← Hall of Foundations Exhibit 155 · k points fix a curve
The Math Behind Splitting a Secret

Points that
lock a curve

Two points determine a line. Three determine a parabola. In general, k points pin down exactly one polynomial of degree k−1 — and any fewer leave it free to be anything. That rigidity is the whole trick behind sharing a secret among many people so that only a quorum can recover it.

Secrecy from geometry. Hide a secret as a curve's height at x = 0. Hand out points on the curve as "shares." Below the threshold, the curve — and the secret — could be anything. At the threshold, it snaps into place.
§1

Drop points, watch the curve commit

The secret is the height where the curve crosses x = 0. Add points one at a time. With too few, infinitely many curves fit — the secret is unknowable. The moment you place the k-th point, a single polynomial locks in and the intercept is revealed.

—
Each ink dot is a share. Below k shares the grey ghost curves show some of the many polynomials that still fit. At k shares the vermilion curve is the unique answer and the secret intercept appears. Drag any dot to move it.
Keyboard alternative: add a share at a chosen x by entering it here.
§2

Recovering the secret with Lagrange

Given k shares, Lagrange interpolation reconstructs the polynomial and evaluates it at x = 0 in one formula — no guessing. In real Shamir's Secret Sharing this all happens over a finite field, so the shares leak nothing about the secret's size, but the geometry is identical to what you see here.

secret = f(0) = Σ yᵢ · ∏ⱼ≠ᵢ (−xⱼ) / (xᵢ − xⱼ)  (mod p)
Where this touches your keys

The threshold behind shared keys

This is the exact mechanism of Shamir’s Secret Sharing, and the threshold logic under modern threshold-signature schemes such as FROST. A key is split so that any k of n parties can act together but no k−1 can — guaranteed not by policy but by the impossibility of pinning down a degree-(k−1) curve from too few points.

Applied in: Shamir's Secret Sharing — this exact mechanism, at working size, guarding DNSSEC root keys.
Related foundations: Finite Fields — the arithmetic the shares actually live in, without which the "curve" leaks information; Information & Entropy — why k−1 shares reveal nothing at all, which is an information-theoretic claim rather than a computational one; Polynomial Rings — the same objects put to a very different use. Tested logic (Lagrange interpolation over a field) in crypto-algebra.js.