Hong Life CalculatorsUnderstanding the secret sharing threshold planner — concept and principle
Shamir's secret sharing splits a secret, such as a master key or a wallet seed, into n shares so that any k of them can rebuild it while k − 1 reveal nothing. Choosing k and n is a trade-off: a high threshold resists theft, a low one tolerates lost shares. This planner calculates how likely you are to recover the secret if each share can be lost independently, and how many shares an attacker would need.
How it is calculated
If each share is lost with probability p and survives with probability 1 − p, the number of surviving shares follows a binomial distribution. The secret is recoverable when at least k survive:
P(recover) = Σ from i = k to n of C(n, i) × (1 − p)ⁱ × pⁿ⁻ⁱ
where C(n, i) is the number of ways to choose i shares out of n. The attacker must obtain k shares, because fewer than k give no information at all.
The principle
Shamir's scheme hides the secret as the constant term of a random polynomial of degree k − 1 over a finite field, and each share is one point on that curve. Two points fix a line, three fix a parabola, and in general k points fix a polynomial of degree k − 1, so any k shares rebuild it by Lagrange interpolation. With only k − 1 points, every possible secret is still equally consistent with what you hold, which is why the scheme is called information-theoretically secure. The binomial sum simply counts all combinations of surviving shares that reach the threshold.
Worked example
- Inputs: n = 5 shares, threshold k = 3, loss probability p = 0.05.
- All 5 survive: 0.95⁵ = 0.77378.
- Exactly 4 survive: 5 × 0.95⁴ × 0.05 = 0.20363.
- Exactly 3 survive: 10 × 0.95³ × 0.05² = 0.02143.
- Sum = 0.99884, so the secret is recoverable with probability 99.88%.
- An attacker must steal 3 shares.
| Probability each share is lost | Probability secret is recoverable |
|---|---|
| 0.0125 | 100% |
| 0.025 | 99.98% |
| 0.0375 | 99.95% |
| 0.05 | 99.88% |
| 0.0625 | 99.78% |
| 0.075 | 99.62% |
| 0.1 | 99.14% |
How to read the result
Compare with a single copy, which survives with only 95% here. Raising n while keeping k fixed improves recovery; raising k improves resistance to theft but lowers recovery. Many people pick schemes such as 2-of-3 or 3-of-5 so that one or two lost shares are tolerated while no single holder can act alone.
Common mistakes
- Storing several shares in the same place, so one fire or one theft defeats the independence assumption.
- Setting k = n, which means losing any single share destroys the secret.
- Splitting the secret by simply cutting it into pieces; each piece then leaks part of the secret, unlike Shamir shares.
Frequently asked questions
Is 2-of-3 or 3-of-5 better?
With the same per-share loss, 3-of-5 lets two shares be lost and needs three to be stolen; 2-of-3 is simpler but only one share can be lost and two suffice for theft.
Is Shamir the same as multisig?
No. Shamir rebuilds one secret in one place; multisig requires several independent signatures and never brings the keys together.
Sources: A. Shamir, "How to Share a Secret", Communications of the ACM 22(11), 1979 · W. Feller, An Introduction to Probability Theory and Its Applications, Vol. 1, Wiley