Shamir's secret sharing

Properties and weaknesses

SSS has useful properties, but also weaknesses that means that it is unsuited to some uses.

Useful properties include:

1. Secure: The scheme has information-theoretic security.
2. Minimal: The size of each piece does not exceed the size of the original data.
3. Extensible: For any given threshold, shares can be dynamically added or deleted without affecting existing shares
4. Dynamic: Security can be enhanced without changing the secret, but by changing the polynomial occasionally (keeping the same free term) and constructing a new share for each of the participants.
5. Flexible: In organizations where hierarchy is important, each participant can be issued different numbers of shares according to their importance inside the organization. For instance, with a threshold of 3, the president could unlock the safe alone if given three shares, while three secretaries with one share each must combine their shares to unlock the safe.

Weaknesses include:

1. No verifiable secret sharing: During the share reassembly process, SSS does not provide a way to verify the correctness of each share being used. Verifiable secret sharing aims to verify that shareholders are honest and not submitting fake shares.
2. Single point of failure: The secret must exist in one place when it is split into shares, and again in one place when it is reassembled. These are attack points, and other schemes including multisignature eliminate at least one of these single points of failure.

History

Adi Shamir first formulated the scheme in 1979.

Mathematical principle

The scheme exploits the Lagrange interpolation theorem, specifically that ${\displaystyle k}$ points on the polynomial uniquely determines a polynomial of degree less than or equal to ${\displaystyle k-1}$. For instance, 2 points are sufficient to define a line, 3 points are sufficient to define a parabola, 4 points to define a cubic curve and so forth.

Mathematical formulation

Shamir's secret sharing is an ideal and perfect ${\displaystyle \left(k,n\right)}$-threshold scheme based on polynomial interpolation over finite fields. In such a scheme, the aim is to divide a secret ${\displaystyle S}$ (for example, the combination to a safe) into ${\displaystyle n}$ pieces of data ${\displaystyle S_1,\dots ,S_n}$ (known as shares) in such a way that:

1. Knowledge of any ${\displaystyle k}$ or more shares ${\displaystyle S_i}$ makes ${\displaystyle S}$ computable. That is, the entire secret ${\displaystyle S}$ can be reconstructed from any combination of ${\displaystyle k}$ shares.
2. Knowledge of any ${\displaystyle k-1}$ or fewer shares ${\displaystyle S_i}$ leaves ${\displaystyle S}$ completely undetermined, in the sense that the possible values for ${\displaystyle S}$ remain as likely with knowledge of up to ${\displaystyle k-1}$ shares as with knowledge of ${\displaystyle 0}$ shares. The secret ${\displaystyle S}$ cannot be reconstructed with fewer than ${\displaystyle k}$ shares.

If ${\displaystyle n=k}$, then all of the shares are needed to reconstruct the secret ${\displaystyle S}$.

Assume that the secret ${\displaystyle S}$ can be represented as an element ${\displaystyle a_0}$ of a finite field ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ (where ${\displaystyle q}$ is greater than the number ${\displaystyle n}$ of shares being generated). Randomly choose ${\displaystyle k-1}$ elements, ${\displaystyle a_1,\cdots ,a_{k-1}}$, from ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ and construct the polynomial ${\displaystyle f\left(x\right)=a_0+a_{1}x+a_2{x}^2+a_3{x}^3+\cdots +a_{k-1}{x}^{k-1}}$. Compute any ${\displaystyle n}$ points out on the curve, for instance set ${\displaystyle i=1,\dots ,n}$ to find points ${\displaystyle \left(i,f\left(i\right)\right)}$. Every participant is given a point (a non-zero input to the polynomial, and the corresponding output). Given any subset of ${\displaystyle k}$ of these pairs, ${\displaystyle a_0}$ can be obtained using interpolation, with one possible formula for doing so being ${\displaystyle a_0=f(0)=\sum _{j=0}^{k-1}{y}_j\prod _{\begin{array}{c}m=0\\ m\ne j\end{array}}^{k-1}\frac{x_m}{x_m-x_j}}$, where the list of points on the polynomial is given as ${\displaystyle k}$ pairs of the form ${\displaystyle (x_i,y_i)}$. Note that ${\displaystyle f(0)}$ is equal to the first coefficient of polynomial ${\displaystyle f(x)}$.

More generally, any value ${\displaystyle f(\alpha )}$, where ${\displaystyle \alpha \in \mathrm{G}\mathrm{F}(q)}$, may be used as the secret instead of ${\displaystyle f(0)}$. The leading coefficient ${\displaystyle a_{k-1}}$ may similarly be interpreted as the value ${\displaystyle f(\mathrm{\infty })}$ on the projective line and can also be used as the secret. These are precisely the polynomial-derived quantities that remain perfectly hidden from every coalition of fewer than ${\displaystyle k}$ participants. In contrast, other linear combinations of the polynomial coefficients, including the intermediate coefficients, ${\displaystyle a_1,\dots ,a_{k-2}}$, may be determined by some coalitions of fewer than ${\displaystyle k}$ participants.

Example calculation

The following example illustrates the basic idea. Note, however, that calculations in the example are done using integer arithmetic rather than using finite field arithmetic to make the idea easier to understand. Therefore, the example below does not provide perfect secrecy and is not a proper example of Shamir's scheme. The next example will explain the problem.

Preparation

Suppose that the secret to be shared is 1234 ${\displaystyle (S=1234)}$.

In this example, the secret will be split into 6 shares ${\displaystyle (n=6)}$, where any subset of 3 shares ${\displaystyle (k=3)}$ is sufficient to reconstruct the secret. ${\displaystyle k-1=2}$ numbers are taken at random. Let them be 166 and 94.

This yields coefficients ${\displaystyle (a_0=1234;a_1=166;a_2=94),}$ where ${\displaystyle a_0}$ is the secret

The polynomial to produce secret shares (points) is therefore:

${\displaystyle f(x)=1234+166x+94x^2}$

Six points ${\displaystyle D_{x-1}=(x,f(x))}$ from the polynomial are constructed as:

${\displaystyle D_0=(1,1494);D_1=(2,1942);D_2=(3,2578);D_3=(4,3402);D_4=(5,4414);D_5=(6,5614)}$

Each participant in the scheme receives a different point (a pair of ${\displaystyle x}$ and ${\displaystyle f(x)}$). Because ${\displaystyle D_{x-1}}$ is used instead of ${\displaystyle D_x}$ the points start from ${\displaystyle (1,f(1))}$ and not ${\displaystyle (0,f(0))}$. This is necessary because ${\displaystyle f(0)}$ is the secret.

Reconstruction

In order to reconstruct the secret, any 3 points are sufficient

Consider using the 3 points${\displaystyle \left(x_0,y_0\right)=\left(2,1942\right);\left(x_1,y_1\right)=\left(4,3402\right);\left(x_2,y_2\right)=\left(5,4414\right)}$.

Computing the Lagrange basis polynomials:

${\displaystyle {\ell }_0(x)=\frac{x-x_1}{x_0-x_1}\cdot \frac{x-x_2}{x_0-x_2}=\frac{x-4}{2-4}\cdot \frac{x-5}{2-5}=\frac{1}{6}{x}^2-\frac{3}{2}x+\frac{10}{3}}$

${\displaystyle {\ell }_1(x)=\frac{x-x_0}{x_1-x_0}\cdot \frac{x-x_2}{x_1-x_2}=\frac{x-2}{4-2}\cdot \frac{x-5}{4-5}=-\frac{1}{2}{x}^2+\frac{7}{2}x-5}$

${\displaystyle {\ell }_2(x)=\frac{x-x_0}{x_2-x_0}\cdot \frac{x-x_1}{x_2-x_1}=\frac{x-2}{5-2}\cdot \frac{x-4}{5-4}=\frac{1}{3}{x}^2-2x+\frac{8}{3}}$

Using the formula for polynomial interpolation, ${\displaystyle f(x)}$ is:

${\displaystyle \begin{array}{cc}f(x)& =\sum _{j=0}^2{y}_j\cdot {\ell }_j(x)\\ & =y_0{\ell }_0(x)+y_1{\ell }_1(x)+y_2{\ell }_2(x)\\ & =1942\left(\frac{1}{6}{x}^2-\frac{3}{2}x+\frac{10}{3}\right)+3402\left(-\frac{1}{2}{x}^2+\frac{7}{2}x-5\right)+4414\left(\frac{1}{3}{x}^2-2x+\frac{8}{3}\right)\\ & =1234+166x+94x^2\end{array}}$

Recalling that the secret is the free coefficient, which means that ${\displaystyle S=1234}$, and the secret has been recovered.

Computationally efficient approach

Using polynomial interpolation to find a coefficient in a source polynomial ${\displaystyle S=f(0)}$ using Lagrange polynomials is not efficient, since unused constants are calculated.

Considering this, an optimized formula to use Lagrange polynomials to find ${\displaystyle f(0)}$ is defined as follows:

${\displaystyle f(0)=\sum _{j=0}^{k-1}{y}_j\prod _{\begin{array}{c}m=0\\ m\ne j\end{array}}^{k-1}\frac{x_m}{x_m-x_j}}$

Problem of using integer arithmetic

Although the simplified version of the method demonstrated above, which uses integer arithmetic rather than finite field arithmetic, works, there is a security problem: Eve gains information about ${\displaystyle S}$ with every ${\displaystyle D_i}$ that she finds.

Suppose that she finds the point ${\displaystyle D=(2,1942)}$. She still does not have ${\displaystyle k=3}$ points, so in theory she should not have gained any more information about ${\displaystyle S}$. But she could combine the information from the point with the public information: ${\displaystyle n=6,k=3,f(x)=a_0+a_{1}x+\cdots +a_{k-1}{x}^{k-1},a_0=S,a_i\in \mathbb{Z}}$. Doing so, Eve could perform the following algebra:

1. Fill the formula for ${\displaystyle f(x)}$ with ${\displaystyle S}$ and the value of ${\displaystyle k:f(x)=S+a_{1}x+\cdots +a_{k-1}{x}^{k-1}\Rightarrow f(x)=S+a_{1}x+a_2{x}^2}$
2. Fill (1) with the values of ${\displaystyle D}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1942=S+a_{1}2+a_2{2}^2\Rightarrow S=1942-2a_1-4a_2}$

which leads her to the information that S is even.

Solution using finite field arithmetic

The above attack exploits constraints on the values that the polynomial may take by virtue of how it was constructed: the polynomial must have coefficients that are integers, and the polynomial must take an integer as value when evaluated at each of the coordinates used in the scheme. This reduces its possible values at unknown points, including the resultant secret, given fewer than ${\displaystyle k}$ shares.

This problem can be remedied by using finite field arithmetic. A finite field always has size ${\displaystyle q=p^r}$, where ${\displaystyle p}$ is a prime and ${\displaystyle r}$ is a positive integer. The size ${\displaystyle q}$ of the field must satisfy ${\displaystyle q>n}$, and that ${\displaystyle q}$ is greater than the number of possible values for the secret, though the latter condition may be circumvented by splitting the secret into smaller secret values, and applying the scheme to each of these. In our example below, we use a prime field (i.e. r = 1). The figure shows a polynomial curve over a finite field.

In practice this is only a small change. The order q of the field (i.e. the number of values that it has) must be chosen to be greater than the number of participants and the number of values that the secret ${\displaystyle a_0=S}$ may take. All calculations involving the polynomial must also be calculated over the field (mod p in our example, in which ${\displaystyle p=q}$ is taken to be a prime) instead of over the integers. Both the choice of the field and the mapping of the secret to a value in this field are considered to be publicly known.

For this example, choose ${\displaystyle p=1613}$, so the polynomial becomes ${\displaystyle f(x)=1234+166x+94x^{2}mod1613}$ which gives the points: ${\displaystyle (1,1494);(2,329);(3,965);(4,176);(5,1188);(6,775)}$

This time Eve doesn't gain any information when she finds a ${\displaystyle D_x}$ (until she has ${\displaystyle k}$ points).

Suppose again that Eve finds ${\displaystyle D_0=\left(1,1494\right)}$ and ${\displaystyle D_1=\left(2,329\right)}$, and the public information is: ${\displaystyle n=6,k=3,p=1613,f(x)=a_0+a_{1}x+\cdots +a_{k-1}{x}^{k-1}\mathrm{mod}p,a_0=S,a_i\in \mathbb{N}}$. Attempting the previous attack, Eve can:

1. Fill the ${\displaystyle f(x)}$-formula with ${\displaystyle S}$ and the value of ${\displaystyle k}$ and ${\displaystyle p}$: ${\displaystyle f(x)=S+a_{1}x+\cdots +a_{3-1}{x}^{3-1}\mathrm{mod}1613}$
2. Fill (1) with the values of ${\displaystyle D_0}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1494\equiv S+a_{1}1+a_2{1}^2(\mathrm{mod}1613)\Rightarrow 1494\equiv S+a_1+a_2(\mathrm{mod}1613)}$
3. Fill (1) with the values of ${\displaystyle D_1}$'s ${\displaystyle x}$ and ${\displaystyle f(x):1942\equiv S+a_{1}2+a_2{2}^2(\mathrm{mod}1613)\Rightarrow 1942\equiv S+2a_1+4a_2(\mathrm{mod}1613)}$
4. Subtract (3)-(2): ${\displaystyle (1942-1494)\equiv (S-S)+(2a_1-a_1)+(4a_2-a_2)(\mathrm{mod}1613)\Rightarrow 448\equiv a_1+3a_2(\mathrm{mod}1613)}$ and rewrite this as ${\displaystyle a_1\equiv 448-3a_2(\mathrm{mod}1613)}$

There are ${\displaystyle p}$ possible values for ${\displaystyle a_1}$. She knows that ${\displaystyle [448,445,442,\dots ]}$ always decreases by 3, so if ${\displaystyle p}$ were divisible by ${\displaystyle 3}$ she could conclude ${\displaystyle a_1\in [1,4,7,\dots ]}$. However, ${\displaystyle p}$ is prime, so she can not conclude this. Thus, using a finite field avoids this possible attack.

Also, even though Eve can conclude that ${\displaystyle S\equiv 1046+2a_2(\mathrm{mod}1613)}$, it does not provide any additional information, since the "wrapping around" behavior of modular arithmetic prevents the leakage of "S is even", unlike the example with integer arithmetic above.

Python code

For purposes of keeping the code clearer, a prime field is used here. In practice, for convenience a scheme constructed using a smaller binary field may be separately applied to small substrings of bits of the secret (e.g. GF(256) for byte-wise application, where GF is Galois Field), without loss of security. The strict condition that the size of the field must be larger than the number of shares must still be respected (e.g., if the number of shares could exceed 255, the field GF(256) might be replaced by say GF(65536)).

<span id="mwAUc"></span><span class="sd" id="mwAUg">"""</span> <span class="sd" id="mwAUk">The following Python implementation of Shamir's secret sharing is</span> <span class="sd" id="mwAUo">released into the Public Domain under the terms of CC0 and OWFa:</span> <span class="sd" id="mwAUs">https://creativecommons.org/publicdomain/zero/1.0/</span> <span class="sd" id="mwAUw">http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0</span> <span class="sd" id="mwAU0">See the bottom few lines for usage. Tested on Python 2 and 3.</span> <span class="sd" id="mwAU4">"""</span> <span class="kn" id="mwAU8">from</span><span class="w" id="mwAVA"> </span><span class="nn" id="mwAVE">__future__</span><span class="w" id="mwAVI"> </span><span class="kn" id="mwAVM">import</span> <span class="n" id="mwAVQ">division</span> <span class="kn" id="mwAVU">from</span><span class="w" id="mwAVY"> </span><span class="nn" id="mwAVc">__future__</span><span class="w" id="mwAVg"> </span><span class="kn" id="mwAVk">import</span> <span class="n" id="mwAVo">print_function</span> <span class="kn" id="mwAVs">import</span><span class="w" id="mwAVw"> </span><span class="nn" id="mwAV0">random</span> <span class="kn" id="mwAV4">import</span><span class="w" id="mwAV8"> </span><span class="nn" id="mwAWA">functools</span> <span class="c1" id="mwAWE"># 12th Mersenne Prime</span> <span class="n" id="mwAWI">_PRIME</span> <span class="o" id="mwAWM">=</span> <span class="mi" id="mwAWQ">2</span> <span class="o" id="mwAWU">**</span> <span class="mi" id="mwAWY">127</span> <span class="o" id="mwAWc">-</span> <span class="mi" id="mwAWg">1</span> <span class="n" id="mwAWk">_RINT</span> <span class="o" id="mwAWo">=</span> <span class="n" id="mwAWs">functools</span><span class="o" id="mwAWw">.</span><span class="n" id="mwAW0">partial</span><span class="p" id="mwAW4">(</span><span class="n" id="mwAW8">random</span><span class="o" id="mwAXA">.</span><span class="n" id="mwAXE">SystemRandom</span><span class="p" id="mwAXI">()</span><span class="o" id="mwAXM">.</span><span class="n" id="mwAXQ">randint</span><span class="p" id="mwAXU">,</span> <span class="mi" id="mwAXY">0</span><span class="p" id="mwAXc">)</span> <span class="k" id="mwAXg">def</span><span class="w" id="mwAXk"> </span><span class="nf" id="mwAXo">_eval_at</span><span class="p" id="mwAXs">(</span><span class="n" id="mwAXw">poly</span><span class="p" id="mwAX0">,</span> <span class="n" id="mwAX4">x</span><span class="p" id="mwAX8">,</span> <span class="n" id="mwAYA">prime</span><span class="p" id="mwAYE">):</span> <span class="w" id="mwAYI"> </span><span class="sd" id="mwAYM">"""Evaluates polynomial (coefficient tuple) at x, used to generate a</span> <span class="sd" id="mwAYQ"> shamir pool in make_random_shares below.</span> <span class="sd" id="mwAYU"> """</span> <span class="n" id="mwAYY">accum</span> <span class="o" id="mwAYc">=</span> <span class="mi" id="mwAYg">0</span> <span class="k" id="mwAYk">for</span> <span class="n" id="mwAYo">coeff</span> <span class="ow" id="mwAYs">in</span> <span class="nb" id="mwAYw">reversed</span><span class="p" id="mwAY0">(</span><span class="n" id="mwAY4">poly</span><span class="p" id="mwAY8">):</span> <span class="n" id="mwAZA">accum</span> <span class="o" id="mwAZE">*=</span> <span class="n" id="mwAZI">x</span> <span class="n" id="mwAZM">accum</span> <span class="o" id="mwAZQ">+=</span> <span class="n" id="mwAZU">coeff</span> <span class="n" id="mwAZY">accum</span> <span class="o" id="mwAZc">%=</span> <span class="n" id="mwAZg">prime</span> <span class="k" id="mwAZk">return</span> <span class="n" id="mwAZo">accum</span> <span class="k" id="mwAZs">def</span><span class="w" id="mwAZw"> </span><span class="nf" id="mwAZ0">make_random_shares</span><span class="p" id="mwAZ4">(</span><span class="n" id="mwAZ8">secret</span><span class="p" id="mwAaA">,</span> <span class="n" id="mwAaE">minimum</span><span class="p" id="mwAaI">,</span> <span class="n" id="mwAaM">shares</span><span class="p" id="mwAaQ">,</span> <span class="n" id="mwAaU">prime</span><span class="o" id="mwAaY">=</span><span class="n" id="mwAac">_PRIME</span><span class="p" id="mwAag">):</span> <span class="w" id="mwAak"> </span><span class="sd" id="mwAao">"""</span> <span class="sd" id="mwAas"> Generates a random shamir pool for a given secret, returns share points.</span> <span class="sd" id="mwAaw"> """</span> <span class="k" id="mwAa0">if</span> <span class="n" id="mwAa4">minimum</span> <span class="o" id="mwAa8">></span> <span class="n" id="mwAbA">shares</span><span class="p" id="mwAbE">:</span> <span class="k" id="mwAbI">raise</span> <span class="ne" id="mwAbM">ValueError</span><span class="p" id="mwAbQ">(</span><span class="s2" id="mwAbU">"Pool secret would be irrecoverable."</span><span class="p" id="mwAbY">)</span> <span class="n" id="mwAbc">poly</span> <span class="o" id="mwAbg">=</span> <span class="p" id="mwAbk">[</span><span class="n" id="mwAbo">secret</span><span class="p" id="mwAbs">]</span> <span class="o" id="mwAbw">+</span> <span class="p" id="mwAb0">[</span><span class="n" id="mwAb4">_RINT</span><span class="p" id="mwAb8">(</span><span class="n" id="mwAcA">prime</span> <span class="o" id="mwAcE">-</span> <span class="mi" id="mwAcI">1</span><span class="p" id="mwAcM">)</span> <span class="k" id="mwAcQ">for</span> <span class="n" id="mwAcU">i</span> <span class="ow" id="mwAcY">in</span> <span class="nb" id="mwAcc">range</span><span class="p" id="mwAcg">(</span><span class="n" id="mwAck">minimum</span> <span class="o" id="mwAco">-</span> <span class="mi" id="mwAcs">1</span><span class="p" id="mwAcw">)]</span> <span class="n" id="mwAc0">points</span> <span class="o" id="mwAc4">=</span> <span class="p" id="mwAc8">[(</span><span class="n" id="mwAdA">i</span><span class="p" id="mwAdE">,</span> <span class="n" id="mwAdI">_eval_at</span><span class="p" id="mwAdM">(</span><span class="n" id="mwAdQ">poly</span><span class="p" id="mwAdU">,</span> <span class="n" id="mwAdY">i</span><span class="p" id="mwAdc">,</span> <span class="n" id="mwAdg">prime</span><span class="p" id="mwAdk">))</span> <span class="k" id="mwAdo">for</span> <span class="n" id="mwAds">i</span> <span class="ow" id="mwAdw">in</span> <span class="nb" id="mwAd0">range</span><span class="p" id="mwAd4">(</span><span class="mi" id="mwAd8">1</span><span class="p" id="mwAeA">,</span> <span class="n" id="mwAeE">shares</span> <span class="o" id="mwAeI">+</span> <span class="mi" id="mwAeM">1</span><span class="p" id="mwAeQ">)]</span> <span class="k" id="mwAeU">return</span> <span class="n" id="mwAeY">points</span> <span class="k" id="mwAec">def</span><span class="w" id="mwAeg"> </span><span class="nf" id="mwAek">_extended_gcd</span><span class="p" id="mwAeo">(</span><span class="n" id="mwAes">a</span><span class="p" id="mwAew">,</span> <span class="n" id="mwAe0">b</span><span class="p" id="mwAe4">):</span> <span class="w" id="mwAe8"> </span><span class="sd" id="mwAfA">"""</span> <span class="sd" id="mwAfE"> Division in integers modulus p means finding the inverse of the</span> <span class="sd" id="mwAfI"> denominator modulo p and then multiplying the numerator by this</span> <span class="sd" id="mwAfM"> inverse (Note: inverse of A is B such that A*B % p == 1). This can</span> <span class="sd" id="mwAfQ"> be computed via the extended Euclidean algorithm</span> <span class="sd" id="mwAfU"> http://en.wikipedia.org/wiki/Modular_multiplicative_inverse#Computation</span> <span class="sd" id="mwAfY"> """</span> <span class="n" id="mwAfc">x</span> <span class="o" id="mwAfg">=</span> <span class="mi" id="mwAfk">0</span> <span class="n" id="mwAfo">last_x</span> <span class="o" id="mwAfs">=</span> <span class="mi" id="mwAfw">1</span> <span class="n" id="mwAf0">y</span> <span class="o" id="mwAf4">=</span> <span class="mi" id="mwAf8">1</span> <span class="n" id="mwAgA">last_y</span> <span class="o" id="mwAgE">=</span> <span class="mi" id="mwAgI">0</span> <span class="k" id="mwAgM">while</span> <span class="n" id="mwAgQ">b</span> <span class="o" id="mwAgU">!=</span> <span class="mi" id="mwAgY">0</span><span class="p" id="mwAgc">:</span> <span class="n" id="mwAgg">quot</span> <span class="o" id="mwAgk">=</span> <span class="n" id="mwAgo">a</span> <span class="o" id="mwAgs">//</span> <span class="n" id="mwAgw">b</span> <span class="n" id="mwAg0">a</span><span class="p" id="mwAg4">,</span> <span class="n" id="mwAg8">b</span> <span class="o" id="mwAhA">=</span> <span class="n" id="mwAhE">b</span><span class="p" id="mwAhI">,</span> <span class="n" id="mwAhM">a</span> <span class="o" id="mwAhQ">%</span> <span class="n" id="mwAhU">b</span> <span class="n" id="mwAhY">x</span><span class="p" id="mwAhc">,</span> <span class="n" id="mwAhg">last_x</span> <span class="o" id="mwAhk">=</span> <span class="n" id="mwAho">last_x</span> <span class="o" id="mwAhs">-</span> <span class="n" id="mwAhw">quot</span> <span class="o" id="mwAh0">*</span> <span class="n" id="mwAh4">x</span><span class="p" id="mwAh8">,</span> <span class="n" id="mwAiA">x</span> <span class="n" id="mwAiE">y</span><span class="p" id="mwAiI">,</span> <span class="n" id="mwAiM">last_y</span> <span class="o" id="mwAiQ">=</span> <span class="n" id="mwAiU">last_y</span> <span class="o" id="mwAiY">-</span> <span class="n" id="mwAic">quot</span> <span class="o" id="mwAig">*</span> <span class="n" id="mwAik">y</span><span class="p" id="mwAio">,</span> <span class="n" id="mwAis">y</span> <span class="k" id="mwAiw">return</span> <span class="n" id="mwAi0">last_x</span><span class="p" id="mwAi4">,</span> <span class="n" id="mwAi8">last_y</span> <span class="k" id="mwAjA">def</span><span class="w" id="mwAjE"> </span><span class="nf" id="mwAjI">_divmod</span><span class="p" id="mwAjM">(</span><span class="n" id="mwAjQ">num</span><span class="p" id="mwAjU">,</span> <span class="n" id="mwAjY">den</span><span class="p" id="mwAjc">,</span> <span class="n" id="mwAjg">p</span><span class="p" id="mwAjk">):</span> <span class="w" id="mwAjo"> </span><span class="sd" id="mwAjs">"""Compute num / den modulo prime p</span> <span class="sd" id="mwAjw"> To explain this, the result will be such that:</span> <span class="sd" id="mwAj0"> den * _divmod(num, den, p) % p == num</span> <span class="sd" id="mwAj4"> """</span> <span class="n" id="mwAj8">inv</span><span class="p" id="mwAkA">,</span> <span class="n" id="mwAkE">_</span> <span class="o" id="mwAkI">=</span> <span class="n" id="mwAkM">_extended_gcd</span><span class="p" id="mwAkQ">(</span><span class="n" id="mwAkU">den</span><span class="p" id="mwAkY">,</span> <span class="n" id="mwAkc">p</span><span class="p" id="mwAkg">)</span> <span class="k" id="mwAkk">return</span> <span class="n" id="mwAko">num</span> <span class="o" id="mwAks">*</span> <span class="n" id="mwAkw">inv</span> <span class="k" id="mwAk0">def</span><span class="w" id="mwAk4"> </span><span class="nf" id="mwAk8">_lagrange_interpolate</span><span class="p" id="mwAlA">(</span><span class="n" id="mwAlE">x</span><span class="p" id="mwAlI">,</span> <span class="n" id="mwAlM">x_s</span><span class="p" id="mwAlQ">,</span> <span class="n" id="mwAlU">y_s</span><span class="p" id="mwAlY">,</span> <span class="n" id="mwAlc">p</span><span class="p" id="mwAlg">):</span> <span class="w" id="mwAlk"> </span><span class="sd" id="mwAlo">"""</span> <span class="sd" id="mwAls"> Find the y-value for the given x, given n (x, y) points;</span> <span class="sd" id="mwAlw"> k points will define a polynomial of up to kth order.</span> <span class="sd" id="mwAl0"> """</span> <span class="n" id="mwAl4">k</span> <span class="o" id="mwAl8">=</span> <span class="nb" id="mwAmA">len</span><span class="p" id="mwAmE">(</span><span class="n" id="mwAmI">x_s</span><span class="p" id="mwAmM">)</span> <span class="k" id="mwAmQ">assert</span> <span class="n" id="mwAmU">k</span> <span class="o" id="mwAmY">==</span> <span class="nb" id="mwAmc">len</span><span class="p" id="mwAmg">(</span><span class="nb" id="mwAmk">set</span><span class="p" id="mwAmo">(</span><span class="n" id="mwAms">x_s</span><span class="p" id="mwAmw">)),</span> <span class="s2" id="mwAm0">"points must be distinct"</span> <span class="k" id="mwAm4">def</span><span class="w" id="mwAm8"> </span><span class="nf" id="mwAnA">PI</span><span class="p" id="mwAnE">(</span><span class="n" id="mwAnI">vals</span><span class="p" id="mwAnM">):</span> <span class="c1" id="mwAnQ"># upper-case PI -- product of inputs</span> <span class="n" id="mwAnU">accum</span> <span class="o" id="mwAnY">=</span> <span class="mi" id="mwAnc">1</span> <span class="k" id="mwAng">for</span> <span class="n" id="mwAnk">v</span> <span class="ow" id="mwAno">in</span> <span class="n" id="mwAns">vals</span><span class="p" id="mwAnw">:</span> <span class="n" id="mwAn0">accum</span> <span class="o" id="mwAn4">*=</span> <span class="n" id="mwAn8">v</span> <span class="k" id="mwAoA">return</span> <span class="n" id="mwAoE">accum</span> <span class="n" id="mwAoI">nums</span> <span class="o" id="mwAoM">=</span> <span class="p" id="mwAoQ">[]</span> <span class="c1" id="mwAoU"># avoid inexact division</span> <span class="n" id="mwAoY">dens</span> <span class="o" id="mwAoc">=</span> <span class="p" id="mwAog">[]</span> <span class="k" id="mwAok">for</span> <span class="n" id="mwAoo">i</span> <span class="ow" id="mwAos">in</span> <span class="nb" id="mwAow">range</span><span class="p" id="mwAo0">(</span><span class="n" id="mwAo4">k</span><span class="p" id="mwAo8">):</span> <span class="n" id="mwApA">others</span> <span class="o" id="mwApE">=</span> <span class="nb" id="mwApI">list</span><span class="p" id="mwApM">(</span><span class="n" id="mwApQ">x_s</span><span class="p" id="mwApU">)</span> <span class="n" id="mwApY">cur</span> <span class="o" id="mwApc">=</span> <span class="n" id="mwApg">others</span><span class="o" id="mwApk">.</span><span class="n" id="mwApo">pop</span><span class="p" id="mwAps">(</span><span class="n" id="mwApw">i</span><span class="p" id="mwAp0">)</span> <span class="n" id="mwAp4">nums</span><span class="o" id="mwAp8">.</span><span class="n" id="mwAqA">append</span><span class="p" id="mwAqE">(</span><span class="n" id="mwAqI">PI</span><span class="p" id="mwAqM">(</span><span class="n" id="mwAqQ">x</span> <span class="o" id="mwAqU">-</span> <span class="n" id="mwAqY">o</span> <span class="k" id="mwAqc">for</span> <span class="n" id="mwAqg">o</span> <span class="ow" id="mwAqk">in</span> <span class="n" id="mwAqo">others</span><span class="p" id="mwAqs">))</span> <span class="n" id="mwAqw">dens</span><span class="o" id="mwAq0">.</span><span class="n" id="mwAq4">append</span><span class="p" id="mwAq8">(</span><span class="n" id="mwArA">PI</span><span class="p" id="mwArE">(</span><span class="n" id="mwArI">cur</span> <span class="o" id="mwArM">-</span> <span class="n" id="mwArQ">o</span> <span class="k" id="mwArU">for</span> <span class="n" id="mwArY">o</span> <span class="ow" id="mwArc">in</span> <span class="n" id="mwArg">others</span><span class="p" id="mwArk">))</span> <span class="n" id="mwAro">den</span> <span class="o" id="mwArs">=</span> <span class="n" id="mwArw">PI</span><span class="p" id="mwAr0">(</span><span class="n" id="mwAr4">dens</span><span class="p" id="mwAr8">)</span> <span class="n" id="mwAsA">num</span> <span class="o" id="mwAsE">=</span> <span class="nb" id="mwAsI">sum</span><span class="p" id="mwAsM">([</span><span class="n" id="mwAsQ">_divmod</span><span class="p" id="mwAsU">(</span><span class="n" id="mwAsY">nums</span><span class="p" id="mwAsc">[</span><span class="n" id="mwAsg">i</span><span class="p" id="mwAsk">]</span> <span class="o" id="mwAso">*</span> <span class="n" id="mwAss">den</span> <span class="o" id="mwAsw">*</span> <span class="n" id="mwAs0">y_s</span><span class="p" id="mwAs4">[</span><span class="n" id="mwAs8">i</span><span class="p" id="mwAtA">]</span> <span class="o" id="mwAtE">%</span> <span class="n" id="mwAtI">p</span><span class="p" id="mwAtM">,</span> <span class="n" id="mwAtQ">dens</span><span class="p" id="mwAtU">[</span><span class="n" id="mwAtY">i</span><span class="p" id="mwAtc">],</span> <span class="n" id="mwAtg">p</span><span class="p" id="mwAtk">)</span> <span class="k" id="mwAto">for</span> <span class="n" id="mwAts">i</span> <span class="ow" id="mwAtw">in</span> <span class="nb" id="mwAt0">range</span><span class="p" id="mwAt4">(</span><span class="n" id="mwAt8">k</span><span class="p" id="mwAuA">)])</span> <span class="k" id="mwAuE">return</span> <span class="p" id="mwAuI">(</span><span class="n" id="mwAuM">_divmod</span><span class="p" id="mwAuQ">(</span><span class="n" id="mwAuU">num</span><span class="p" id="mwAuY">,</span> <span class="n" id="mwAuc">den</span><span class="p" id="mwAug">,</span> <span class="n" id="mwAuk">p</span><span class="p" id="mwAuo">)</span> <span class="o" id="mwAus">+</span> <span class="n" id="mwAuw">p</span><span class="p" id="mwAu0">)</span> <span class="o" id="mwAu4">%</span> <span class="n" id="mwAu8">p</span> <span class="k" id="mwAvA">def</span><span class="w" id="mwAvE"> </span><span class="nf" id="mwAvI">recover_secret</span><span class="p" id="mwAvM">(</span><span class="n" id="mwAvQ">shares</span><span class="p" id="mwAvU">,</span> <span class="n" id="mwAvY">prime</span><span class="o" id="mwAvc">=</span><span class="n" id="mwAvg">_PRIME</span><span class="p" id="mwAvk">):</span> <span class="w" id="mwAvo"> </span><span class="sd" id="mwAvs">"""</span> <span class="sd" id="mwAvw"> Recover the secret from share points</span> <span class="sd" id="mwAv0"> (points (x,y) on the polynomial).</span> <span class="sd" id="mwAv4"> """</span> <span class="k" id="mwAv8">if</span> <span class="nb" id="mwAwA">len</span><span class="p" id="mwAwE">(</span><span class="n" id="mwAwI">shares</span><span class="p" id="mwAwM">)</span> <span class="o" id="mwAwQ"><</span> <span class="mi" id="mwAwU">3</span><span class="p" id="mwAwY">:</span> <span class="k" id="mwAwc">raise</span> <span class="ne" id="mwAwg">ValueError</span><span class="p" id="mwAwk">(</span><span class="s2" id="mwAwo">"need at least three shares"</span><span class="p" id="mwAws">)</span> <span class="n" id="mwAww">x_s</span><span class="p" id="mwAw0">,</span> <span class="n" id="mwAw4">y_s</span> <span class="o" id="mwAw8">=</span> <span class="nb" id="mwAxA">zip</span><span class="p" id="mwAxE">(</span><span class="o" id="mwAxI">*</span><span class="n" id="mwAxM">shares</span><span class="p" id="mwAxQ">)</span> <span class="k" id="mwAxU">return</span> <span class="n" id="mwAxY">_lagrange_interpolate</span><span class="p" id="mwAxc">(</span><span class="mi" id="mwAxg">0</span><span class="p" id="mwAxk">,</span> <span class="n" id="mwAxo">x_s</span><span class="p" id="mwAxs">,</span> <span class="n" id="mwAxw">y_s</span><span class="p" id="mwAx0">,</span> <span class="n" id="mwAx4">prime</span><span class="p" id="mwAx8">)</span> <span class="k" id="mwAyA">def</span><span class="w" id="mwAyE"> </span><span class="nf" id="mwAyI">main</span><span class="p" id="mwAyM">():</span> <span class="w" id="mwAyQ"> </span><span class="sd" id="mwAyU">"""Main function"""</span> <span class="n" id="mwAyY">secret</span> <span class="o" id="mwAyc">=</span> <span class="mi" id="mwAyg">1234</span> <span class="n" id="mwAyk">shares</span> <span class="o" id="mwAyo">=</span> <span class="n" id="mwAys">make_random_shares</span><span class="p" id="mwAyw">(</span><span class="n" id="mwAy0">secret</span><span class="p" id="mwAy4">,</span> <span class="n" id="mwAy8">minimum</span><span class="o" id="mwAzA">=</span><span class="mi" id="mwAzE">3</span><span class="p" id="mwAzI">,</span> <span class="n" id="mwAzM">shares</span><span class="o" id="mwAzQ">=</span><span class="mi" id="mwAzU">6</span><span class="p" id="mwAzY">)</span> <span class="nb" id="mwAzc">print</span><span class="p" id="mwAzg">(</span><span class="s1" id="mwAzk">'Secret: '</span><span class="p" id="mwAzo">,</span> <span class="n" id="mwAzs">secret</span><span class="p" id="mwAzw">)</span> <span class="nb" id="mwAz0">print</span><span class="p" id="mwAz4">(</span><span class="s1" id="mwAz8">'Shares:'</span><span class="p" id="mwA0A">)</span> <span class="k" id="mwA0E">if</span> <span class="n" id="mwA0I">shares</span><span class="p" id="mwA0M">:</span> <span class="k" id="mwA0Q">for</span> <span class="n" id="mwA0U">share</span> <span class="ow" id="mwA0Y">in</span> <span class="n" id="mwA0c">shares</span><span class="p" id="mwA0g">:</span> <span class="nb" id="mwA0k">print</span><span class="p" id="mwA0o">(</span><span class="s1" id="mwA0s">' '</span><span class="p" id="mwA0w">,</span> <span class="n" id="mwA00">share</span><span class="p" id="mwA04">)</span> <span class="nb" id="mwA08">print</span><span class="p" id="mwA1A">(</span><span class="s1" id="mwA1E">'Secret recovered from minimum subset of shares: '</span><span class="p" id="mwA1I">,</span> <span class="n" id="mwA1M">recover_secret</span><span class="p" id="mwA1Q">(</span><span class="n" id="mwA1U">shares</span><span class="p" id="mwA1Y">[:</span><span class="mi" id="mwA1c">3</span><span class="p" id="mwA1g">]))</span> <span class="nb" id="mwA1k">print</span><span class="p" id="mwA1o">(</span><span class="s1" id="mwA1s">'Secret recovered from a different minimum subset of shares: '</span><span class="p" id="mwA1w">,</span> <span class="n" id="mwA10">recover_secret</span><span class="p" id="mwA14">(</span><span class="n" id="mwA18">shares</span><span class="p" id="mwA2A">[</span><span class="o" id="mwA2E">-</span><span class="mi" id="mwA2I">3</span><span class="p" id="mwA2M">:]))</span> <span class="k" id="mwA2Q">if</span> <span class="vm" id="mwA2U">__name__</span> <span class="o" id="mwA2Y">==</span> <span class="s1" id="mwA2c">'__main__'</span><span class="p" id="mwA2g">:</span> <span class="n" id="mwA2k">main</span><span class="p" id="mwA2o">()</span>