Shamir's Secret Sharing: a 3‑of‑4 QR‑color example

What does n = 4, k = 3 mean?

• n = 4: You hand out 4 total shares (one to each color).
• k = 3: Any 3 shares can reconstruct the secret.
• The secret itself is the curve’s value at x = 0 — think of a hidden point (0, S).
• Each player gets a different point (xᵢ, yᵢ) on the same curve. Alone it’s useless; together (≥ k) they can “connect the dots.”

How this maps to your QR colors

• Each QR encodes its share: a tiny pair of numbers like (x, y).
• Scan any 3 QR codes → the app recomputes the curve and reads the secret at x = 0.
• Scanning just 1 or 2 QR codes doesn’t help: there are infinitely many curves through 1–2 points.

Interactive demo (with small, friendly numbers)

Under the hood, Shamir uses arithmetic “modulo” a big prime number. For this demo we pick a small prime so the math fits on a napkin. The shares below are auto‑computed from a hidden polynomial. Try selecting any 3 players to reconstruct the secret!

Show the (optional) math details

We work in a finite field modulo prime p. We pick a secret S and a random polynomial of degree k−1 with constant term S. For k = 3 we use a quadratic:

f(x) = S + a₁·x + a₂·x² (mod p)

Each share is (xᵢ, yᵢ = f(xᵢ)). To recover the secret from any 3 shares, we use Lagrange interpolation at x=0:

S = f(0) = Σ yᵢ · Lᵢ(0) (mod p), where Lᵢ(0) = Πj≠i (0 − xⱼ) · (xᵢ − xⱼ)⁻¹ (mod p).

Don’t worry if that looks intense: the button does it for you.

Security intuition (rough terms)

• Fewer than 3 shares leak nothing: in a finite field, many different secrets remain possible with just 1–2 points.
• Flexible: you can pick any k and n you want (e.g., 2‑of‑3, 5‑of‑8, etc.).
• Practical: your four QR codes simply carry the four share pairs; a small script recombines any 3.