Splitting Secrets

December 20 2022 Home | Blog | Prev | Next ·

• Why You Might Want to Split Secrets
• Naive Secret Sharing: Chunks
• A Better Solution
  • Splitting
  • Reassembly
  • Advantages
  • Disadvantages
• Why It Works

Secret splitting is splitting a secret, such as a password, into N shares such that recovering the secret requires combining m ≤ N of those N shares. It's a technique to ensure that no single person can unilaterally access the secret without other people's consent. It's the cryptographic equivalent of requiring multiple people to simultaneously turn keys in order to launch nuclear missiles.

There are a few widely-used secret splitting techniques, such as Shamir's secret sharing, but they invariably require computers because they operate on large numbers. This page introduces techniques that you can do by hand.

1. Each share is readable. Collecting more shares reveals more information about the secret. An ideal scheme would completely hide the secret until all shares are gathered and combined.
2. You cannot use this scheme if you want to be able to reconstruct the secret with fewer than N shares. (Use Shamir's secret sharing.)
3. A malicious person could lie about his share to deceive others into giving him their shares. The malicious person could reassemble the secret, but the other shareholders would be left with nothing.

A better solution is based on one-time pad encryption.

1. Convert the secret into a sequence of decimal digits using a translation table. (See the CT-37c translation table on this website for an example. Note: The translation table doesn't have to be secret.) Let D be the number of decimal digits the translated secret has.
2. Write the translated secret's D decimal digits on a sheet of scratch paper.
3. Do the following for N-1 of the shares:
   1. Roll a 10-sided die D times and write the results. (If the die is labeled 1-10, subtract 1 from each roll.) The resulting D-digit number is a share.
   2. Write the share's D digits underneath the translated secret's D digits.
   When you're done, you should have written N-1 rows of D digits. Their digits should be aligned underneath the translated secret's D digits, forming a D×N grid.
4. Compute the final share by doing the following:
   1. For each of the D digits in the translated secret, subtract all of the share digits lined up underneath it, modulo 10.
   2. The resulting D-digit number is the final share.
5. Burn the original secret and any scratch paper you used.
6. Securely distribute the translation table and the shares to their intended recipients.

and you want to split it into 3 shares. Suppose your translation table converts this password into these decimal digits:

298512345

Write this on a piece of scratch paper. There are D=9 digits. To generate the first share (step (3) above), roll a 10-sided die 9 times and write the numbers underneath the password's digits:

   298512345
1: 877130125

To generate the second share, roll the 10-sided die 9 more times and write the numbers underneath the first share:

   298512345
1: 877130125
2: 612357962

Finally, to compute the third and last share, read the password's digits left-to-right. For each digit, subtract all of the digits underneath it, modulo 10, and write the result under the second share:

   298512345
1: 877130125
2: 612357962
------------
3: 819135368

The three shares are 877130125, 612357962, and 819135368. Distribute these to their intended recipients securely and burn the scratch paper.

1. Write the N shares on a piece of scratch paper. The order of the shares doesn't matter: The first share doesn't have to come first. Line their digits up vertically. This should form a D×N grid of digits.
2. For each column of digits, add the digits in that column, modulo 10, and write the result underneath that column.
3. The resulting row of D digits is the original secret. Convert the D digits back into readable language using the splitter's translation table. (See the CT-37c translation table on this website for an example.)

For example, suppose you acquire all three shares from the splitting example above. Write them on a sheet of paper, aligning their digits:

3: 819135368
1: 877130125
2: 612357962

In this case, the third share came first. The order doesn't matter. (Retry this example with different orders to see for yourself. Why doesn't the order matter?) Sum each column's digits modulo 10 and write the results below them:

3: 819135368
1: 877130125
2: 612357962
------------
   298512345

298512345 is the original secret. Using the same translation table as before, translate the digits into the original password:

a12345

1. Unlike the naive scheme, individual shares reveal no information other than the secret's maximum length. A malicious person cannot recover any piece of the original secret without all the shares.
2. The math is simple. A grade schooler could do it.

1. This secure scheme requires lots of random numbers.
2. Each share reveals the secret's maximum length.
3. Knowing the same part of each share reveals that part of the secret. For example, if someone recovers the first five digits of each share, he can recover the first five digits of the secret. However, whether this is a weakness or a strength is debatable: Recovery is limited to the known parts of the shares.
4. You cannot use this scheme if you want to be able to reconstruct secrets with fewer than N shares. (Use Shamir's secret sharing.)
5. A malicious person could still lie about his share to trick others into revealing theirs.