2-of-3 Secret Sharing Explained

Understand the threshold and availability tradeoff

Two-of-three means one fragment alone is insufficient and any pair among the three can meet the threshold. The arrangement tolerates one unavailable or lost fragment, which can improve recovery availability compared with requiring every holder. It also means any two capable holders can cooperate, so holder selection is a trust decision.

This is not the same as unanimous approval and does not guarantee that two different human identities are present if participant links are forwarded or gathered on one device. Distinct links represent capabilities. Verify holders, keep assignments current, and do not rely on display labels as cryptographic identity.

Create and distribute three independent links

The sender's browser encrypts the payload using AES-256-GCM and uses Shamir's Secret Sharing to create fragments. Strumio coordinates encrypted payload and participant contribution records needed for the flow. An authorized viewer reconstructs key material in the browser after the threshold is reached.

Deliver each complete participant link directly to its intended holder. Avoid storing all three in one shared mailbox, ticket, drive, chat history, administrator account, or device, because a single compromise could collect the threshold. Consider genuinely separate channels and locations based on the risk.

Choose holders for both trust and resilience

Select people with appropriate authority, independent availability, and a reason to participate in recovery. For an organization, that might be three role owners in different reporting or operational paths. Avoid arrangements where two links are routinely controlled by one person or automated into the same account.

Plan for vacation, illness, departure, device loss, and emergency time zones. Record roles and contact procedures without recording complete links in the plan. Review assignments after personnel changes and create a fresh distribution if a link was exposed or custody can no longer be established.

Protect the authorized viewer and reconstructed plaintext

Threshold contributions eventually allow plaintext on the authorized viewer's device. Use a managed, updated browser and pause screen sharing, remote support, clipboard synchronization, and recording. Complete viewer and participant links remain sensitive, and operational metadata is still processed to coordinate the workflow.

Once reconstructed, the secret can be copied, photographed, printed, or otherwise retained. Threshold sharing controls the path to reconstruction; it cannot enforce behavior afterward. Rotate recovery codes, API keys, and administrator credentials following emergency use whenever the issuing system permits.

Test the plan and know when to choose another threshold

Practice with non-production data so holders understand contribution and viewing without exposing the live secret. Confirm that each of the three possible holder pairs can support the intended process and that losing one fragment does not remove the only documented contact route.

Choose a higher threshold such as 3-of-5 when broader agreement is required, accepting more coordination. Use individual accounts, hardware-backed credentials, audited approval systems, and offline recovery procedures for durable governance. A 2-of-3 Strumio item is a focused threshold handoff, not a complete organizational control framework.

Related guidance

When an encrypted delivery link is appropriate, Create a free Strumio account.