Threshold Thinking for People Who Do Not Like Math
Shamir's Secret Sharing has a property that sounds like a trick when you first hear it: you can split a secret into pieces such that holding all but one of them tells you nothing at all about the secret.
Not "makes it hard to guess." Nothing.
This post explains why that is true without asking you to work through the algebra.
Start with two points
Think about a straight line on a graph. A line is fully described by two numbers, so if I give you two points on it, you can draw the line exactly. You know everything.
Now suppose I give you only one point.
How many lines pass through a single point? Infinitely many. Every possible slope produces a different line, and each one passes through your point just as well as the others. Your one point is entirely consistent with all of them.
Here is the part that matters: you have not narrowed anything down. Before I gave you the point, every line was possible. After I gave you the point, every line is still possible, in the sense that for any line you might propose, there is a version passing through your point.
Now hide a secret in the line
Say the secret is the value where the line crosses the vertical axis. Call that the secret number.
I pick a random line that crosses the axis at my secret. I hand out points on that line, one to each participant. Any two participants can combine their points, reconstruct the line, and read off the crossing value.
One participant on their own holds a single point. And a single point is consistent with every possible crossing value. Their share has told them nothing about the secret, because every candidate secret remains exactly as plausible as it was before.
That is the whole idea. Shamir's scheme uses higher-degree curves instead of lines so you can require three points, or five, or seven, but the logic does not change:
- A curve of degree K minus 1 needs K points to pin down.
- Give out N points.
- Any K of them reconstruct the secret.
- Any K minus 1 of them are consistent with every possible secret.
Why this is stronger than encryption
Encryption produces a ciphertext that does contain your data. The data is in there, transformed. It is protected by the belief that reversing the transformation costs more than an attacker can spend.
That belief is well founded and it is still a belief about cost. Costs fall. Better methods get discovered. Faster hardware arrives.
Sub-threshold shares are a different situation. There is no transformed copy of the secret sitting inside them waiting to be recovered. The information required to distinguish your secret from any other was never placed in them. There is nothing to reverse, so there is no cost to fall.
This is why the property is called information-theoretic security rather than computational security. It does not depend on the attacker's budget, because it does not depend on the attacker doing work at all.
The honest caveats
Two things this does not mean.
It does not mean a system built on secret sharing is unbreakable. If an attacker collects K shares, they reconstruct the secret. The security claim is about what happens below the threshold, so the real engineering question becomes: how hard is it to reach K? That is why it matters that the shares live with independent operators in different jurisdictions running different software, rather than in one provider's account.
It does not protect the payload by itself. Untrace applies secret sharing to the encryption key and erasure coding to the encrypted file. The key gets the information-theoretic property. The file is protected by AES-256 plus the requirement that you hold enough shards. Those are two different jobs and they need two different tools.
Why it is worth the trouble
For data with a short life, encryption alone is the right call. It is simpler and the bet is safe.
For a passport scan that identifies someone for the rest of their life, the calculus is different. You are being asked to guarantee something for forty years using a tool whose guarantee is "no one currently knows how to break this affordably."
Threshold sharing lets you make a narrower promise, and actually keep it: below K shares, there is nothing there.
Further reading: Shamir Secret Sharing (SSS) for the actual mathematics, and Post-Quantum and Harvest Now, Decrypt Later for what this means against future compute.