← all experiments

Any Three Will Do

Experiment № 091 · October 16, 2026

// Shamir, 1979 — split secret s, any k of n:
f(x) = s + a₁x + … + ak−1xk−1 // random a's
share i = (i, f(i)) for i = 1 … n
k shares → Lagrange → f(0) = s
k − 1 shares → every s still fits
Lagrange pieces
dealer's curve
Split a word · byte by byte in GF(256)
rebuilt —
a share you hold
a share someone else holds
curve rebuilt from k shares
curves that still fit (k − 1 or fewer)
the secret, at x = 0
dealer's curve (if shown)

tap a share to hold it · 1–8 toggle shares · N deals a new secret · H hides the panel

Experiment № 091 · The story

Any Three Will Do

Why I picked it

In November 1979 Adi Shamir, the S in RSA, published a two-page note in Communications of the ACM called "How to Share a Secret." The problem was practical: a key too important to trust to one person and too important to lose if one person goes missing. His answer fits on an index card, and it is still running. When you set up HashiCorp Vault, the default is to split its master key into five shares with a threshold of three, which is the exact setup this page opens with.

Most of this collection is about finding things: shortest paths, best matches, hidden structure. I wanted one about the opposite, a piece of mathematics whose whole job is to make sure something can't be found until enough people agree.

What I enjoy about it

It reuses a fact from school. Two points fix a line, three fix a parabola, k points fix a curve of degree k − 1. Shamir just reads it backwards. Put the secret where the curve crosses the y-axis, hand out other points on it, and the threshold is built into geometry rather than into any rule someone has to enforce.

The moment I like best is holding two shares out of three. The pink fan is every parabola through your two points, and it sweeps across the whole y-axis. Each possible secret has its own curve, and each one fits perfectly. Then you tap the third share and the fan collapses into one violet curve. Switch to Mod 31 for the airtight version: there the count is exact, with the same number of polynomials for every one of the 31 secrets, so two shares carry literally zero information. That part surprised me most. Not "very little". None.

Something you might take away

Keeping a secret doesn't have to mean hiding the answer. Here it means leaving every answer equally true until the last piece arrives. And the same trick spreads trust around: no single holder can betray the secret, and no single loss can destroy it. If you ever have to put something precious in the hands of a group, it's a good question to ask what the smallest number of people who can act is, and the largest number who can't.