This question already has an answer here:

Given a 24 word BIP39 mnemonic phrase, I would like to have a way to split it into 5 shares, so that any 3 would allow me to reconstruct the phrase (but any less than 3 would not).

This is easy enough to do with Shamir Secret Sharing, and very secure. But that requires, at the minimum, a computer, and I would rather have a way to achieve the same (or something similar) with only a pen and paper (and let's say not more than an hour's work).

Now, I don't mind it being slightly less secure, in the sense that obtaining 2 of the 5 shares makes it easier to guess any of the other 3, as long as the difficulty is reasonable (e.g. 90 bits entropy). I feel like a 24 word phrase is really entropy overkill, and a third of that entropy is, by itself, quite a lot and sufficient for my purposes.


marked as duplicate by Raghav Sood, 0xb10c, MCCCS, Max Vernon, Andrew Chow Sep 12 '18 at 15:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2 of 3 requires a different solution. – Assaf Lavie Aug 13 '18 at 1:11
  • a lot of the solutions can be adapted to 3 of 5. I suggest taking a closer look. – Abdussamad Aug 13 '18 at 18:54
  • Literally none of the ones you linked to do. – Assaf Lavie Aug 14 '18 at 17:12

Figured out a solution that can easily be done with a pen and paper and at most a pocket calculator.

You take your secret (264 bits) and divide into 6 equal-length parts. Call them A, B, C, D, E, F.

For brevity I write XY as meaning X xor Y. Share 1: A,B Share 2: C,D Share 3: E,F Share 4: CE,AF,BD (remember these are xors) Share 5: ABCE,ACDF,BDEF

Now with a bit of xoring any 3 of these give you the entire secret. I'll write a proper blog post with instructions exactly how to combine shares and a proof that it's reliable.

Downside is that unlike SSSS, each share is only 1/3 of the entropy, so if someone has two of the five shares, it's only 2**88 attempts to guess the third. Still, 88 bit entropy by itself is not bad at all, at least in my book.

Also, unlike SSSS, the "order" of shares is important. You need to note beside each share which it's supposed to be (S1, S2...) so you know what sort of xoring to do.

What do you think? Any other weakness in this?

Not the answer you're looking for? Browse other questions tagged or ask your own question.