Shamir's Secret Sharing
Shamir's Secret Sharing, formulated by Adi Shamir, is one of the first secret sharing schemes in cryptography. It is based on polynomial interpolation over finite fields.

High-level explanation

Shamir's Secret Sharing (SSS) is used to secure a secret in a distributed way, most often to secure other encryption keys. The secret is split into multiple parts, called shares. These shares are used to reconstruct the original secret.   

To unlock the secret via Shamir's secret sharing, a minimum number of shares are needed. This is called the threshold, and is used to denote the minimum number of shares needed to unlock the secret. An adversary who discovers any number of shares less than the threshold will not have any additional information about the secured secret-- this is called perfect secrecy. In this sense, SSS is a generalisation of the one-time pad (which is effectively SSS with a two-share threshold and two shares in total). 

Let us walk through an example:Problem: Company XYZ needs to secure their vault's passcode. They could use something standard, such as AES, but what if the holder of the key is unavailable or dies? What if the key is compromised via a malicious hacker or the holder of the key turns rogue, and uses their power over the vault to their benefit?This is where SSS comes in. It can be used to encrypt the vault's passcode and generate a certain number of shares, where a certain number of shares can be allocated to each executive within Company XYZ. Now, only if they pool their shares can they unlock the vault. The threshold can be appropriately set for the number of executives, so the vault is always able to be accessed by the authorized individuals. Should a share or two fall into the wrong hands, they couldn't open the passcode unless the other executives cooperated.

Mathematical formulation

Shamir's Secret Sharing is an ideal and perfect -threshold scheme. In such a scheme, the aim is to divide a secret  (for example, the combination to a safe) into  pieces of data  (known as shares) in such a way that: 
 Knowledge of any  or more  pieces makes  easily computable. That is, the complete secret  can be reconstructed from any combination of  pieces of data.
 Knowledge of any  or fewer  pieces leaves  completely undetermined, in the sense that the possible values for  seem as likely as with knowledge of  pieces. The secret  cannot be reconstructed with fewer than  pieces.

If , then every piece of the original secret  is required to reconstruct the secret.
The essential idea of the scheme is based on Lagrange interpolation theorem, specifically that  points is enough to uniquely determine a polynomial of degree less than or equal to . For instance, 2 points are sufficient to define a line, 3 points are sufficient to define a parabola, 4 points to define a cubic curve and so forth. We assume our secret  can be represented as an element  of a finite field . We choose at random  elements, , from  and construct the polynomial . Let us construct any  points out of it, for instance set  to retrieve . Every participant is given a point (a non-zero integer input to the polynomial, and the corresponding integer output).
Given any subset of  of these pairs, we can obtain  using interpolation, with one possible formulation as below:  

.

Usage

Example 
The following example illustrates the basic idea. Note, however, that calculations in the example are done using integer arithmetic rather than using finite field arithmetic. Therefore the example below does not provide perfect secrecy and is not a true example of Shamir's scheme. So we'll explain this problem and show the right way to implement it (using finite field arithmetic).

Preparation
Suppose that our secret is 1234 .

We wish to divide the secret into 6 parts , where any subset of 3 parts  is sufficient to reconstruct the secret. At random we obtain  numbers: 166 and 94.

  where  is secret

Our polynomial to produce secret shares (points) is therefore:

 

We construct six points  from the polynomial:

 

We give each participant a different single point (both  and ). Because we use  instead of  the points start from  and not . This is necessary because  is the secret.

Reconstruction
In order to reconstruct the secret any 3 points will be enough.

Consider .

We will compute Lagrange basis polynomials:

 

 

 

Therefore

 

Recall that the secret is the free coefficient, which means that , and we are done.

Computationally efficient approach 
Considering that the goal of using polynomial interpolation is to find a constant in a source polynomial  using Lagrange polynomials "as it is" is not efficient, since unused constants are calculated.

An optimized approach to use Lagrange polynomials to find  is defined as follows:

Problem
Although the simplified version of the method demonstrated above, which uses integer arithmetic rather than finite field arithmetic, works fine, there is a security problem: Eve gains a lot of information about  with every  that she finds.

Suppose that she finds the 2 points  and ,
she still doesn't have  points so in theory she shouldn't have gained any more info about .
But she combines the info from the 2 points with the public info:  and she :

 
 She now only has 150 numbers to guess from instead of an infinite number of natural numbers.

Solution

Geometrically this attack exploits the fact that we know the order of the polynomial and so gain insight into the paths it may take between known points. This reduces possible values of unknown points since it must lie on a smooth curve.

This problem can be fixed by using finite field arithmetic. A field of size  is used. The graph shows a polynomial curve over a finite field, in contrast to the usual smooth curve it appears very disorganised and disjointed.

In practice this is only a small change, it just means that we should choose a prime  that is bigger than the number of participants and every  (including ) and we have to calculate the points as  instead of .

Since everyone who receives a point also has to know the value of , it may be considered to be publicly known. Therefore, one should select a value for  that is not too low.

For this example we choose , so our polynomial becomes  which gives the points: 

This time Eve doesn't win any info when she finds a  (until she has  points).

Suppose again that Eve finds  and , this time the public info is:  so she:

This time she can't stop because  could be any integer (even negative if ) so there are an infinite amount of possible values for . She knows that  always decreases by 3 so if  was divisible by  she could conclude  but because it's prime she can't conclude even that and so she didn't win any information.

Python example
"""
The following Python implementation of Shamir's Secret Sharing is
released into the Public Domain under the terms of CC0 and OWFa:
https://creativecommons.org/publicdomain/zero/1.0/
http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0

See the bottom few lines for usage. Tested on Python 2 and 3.
"""

from __future__ import division
from __future__ import print_function

import random
import functools

# 12th Mersenne Prime
# (for this application we want a known prime number as close as
# possible to our security level; e.g.  desired security level of 128
# bits -- too large and all the ciphertext is large; too small and
# security is compromised)
_PRIME = 2 ** 127 - 1
# 13th Mersenne Prime is 2**521 - 1

_RINT = functools.partial(random.SystemRandom().randint, 0)

def _eval_at(poly, x, prime):
    """Evaluates polynomial (coefficient tuple) at x, used to generate a
    shamir pool in make_random_shares below.
    """
    accum = 0
    for coeff in reversed(poly):
        accum *= x
        accum += coeff
        accum %= prime
    return accum

def make_random_shares(secret, minimum, shares, prime=_PRIME):
    """
    Generates a random shamir pool for a given secret, returns share points.
    """
    if minimum > shares:
        raise ValueError("Pool secret would be irrecoverable.")
    poly = [secret] + [_RINT(prime - 1) for i in range(minimum - 1)]
    points = [(i, _eval_at(poly, i, prime))
              for i in range(1, shares + 1)]
    return points

def _extended_gcd(a, b):
    """
    Division in integers modulus p means finding the inverse of the
    denominator modulo p and then multiplying the numerator by this
    inverse (Note: inverse of A is B such that A*B % p == 1) this can
    be computed via extended Euclidean algorithm
    http://en.wikipedia.org/wiki/Modular_multiplicative_inverse#Computation
    """
    x = 0
    last_x = 1
    y = 1
    last_y = 0
    while b != 0:
        quot = a // b
        a, b = b, a % b
        x, last_x = last_x - quot * x, x
        y, last_y = last_y - quot * y, y
    return last_x, last_y

def _divmod(num, den, p):
    """Compute num / den modulo prime p

    To explain what this means, the return value will be such that
    the following is true: den * _divmod(num, den, p) % p == num
    """
    inv, _ = _extended_gcd(den, p)
    return num * inv

def _lagrange_interpolate(x, x_s, y_s, p):
    """
    Find the y-value for the given x, given n (x, y) points;
    k points will define a polynomial of up to kth order.
    """
    k = len(x_s)
    assert k == len(set(x_s)), "points must be distinct"
    def PI(vals):  # upper-case PI -- product of inputs
        accum = 1
        for v in vals:
            accum *= v
        return accum
    nums = []  # avoid inexact division
    dens = []
    for i in range(k):
        others = list(x_s)
        cur = others.pop(i)
        nums.append(PI(x - o for o in others))
        dens.append(PI(cur - o for o in others))
    den = PI(dens)
    num = sum([_divmod(nums[i] * den * y_s[i] % p, dens[i], p)
               for i in range(k)])
    return (_divmod(num, den, p) + p) % p

def recover_secret(shares, prime=_PRIME):
    """
    Recover the secret from share points
    (x, y points on the polynomial).
    """
    if len(shares) < 3:
        raise ValueError("need at least three shares")
    x_s, y_s = zip(*shares)
    return _lagrange_interpolate(0, x_s, y_s, prime)

def main():
    """Main function"""
    secret = 1234
    shares = make_random_shares(secret, minimum=3, shares=6)

    print('Secret:                                                     ',
          secret)
    print('Shares:')
    if shares:
        for share in shares:
            print('  ', share)

    print('Secret recovered from minimum subset of shares:             ',
          recover_secret(shares[:3]))
    print('Secret recovered from a different minimum subset of shares: ',
          recover_secret(shares[-3:]))

if __name__ == '__main__':
    main()

Properties
Some of the useful properties of Shamir's  threshold scheme are:
 Secure: Information theoretic security.
 Minimal: The size of each piece does not exceed the size of the original data.
 Extensible: When  is kept fixed,  pieces can be dynamically added or deleted without affecting the other pieces.
 Dynamic: Security can be easily enhanced without changing the secret, but by changing the polynomial occasionally (keeping the same free term) and constructing new shares to the participants.
 Flexible: In organizations where hierarchy is important, we can supply each participant different number of pieces according to their importance inside the organization. For instance, the president can unlock the safe alone, whereas 3 secretaries are required together to unlock it.

A known issue in Shamir's Secret Sharing scheme is the verification of correctness of the retrieved shares during the reconstruction process, which is known as verifiable secret sharing. Verifiable secret sharing aims at verifying that shareholders are honest and not submitting fake shares.

See also
 Secret sharing
 Lagrange polynomial
 Homomorphic secret sharing – A simplistic decentralized voting protocol.
 Two-man rule
 Partial Password

References
.

.
.
.

.

External links 

 Shamir's Secret Sharing in the Crypto++ library
 Shamir's Secret Sharing Scheme (ssss) – a GNU GPL implementation
 sharedsecret – implementation in Go
 s4 - online shamir's secret sharing tool utilizing HashiCorp's shamir secret sharing algorithm

Secret sharing
Information-theoretically secure algorithms
Articles with example JavaScript code
Articles with example Python (programming language) code