing. A real backup procedure must specify the standard, the share format, and a tested recovery path in another compatible application.
Threshold signatures, multisig, and key ceremonies pursue a similar organizational goal, but they should not automatically be labeled Shamir secret sharing. IANA's root DNSSEC policy requires three of seven Crypto Officer credentials to activate an HSM, and all cryptographic operations involving the private KSK must run inside a validated device. The same policy separately specifies five-of-seven threshold secret sharing for the Storage Master Key or Domain Key without naming Shamir's algorithm. A threshold ceremony is therefore not evidence that the signing key itself has been split with Shamir polynomials.
What our tool actually does
Shamir's Secret Sharing encodes the entered text as UTF-8 and splits each byte over GF(256). It can create between 2 and 255 shares with a threshold from 2 through N, copy their Base64 representation, save individual QR codes as PNG or SVG, or download a ZIP containing QR images, a text list, and metadata. During recovery it accepts share strings and QR images, removes duplicate point numbers, and checks that the stated threshold has been met.
Every share contains a format version, threshold K, random eight-byte set identifier, point number x, CRC32 of the original text, and the polynomial values. The identifier helps detect an accidentally mixed set, while CRC32 catches many forms of damage after reconstruction. Neither value is a digital signature or authentication code, however; someone who can modify a share can also recompute an unkeyed checksum.
The format has two further limitations worth making explicit. Share length reveals secret length, and the CRC32 stored in every share lets an observer test guesses about short or predictable input. The code also forces the leading coefficient to be nonzero so that every byte polynomial has exactly degree K−1. With K−1 shares, that restriction rules out one byte value, so the classical zero-leakage proof no longer applies literally. The polynomial payload reconstructs correctly, but this implementation should not be presented as a strict, independently verified perfect-secret-sharing system.
All calculations happen in the open tab using crypto.getRandomValues, and the tool itself does not send the secret to a server. A loaded web page still executes inside an ordinary browser, though, so long-lived master keys and real wallet secrets deserve an audited implementation of a recognized format, an isolated device, and a recovery drill performed in advance. Every share also needs protection, because collecting the threshold reveals the entire original secret.
Related tools
Frequently asked questions
What is Shamir's Secret Sharing?
It is a threshold cryptographic scheme that divides a secret into N shares. Any K valid shares recover the secret, while in the classical construction with uniformly chosen coefficients, the distribution of any K−1 shares is statistically independent of it. Adi Shamir described the scheme in his 1979 paper 'How to Share a Secret'.
How does a (K, N) threshold scheme work?
The secret becomes the constant term of a random polynomial of degree at most K−1, and the N shares are its values at distinct nonzero points. Lagrange interpolation over any K points recovers the polynomial's value at zero, which is the secret.
Where is secret sharing used?
It is used for distributed key custody and recovery. HashiCorp Vault, for example, can split an unseal key into shares, while SLIP-0039 defines an interoperable mnemonic-share format for wallet master-secret backups. Multisig, threshold signatures, and threshold access to an HSM solve related organizational problems but do not necessarily use Shamir's scheme.
Should I use this browser tool for critical keys?
The tool runs locally and is useful for studying the mechanism, but its format is not SLIP-0039 and has not been independently audited. Each share also contains the secret's CRC32, and the leading coefficient is restricted to nonzero values, so the strict zero-leakage guarantee for K−1 shares does not apply to this implementation. Use an audited specialist product on an isolated device for critical keys.
Author
Alex RelFullstack Engineer
In commercial development since 2011 — over 15 years. Author of two SaaS products, TeleGo.io and LingvoHabit.com. The articles here come out of real client and product work.
