Shamir's Secret Sharing

The following example illustrates the basic idea. Note, however, that calculations in the example are done using integer arithmetic rather than using finite field arithmetic. Therefore the example below does not provide perfect secrecy and is not a true example of Shamir's scheme. So we'll explain this problem and show the right way to implement it (using finite field arithmetic).

Suppose that our secret is 1234 ${\displaystyle (S=1234)\,\!}$.

We wish to divide the secret into 6 parts ${\displaystyle (n=6)\,\!}$, where any subset of 3 parts ${\displaystyle (k=3)\,\!}$ is sufficient to reconstruct the secret. At random we obtain ${\displaystyle k-1}$ numbers: 166 and 94.

${\displaystyle (a_{0}=1234;a_{1}=166;a_{2}=94),\,\!}$ where ${\displaystyle a_{0}}$ is secret

Our polynomial to produce secret shares (points) is therefore:

${\displaystyle f(x)=1234+166x+94x^{2}\,\!}$

We construct six points ${\displaystyle D_{x-1}=(x,f(x))}$ from the polynomial:

${\displaystyle D_{0}=(1,1494);D_{1}=(2,1942);D_{2}=(3,2578);D_{3}=(4,3402);D_{4}=(5,4414);D_{5}=(6,5614)\,\!}$

We give each participant a different single point (both ${\displaystyle x\,\!}$ and ${\displaystyle f(x)\,\!}$). Because we use ${\displaystyle D_{x+1}}$ instead of ${\displaystyle D_{x}}$ the points start from ${\displaystyle (1,f(1))}$ and not ${\displaystyle (0,f(0))}$. This is necessary because ${\displaystyle f(0)}$ is the secret.

In order to reconstruct the secret any 3 points will be enough.

Consider ${\displaystyle \left(x_{0},y_{0}\right)=\left(2,1942\right);\left(x_{1},y_{1}\right)=\left(4,3402\right);\left(x_{2},y_{2}\right)=\left(5,4414\right)\,\!}$.

We will compute Lagrange basis polynomials:

${\displaystyle \ell _{0}={\frac {x-x_{1}}{x_{0}-x_{1}}}\cdot {\frac {x-x_{2}}{x_{0}-x_{2}}}={\frac {x-4}{2-4}}\cdot {\frac {x-5}{2-5}}={\frac {1}{6}}x^{2}-{\frac {3}{2}}x+{\frac {10}{3}}\,\!}$

${\displaystyle \ell _{1}={\frac {x-x_{0}}{x_{1}-x_{0}}}\cdot {\frac {x-x_{2}}{x_{1}-x_{2}}}={\frac {x-2}{4-2}}\cdot {\frac {x-5}{4-5}}=-{\frac {1}{2}}x^{2}+{\frac {7}{2}}x-5\,\!}$

${\displaystyle \ell _{2}={\frac {x-x_{0}}{x_{2}-x_{0}}}\cdot {\frac {x-x_{1}}{x_{2}-x_{1}}}={\frac {x-2}{5-2}}\cdot {\frac {x-4}{5-4}}={\frac {1}{3}}x^{2}-2x+{\frac {8}{3}}\,\!}$

Therefore

${\displaystyle {\begin{aligned}f(x)&=\sum _{j=0}^{2}y_{j}\cdot \ell _{j}(x)\\[6pt]&=y_{0}\ell _{0}+y_{1}\ell _{1}+y_{2}\ell _{2}\\[6pt]&=1942\left({\frac {1}{6}}x^{2}-{\frac {3}{2}}x+{\frac {10}{3}}\right)+3402\left(-{\frac {1}{2}}x^{2}+{\frac {7}{2}}x-5\right)+4414\left({\frac {1}{3}}x^{2}-2x+{\frac {8}{3}}\right)\\[6pt]&=1234+166x+94x^{2}\end{aligned}}}$

Recall that the secret is the free coefficient, which means that ${\displaystyle S=1234\,\!}$, and we are done.

Considering that the goal of using polynomial interpolation is to find a constant in a source polynomial ${\displaystyle S=f(0)}$ using Lagrange polynomials "as it is" is not efficient, since unused constants are calculated.

An optimized approach to use Lagrange polynomials to find ${\displaystyle L(0)}$ is defined as follows:

${\displaystyle L(0)=\sum _{j=0}^{k-1}f(x_{j})\prod _{\begin{smallmatrix}m\,=\,0\\m\,\neq \,j\end{smallmatrix}}^{k-1}{\frac {x_{m}}{x_{m}-x_{j}}}}$

Although the simplified version of the method demonstrated above, which uses integer arithmetic rather than finite field arithmetic, works fine, there is a security problem: Eve gains a lot of information about ${\displaystyle S}$ with every ${\displaystyle D_{i}}$ that she finds.

Suppose that she finds the 2 points ${\displaystyle D_{0}=(1,1494)}$ and ${\displaystyle D_{1}=(2,1942)}$, she still doesn't have ${\displaystyle k=3}$ points so in theory she shouldn't have gained any more info about ${\displaystyle S}$. But she combines the info from the 2 points with the public info: ${\displaystyle n=6,k=3,f(x)=a_{0}+a_{1}x+\cdots +a_{k-1}x^{k-1},a_{0}=S,a_{i}\in \mathbb {N} }$ and she :

${\displaystyle S\in [1046,1048,\dots ,1342,1344].}$

She now only has 150 numbers to guess from instead of an infinite number of natural numbers.

This is a polynomial curve over a finite field—now the order of the polynomial has seemingly little to do with the shape of the graph.

Geometrically this attack exploits the fact that we know the order of the polynomial and so gain insight into the paths it may take between known points. This reduces possible values of unknown points since it must lie on a smooth curve.

This problem can be fixed by using finite field arithmetic. A field of size ${\displaystyle p\in \mathbb {P} :p>S,p>n}$ is used. The graph shows a polynomial curve over a finite field, in contrast to the usual smooth curve it appears very disorganised and disjointed.

In practice this is only a small change, it just means that we should choose a prime ${\displaystyle p}$ that is bigger than the number of participants and every ${\displaystyle a_{i}}$ (including ${\displaystyle a_{0}=S}$) and we have to calculate the points as ${\displaystyle (x,f(x){\bmod {p}})}$ instead of ${\displaystyle (x,f(x))}$.

Since everyone who receives a point also has to know the value of ${\displaystyle p}$, it may be considered to be publicly known. Therefore, one should select a value for ${\displaystyle p}$ that is not too low.

Low values of ${\displaystyle p}$ are risky because Eve knows ${\displaystyle p>S\Rightarrow S\in {[0,1,\dots ,p-2,p-1]}}$, so the lower one sets ${\displaystyle p}$, the fewer possible values Eve has to guess from to get ${\displaystyle S}$.

For this example we choose ${\displaystyle p=1613}$, so our polynomial becomes ${\displaystyle f(x)=1234+166x+94x^{2}{\bmod {1613}}}$ which gives the points: ${\displaystyle (1,1494);(2,329);(3,965);(4,176);(5,1188);(6,775)}$

This time Eve doesn't win any info when she finds a ${\displaystyle D_{x}}$ (until she has ${\displaystyle k}$ points).

Suppose again that Eve finds ${\displaystyle D_{0}=\left(1,1494\right)}$ and ${\displaystyle D_{1}=\left(2,329\right)}$, this time the public info is: ${\displaystyle n=6,k=3,p=1613,f(x)=a_{0}+a_{1}x+\dots +a_{k-1}x^{k-1}\mod {p},a_{0}=S,a_{i}\in \mathbb {N} }$ so she:

This time she can't stop because ${\displaystyle (m_{1}-m_{2})}$ could be any integer (even negative if ${\displaystyle m_{2}>m_{1}}$) so there are an infinite amount of possible values for ${\displaystyle a_{1}}$. She knows that ${\displaystyle [448,445,442,\ldots ]}$ always decreases by 3 so if ${\displaystyle 1613}$ was divisible by ${\displaystyle 3}$ she could conclude ${\displaystyle a_{1}\in [1,4,7,\ldots ]}$ but because it's prime she can't even conclude that and so she didn't win any information.