Recovery shares from friends and family

Simple

Your recovery phrase is the key to your whole wallet. If you lose it, your money is gone. Secret sharing gives you a safety net.

You can cut your phrase into pieces, called shares, and give one to each person you trust. It's like a treasure map torn into pieces: one piece on its own shows nothing.

You choose how many pieces are needed. For example, 7 people, and any 4 of them together can bring your wallet back if you lose it, or for your family if you pass away.

Set it up in Profile → Backup & security → Secret sharing, and send each share as a private Zcash message to a contact, by email with a password, or as words in a letter. To use shares later, choose Recover with shares on Kalda's welcome screen.

Choose people who won't all get together behind your back: enough of them together could open your wallet. If you think too many shares are no longer safe, move your money to a new wallet.

Detailed

Secret sharing is built on a well-known idea from cryptography, Shamir's secret sharing, published by Adi Shamir in 1979. Kalda's shares follow SLIP-39, a public, open standard that turns Shamir shares into lists of words.

• Threshold: you pick N people and a number T. Any T shares rebuild the recovery phrase; T − 1 or fewer reveal nothing about it, not even a hint.
• Words with error detection: each share is written with a fixed word list, so it can be copied by hand, read aloud or kept on paper, and carries a checksum, so a mistyped word is caught instead of producing the wrong wallet.
• Sets stay together: every share in a set carries the same identifier, so shares from two different sets can't be mixed by accident.

Getting shares to people safely

A private Zcash message is encrypted by the Zcash network itself, so only the recipient can read it. Email and chat apps aren't private, so a share sent that way travels locked with a password; give the password another way, such as in person, by phone or in your will. Words in a letter need nothing more.

No scheme can take shares back once they are given out: making a new set doesn't stop the old one working. And if more than N − T people lose their shares, there aren't enough left to recover. The only way to retire old shares is to move your money to a new wallet.

In depth

Shamir's secret sharing rests on a simple fact about polynomials: two points fix a straight line, three points fix a parabola, and in general T points fix exactly one polynomial of degree T − 1.

Splitting

To share a secret s with threshold T, choose a random polynomial of degree T − 1 whose value at zero is the secret. Each person receives one point on that curve, taken at a different, non-zero x.

f(x) = s + a₁x + a₂x² + … + a₍T−1₎x^(T−1)     share i = (xᵢ, f(xᵢ))

Rebuilding

Any T shares determine the polynomial uniquely, and Lagrange interpolation gives its value at zero, which is the secret:

s = f(0) = Σᵢ yᵢ · Πⱼ≠ᵢ xⱼ / (xⱼ − xᵢ)

Why fewer shares reveal nothing

The arithmetic is done in a finite field (for byte-sized secrets, typically a field of 256 elements), not with ordinary numbers. With only T − 1 points, every possible secret is matched by exactly one polynomial through those points, so each value is equally likely. This is information-theoretic security: it holds no matter how much computing power an attacker has.

In practice, long secrets are split byte by byte with fresh random coefficients each time. Plain Shamir can't tell a wrong share from a right one, so practical schemes add a checksum to each share and a digest of the secret to detect mistakes. And the scheme protects the secret only until T holders combine their shares, so the threshold is a trade-off: high enough to resist collusion, low enough to survive lost shares.