In a shamir secret sharing scheme, why can't the secret be a middle coefficient and only the first or the last? In the shamir secret sharing scheme, the Secret s is set as the constant in the equation 

$ y_p = s+ \sum_{i=0}^{i = t-1} a_i * x_p^i$

s can only be the constant term or the last coefficient or the secret may be leaked. This is also per question below:

Coefficients in Shamir&#39;s Secret Sharing Scheme

How can I show this rigorously in a mathematical way? In the provided answer only an example is given. 



Updated:

The mathematical way I currently have to show this is for the case of a (t,n) system where t = 3, sharing between two people, and y defined as 

$y_1 = a_0 + s*x_1 + a_1*x_1^2$ mod P

$y_2 = a_0 + s*x_2 + a_1*x_2^2$ mod P

Then by rearranging (or by taking inverse of matrix) we have 

$s = (y_2 - y_1)(x_2 - x_1) ^{-1} - a_1(x_2+x_1)$ mod P

and we get the case where S is revealed when $(x_2+x_1)$ mod P = 0. 

How would we show using similar (or different) argument for t>=3, t-1 shares, that we will not have similar cases when s is the constant or the very last coefficient?
Here's one way to approach the question: if we have a $(n, t)$ Shamir secret sharing system, and we have $t-1$ shares $(x_0, y_0), (x_1, y_1), …, (x_{t-2}, y_{t-2})$, then all we can deduce that the secret polynomial is of the form:

$$P(x) + c \prod_{i=0}^{t-2}(x - x_i)$$

where $P(x)$ is a computable polynomial (exactly what that polynomial is depends on the known shares), and $c$ is an unknown constant (and which we have no information about).

So, the question is: given that the polynomial is of this form (for some $c$), and the secret we want is the $j$th coefficient, can we deduce the coefficient that's the secret we're interested in?

We know the $j$th coefficient for $P(x)$, and so this reduces to whether we know the $j$th coefficient of $c \prod_{i=0}^{t-2}(x - x_i)$; we can if and only if the $j$th coefficient of the polynomial $\prod_{i=0}^{t-2}(x - x_i)$ is 0.  If it is 0, then (no matter what $c$ is) the $j$th coefficient of the entire polynomial will be the $j$th coefficient of $P(x)$ (which we know); if it is nonzero, then (depending on what $c$ is) it could be any value.

For the linear term ($j=0$), this coefficient is $\prod_{i=0}^{t-2}-x_i$, which (because we're in a field) is nonzero if and only if all the $x_i$ values are nonzero (which they are in Shamir's scheme).

For the highest term ($j=t-2$), this coefficient turns out to be 1, hence the secret is never leaked (even if the share $x_i=0$ was issued).

For the second term ($j=1$), this coefficient turns out to be $-\sum_{i=0}^{t-2}x_i$, that is, the secret is revealed if $x_0 + x_1 + … + x_{t-2} = 0$, which (for the case $t=3$) is what you came up with.  Further note that, if we're in an even characteristic field ($1+1=0$), then $x_0 + x_1 \ne 0$ (unless $x_0 = x_1$, which cannot happen), hence in that specific case, the secret is not revealed.

Since I wrote the original answer, I found yet another corner case which is secure; if the field order is $p^z$ (that is, the field has that many elements), and if $t = p^z-1$, and the share $x_i = 0$ is not issued, then all coefficients are secure.  That's because, for any $k$ $(k$ being the share which is not revealed), we have $\prod_{i \in GF(p^z), i \ne 0, k}(x - x_i) = (x^{t} - 1) / (x - k)$, and that doesn't have any 0 coefficients.  For course, this really is a corner case, as there are only $t$ possible shares, and we need all $t$, hence this is a $(t, t)$ secret sharing scheme (and if so, why are we bothering with Shamir anyways; there are simpler methods).

Other than those cases, it is plausible for me to speculate (although I don't have proof) that for any middle coefficients, one can find a set $x_0, x_1, …, x_{t-2}$ that does leak the secret, assuming that the adversary can pick which shares he gets (which is analogous to the CPA assumption).