Secret Sharing

Unlike computational security assumptions that rely on the hardness of mathematical problems, Shamir's Secret Sharing provides unconditional, information-theoretic security. An attacker with fewer than the threshold number of shares gains zero additional information about the secret, regardless of unlimited computational power. This property makes the scheme immune to advances in quantum computing and algorithmic breakthroughs.

• Based on polynomial interpolation over finite fields
• Security holds even against adversaries with infinite compute
• No cryptographic hardness assumptions required
• Contrasts with encryption schemes vulnerable to quantum attacks

A (t, n)-threshold scheme distributes a secret into n shares such that any t or more shares can reconstruct the original secret, while any t-1 or fewer shares reveal nothing. This enables flexible security policies where availability and confidentiality are independently tuned.

• t = 3, n = 5: Any 3 of 5 executives can unlock the master key
• Reconstruction uses Lagrange polynomial interpolation
• The threshold t is chosen at share creation time
• Supports dynamic trust models without re-encrypting data

Standard secret sharing assumes shares remain static, creating a vulnerability window where an adversary can slowly accumulate shares over time. Proactive secret sharing periodically refreshes shares without changing the underlying secret, invalidating previously stolen fragments.

• Shares are refreshed at defined epochs using share renewal protocols
• Old shares become cryptographically useless after refresh
• Enables long-term secret protection in persistent threat environments
• Critical for securing root certificate authorities and blockchain validator keys

In adversarial settings, a malicious dealer could distribute inconsistent shares that prevent reconstruction or allow different subsets to recover different secrets. Verifiable Secret Sharing (VSS) attaches cryptographic commitments to each share, enabling recipients to verify their share's validity without revealing it.

• Uses Pedersen commitments or Feldman's scheme for verification
• Detects dealer misbehavior before reconstruction is attempted
• Essential for distributed key generation in threshold signature schemes
• Enables trustless participation in multi-party protocols

Secret sharing underpins threshold signature schemes where a private key is split across multiple parties. No single party ever holds the complete key, eliminating single points of compromise. A transaction requires t-of-n parties to collaboratively produce a valid signature.

• Powers distributed validator technology in Ethereum staking
• Enables threshold ECDSA for institutional cryptocurrency custody
• Used in DNSSEC root key management ceremonies
• Protects code signing keys in software supply chain security

The classic scheme encodes the secret as the constant term of a random polynomial of degree t-1 over a finite field. Each share is a distinct point (x, y) on that polynomial. Reconstruction solves for the polynomial using Lagrange interpolation with any t distinct points.

• Secret S becomes coefficient a₀ in: f(x) = a₀ + a₁x + ... + aₜ₋₁xᵗ⁻¹
• Share i is the point (i, f(i) mod p) for a large prime p
• All arithmetic performed in GF(p) — a finite field
• Efficient O(t²) reconstruction with precomputed Lagrange coefficients

A cryptographic protocol that distributes computation across multiple parties where no single party can see the others' private data. SMPC often uses secret sharing as its underlying primitive to split inputs into shares that are processed collaboratively. The key guarantee: each participant learns only the final output, never the individual inputs of other parties. This enables collaborative model training and private inference across mutually distrusting organizations without a trusted third party.

The foundational algorithm invented by Adi Shamir in 1979. It encodes a secret as the constant term of a random polynomial of degree t-1 over a finite field, then distributes points on that polynomial as shares. Any t shares can reconstruct the polynomial via Lagrange interpolation; any t-1 shares reveal absolutely nothing about the secret. This provides information-theoretic security—the guarantee holds even against adversaries with unlimited computational power.

An extension of standard secret sharing that protects against malicious dealers who might distribute inconsistent shares. VSS adds cryptographic commitments that allow participants to verify their share's validity without revealing the secret. Key properties include:

• Commitment binding: The dealer cannot change the secret after distribution
• Share consistency: All honest parties receive shares of the same secret
• Critical for Byzantine fault-tolerant systems where participants cannot trust each other

A cryptographic paradigm where private keys are split using secret sharing so that no single party ever holds the complete key. To sign a transaction or decrypt data, a threshold number of parties must collaborate. This eliminates single points of compromise in:

• Wallet security: Multi-signature and MPC wallets for digital assets
• Certificate authorities: Distributed signing for TLS certificates
• Decryption services: Threshold decryption for encrypted AI model weights Unlike simple key splitting, threshold schemes produce signatures indistinguishable from standard single-key signatures.

A security mechanism that periodically refreshes shares without changing the underlying secret. Participants generate new random polynomials that encode zero as the constant term, then add these to existing shares. This defends against mobile adversaries—attackers who slowly compromise parties over time. Even if an adversary collects shares across multiple epochs, they cannot reconstruct the secret because old shares become cryptographically useless after refresh. Essential for long-lived secrets in production AI infrastructure.

The strongest form of cryptographic security, where a scheme remains unbreakable even against adversaries with unlimited computational resources. Secret sharing achieves this because any unauthorized subset of shares has no mathematical relationship to the secret—there are equally many possible secrets consistent with the observed shares. Contrast with computational security, which relies on the assumed hardness of mathematical problems like factoring. This property makes secret sharing ideal for protecting long-term secrets that must resist future advances in quantum computing.