@@ -36,12 +36,28 @@ In case sufficient M values are provided the points exactly define the polynomia
The value to be encoded as the master secret must be a multiple of 8 bits. This is typically a wallet entropy, but we do not restrict the usage in any way. The master secret is divided into N Shamir parts and M specifies how many of those parts do we need to reconstruct the master secret. We use GF(256) as the underlying field. We consider the master secret in a form which includes its own checksum:
| master secret | 16-bit master secret checksum |
|---------------|-------------------------------|
From this value the N parts are generated and each participating party receives the following data:
| 00 | 4-bit index | 4-bit M threshold | variable-bit SSSS part | 16-bit checksum |
| 5-bit index | 5-bit M threshold | variable-bit SSSS part | 16-bit checksum |
The index corresponds to the SSSS part's x value (see the diagram above) and the SSSS part is the corresponding y value. Finally, the checksum field is a checksum of both the whole share (including padding zeroes, index and threshold, N is not included).
The index corresponds to the SSSS part's x value (see the diagram above) and the SSSS part is the corresponding y value.
Index and threshold are encoding using the following scheme:
| 5-bit value | index/threshold value |
|-------------|-----------------------|
| 00000 | 1 |
| 00001 | 2 |
| 00010 | 3 |
| ... | ... |
| 11101 | 30 |
| 11110 | 31 |
| 11111 | 32 |
The checksum field is a checksum of both the whole share (including padding zeroes, index and threshold, N is not included).
This structure is then converted into a mnemonic passphrase by splitting it up by 10 bits which correspond as an index to the a word list containing exactly 1024 words (see below).
