← Hall of Foundations Exhibit 155 · k points fix a curve
The Math Behind Splitting a Secret

Points that
lock a curve

At k distinct x-coordinates, the point values determine one polynomial of degree at most k−1. Fewer nonzero-coordinate points leave its intercept undetermined. That algebra supplies the reconstruction step in Shamir secret sharing.

Interpolation geometry. Nonzero, distinct share coordinates let you reconstruct the intercept once enough points are present. Perfect secrecy additionally needs the finite-field randomness assumptions described below.
§1

Drop points, watch the curve commit

The secret is the height where the curve crosses x = 0. Add points one at a time. With too few, infinitely many curves fit — the intercept is not uniquely determined. The moment you place the k-th point, a single polynomial locks in and the intercept is revealed.

—
Each ink dot is a share. Below k shares the grey ghost curves show some of the many polynomials that still fit. At k shares the vermilion curve is the unique answer and the secret intercept appears. Drag any dot to move it.
Keyboard alternative: add a share at a chosen x by entering it here. Pick a share, focus the move button, then arrow keys move it by 0.25 per press. The result is announced.
§2

Recovering the secret with Lagrange

Lagrange interpolation reconstructs a polynomial from distinct-coordinate values. Real Shamir secret sharing uses a finite field, distinct nonzero coordinates, and independently uniform random coefficients. The real-number curves here illustrate interpolation only; they are not an information-theoretically secure sharing scheme.

secret = f(0) = Σ yᵢ · ∏ⱼ≠ᵢ (−xⱼ) / (xᵢ − xⱼ)  (mod p)
Where this touches your keys

The threshold behind shared keys

Shamir's scheme uses this interpolation identity over a finite field. With proper randomness, any k of n shares recover the secret and fewer than k leave its prior distribution unchanged. Threshold signatures such as FROST add further protocol steps and security requirements.

Applied in: Shamir's Secret Sharing — a small finite-field demonstration of reconstruction and its limits.
Related foundations: Finite Fields — the arithmetic the shares actually live in, without which the "curve" leaks information; Information & Entropy — why k−1 shares reveal nothing at all, which is an information-theoretic claim rather than a computational one; Polynomial Rings — the same objects put to a very different use. Tested logic (Lagrange interpolation over a field) in crypto-algebra.js.

Sources and scope: Shamir, How to Share a Secret (1979); RFC 9591 (FROST, 2024).