Key Split

Key splitting partitions a private key (or a seed) into multiple shares such that any threshold number can reconstruct the secret but fewer cannot. The canonical math is Shamir's Secret Sharing (SSS), published in 1979: any k of n shares rebuild the secret, and k-1 shares reveal nothing at all.

In Bitcoin practice, the standard form is SLIP-39, which splits a wallet's BIP 32 master seed into shares written as words from its own 1024-word list. It is a replacement for BIP 39, proposed by BIP 39's own authors, not a wrapper around it: an existing 12 or 24 word phrase can only be converted by splitting its derived 512-bit seed, which makes every share 59 words long, and the spec advises moving funds to a fresh SLIP-39 wallet instead. Trezor implements it natively. Common configurations: 2-of-3 or 3-of-5 shares spread across geographic locations or trusted parties.

The crucial caveat that most introductions skip: key splitting is not the same security model as multisig.

• Multisig: each cosigner signs independently with their own key, and the M signatures get combined by the script. No single device ever holds the spending capacity.
• Shamir-style key splitting: at signing time, the threshold of shares must be combined back into a single private key on one device, which then signs. That device momentarily holds the full key.

Threshold signature schemes such as FROST are a third model: the key is split into shares that each sign their own piece, and the shares are never recombined. In security terms they sit closer to multisig, but they are only starting to appear in Bitcoin wallets.

So key splitting is excellent for cold backup distribution (no one location is sufficient to steal the wallet) but worse than multisig for hot/warm operational use (the reconstruction event is a juicy target). A common pattern is multisig for the operational layer, with SSS used only to distribute the backup of a single key.