Recommendations

Split a Seed Phrase (K-of-M) / Guide

Why?

While a 2-of-3 split is a good enough backup strategy, the K-of-M generalization is sometimes needed for sophisticated use cases such as social recovery. With this method, up to 26 shares shares can be generated. A recovery threshold is chosen by the user (the "K" in "K-of-M"); it indicates the number of shares that will be needed to recover the seed phrase, while less than "K" shares won't leak any information. For example, a 3-of-5 split will generate 5 shares and require 3 of them to recover the seed phrase.

It is worth noting that the K-of-M split uses a different algorithm, known as Shamir Secret Sharing Scheme. Compared to the 2-of-3 split, this method takes exponentially longer to perform as K (the number of shares needed for recovery) and M (the total number of shares) grows. However, the recovery time increases linearly.

Components

Worksheets
The shares look the same as for the 2-of-3 split, but there are now more of them. The concepts of "random shares" and "derived shares" are similar, however an intermediary step knows as "tweaked share" is now introduced. There are two types of tweaking worksheets that should not be confused with one another. The first are "Tweaking (derivation)" sheets that are used to devire shares. The second is the "Tweaking (recovery)" sheet, used for recovering the seed phrase.
Wheels
Two new wheels are needed in addition to the of the 2-of-M wheel. The larger K-of-M wheel is for tweaking shares, and the smaller one is used for recovery.
Derivation Tables
These tables show the tweaking factors for deriving shares. More details will follow on this later.
Tiles
These are the same as in the 2-of-3 guide.

Steps

1. Fill the shares' headers
Begin with writing the group identifier on each random and derived share (typically: "Brand Model MM/DD"). Complete the scheme parameters (e.g.: 3-of-5). Then, name the derived shares following alphabetic order up to Z (C/D/E for 3-of-5). There cannot be more than 26 shares in total.
2. Write the seed phrase
Fill the "Secret" section's gray fields with the seed phrase, respecting the word's numbering.
3. Generate the random shares
Generate the random shares as explained in the 2-of-3 split guide. The number of random shares depends on the recovery threshold (the "K" in "K-of-M", minus one).
4. Checksum the secret and the random shares
Using the 2-of-M wheel, generate the checksums for the seed phrase and the random shares as explained in the 2-of-3 split guide.
5. Generate the derived shares
Derive as many additional shares as needed to reach a total of "M" random + derived shares. This will be done in two phases - firstly, follow the section titled A1) Tweaking Shares for Derivation, and then the section titled A3) Deriving from Tweaked Shares. Both processes are detailed below.
6. Verify the derived shares
Using the 2-of-M wheel, verify the checksum of each of the derived share (this operation was explained in the 2-of-3 split guide). To fix erroneous characters, repeat the various steps starting with the checksums on the random shares, then the tweaking and finally the derivation.
7. Recover the first seed phrase word
If you are using this guide for the first time, verify that you completed each step correctly by recovering the first seed word from the derived shares as explained in B1) Recovering the Seed Phrase below. This will also prove the soundness of the method.

A1) Tweaking Shares for Derivation

  1. Take the "Derivation Tables" sheet.
  2. Look for the correct table for your K-of-M.
  3. Look for the index (letter) of the share being derived.
  4. Take one of the "Tweaking (derivation)" worksheets.
  5. For each share on the tweaking worksheet, write the "Factor:" indicated in the derivation table.
  6. Tweak each share as indicated in A2) Tweaking a Share below.

A2) Tweaking a Share

Tweaking a share consist of replacing its characters by the corresponding tweaked characters:

  1. Take the big K-of-M wheel.
  2. Place the pointer over the desired factor. The wheel displays the character mapping for that tweaking factor.
  3. For each character of the share, write the corresponding tweaked character at the corresponding position on the tweaked share.

A3) Deriving from Tweaked Shares

  1. Take the 2-of-M wheel.
  2. Place the pointer on the first character of the first tweaked share.
  3. On the inner row, find the first character of the second tweaked share.
  4. Move the pointer to the corresponding outer-row character.
  5. Repeat from step 3 with the first character of the remaining tweaked shares.
  6. Write the character under the pointer as the first character of the derived share.
  7. Repeat from step 1 with the second character of the first tweaked share, and keep going until derivation is complete.

B1) Recoving the Seed Phrase

Recovery can be achieved by deriving the secret (seed phrase + checksum) from the gathered shares. The tweaking factors have to be determined using both K-of-M wheels as explained later.

  1. Gather K shares of the same group.
  2. Tweak these shares as indicated in B2) Tweaking Shares for Recovery just below.
  3. Take a blank "Random Shares" worksheet where to write the secret.
  4. Derive the secret from the tweaked shares, as indicated in A3) Deriving from Tweaked Shares.
  5. Verify the seed phrase's checksum as explained in the 2-of-3 guide. If erroneous characters are found, correct them by repeating the recovery steps for these characters only.

B2) Tweaking Shares for Recovery

  1. Take the "Tweaking (recovery)" worksheet.
  2. Write the index of each share to tweak on the worksheet (in any order).
  3. Take the small K-of-M wheel.
  4. Place the pointer over the index of the first share to tweak.
  5. Look for the indexes of each of the other shares to tweak on the outer row.
  6. The corresponding values as the tweaking factors for the share under the pointer. We are now going to sum these factors.
  7. Take the big K-of-M wheel.
  8. Place the pointer on the first tweaking factor.
  9. Under the outer row, look for the label that adds the second factor.
  10. Move the pointer to the corresponding value on the outer row.
  11. If there are more factors to add, repeat from step 8 with the next factor.
  12. Use the resulting factor to tweak the first share as indicated before in Tweaking a Share.
  13. If there are more shares to tweak, repeat from step 4 with the next one.