VSSS-WASM

Verifiable Shamir Secret Sharing over WASM for Node.js

Description

Porting publicly verifiable shamir secret sharing from Rust to WASM for javascript.

Features:

• ✅ Variable secret sizes - Support secrets from 1 byte to kilobytes
• ✅ Configurable shares - Choose any shares/threshold combination (2-255 shares)
• ✅ Cryptographic security - Uses XChaCha20-Poly1305 encryption
• ✅ Integrity verification - SHA-256 hash verification on reconstruction
• ✅ Share verification - Verify individual shares against verifier set
• Secret size: Any size (1+ bytes)
• Share size: 66 bytes each (1 byte length + 32 bytes identifier + 1 byte length + 32 bytes value)
• Total shares: Configurable (default: 5)
• Threshold: Configurable (default: 3)

Installation

npm install vsss-wasm

Usage

import { generatesecret, splitsecret, combinesecret } from "vsss-wasm";

// Generate a random 32-byte secret
const secret = generatesecret();

// Split secret with configurable shares and threshold
// Format: splitsecret(secret, sharesNumber, threshold)
const splitData = splitsecret(secret, 5, 3); // 5 shares, need 3 to reconstruct

// Reconstruct secret from full split data
const combinedSecret = combinesecret(splitData);

Example with custom configuration:

// 4-of-7 configuration (higher security)
const mySecret = new Uint8Array(256);
// ... fill with your data ...

const splitData = splitsecret(mySecret, 7, 4);
// Store shares on different systems

// Later, reconstruct (need at least 4 shares)
const reconstructed = combinesecret(splitData);

Performance Benchmarks

Benchmarks run on a typical modern machine (Node.js v20+, WASM). Results may vary based on hardware.

Operation Performance (3-of-5, 32-byte secret)

| Operation | Avg Time | Ops/sec | Description | |------------------|-----------|------------|----------------------------| | Generate Secret | ~14 μs | ~70,000 | Generate 32-byte secret | | Split Secret | ~237 μs | ~4,200 | Split into 5 shares | | Verify Share | ~24 μs | ~42,000 | Verify single share | | Combine Secret | ~73 μs | ~13,700 | Reconstruct from shares |

Configuration Comparison (32-byte secret)

| Configuration | Split | Verify | Combine | |--------------------|-----------|-----------|-----------| | 2-of-3 (Minimal) | 310 μs | 31 μs | 90 μs | | 3-of-5 (Standard) | 314 μs | 30 μs | 100 μs | | 4-of-7 (Higher) | 455 μs | 34 μs | 128 μs | | 5-of-10 (Maximum) | 449 μs | 42 μs | 195 μs |

Secret Size Scaling (3-of-5 configuration)

| Secret Size | Split | Verify | Combine | Throughput (Split) | Throughput (Combine) | |-------------|-----------|-----------|-----------|--------------------|----------------------| | 16 bytes | 284 μs | 29 μs | 81 μs | 4,200 ops/s | 14,300 ops/s | | 32 bytes | 356 μs | 29 μs | 83 μs | 3,600 ops/s | 13,900 ops/s | | 64 bytes | 249 μs | 27 μs | 78 μs | 4,200 ops/s | 14,400 ops/s | | 128 bytes | 249 μs | 24 μs | 75 μs | 4,300 ops/s | 14,300 ops/s | | 256 bytes | 248 μs | 57 μs | 74 μs | 4,300 ops/s | 14,100 ops/s | | 512 bytes | 263 μs | 29 μs | 83 μs | 4,200 ops/s | 13,500 ops/s | | 1024 bytes | 244 μs | 24 μs | 81 μs | 4,000 ops/s | 12,300 ops/s |

Output Size Overhead (3-of-5 configuration)

The split output includes shares, verifier data, encrypted secret, and hash.

| Secret Size | Output Size | Overhead | Ratio | |-------------|-------------|----------|--------| | 16 bytes | 555 bytes | 539 B | 34.7x | | 32 bytes | 571 bytes | 539 B | 17.8x | | 64 bytes | 603 bytes | 539 B | 9.4x | | 128 bytes | 667 bytes | 539 B | 5.2x | | 256 bytes | 795 bytes | 539 B | 3.1x | | 512 bytes | 1.03 KB | 539 B | 2.1x | | 1024 bytes | 1.53 KB | 539 B | 1.5x |

Key Insights:

• Performance is relatively constant across secret sizes (encryption is fast)
• Overhead decreases significantly with larger secrets (fixed ~539 bytes overhead)
• Higher threshold configurations have slightly higher combine times
• Share verification is extremely fast (~24-42 μs)

Running Benchmarks

cd sample
npm install
node benchmark.mjs

API

• generatesecret(): Uint8Array - Generate a random 32-byte secret
• splitsecret(secret: Uint8Array, sharesNumber: number, threshold: number): Uint8Array - Split secret with configurable shares and threshold
• verifysecret(sharebytes: Uint8Array, verifybytes: Uint8Array): boolean - Verify a share
• combinesecret(fullData: Uint8Array): Uint8Array - Reconstruct secret from full split output

Output format from splitsecret:

[header (4 bytes)][shares (N × 66 bytes)][verifier (variable)][encrypted secret (variable)][hash (32 bytes)]

Header structure:

• Byte 0: Number of shares
• Byte 1: Threshold
• Bytes 2-3: Verifier size (big-endian u16)

Important: Pass the full output of splitsecret to combinesecret for reconstruction. The function automatically parses the header to determine the data layout.

Development

Prerequisites

Install WASI and build tools:

cargo install wit-bindgen-cli
rustup target install wasm32-wasi wasm32-wasip1 wasm32-wasip2
cargo install cargo-component
npm install -g @bytecodealliance/jco
npm install -g @bytecodealliance/componentize-js
npm install -g @bytecodealliance/preview2-shim

Build WASM

# Check and test
cargo component check
cargo component test

# Build release
cargo component build --release --target wasm32-wasip1

# Transpile to JavaScript
jco transpile target/wasm32-wasip1/release/vsss_wasm.wasm -o pkg

Or use the npm script:

npm run build:release

Run Sample

cd sample
npm install
node --trace-warnings app.mjs

License

Apache-2.0

Author

Amin Razavi