Green-Cliff Town had exactly one money house: Confluence Hall, three generations in the trade. The town’s silver, its land deeds, the drafts entrusted by passing caravans — all locked in the cellar vault behind the courtyard. The vault door was carved from a single slab of blue stone, its keyhole deep-hidden; the key was singular, a crow-iron thing the size of a cricket, worn at the belt of each generation’s master.

Now Old Master Qin was aging, with five sons beneath him. To whom the iron key should pass was the ache that kept him awake at night.

To the eldest alone? That was the road Abundance Hall in the next valley took: the key passed to the firstborn, the firstborn drank deep one night, and someone lifted the key from his belt — by dawn the vault stood empty, and Abundance Hall never recovered. One key is one belt, waiting to be picked.

One copy per son, five keys? Worse. The third son gambled; the fifth was easily led. Let any key be lost, stolen, or moulded off a drunkard in his sleep, and the vault was done. Five keys, five belts. However hard the lock, it protects only as much as the most careless holder.

Cut the key into five shards, one per brother? No one could rob the vault alone anymore — but every opening needed all five gathered. The second son rode the western caravan routes half the year, and the year the mountain road collapsed, the western caravans lost half their men. If a man never came home, his shard stayed buried in the mountains with him — and a vault full of silver sat locked beside a sliver of iron, forever.

Three roads, all blocked; and the old master had bricked himself in with them.

That autumn a wandering scholar came through town — Master Sha. People knew only that he reckoned by drawing in sand: one stick, one smooth patch, and any account under heaven could be drawn out.

Master Sha drank three days of tea at Confluence Hall, heard the old man’s ache, and laughed. “Why must there be a key at all?”

“Never open the vault again?”

“Open it as always. But the key need not exist.” With his stick he drew an arc in the courtyard sand, like a drawn bow. “I hold one curve in my mind — no one else knows it, and you needn’t either. It rises from the hidden spring directly beneath your vault and bends up into the sky. On this curve I take five points, and carve each point’s distance and height into a jade tally. Five sons, one tally each.”

“And how does a tally open a lock?”

“Gather any three and set them on the stone table before the vault. The mechanism traces the one arc that passes through all three points, and follows it back to its origin — the hidden spring. The spring’s position is the one true key the lock has ever known. Three suffice; all five need not be present: while your second son rides the western routes, any three of the remaining four open the vault as usual.”

“And two?”

Master Sha smoothed the sand flat and set down two points. “Look — how many arcs pass through these two?”

The old master stared, and a fine sweat rose on his back. Through two points run ten thousand arcs, each rising from a different spring. Holding two tallies, the true spring hides among ten thousand false ones and gives up nothing — not a hair’s worth. What the thief holds is not half a secret. It is zero.

The old master struck the table: so be it.

The night the tallies were cut, the jade-cutter’s fire burned past the third watch: five jade tallies, each carved with two small numbers. Before leaving, Master Sha left one more instruction: “If a tally is lost, don’t panic — three gathered can cast a fresh one on the same curve for whoever needs it. Only remember: the moment three gather, the curve lies bare before those three pairs of eyes. On the day you distrust your own brothers, send for someone to draw a new curve — void every old tally, and the key silently changes its heart.”

Two years of peace. In the third winter, trouble.

In the twelfth month the third son, losing badly at the gambling house, pledged his tally to the men running the table; and someone climbed the fifth son’s wall and lifted the tally from under his pillow. The gamesters gathered their two tallies and brought a craftsman to the vault by night. They set both on the stone table and, following scraps the gamblers had overheard, guessed wildly at a third point. The mechanism traced its arc in silence — an arc existed, but its origin pointed to a dry well seven li away, to the scree on the mountain’s shaded side, to springs that had never existed. A night of guessing, a night of error; a year of guessing, a year of error. Two points cannot fix an arc, and every guessed arc runs to someone else’s spring. The vault door never moved.

In spring the brothers gathered three good tallies (the two compromised ones were voided and recast) and, by Master Sha’s old instruction, had a new curve drawn. When the five new tallies came down, the old ones were smashed before the whole family.

Confluence Hall traded on for three more generations. The town remembered one rule: the Qin vault opens for three tallies; for two, not even the immortals can open it.

By now you’ve probably recognized it: this is Shamir’s Secret Sharing.

What it is

Shamir’s Secret Sharing is a (k, n) threshold scheme published by Adi Shamir in 1979: split a secret — typically a master key — into n shares such that any k shares reconstruct the secret exactly, while fewer than k shares reveal nothing about it. Not “computationally hard to crack” — information-theoretically zero leakage.

The construction in one sentence: hide the secret at the origin of a curve. Choose a random polynomial f(x) of degree k−1 with the secret S as f(0); the i-th share is simply the point (i, f(i)), handed to one of n holders. Any k points determine a degree-(k−1) polynomial uniquely (Lagrange interpolation); evaluate at x = 0 and S falls out. With only k−1 points, infinitely many polynomials fit, each taking a different, equally likely value at the origin — the attacker’s information is exactly zero. A share is not “half a secret”: alone, a tally is just an unremarkable point on a curve.

Why it matters

1. A single key is a single point of failure (Abundance Hall emptied overnight); replicated keys are weakest-link security (five belts to pick). A threshold scheme wins on both ends: up to k−1 shares stolen, the secret is unharmed; up to n−k shares missing, the door still opens. Security and availability improve together rather than trading off.
2. It guards root secrets in real systems: HashiCorp Vault’s Shamir unseal (five unseal keys, any three revive the seal); threshold signatures and DKG for distributed blockchain validators, where a staked private key is never held whole by anyone; multi-party cold-wallet custody; DNSSEC emergency key procedures; sharded custody of cloud providers’ root keys.
3. It is the foundation of a larger puzzle: secure multi-party computation and distributed key generation both rest on secret sharing; verifiable secret sharing adds proofs that shares are mutually consistent.
4. The curve can be redrawn (proactive resharing): periodically re-deal the shares, and an attacker must steal k of them within a single window — a slow, patient theft never adds up.

Metaphor mapping

• the crow-iron key worn at the belt → the protected secret, e.g. a master key (secret)
• the curve in Master Sha’s mind → the randomly constructed degree-(k−1) polynomial f(x) (random polynomial)
• the hidden spring where the curve begins → the secret itself, f(0) (secret = f(0))
• the five jade tallies → n shares (shares, n = 5)
• distance and height carved on a tally → one point (i, f(i)) on the curve — one share
• any three tallies open the vault → the threshold k = 3 (threshold)
• three points fix exactly one arc → k points uniquely determine the degree-(k−1) polynomial (Lagrange interpolation)
• the stone table’s arc-tracing mechanism → the reconstruction algorithm run by the holders (interpolation)
• two tallies give up nothing → fewer than k shares leak zero information, information-theoretically (information-theoretic security)
• the gamblers’ guessed third point, always wrong → forged shares reconstruct a wrong secret (forged shares)
• the second son away west, any three of four suffice → tolerance of up to n−k missing shares (availability)
• three gathered recast a lost tally → re-provisioning a share for a new holder (share re-provisioning)
• drawing a new curve, smashing the old tallies → periodic resharing and secret rotation (proactive resharing / secret rotation)
• Abundance Hall’s lifted key → single point of failure (single point of failure)
• five copied keys, five belts → weakest-link key replication (weakest-link security)