Shamir Secret Sharing, Explained With Pictures

There is a claim in the seed phrase write-up that deserves more than an assertion:

Two shares don’t get you “most of the way there”. They get you nowhere.

That sounds like marketing. It is not — it is a property you can draw on paper in about a minute, and once you have seen it drawn you will not need to trust anyone about it again. So here is the drawing.

Start with two points and a line

Pick any two points on a page. Exactly one straight line passes through both of them. Not “roughly one” — one. Take away either point and infinitely many lines fit the survivor.

That asymmetry is the entire scheme. Adi Shamir published it in 1979, and the trick is to hide a secret inside a curve rather than inside a container:

1. Put the secret at one specific spot on the curve — where it crosses the axis, at x = 0.
2. Draw the rest of the curve however you like, at random.
3. Hand out other points on that curve. Those are the shares.

Nobody holds the secret. Everybody holds a point that the secret’s curve happens to pass through.

Look at the left panel. One point, and five different lines drawn through it, each hitting the axis somewhere different. There is nothing special about those five; you could draw a line through that point to any intercept you like. So a person holding one share cannot narrow the secret down at all. Not to a range, not to a likely region. Every value is still exactly as plausible as it was before they had the share.

Now the right panel. A second point fixes the slope, one line fits both, and following it back to the axis gives the secret. Two shares, done.

Three of five is the same trick, one degree up

A line is fixed by two points. A parabola takes three. Curve upward through degree and you get any threshold you want:

• 2-of-N: put the secret on a line, hand out points on it. Any two shares reconstruct the line.
• 3-of-N: put the secret on a parabola. Any three reconstruct it; two leave infinitely many parabolas fitting, one for each candidate secret.
• k-of-N: a curve of degree k−1.

The N is free. Five shares from a parabola, or fifty, and the threshold stays at three either way, because it is a property of the curve’s degree rather than of how many points you gave away. That is why 3-of-5 and 3-of-50 are equally secure against two attackers, and why generosity with shares costs you nothing in threshold terms.

The honest footnote about the picture

The drawing uses ordinary school-graph arithmetic, and real implementations do not. Points on a real graph leak information: a share sitting at an extreme height narrows what the intercept could plausibly be, and floating-point rounding would corrupt the reconstruction anyway.

So implementations work in a finite field — arithmetic on a fixed set of values that wraps around instead of running off to infinity, usually GF(256), which is to say bytes. Addition, multiplication and division all still work, the “one curve through k points” theorem still holds exactly, and there is no rounding because there are no fractions. What changes is that “extreme value” stops meaning anything: every share is a byte, uniformly distributed, and the geometry that made the picture intuitive stops leaking the hints that made it intuitive.

The picture is true about the structure. The field is what makes it true about the security.

Where SLIP39 fits, and what it is not competing with

If you have looked into split backups for a wallet you will have met SLIP39, and probably seen it framed as “SLIP39 vs BIP39”. That framing is misleading.

BIP39 is not a splitting scheme. It turns one seed into one phrase of English words. There is nothing to compare — it solves encoding, not distribution.

SLIP39 applies Shamir’s scheme and then encodes each resulting share as its own word list, so the thing you write down looks familiar. It adds grouping on top, so you can express rules like “two of the three family shares, plus the lawyer’s”.

So the real comparison is one backup versus a threshold of several, and it is a question about failure modes rather than about formats. One phrase in one place fails when that place fails, in either direction: lost, or found.

Why a threshold beats a safe

A safe is a single point of failure wearing armour. It is very good at the thing it does — resisting force — and it concentrates every other risk into one location. Whoever opens it has everything. If it burns, everything is gone.

A 3-of-5 split inverts that. There is no single object to steal, and no single place to lose. An attacker needs to find and take three separate things, and you can lose two of them to fire, flood, a house move or a forgotten hiding place and still be fine.

What it does not do is survive time. Which brings us to the part that gets skipped.

What splitting does not fix

It does not make anything durable. Five copies that all degrade are five copies of nothing. Splitting solves the single point of failure problem, not the the medium died problem. A steel plate is still better than any digital medium at surviving a house fire, and the two are complements rather than alternatives.

Recovery reassembles the whole secret in one place. For the moment reconstruction happens, on whatever device does it, the complete secret exists — and that device is now the single point of failure the scheme was built to eliminate. The protection is real in storage and absent in use. Anyone telling you a threshold scheme means the secret “never exists in one place” is describing something else.

It does not choose your locations for you. Three shares in three drawers of the same desk is a 3-of-5 split with the security of one drawer. The mathematics is only as good as the independence of the places.

A real run, and the one thing the diagram leaves out

Everything above is the scheme. Here is our own CLI actually doing it, because a drawing of a threshold and a threshold are different claims.

Five ordinary photos, one sentence hidden across them:

$ stegosafe_cli.py embed -i in -s "the mitochondria is the powerhouse of the cell" -o out
Key length: 32 bytes, Ciphertext length: 74 bytes
Key split into 5 shares
Share 1: x=1, y length=32
Total data length to embed: 107 bytes
Saved: out/stego_1.png
...
Encryption and embedding complete. Created 5 stego images

Read the second line again, because it is the part the diagram does not show. What gets split five ways is not the secret. It is the 32-byte AES key. Every image carries the whole ciphertext plus one share of the key — 74 + 32 bytes, 107 with framing. You need three images because that is how many it takes to rebuild the key, not because the message is in pieces.

That is a better design than splitting the message would be, and it is worth saying why: a share of a key is a fixed 32 bytes whatever the secret’s length, so the scheme costs the same whether you hide a twelve-word phrase or a paragraph. It also means every image is independently useless in the same way — ciphertext with no key is ciphertext.

Now delete two of the five and recover from what is left:

$ rm out/stego_2.png out/stego_4.png
$ stegosafe_cli.py recover -i out
Collected 3 shares, starting recovery
Recovered key length: 32 bytes

Recovered secret:
the mitochondria is the powerhouse of the cell

And with only two:

$ stegosafe_cli.py recover -i two
Error: At least 3 stego images are required to recover the secret
Found 2 stego images

It refuses. It does not return a partial phrase, and it does not return a wrong one — which matters more than it sounds, because a recovery tool that guesses is worse than one that stops.

The cost to the photographs, measured across the five: between 0.0067% and 0.0117% of pixels changed, and no colour channel moved by more than 1 out of 255. The percentage is higher on the smallest image for the obvious reason — the payload is a fixed number of bytes, so it occupies a larger share of a smaller picture.

Seeing it rather than believing it

The claim at the top of this page is checkable in ten minutes and does not require trusting us. Split a sentence you do not care about into five shares, delete two, recover from three. Then take a single share and try to get anything out of it at all.

The command-line tool is open source if you would rather read the implementation than the explanation. What StegoSafe adds on top of the scheme described here is where the shares live — each one inside an ordinary photograph rather than in a file that announces itself as a share — which is the subject of the seed phrase write-up, and of what actually happens when you hide a secret in a photo.