nebulosus/shamir

Pure Rust implementation of Shamir's secret sharing

Shamir

Shamir is a pure Rust implementation of Shamir's secret sharing.

Install

To install shamir into your application, you need to add it to your cargo.toml:

[dependencies]
shamir = "~1.0"

and you need to include it at the top of oyur main.rs:

extern crate shamir;

use shamir::SecretData;

Usage

extern crate shamir;

use shamir::SecretData;

fn main() {
    let secret_data = SecretData::with_secret("Hello World!", 3);

    let share1 = secret_data.get_share(1);
    let share2 = secret_data.get_share(2);
    let share3 = secret_data.get_share(3);

    let recovered = SecretData::recover_secret(3, vec![share1, share2, share3]).unwrap();

    println!("Recovered {}", recovered);
}

shamir's Issues

SECURITY: Threshold value is ignored (all shares are n=3).

There is a pretty serious bug in SecretData::with_secret -- all sharded secrets (no matter the threshold setting) will require three shares to reconstruct the secret. Here's an example:

extern crate shamir;

use shamir::SecretData;

fn try_recover(n: u8, shares: &Vec<Vec<u8>>) -> Option<String> {
    let shares = shares.iter().take(n as usize).cloned().collect::<Vec<_>>();
    SecretData::recover_secret(n, shares)
}

fn main() {
    let secret_data = SecretData::with_secret("Hello World!", 5);

    let shares = vec![
        secret_data.get_share(1),
        secret_data.get_share(2),
        secret_data.get_share(3),
        secret_data.get_share(4),
        secret_data.get_share(5),
    ];

    let recovered = try_recover(5, &shares).unwrap();
    println!("Good recover: {}", recovered);

    let recovered = try_recover(3, &shares).unwrap();
    println!("Bad recover: {}", recovered);
}

The reason for this bug is this line from with_secret:

        let mut rand_container = [0u8, threshold - 1];

This leads to only three coefficients being generated for the polynomial (resulting in an n=3 threshold system). I presume this was meant to be [0u8; threshold - 1] (an array of zeroes of threshold - 1 size) but this won't work in Rust -- instead you should use something like vec![0; threshold - 1].

I'm a also quite a bit worried by the very minimal test-cases (failure to reconstruct isn't checked, and the only threshold tests are for 3 shares -- this bug would've been obvious if there was a test for 2 shares). As it stands, I would humbly suggest that you yank all releases of shamir and make a new release which fixes this problem (or, since it seems this crate is abandoned, just leave it yanked).

/cc @ChrisMacNaughton