Shamir’s Secret Sharing (SLIP-39)

Shamir's Secret Sharing (SSS) is a cryptographic technique that splits a secret into a number of shares such that any threshold of them can rebuild it, while fewer than the threshold reveal nothing at all. A 2-of-3 split produces three shares; any two reconstruct the secret, but a single captured share is mathematically useless — not merely hard to crack, but information-free. Invented by Adi Shamir in 1979, the scheme found its natural Bitcoin application in protecting the seed phrase: SLIP-39 is the wallet-focused standard, developed at SatoshiLabs, that adapts SSS to hierarchical deterministic seeds with a human-usable word encoding.

The math, briefly

SSS rests on polynomial interpolation. To create a K-of-N scheme, the secret is encoded as one coefficient of a randomly generated polynomial of degree K−1, and each share is simply a distinct point on that curve. K points uniquely determine a degree-(K−1) polynomial — two points fix a line, three fix a parabola — so any K shares recover the secret exactly. But K−1 points leave the polynomial completely undetermined: every possible secret remains equally consistent with the shares an attacker holds. That is information-theoretic security below the threshold — immune to any amount of computing power, quantum or otherwise — a strictly stronger guarantee than the computational hardness protecting the keys themselves.

What SLIP-39 adds

SLIP-39 standardizes the application to wallet seeds. Shares are encoded as mnemonic phrases from a dedicated 1024-word list, deliberately different from the BIP-39 list, so a Shamir share can never be mistaken for — or accidentally typed as — an ordinary seed phrase; each share also carries integrity checksums, and an optional passphrase adds a further factor. Its most powerful feature is two-level grouping: you can require, say, any two of three "family" shares plus any three of five "lawyer/institution" shares, composing thresholds across trust domains. That expressiveness is what makes SLIP-39 genuinely useful for inheritance and organizational custody — no single household, office, or safe-deposit box is a point of failure, and no single defector learns anything. Supported hardware wallets can generate and restore SLIP-39 natively, which keeps the whole ceremony offline where it belongs.

The key trade-off versus multisig

SSS protects the backup, not the signing. To spend, a threshold of shares must be brought together and the full seed reconstructed on one device — briefly recreating exactly the single point of failure the scheme exists to avoid; a compromised reconstruction device at that moment captures everything. On-chain multisig never has this moment: keys live on separate devices, sign separately, and no whole-wallet secret ever exists in one place. The honest framing is that they solve different problems — SSS is a superior backup geometry (one seed, distributed resilience, nothing on-chain, no extra fees or script complexity), while multisig is a superior spending security model. Serious cold storage often uses both: multisig for structure, with each cosigner's seed individually Shamir-split for backup. For threshold schemes that sign without ever reassembling a key, see threshold ECDSA; for a simpler split-the-seed alternative with all-or-nothing semantics, compare Seed XOR.

Practical cautions

Never implement SSS by hand or with ad-hoc tools — subtle mistakes (bad randomness, verifying shares against each other, splitting the raw seed with a homemade script) have cost people funds; use audited implementations, ideally inside a hardware signer. Test full recovery before funding the wallet. Store shares in genuinely separate locations with separate risks, and document the scheme for your heirs: a threshold nobody knows how to assemble protects your coins from everyone, including your family. Like all cold-storage design, the goal is not maximum cleverness but a scheme you — and eventually someone who is not you — can execute flawlessly under stress.