ssss(1)

💖 ssss(1) — ok bestie, let's talk secrets 💖

Welcome to the ssss(1) manual page, General Commands Manual edition, but make it a conversation. Sit down, grab a strawberry 🍓, and let's get into it, because this one is genuinely iconic.

---

✨ NAME ✨

ssss — Split and Combine Secrets using Shamir's Secret Sharing Scheme. That's the whole vibe. You split a secret. You combine a secret. Nothing else, and honestly? She does it flawlessly.

---

🎀 SYNOPSIS 🎀

ssss-split -t threshold -n shares [-w token] [-s level] [-x] [-q] [-Q]
[-D] [-v]

ssss-combine -t threshold [-x] [-q] [-Q] [-D] [-v]

Two commands, one destiny. 💅

---

🦋 DESCRIPTION 🦋

ssss is an implementation of Shamir's Secret Sharing Scheme, and she is not doing a half job — the program suite does both things:

• the generation of shares for a known secret, and
• the reconstruction of a secret using user-provided shares.

Like, she hands out the puzzle pieces 🧩 and she puts them back together. Main character energy fr.

---

🌸 COMMANDS 🌸

• ssss-split — prompt the user for a secret and generate a set of corresponding shares. (She asks, you answer, she scatters the pieces.)
• ssss-combine — read in a set of shares and reconstruct the secret. (You hand back the pieces, she rebuilds the whole thing. Slay.)

---

✨ OPTIONS ✨

• -t threshold — Specify the number of shares necessary to reconstruct the secret. This is the "how many of y'all need to show up" number.
• -n shares — Specify the number of shares to be generated. The total squad size.
• -w token — Text token to name shares in order to avoid confusion in case one utilizes secret sharing to protect several independent secrets. The generated shares are prefixed by these tokens. Basically: name tag your secrets so they don't get mixed up at the party. 🎀
• -s level — Enforce the scheme's security level (in bits). This option implies an upper bound for the length of the shared secret (shorter secrets are padded). Only multiples of 8 in the range from 8 to 1024 are allowed. If this option is omitted (or the value given is 0) the security level is chosen automatically depending on the secret's length. The security level directly determines the length of the shares. Read that twice bestie, because the security level literally decides how chunky your shares are gonna be.
• -x — Hex mode: use hexadecimal digits in place of ASCII characters for I/O. This is useful if one wants to protect binary data, like block cipher keys. 🔥
• -q — Quiet mode: disable all unnecessary output. Useful in scripts. No chatter, just work. She's focused.
• -Q — Extra quiet mode: like -q, but also suppress warnings. Warnings too. She said 🤫.
• -D — Disable the diffusion layer added in version 0.2. This option is needed when shares are combined that where generated with ssss version 0.1. Old shares, new tool — that's the only reason you'd reach for this one.
• -v — Print version information. 👑

---

💫 EXAMPLE 💫

In case you want to protect your login password with a set of ten shares in such a way that any three of them can reconstruct the password, you simply run the command:

ssss-split -t 3 -n 10 -w passwd

To reconstruct the password pass three of the generated shares (in any order) to:

ssss-combine -t 3

Any three. Any order. She's not picky, she's just secure. 💅

---

🫶 NOTES 🫶

To protect a secret larger than 1024 bits a hybrid technique has to be applied: encrypt the secret with a block cipher and apply secret sharing to just the key. Among others openssl and gpg can do the encryption part:

openssl bf -e < file.plain > file.encrypted

gpg -c < file.plain > file.encrypted

Big secret? Encrypt the whole thing, then secret-share just the key. Chef's kiss. 🤌

---

🔒 SECURITY 🔒

ssss tries to lock its virtual address space into RAM for privacy reasons. But this may fail for two reasons: either the current uid doesn't permit page locking, or the RLIMIT_MEMLOCK is set too low. After printing a warning message ssss will run even without obtaining the desired mlock.

⚠️ Bestie, listen: if that mlock fails, she warns you and keeps going anyway. No mlock, still running. Know that going in. 😭

---

👑 AUTHOR 👑

This software (v0.5) was written in 2006 by B. Poettering (ssss AT point-at-infinity.org). Find the newest version of ssss on the project's homepage: http://point-at-infinity.org/ssss/.

---

📚 FURTHER READING 📚

http://en.wikipedia.org/wiki/Secret_sharing

---

And that's the page, babe ✨ This one's filed under Manuals and catalogued in the User section — so if you ever forget where you found her, it's the ssss(1) entry in the Manuals set, User edition. Now go split something. Safely. 🦋💖