> For the complete documentation index, see [llms.txt](https://learn.cypherock.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.cypherock.com/design-decision/using-shamir-secret-sharing-vs.-multi-sig/how-is-shamir-secret-sharing-implemented-within-cypherock-x0.md).

# How is Shamir Secret Sharing implemented within Cypherock X0

The X0 Card implementation of SSS follows the same original concepts as Cypherock X1, and thus essentially is a secret sharing algorithm that operates on each byte of original data (treated as secret in the algorithm) and splits it into N number of parts of each byte. In Cypherock's case, the secret is the entropy (ENT) of the wallet, as explained in [Cypherock is BIP39 compliant](file:///0050776/cypherock-is-bip39-compliant.md).

The sharing scheme that is used in Cypherock X0 is a (2, 5)-threshold scheme, or 2-of-5 sharing scheme, wherein any two of the 5 generated shards can be used to retrieve the original data (or secret), while a single shard reveals nothing about it.

What differs from Cypherock X1 is where the 5 shards are stored and where the secret is retrieved.

| Shard    | Stored on                     | Protected by                                                                                                                                |
| -------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| 4 shards | One on each of the 4 X0 Cards | The EAL6+ certified secure element of the X0 Card, encrypted with a key derived from the wallet PIN                                         |
| 1 shard  | The user's smartphone         | Hardware-backed secure storage (Keychain on iOS, Keystore on Android) behind the app lock, encrypted with a key derived from the wallet PIN |

## Sharding

When a wallet is created or imported, the X0 Card that creates the wallet splits the ENT into 5 shards inside its secure element. It keeps one shard, sends one encrypted shard to the X0 Wallet App, and sends one shard to each of the other 3 X0 Cards over the card-to-card secure channel. The complete secret is then deleted from the card.

## Reconstruction

* **Smartphone + any one X0 Card:** Used for everyday transactions. The smartphone sends its shard to the tapped X0 Card, which combines it with its own shard.
* **Any two X0 Cards:** Used to restore the wallet on a new phone. One card's shard is sent to the other over the card-to-card secure channel.

In every case, the secret is only ever reconstructed inside the secure element of an X0 Card and is erased as soon as the operation is complete.