Shamir's Secret Sharing and Drop's hybrid model
How a wallet protects your key looks like a technical choice. It is also a choice about people: who can move your money, who can lose it, and who you have to trust. Technical decisions are moral decisions.
The Security Model page describes how Drop protects your key. This page covers one decision behind it: why we don't use Shamir's Secret Sharing, the most common way to split a key, and what that choice costs.
Shamir's Secret Sharing in Brief
Shamir's Secret Sharing (SSS) splits a private key into pieces called shares, and lets you choose how many are needed to rebuild it, for example any 2 of 3. Anyone holding fewer learns nothing about the key, and one share can be lost without losing the key. The method dates from 1979 and is used across the industry.
A typical SSS wallet keeps one share on your device, one with the provider, and a recovery share that you store yourself.
Drop splits a key into two shares instead, and both are always needed. There is no extra key share able to reconstruct the private key like in SSS.
Three Decisions
Who Keeps the Spare Share?
With SSS, you do. Being able to lose a share is its main attraction, and that depends on a spare stored somewhere: a file, a cloud drive, a printed code. It is one more thing you can lose, or leak.
With Drop, there is no spare share and nothing extra for you to store.
The cost: losing a share is not an option, so keeping backups falls to us, and to your second device.
Who Is Asked When Something Is Stolen?
With SSS, possibly no one. If the recovery share ends up next to the device share, on the same phone, cloud account or laptop backup, whoever gets into that one place has the whole key. There is no approval step, no limit and no alert, because two shares are enough.
With Drop, a copied file or a stolen backup is never enough. With a supported passkey, the share on your side is useless without that passkey, and our service releases the other share only for a request your passkey approved.
How Much Can Go Wrong in the Arithmetic?
With SSS, more than you would expect. It relies on arithmetic that leaves room for mistakes ordinary testing does not catch. An independent audit of Privy's open-source library, which is carefully built and widely used, found that in some cases fewer shares than intended could recover part of a secret. Privy fixed it and wrote about it openly. SSS also cannot tell that a share is wrong: combining a bad one produces a different key, with no warning.
With Drop, the two shares are combined in the simplest way there is. That keeps the property SSS is valued for, that one share alone reveals nothing, with far less to get wrong. Drop also checks that the rebuilt key matches your wallet's address before using it.
The cost: flexibility. "Any 2 of 3" is exactly what the extra arithmetic buys.
How We Cover the Cost
- Three backup copies on our side. We keep three backup copies of the encrypted server-side shares for now and might expand to more replicas: one in a backup database, one in a database in a separate and isolated AWS account, and one in offline hardware
- A second device on your side. Pair one with Backup Passkey, so losing a device does not lock you out
- A way out. You can export your private key at any time. From then on, that copy is yours alone to protect