Shamir secret sharing

Shamir Secret Sharing (SSS) splits a secret into n shares so that any t of them reconstruct it, while any t−1 reveal absolutely nothing about it. The whole scheme rests on one humble fact about polynomials: t points uniquely determine a degree-(t−1) curve, and t−1 points leave it completely undetermined.

To share a secret S with threshold t, build a random polynomial f(x) = S + a1·x + a2·x^2 + ... + a_(t−1)·x^(t−1) over a finite field, hiding the secret as the constant term f(0) = S. Hand party i the point (i, f(i)). Any t of these points let you interpolate f via Lagrange interpolation and read off f(0) = S; with only t−1 points, every possible value of S remains exactly equally likely. This is information-theoretic security — it holds even against an adversary with unlimited computing power, not merely a computationally bounded one.

Uses include backing up a seed phrase across guardians (SLIP-39 standardizes Shamir backup for hardware wallets), splitting custody so no single employee can move funds, and serving as the secret-sharing layer beneath threshold signatures, DKG, and MPC. A caveat: plain SSS needs a trusted dealer to create the shares (who briefly knows S), and basic SSS is not verifiable — a malicious dealer or a lying shareholder can submit a wrong share and corrupt the reconstruction. Verifiable Secret Sharing and DKG close those two gaps.