# Shamir's Secret Sharing

Shamir's Secret Sharing is an algorithm in cryptography created by Adi Shamir. It is a form of secret sharing, where a secret is divided into parts, giving each participant its own unique part, where some of the parts or all of them are needed in order to reconstruct the secret.

Counting on all participants to combine the secret might be impractical, and therefore sometimes the threshold scheme is used where any ${\displaystyle k}$ of the parts are sufficient to reconstruct the original secret.

## Mathematical definition

The goal is to divide secret ${\displaystyle S}$ (for example, the combination to a safe) into ${\displaystyle n}$ pieces of data ${\displaystyle S_{1},\ldots ,S_{n}}$ in such a way that:

1. Knowledge of any ${\displaystyle k}$ or more ${\displaystyle S_{i}}$ pieces makes ${\displaystyle S}$ easy to compute. That is, the complete secret ${\displaystyle S}$ can be reconstructed from any combination of ${\displaystyle k}$ pieces of data.
2. Knowledge of any ${\displaystyle k-1}$ or fewer ${\displaystyle S_{i}}$ pieces leaves ${\displaystyle S}$ completely undetermined, in the sense that the possible values for ${\displaystyle S}$ seem as likely as with knowledge of ${\displaystyle 0}$ pieces. Said another way, the secret ${\displaystyle S}$ cannot be reconstructed with fewer than ${\displaystyle k}$ pieces.

This scheme is called ${\displaystyle \left(k,n\right)}$ threshold scheme. If ${\displaystyle k=n}$ then every piece of the original secret ${\displaystyle S}$ is required to reconstruct the secret.

## Shamir's secret-sharing scheme

One can draw an infinite number of polynomials of degree 2 through 2 points. 3 points are required to define a unique polynomial of degree 2. This image is for illustration purposes only — Shamir's scheme uses polynomials over a finite field, not representable on a 2-dimensional plane.

The essential idea of Adi Shamir's threshold scheme is that 2 points are sufficient to define a line, 3 points are sufficient to define a parabola, 4 points to define a cubic curve and so forth. That is, it takes ${\displaystyle k\,\!}$ points to define a polynomial of degree ${\displaystyle k-1\,\!}$.

Suppose we want to use a ${\displaystyle \left(k,n\right)\,\!}$ threshold scheme to share our secret ${\displaystyle S\,\!}$, without loss of generality assumed to be an element in a finite field ${\displaystyle F}$ of size ${\displaystyle P}$ where ${\displaystyle 0 and ${\displaystyle P}$ is a prime number.

Choose at random ${\displaystyle k-1\,\!}$ positive integers ${\displaystyle a_{1},\cdots ,a_{k-1}\,\!}$ with ${\displaystyle a_{i}, and let ${\displaystyle a_{0}=S\,\!}$. Build the polynomial ${\displaystyle f\left(x\right)=a_{0}+a_{1}x+a_{2}x^{2}+a_{3}x^{3}+\cdots +a_{k-1}x^{k-1}\,\!}$. Let us construct any ${\displaystyle n\,\!}$ points out of it, for instance set ${\displaystyle i=1,\ldots ,n\,\!}$ to retrieve ${\displaystyle \left(i,f\left(i\right)\right)\,\!}$. Every participant is given a point (a non-zero integer input to the polynomial, and the corresponding integer output) along with the prime which defines the finite field to use. Given any subset of ${\displaystyle k\,\!}$ of these pairs, we can find the coefficients of the polynomial using interpolation. The secret is the constant term ${\displaystyle a_{0}\,\!}$.

## Usage

### Example

The following example illustrates the basic idea. Note, however, that calculations in the example are done using integer arithmetic rather than using finite field arithmetic. Therefore the example below does not provide perfect secrecy and is not a true example of Shamir's scheme. So we'll explain this problem and show the right way to implement it (using finite field arithmetic).

#### Preparation

Suppose that our secret is 1234 ${\displaystyle (S=1234)\,\!}$.

We wish to divide the secret into 6 parts ${\displaystyle (n=6)\,\!}$, where any subset of 3 parts ${\displaystyle (k=3)\,\!}$ is sufficient to reconstruct the secret. At random we obtain two (${\displaystyle k-1}$) numbers: 166 and 94.

${\displaystyle (a_{0}=1234;a_{1}=166;a_{2}=94)\,\!}$

Our polynomial to produce secret shares (points) is therefore:

${\displaystyle f\left(x\right)=1234+166x+94x^{2}\,\!}$

We construct 6 points ${\displaystyle D_{x-1}=(x,f(x))}$ from the polynomial:

${\displaystyle D_{0}=\left(1,1494\right);D_{1}=\left(2,1942\right);D_{2}=\left(3,2578\right);D_{3}=\left(4,3402\right);D_{4}=\left(5,4414\right);D_{5}=\left(6,5614\right)\,\!}$

We give each participant a different single point (both ${\displaystyle x\,\!}$ and ${\displaystyle f\left(x\right)\,\!}$). Because we use ${\displaystyle D_{x-1}}$ instead of ${\displaystyle D_{x}}$ the points start from ${\displaystyle (1,f(1))}$ and not ${\displaystyle (0,f(0))}$. This is necessary because ${\displaystyle f(0)}$ is the secret.

#### Reconstruction

In order to reconstruct the secret any 3 points will be enough.

Let us consider ${\displaystyle \left(x_{0},y_{0}\right)=\left(2,1942\right);\left(x_{1},y_{1}\right)=\left(4,3402\right);\left(x_{2},y_{2}\right)=\left(5,4414\right)\,\!}$.

We will compute Lagrange basis polynomials:

${\displaystyle \ell _{0}={\frac {x-x_{1}}{x_{0}-x_{1}}}\cdot {\frac {x-x_{2}}{x_{0}-x_{2}}}={\frac {x-4}{2-4}}\cdot {\frac {x-5}{2-5}}={\frac {1}{6}}x^{2}-{\frac {3}{2}}x+{\frac {10}{3}}\,\!}$

${\displaystyle \ell _{1}={\frac {x-x_{0}}{x_{1}-x_{0}}}\cdot {\frac {x-x_{2}}{x_{1}-x_{2}}}={\frac {x-2}{4-2}}\cdot {\frac {x-5}{4-5}}=-{\frac {1}{2}}x^{2}+{\frac {7}{2}}x-5\,\!}$

${\displaystyle \ell _{2}={\frac {x-x_{0}}{x_{2}-x_{0}}}\cdot {\frac {x-x_{1}}{x_{2}-x_{1}}}={\frac {x-2}{5-2}}\cdot {\frac {x-4}{5-4}}={\frac {1}{3}}x^{2}-2x+{\frac {8}{3}}\,\!}$

Therefore

${\displaystyle f(x)=\sum _{j=0}^{2}y_{j}\cdot \ell _{j}(x)\,\!}$

${\displaystyle =1234+166x+94x^{2}\,\!}$

Recall that the secret is the free coefficient, which means that ${\displaystyle S=1234\,\!}$, and we are done.

#### Computationally Efficient Approach

Considering that the goal of using polynomial interpolation is to find a constant in a source polynomial ${\displaystyle S=f(0)}$ using Lagrange polynomials "as it is" is not efficient, since unused constants are calculated.

An optimized approach to use Lagrange polynomials to find ${\displaystyle L(0)}$ is defined as follows:

${\displaystyle L(0)={\sum _{j=0}^{k-1}}f(x_{j}){\prod _{\underset {m\neq j}{m=0}}^{k-1}}{\frac {x_{m}}{x_{m}-x_{j}}}}$

#### Problem

Although the simplified version of the method demonstrated above, which uses integer arithmetic rather than finite field arithmetic, works fine, there is a security problem: Eve gains a lot of information about ${\displaystyle S}$ with every ${\displaystyle D_{i}}$ that she finds.

Suppose that she finds the 2 points ${\displaystyle D_{0}=(1,1494)}$ and ${\displaystyle D_{1}=(2,1942)}$, she still doesn't have ${\displaystyle k=3}$ points so in theory she shouldn't have gained any more info about ${\displaystyle S}$. But she combines the info from the 2 points with the public info: ${\displaystyle n=6,k=3,f(x)=a_{0}+a_{1}x+\dots +a_{k-1}x^{k-1},a_{0}=S,a_{i}\in \mathbb {N} }$ and she :

1. fills the ${\displaystyle f(x)}$-formula with ${\displaystyle S}$ and the value of ${\displaystyle k:f(x)=S+a_{1}x+\dots +a_{3-1}x^{3-1}\Rightarrow {}f(x)=S+a_{1}x+a_{2}x^{2}}$
2. fills (i) with the values of ${\displaystyle D_{0}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1494=S+a_{1}1+a_{2}1^{2}\Rightarrow {}1494=S+a_{1}+a_{2}}$
3. fills (i) with the values of ${\displaystyle D_{1}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1942=S+a_{1}2+a_{2}2^{2}\Rightarrow {}1942=S+2a_{1}+4a_{2}}$
4. does (iii)-(ii): ${\displaystyle (1942-1494)=(S-S)+(2a_{1}-a_{1})+(4a_{2}-a_{2})\Rightarrow {}448=a_{1}+3a_{2}}$ and rewrites this as ${\displaystyle a_{1}=448-3a_{2}}$
5. knows that ${\displaystyle a_{2}\in \mathbb {N} }$ so she starts replacing ${\displaystyle a_{2}}$ in (iv) with 0, 1, 2, 3, ... to find all possible values for ${\displaystyle a_{1}}$:
• ${\displaystyle a_{2}=0\rightarrow {}a_{1}=448-3\times 0=448}$
• ${\displaystyle a_{2}=1\rightarrow {}a_{1}=448-3\times 1=445}$
• ${\displaystyle a_{2}=2\rightarrow {}a_{1}=448-3\times 2=442}$
• ${\displaystyle \dots }$
• ${\displaystyle a_{2}=148\rightarrow {}a_{1}=448-3\times 148=4}$
• ${\displaystyle a_{2}=149\rightarrow {}a_{1}=448-3\times 149=1}$
After ${\displaystyle a_{2}=149}$ she stops because she reasons that if she continues she would get negative values for ${\displaystyle a_{1}}$ (which is impossible because ${\displaystyle a_{1}\in \mathbb {N} }$), she can now conclude ${\displaystyle a_{2}\in [0,1,\dots ,148,149]}$
6. replaces ${\displaystyle a_{1}}$ by (iv) in (ii): ${\displaystyle 1494=S+(448-3a_{2})+a_{2}\Rightarrow {}S=1046+2a_{2}}$
7. replaces in (vi) ${\displaystyle a_{2}}$ by the values found in (v) so she gets ${\displaystyle S\in [1046+2\times 0,1046+2\times 1,\dots ,1046+2\times 148,1046+2\times 149]}$ which leads her to the information:

${\displaystyle S\in [1046,1048,\dots ,1342,1344]}$. She now only has 150 numbers to guess from instead of an infinite number of natural numbers.

#### Solution

This is a polynomial curve over a finite field—now the order of the polynomial has seemingly little to do with the shape of the graph.

Geometrically this attack exploits the fact that we know the order of the polynomial and so gain insight into the paths it may take between known points this reduces possible values of unknown points since it must lie on a smooth curve.

This problem can be fixed by using finite field arithmetic. A field of size ${\displaystyle p\in \mathbb {P} :p>S,p>n}$ is used. The graph shows a polynomial curve over a finite field, in contrast to the usual smooth curve it appears very disorganised and disjointed.

In practice this is only a small change, it just means that we should choose a prime ${\displaystyle p}$ that is bigger than the number of participants and every ${\displaystyle a_{i}}$ (including ${\displaystyle a_{0}=S}$) and we have to calculate the points as ${\displaystyle (x,f(x){\pmod {p}})}$ instead of ${\displaystyle (x,f(x))}$.

Since everyone who receives a point also has to know the value of ${\displaystyle p}$ so it may be considered to be publicly known. Therefore, one should select a value for ${\displaystyle p}$ that is not too low.

Low values of ${\displaystyle p}$ are risky because Eve knows ${\displaystyle p>S\Rightarrow {}S\in {[0,1,\dots ,p-2,p-1]}}$, so the lower one sets ${\displaystyle p}$, the fewer possible values Eve has to guess from to get ${\displaystyle S}$.

For this example we choose ${\displaystyle p=1613}$, so our polynomial becomes ${\displaystyle f\left(x\right)=1234+166x+94x^{2}\mod {1613}}$ which gives the points: ${\displaystyle \left(1,1494\right);\left(2,329\right);\left(3,965\right);\left(4,176\right);\left(5,1188\right);\left(6,775\right)}$

This time Eve doesn't win any info when she finds a ${\displaystyle D_{x}}$ (until she has ${\displaystyle k}$ points).

Suppose again that Eve finds ${\displaystyle D_{0}=\left(1,1494\right)}$ and ${\displaystyle D_{1}=\left(2,329\right)}$, this time the public info is: ${\displaystyle n=6,k=3,p=1613,f(x)=a_{0}+a_{1}x+\dots +a_{k-1}x^{k-1}\mod {p},a_{0}=S,a_{i}\in \mathbb {N} }$ so she:

1. fills the ${\displaystyle f(x)}$-formula with ${\displaystyle S}$ and the value of ${\displaystyle k}$ and ${\displaystyle p}$: ${\displaystyle f(x)=S+a_{1}x+\dots +a_{3-1}x^{3-1}\mod 1613\Rightarrow {}f(x)=S+a_{1}x+a_{2}x^{2}-1613m_{x}:m_{x}\in \mathbb {N} }$
2. fills (i) with the values of ${\displaystyle D_{0}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1494=S+a_{1}1+a_{2}1^{2}-1613m_{1}\Rightarrow {}1494=S+a_{1}+a_{2}-1613m_{1}}$
3. fills (i) with the values of ${\displaystyle D_{1}}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1942=S+a_{1}2+a_{2}2^{2}-1613m_{2}\Rightarrow {}1942=S+2a_{1}+4a_{2}-1613m_{2}}$
4. does (iii)-(ii): ${\displaystyle (1942-1494)=(S-S)+(2a_{1}-a_{1})+(4a_{2}-a_{2})+(1613m_{1}-1613m_{2})\Rightarrow {}448=a_{1}+3a_{2}+1613(m_{1}-m_{2})}$ and rewrites this as ${\displaystyle a_{1}=448-3a_{2}-1613(m_{1}-m_{2})}$
5. knows that ${\displaystyle a_{2}\in \mathbb {N} }$ so she starts replacing ${\displaystyle a_{2}}$ in (iv) with 0, 1, 2, 3, ... to find all possible values for ${\displaystyle a_{1}}$:
• ${\displaystyle a_{2}=0\rightarrow {}a_{1}=448-3\times 0-1613(m_{1}-m_{2})=448-1613(m_{1}-m_{2})}$
• ${\displaystyle a_{2}=1\rightarrow {}a_{1}=448-3\times 1-1613(m_{1}-m_{2})=445-1613(m_{1}-m_{2})}$
• ${\displaystyle a_{2}=2\rightarrow {}a_{1}=448-3\times 2-1613(m_{1}-m_{2})=442-1613(m_{1}-m_{2})}$
• ${\displaystyle \dots }$

This time she can't stop because ${\displaystyle (m_{1}-m_{2})}$ could be any integer (even negative if ${\displaystyle m_{2}>m_{1}}$) so there are an infinite amount of possible values for ${\displaystyle a_{1}}$. She knows that ${\displaystyle [448,445,442,...]}$ always decreases by 3 so if ${\displaystyle 1613}$ was divisible by ${\displaystyle 3}$ she could conclude ${\displaystyle a_{1}\in [1,4,7,\dots ]}$ but because it's prime she can't even conclude that and so she didn't win any information.

#### Python example

"""The following Python implementation of Shamir's Secret Sharing is
released into the Public Domain under the terms of CC0 and OWFa:
https://creativecommons.org/publicdomain/zero/1.0/
http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0

See the bottom few lines for usage. Tested on Python 2 and 3.
"""

from __future__ import division
import random
import functools

# 12th Mersenne Prime
# (for this application we want a known prime number as close as
# possible to our security level; e.g.  desired security level of 128
# bits -- too large and all the ciphertext is large; too small and
# security is compromised)
_PRIME = 2**127 - 1
# 13th Mersenne Prime is 2**521 - 1

_rint = functools.partial(random.SystemRandom().randint, 0)

def _eval_at(poly, x, prime):
'''evaluates polynomial (coefficient tuple) at x, used to generate a
shamir pool in make_random_shares below.
'''
accum = 0
for coeff in reversed(poly):
accum *= x
accum += coeff
accum %= prime
return accum

def make_random_shares(minimum, shares, prime=_PRIME):
'''
Generates a random shamir pool, returns the secret and the share
points.
'''
if minimum > shares:
raise ValueError("pool secret would be irrecoverable")
poly = [_rint(prime) for i in range(minimum)]
points = [(i, _eval_at(poly, i, prime))
for i in range(1, shares + 1)]
return poly[0], points

def _extended_gcd(a, b):
'''
division in integers modulus p means finding the inverse of the
denominator modulo p and then multiplying the numerator by this
inverse (Note: inverse of A is B such that A*B % p == 1) this can
be computed via extended Euclidean algorithm
http://en.wikipedia.org/wiki/Modular_multiplicative_inverse#Computation
'''

x = 0
last_x = 1
y = 1
last_y = 0
while b != 0:
quot = a // b
a, b = b,  a%b
x, last_x = last_x - quot * x, x
y, last_y = last_y - quot * y, y
return last_x, last_y

def _divmod(num, den, p):
'''compute num / den modulo prime p

To explain what this means, the return value will be such that
the following is true: den * _divmod(num, den, p) % p == num
'''
inv, _ = _extended_gcd(den, p)
return num * inv

def _lagrange_interpolate(x, x_s, y_s, p):
'''
Find the y-value for the given x, given n (x, y) points;
k points will define a polynomial of up to kth order
'''
k = len(x_s)
assert k == len(set(x_s)), "points must be distinct"
def PI(vals):  # upper-case PI -- product of inputs
accum = 1
for v in vals:
accum *= v
return accum
nums = []  # avoid inexact division
dens = []
for i in range(k):
others = list(x_s)
cur = others.pop(i)
nums.append(PI(x - o for o in others))
dens.append(PI(cur - o for o in others))
den = PI(dens)
num = sum([_divmod(nums[i] * den * y_s[i] % p, dens[i], p)
for i in range(k)])
return (_divmod(num, den, p) + p) % p

def recover_secret(shares, prime=_PRIME):
'''
Recover the secret from share points
(x,y points on the polynomial)
'''
if len(shares) < 2:
raise ValueError("need at least two shares")
x_s, y_s = zip(*shares)
return _lagrange_interpolate(0, x_s, y_s, prime)

secret, shares = make_random_shares(minimum=3, shares=6)

print('secret and shares:', secret, shares)

print('secret recovered from minimum subset of shares', recover_secret(shares[:3]))
print('secret recovered from a different minimum subset of shares', recover_secret(shares[-3:]))


## Properties

Some of the useful properties of Shamir's ${\displaystyle \left(k,n\right)\,\!}$ threshold scheme are:

1. Secure: Information theoretic security.
2. Minimal: The size of each piece does not exceed the size of the original data.
3. Extensible: When ${\displaystyle k\,\!}$ is kept fixed, ${\displaystyle D_{i}\,\!}$ pieces can be dynamically added or deleted without affecting the other pieces.
4. Dynamic: Security can be easily enhanced without changing the secret, but by changing the polynomial occasionally (keeping the same free term) and constructing new shares to the participants.
5. Flexible: In organizations where hierarchy is important, we can supply each participant different number of pieces according to their importance inside the organization. For instance, the president can unlock the safe alone, whereas 3 secretaries are required together to unlock it.

A known issue in Shamir's Secret Sharing scheme is the verification of correctness of the retrieved shares during the reconstruction process, which is known as verifiable secret sharing. Verifiable secret sharing aims at verifying that shareholders are honest and not submitting fake shares.