Talk:Shamir's secret sharing

message: Assume the secret is D=148
Let’s take p=997 (prime), a1=59 (random), a2=340(random) so that 
g(x)=148 + 59x + 340x2
We compute 5 fragments
D1 = g(1) mod 997= 547
D2 = g(2) mod 997 = 1626 mod 997 = 629
D3 = g(3) mod 997 = 3385 mod 997 = 394
D4 = g(4) mod 997 = 5824 mod 997 = 839
D5 = g(5) mod 997 = 8943 mod 997 = 967
We give to each user a fragment among
(1,547), (2,629), (3,394), (4,839), (5,967)
Assume users with fragments 1,3,4 want to reconstruct the secret
They compute q(0)
𝑞(0)=547((−3)/(1−3)  (−4)/(1−4))+394((−1)/(3−1)  (−4)/(3−4))+839(1/(4−1)  3/(4−3))
𝑞(0)=547∗2−394∗2+839=1145
𝑞(0)  𝑚𝑜𝑑 997=148
Arnaud.legout (talk) 20:05, 28 October 2010 (UTC)
thread_title:  Example using arithmetic on finite field 

message: There isn't a single computation that is correct in the reconstruction phase!
l0 = 1/6x^2 -3/2x+10/3
l1=-1/2x^2 +7/2x-5
l2=1/3x^2 -2x + 8/3
Moreover, as the goal is to compute f(0), the computation of the li can be simplified
by considering x=0.
f(0) = 1942 * 10/3 -3402*5 + 4414*8/3 = 1234
Arnaud.legout (talk) 16:56, 28 October 2010 (UTC)
thread_title:  Reconstruction phase flawed 

message: In the reconstruction phase, aren't there potential issues with approximation errors when interpolating? 128.178.252.14 (talk) 20:12, 5 September 2009 (UTC)
replies: text:  Not when you work in finite fields, as you should in a proper implementation of Shamir's method.  01:51, 30 January 2013 (UTC)
thread_title:  Practical implementation considerations 

message: Citations should be available in the paper that this page is about.  There is a link to it under "References".
Vulturejoe 23:10, 22 May 2007 (UTC)
thread_title:  Citations 

message: Are the lagrange operations correct ? I mean, 1942 - 3402 * 5 + 4414 * 4/3 doesn't goes into 1234..  —Preceding unsigned comment added by 158.109.1.15 (talk) 14:34, 20 January 2010 (UTC)
thread_title:  Lagrange Operations correct ? 

message: It seems to me that Shamir's Secret Sharing is an example of an erasure code, with additional security properties not necessarily shared by other erasure codes.  It might be useful to have cross-references back and forth, and ideally also a discussion of how Shamir's algorithm is different (or has additional properties) vs. other erasure codes. Paul Koning (talk) 18:25, 31 August 2011 (UTC)
thread_title:  Link to erasure code? 

message: David McGrew created a version of Shamir's algorithm that has some useful practical benefits: .  It might be worth minimally a reference and perhaps some description.  The main difference is that it processes the input as a sequence of bytes which are then shared over GF(256) instead of treating the input as a large integer shared over GF(prime). Paul Koning (talk) 18:31, 31 August 2011 (UTC)
replies: text: What about a section called "Variants and Alternatives" to cover this, and also variants of multisig? Dan Shearer (talk) 06:48, 27 September 2022 (UTC)
thread_title:  David McGrew's variant 

message: The code for joining the shares that is written in python is incorrect. It should use mod inverse.  — Preceding unsigned comment added by 108.46.120.106 (talk) 00:57, 10 August 2013 (UTC)
thread_title:  Incorrect python code 

message: The article defines the size of F as 0 < k \le n < P, why don't we use 0 < k \le n ?
The P is used nowhere else in the article and there is always a prime number bigger than n because it's easy to prove that there is no biggest prime number.  — Preceding unsigned comment added by 2001:6F8:14DC:2:E892:D2DB:40C:4132 (talk) 18:35, 19 January 2014 (UTC)
thread_title:  Why the <math>P</math> ? 

message: The page currently reads, "Note, however, that calculations in the example are done using integer arithmetic rather than using finite field arithmetic. Therefore the example below does not provide perfect secrecy,[clarification needed] and is not a true example of Shamir's scheme."
But isn't integer arithmetic going to produce the same results as finite field arithmetic in a sufficiently large finite field?  If so, then should there be some upper bound on P, or is the above wrong?
50.204.20.34 (talk) 17:41, 8 April 2014 (UTC)
thread_title:  "Not a finite field, therefore not SSS"? 

message: Does really have to be a_i\in\mathbb{N}? What about \mathbb{Z}?  — Preceding unsigned comment added by Fsdoiudofh (talk • contribs) 12:52, 30 August 2014 (UTC)
thread_title:  <math>a_i\in\mathbb{N}</math> ? 

message: Throughout the page, the example secret is 1234. However in the sample implementation, the secret 129 is used instead (even some of the internal comments still reference 1234). While the results appear correct for that value, it's very confusing. The example should either continue to use the secret 1234 (which, if my results are correct, generates points [(1, 209), (2, 143), (3, 8), (4, 61), (5, 45), (6, 217)] but someone smarter than me should confirm) or have the different secret clearly called out and the comments updated. I'm not confident enough in my implementation to make the change myself.  — Preceding unsigned comment added by 71.6.63.210 (talk) 21:15, 27 January 2015 (UTC)
thread_title:  Error in javascript example 

message: I tried the javascript example with different settings for "needed". Therefore I enabled the random coefficients line.
I observer a rather strange result:
* for split(129,6,2), I need 3 shares to reconstruct (which should not be the case)
* for split(129,6,3), I need 3 shares (ok)
* for split(129,6,4), I need 5 shares (wrong!)
* for split(129,6,5), I need 5 shares (ok)
* for split(129,6,6), I need 7 shares (i.e. 129,7,6 works, 129,6,6 doesn't)
I've looked at the code for half an hour, but i don't see the problem.
So it looks like this only works for odd values of "needed".
Lizziemcguire (talk) 17:45, 15 September 2017 (UTC)
thread_title:  Error 2 in javascript example 

message: As seen above, the JavaScript example had some recurring issues. Tracked this down to some issues with the floating point math. I'll be posting an example implementation with the following improvements:
* Prime is of secure length (~128 bit) - JavaScript's built-in integer math limits the current example to 1237, meaning all results of the current implementation will be brute-forceable. Justification for the prime is also provided.
* No math.floor() or possible loss of accuracy
* Shorter - fewer lines of code for increased readability
* Tested. This code is released into the public domain from a working industry implementation of Shamir. This greatly improves security in the event that someone copies and pastes the code into a production use case.
Here's to no more bugs in examples! --MahmoudHashemi (talk) 23:02, 16 December 2017 (UTC)
thread_title: Errors in JavaScript example (and new example details)

message: The page claims that setting p "too high" can result in reduced security "because Eve knows that the chance for f(x)\pmod{p}=f(x) increases with a higher p and she can use the procedure from the original problem to guess S (although now, instead of being sure of the 150 possible values, they just have a increased chance of being valid compared to the other natural numbers)". I see no evidence that this is true. The integer attack fails completely, since the parameters a_i should be drawn uniformly at random from \mathbb{Z}_p, and therefore "positive" numbers are just as likely as "negative" numbers. In fact Shamir provides a constructive proof of security in his paper, so I am convinced that this warning is spurious. 118.209.99.238 (talk) 02:17, 28 February 2015 (UTC)
thread_title:  Security with high <math>p</math> 

message: The only difference between the two secret sharing schemes is the choice of the underlying ring.  Shamir's secret sharing uses a polynomial ring with moduli of degree 1 while the other article uses the integers.  Merging the two schemes would simplify the content as well as broaden it. — Preceding unsigned comment added by Jannaston (talk • contribs) 21:15, 5 April 2016 (UTC)
thread_title:  Merge with [[Secret sharing using the Chinese remainder theorem]] 

message: " 2 points are sufficient to define a line, 3 points are sufficient to define a parabola"...
Really? If by chance it happens that the three points are colinear, then there is no parabola determined by them. I think things need some conditions.  — Preceding unsigned comment added by 78.97.133.105 (talk) 06:40, 19 April 2016 (UTC)
thread_title:  "2 points are sufficient to define a line, 3 points are sufficient to define a parabola"... 

message: With the exception of a research paper, I removed all links in the External Links section as several were dead projects, none appeared to be particularly authoritative, and most appeared to be promotional. A Google search on the topic will turn up currently relevant results. —Waldhorn (talk) 04:55, 26 December 2017 (UTC)
thread_title:  Links to external projects 

message: Within the scheme section there is a step which requires the secret S to be less than P but that incorrectly assumes that S is a real number instead of being an element of a finite field F which does not necessarily have an order defined on it. Also P is not necessarily an element of F so even if it did have an order it still doesn't allow the both to be compared. SalimShady (talk) 23:30, 19 August 2019 (UTC)
thread_title:  Ambiguous use of order in the scheme 

message: * In the explanation of solution to the problem, infinite amount of possible values for a_1 is incorrect, the number of values is still limited to the elements in the finite field. With small enough p, standard algorithms like the extended Euclidean algorithm can be used to easily obtain the required result directly.
* More emphasis on what should be private and public, and the level of security should be mentioned. The article seems to overstate the secrecy too much, given current tools available. More emphasis on this being superseded by other schemes (by decades) should be mentioned.
* Relation to Reed-Solomon codes should be emphasised, and generalisations (such as multi-party computation) should be linked. 
* More theory on properties should be explained. 
* Pseudo-code should be used instead of a particular language like Python.
ZekeTan (talk) 05:17, 26 April 2021 (UTC)
thread_title:  Suggestions 

message: The article says
Is this correct? It is my understanding that the size of the finite field is only restricted by the size of the message and the number of shares of the secret.
--Been-jamming (talk) 20:01, 12 December 2021 (UTC)
thread_title:  The size of the finite field 

message: On further thought, the python code is not just unhelpful, I think it may be excluded from Wikipedia due to being original research. I was unable to find this exact code anywhere else (which does not mean it doesn't exist, merely that I did not find it.) If correct, that suggests someone wrote it exclusively for Wikipedia. That's a good effort, but I think in this case misguided. I will have a look at who the original author was in the history, but I think this has to go.
... or perhaps not, I later found :Category:Articles_with_example_Python_(programming_language)_code . It would be helpful to get review from someone who curates Compsci.
Dan Shearer (talk) 09:30, 3 October 2022 (UTC)
thread_title:  Detailed python implementation is original research