secret sharing scheme for 3-of-5 shares (for BIP39 mnemonic phrase of 24 words)
Figured out a solution that can easily be done with a pen and paper and at most a pocket calculator.

You take your secret (264 bits) and divide into 6 equal-length parts. Call them A, B, C, D, E, F.

For brevity I write XY as meaning X xor Y.

Share 1: A,B
Share 2: C,D
Share 3: E,F
Share 4: CE,AF,BD (remember these are xors)
Share 5: ABCE,ACDF,BDEF


Now with a bit of xoring any 3 of these give you the entire secret. I'll write a proper blog post with instructions exactly how to combine shares and a proof that it's reliable.

Downside is that unlike SSSS, each share is only 1/3 of the entropy, so if someone has two of the five shares, it's only 2**88 attempts to guess the third. Still, 88 bit entropy by itself is not bad at all, at least in my book.

Also, unlike SSSS, the "order" of shares is important. You need to note beside each share which it's supposed to be (S1, S2...) so you know what sort of xoring to do.

What do you think? Any other weakness in this?