Module shamir_recovery 

Shamir Secret Sharing over GF(2⁸) — the primitive for social recovery of a key without the owner.

A secret (e.g. a payload’s data-encryption key, or a recovery key) is split into n shares such that any k of them reconstruct it and any k-1 reveal nothing (information-theoretic). The shares are handed to chosen friends/trustees; after death or incapacity, a quorum of k of them combine their shares and recover the key — the owner’s key is never needed (this is what the dead-man / incapacity switches need for true friend-side enactment, which key-release-on-enact could not do while it depended on the owner’s derived key).

This is not a cipher and not a simulation: it is the standard Shamir scheme — a degree-(k-1) polynomial per secret byte over the AES field GF(2⁸) (modulus x⁸+x⁴+x³+x+1 = 0x11b), evaluated at x = 1..=n for the shares and Lagrange-interpolated at x = 0 to recover the constant term (the secret byte). Field multiplication uses carry-less multiply with reduction; the inverse is a^254 (Fermat in GF(2⁸)). Fully deterministic and testable.

Structs

Share

A single Shamir share: the evaluation point x (1..=n, distinct, nonzero) and the per-byte evaluations.

Functions

reconstruct

Reconstruct the secret from a set of shares via Lagrange interpolation at x = 0. Requires at least the original k shares (fewer under-determines the polynomial and yields a wrong secret); all shares must have equal-length y and distinct x. Providing more than k is fine (consistent, overdetermined).

split

Split secret into n shares, any k of which reconstruct it. k in 1..=n, n in 1..=255. Each secret byte gets an independent random degree-(k-1) polynomial with that byte as the constant term.