I tested the 'ssss' package in Linux, an implementation of Shamir's secret sharing algorithm. link

The package is easy to use, and I presume that it is cryptographically valid implementation, though I have not personally verified that. How standardised is this implementation? It appears that the package is quite old, which is probably a good sign. But I am wondering whether a version of Linux (or other OS) in ten or twenty years' time is likely to be able to recover the secret from the shares, or is it advisable to retain a copy of this specific implementation? For example/comparison, I am very confident that some md5 algorithm will still be available for a long time on any pc, and produce identical results to a current implementation.


There is no really "standard" implementation, let alone output format, for such tools. Whatever you use, you'd better keep around its source code so that it may be recompiled or at least ported on the machine you will have twenty years from now.

I note that the code uses GMP, to make computations with big integers -- which means that it uses big integers, which implies that the code does not do things the easy and simple way. This is not, in all generality, a good sign. A good and practical implementation of Shamir's Secret Sharing should:

  • Use the sharing on a byte-by-byte basis.
  • Do computations in the finite field GF(256) (values fit in one byte, there is no bias or other similar issue, porting to any other language is easy).
  • Store shares in files, instead of strings to be typed and/or pasted.
  • Not be limited to 128 characters, which is sloppy. If you do the sharing on a byte-by-byte basis, you can split files or arbitrary length.
  • Not the answer I was hoping for, of course, but helpful nonetheless! – SauceCode Mar 16 '15 at 20:31
  • "Use the sharing on a byte-by-byte basis", unless there are more than 255 shares. – user49075 Mar 16 '15 at 21:03
  • 1
    If you have more than 255 shares, then you are probably doing something weird, possibly wrong. Shamir's Secret Sharing is not something that is often used (hence the lack of standard format and utility) but when it is used, it usually is for splitting a master secret or password for backup purposes -- with a typical threshold of 2 or 3, and less than ten shares in all. Anyway, you can process bytes by pairs and work in GF(65536), allowing for up to 65535 shares. – Thomas Pornin Mar 16 '15 at 21:38
  • SSS is M-squared in complexity and large prime field math gets prohibitive as the number of shares increases and things like redistribution come into play. – Erik Aronesty Mar 13 at 19:30
  • Encoding shares as a mnemonic phrase would be a great option as it would allow easy backup / recovery by humans. Satoshi Labs seems to be working on such a standard: SLIP-0039 : Shamir's Secret-Sharing for Mnemonic Codes – Jonathan Cross Aug 21 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.