How can two shares recover a secret that one share cannot reveal?

Three people can each hold a different share of a secret number so that any two can recover it, while one share alone reveals no additional information. Splitting the secret's digits would not achieve that: a holder would still learn the digits they received. Threshold secret sharing instead combines the whole secret with randomness before making the shares.

A two-of-three Shamir example uses arithmetic modulo 17. Values wrap around, so 18 and 1 represent the same field element. Write a rule y = s + ax modulo 17, where s is the secret and a is a fresh random coefficient. The three holders receive the points at x = 1, 2 and 3. Each share contains both its x coordinate and its resulting y value; the point at x = 0 would reveal the secret directly and is not distributed.

For a public teaching deal, let s = 5 and a = 3. The shares are (1,8), (2,11) and (3,14). Two distinct points determine the rule. Using the first and third shares, the change in y is 6 and the change in x is 2. Division by 2 in this field means multiplication by 9, because 2 × 9 = 18, which is 1 modulo 17. Thus a = 6 × 9 = 54, or 3 modulo 17. Subtracting 3 × 1 from 8 then recovers s = 5.

Why does one share reveal nothing additional? Suppose only (1,8) is known. Secret 5 fits with coefficient 3, but secret 0 fits with coefficient 8, and secret 16 fits with coefficient 9. In fact, each of the seventeen possible secrets has exactly one compatible coefficient. One point therefore does not select a secret; it leaves a complete family of possible rules.

This becomes perfect secrecy only when a is chosen independently and uniformly from all seventeen field values, including zero, and kept hidden. For any particular secret, every possible y value in a nonzero-x share then occurs with probability 1/17. Seeing one share does not change the observer's prior probabilities for the secret. A predictable coefficient, biased randomness or reused randomness can break that guarantee. The coefficient shown in this article is public, so this published deal protects nothing.

Two legitimate shares from the same deal remove the ambiguity, while the third makes recovery possible even if one share is unavailable. The basic construction does not itself identify the holders or detect a forged share. In larger threshold schemes, higher-degree polynomials provide the same idea with more required shares. The surprising result is not that each person holds a fragment of meaning, but that the right combination creates information no individual share supplied on its own.