Module shamir 

Shamir secret sharing over GF(2^8).

A secret is split into share_count shares, any threshold of which recover it, and any fewer of which reveal nothing about it: each byte of the secret is the constant term of its own random polynomial of degree threshold - 1, and share i holds every polynomial’s value at x = i. Recovery is Lagrange interpolation at zero.

The field is the one AES uses, x^8 + x^4 + x^3 + x + 1, and the arithmetic is crate::gf’s: branch-free and table-free, so neither the coefficients nor the share bytes reach an address or a branch. Share indices and counts are public.

What it does not do

Shares carry no integrity. A corrupted share, or fewer than threshold shares, recover a wrong secret rather than an error, because nothing in a share says what the right answer is. Split a random key rather than data, and use that key with an AEAD over the data: the AEAD is what detects a bad recovery. The share’s index and the threshold have to travel with it, in whatever format the caller chooses; nothing here encodes them.

Verification

Against an implementation written from Shamir’s construction with its own field arithmetic (scripts/gen_shamir_vectors.py), share for share, and by recombining every subset of shares this crate’s tests enumerate.

Structs

Shamir

Shamir secret sharing over GF(2^8), for the ontology and the self-test table.

Share

A share, with its index, as split_vec returns them. Wiped on drop.

Constants

MAX_SHARES

The most shares a split can make: the nonzero elements of GF(2^8).

Functions

combine

Recover a secret from shares given as (index, bytes).

combine_vec

combine, returning the secret in a buffer wiped on drop.

split

Split secret into share_count shares, any threshold of which recover it.

split_vec

split, returning the shares.