Shamir Secret Sharing in a Password Manager: Recovery Without a Forgot-Password Button

A zero-knowledge password manager cannot reset your master password, because it never has the key that decrypts your vault. That is the reason it is secure. It is also the reason a forgotten master password can lock you out for good.

Shamir Secret Sharing addresses that trade-off. It lets you recover a secret without giving any one holder the ability to recover it alone.

How the scheme works

In 1979, Adi Shamir described a method that splits a secret into several shares. You choose a threshold k and a total n. Any k shares reconstruct the secret. Fewer than k shares reveal nothing about it.

Two values define the scheme:

• n, the number of shares you create;
• k, the number needed to rebuild the secret.

A 3-of-5 scheme creates five shares. Any three of them recover the secret. Two shares, or any smaller set, do not help an attacker.

How VaultKeepR uses it

In VaultKeepR, the default configuration is a threshold of 3 out of 5. The master key is split into five fragments. Each fragment is encrypted on its own before it is stored, and the fragments are kept in different places, so no single location can rebuild the key.

The design also keeps one encrypted fragment on the VaultKeepR service. On its own, that fragment cannot recover your vault. The recovery code rejects any attempt with fewer than 3 fragments, and the test suite of the recovery package checks that case.

The trade-offs

The threshold is a choice, and each value has a cost:

• Threshold too low (for example 2 of 5): two stolen fragments are enough. The attack surface grows.
• Threshold too high (for example 5 of 5): losing one fragment locks you out. Recovery becomes fragile.
• Locations too close together: if several fragments depend on the same account, device or place, one failure can remove more than one of them.

A 3-of-5 scheme is a middle point. It survives the loss of two fragments, and it resists the theft of two. The right values depend on where each fragment is kept and who can reach it.

What Shamir does not solve

Shamir protects the recovery path. It does not protect the device where you unlock your vault. If malware reads the vault while it is open, no threshold will help. It also does not replace a strong master password, since the vault is still encrypted with a key derived from it.

Checklist for your own recovery plan

• Know where each of the five fragments is kept, and who can reach each location.
• Make sure that no two fragments depend on the same account, device or place.
• Test the recovery once, with a dummy vault, before you rely on it.
• Know what happens if one location disappears.

Recovery is a plan you carry out in advance. A scheme on paper does not restore a vault by itself.