Lion Cipher Lab
Implement Shamir's Secret Sharing from scratch (split a secret, prove t-1 shares leak nothing, then catch a tampered share with Feldman VSS)
- Foundations
- Advanced
- ~90 min
- Free · no account required
Why it matters
Secret sharing is how the most important keys in the world are held: no single person can unlock them, and losing a few custodians does not lose the secret. HashiCorp Vault's unseal keys, hardware-security-module master-key ceremonies, and serious crypto-wallet backups all rest on Shamir's 1979 scheme -- split a secret S into n shares so ANY t reconstruct it and ANY t-1 learn NOTHING. That last clause is the magic and the whole reason to use it over 'just encrypt it' (which only moves the problem to one key someone still has to guard) or naive splitting (hand each person a piece of the secret…
What you'll learn
- Implementing Shamir's Secret Sharing from scratch over a finite field GF(p): polynomial construction, share generation, Lagrange interpolation
- The difference between information-theoretic and computational security -- and proving t-1 shares leak literally nothing
- Why the arithmetic MUST live in a finite field: how doing it over the integers leaks the secret
- Named failure modes: integer leakage, x-coordinate/polynomial reuse, missing verifiability, side channels
- Implementing a minimal Feldman Verifiable Secret Sharing (VSS) commitment check that catches a tampered or malicious share
- The real-world pattern: Vault's Shamir unseal keys, and sharing a symmetric key (hybrid) instead of large data
Steps in this lab
- What secret sharing is, in one breath
- When you'd actually reach for this (and when you would not)
- The maths you actually need (kept minimal)
- Set up a clean workspace
- Implement the split: build the polynomial and hand out shares
- Reconstruct with Lagrange interpolation -- and prove ANY t work
- Prove the other half: t-1 shares leak NOTHING
- Failure mode (a): do the arithmetic over the INTEGERS and it leaks
- Failure mode (b): reusing x-coordinates or the polynomial across secrets
- Failure mode (c): no verifiability -- and fixing it with Feldman VSS
- Failure mode (d): not constant-time, and other side channels
- Do it better in the real world: Vault unseal keys and the hybrid pattern
- The judgment call: what to carry out of this lab