How to forge a Shamir secret share? On this website, we have a lot of questions and answers devoted to Shamir secret sharing. We make it clear that Shamir secret sharing does not guarantee integrity. When we want integrity, we need to use a verifiable threshold scheme. But it is never explained how a malicious secret is actually forged.

Consider an easy setup of the scheme with 2 shares and threshold $k = 2$. Assume the adversary knows the secret message $m$ and share 1 (but not share 2). The shares are evaluated at $x_1 = 1, x_2 = 2$.

How does the adversary forge a chosen secret $m'$?
For us to make it exciting, let's first define the meaning of two sample messages:


$m : $ "yes, in case of m.a.d., do fire the missiles"
$m' : $ "no, do not fire missiles"



Let's guess that the current president has chosen $m$ as the message, and we the adversary (and holder of share 1) want to change it to $m'$.

Recall that the polynomial is of the following form:

$$p(x) = a_1x + m$$

We know share 1. In other words we know a value $y_1$ such that :

$$y_1 = a_1 + m $$

So now we have two values. This is enough to get the original polynomial back. We now know the original polynomial, and can reconstruct the second share:

$$
\begin{align} 
p(x) &amp;= (y_1 - m) \cdot x + m \\
y_2 = p(2) &amp;= (y_1 - m) \cdot 2 + m
\end{align}
$$

During the recombination phase of the algorithm, the secret $m$ will be constructed by computing $2y_1 - y_2 = m$. We can rewrite this equation and compute a new forged $y_1'$:

$$
y_1' =
\frac{m' + y_2}{2} =
\frac{m' + (y_1 - m) \cdot 2 + m}{2}
$$
Which simplifies to:
$$
y_1' = y_1 + \frac{m' - m}{2}
$$

Now we have constructed a new share which will, together with the second share, combine to the new secret message $m'$.

We see that in your (my?) case we could indeed choose any new message $m'$.