@nihilium/recovery-shamir

Shamir secret sharing over GF(256). Split a secret of any length into n shares, any k of which reconstruct it; k-1 shares leave every value of the secret equally likely.

No internal dependencies — pure algorithm, testable in isolation, sitting at the top of the dependency graph alongside core.

import { split, combine, deriveCoefficients } from "@nihilium/recovery-shamir";

const shares = split(secret, { threshold: 2, shares: 3 });
const secretAgain = combine([shares[0], shares[2]]);

Notes

• Byte-wise, over the AES polynomial 0x11b. Each byte position is an independent instance of the scheme, so any-length secrets split without padding or a big-integer dependency.
• Share indices are 1..255 — they are GF(256) x-coordinates, and 0 is the secret itself.
• combine cannot detect too few shares. Interpolating k-1 points returns a value, not an error. Check the result against a commitment; @nihilium/recovery-condition-quorum is what carries one.
• Coefficients can be supplied rather than sampled, which is how a resumed sealing run reproduces byte-identical shares without writing a plaintext share to disk. See deriveCoefficients.
• Not constant-time against cache observation. mul is branchless, but the log/exp tables are memory lookups — the standard trade for table-driven GF(256). Fine for ephemeral shares; do not reuse this for long-lived key material.

Pinned by spec/vectors/shamir.json.