ssss-rs

Shamir's Secret Sharing Scheme CLI — split secrets into shares and combine them to recover the original.

Built on the shamir Rust library.

Installation

Download the latest binary from Releases (Linux amd64/arm64, macOS amd64/arm64).

Or build from source:

cargo install --git https://github.com/aitorpazos/ssss-rs.git

Usage

Split a secret

Split a secret into shares with a minimum threshold to recover:

# Split into 4 shares, any 2 can recover the secret
ssss-rs split -t 2 -s 4 -i "this is my secret"

01f92705cb752abb31f9243a692ddb1d3573
0275f6b1188aeff8025ec31447f508acc57a
03f8b9dda0dfac3013ca9e0e5dbdb0c3957d
04764fc2a56f7e7e640b16481b5eb5d53e68

Read the secret from stdin:

echo "my secret" | ssss-rs split -t 2 -s 4 -i -

Combine shares

Recover the secret from shares:

ssss-rs combine 0275f6b1188aeff8025ec31447f508acc57a 04764fc2a56f7e7e640b16481b5eb5d53e68

Recovered key: this is my secret
Recovered key in base64: dGhpcyBpcyBteSBzZWNyZXQ=
Error decoding key to hex (expected for non hexadecimal keys): OddLength
BIP39 words list generation skipped

Short mode (script-friendly, key only):

ssss-rs combine -s 0275f6b1188aeff8025ec31447f508acc57a 04764fc2a56f7e7e640b16481b5eb5d53e68

this is my secret

Read shares from stdin (one per line):

ssss-rs combine - <<EOF
0275f6b1188aeff8025ec31447f508acc57a
04764fc2a56f7e7e640b16481b5eb5d53e68
EOF

Options

split

Flag	Description
-t	Minimum shares required to recover (threshold)
-s	Total number of shares to create
-i	Secret to split (use - for stdin)

combine

Flag	Description
-s, --short	Output only the recovered key
SHARES...	Hex-encoded shares (use - for stdin)

BIP39 output

When the recovered secret is valid hex with a BIP39-compatible entropy length (128, 160, 192, 224, or 256 bits), the full output includes the BIP39 mnemonic representation.

Related

• shamir-iso — minimal bootable image for secret splitting ceremonies

License

GPL-3.0 — see LICENSE.