// additive secret sharing for groups

Everyone counts.
Nobody tells.

Mainnet · checking… Status: Ticker (placeholder, no token exists):
// the working app · a real multi-party room

Pull up a chair

Set a table for 3–12 people, share the invite link, and everyone types their number in their own browser. When every seat is filled, each person seals their shares and the total appears for everyone. Try it with several browser tabs or devices.

Set a table

Pick how many people will contribute. The table locks when every seat is taken.

Rooms live only in this server's memory, expire after 2 hours (30 minutes after the result), and are lost if the server restarts.

The table

no table

Create or open a table to see the seats here.

    // one-page simulation

    Simulate a table of N people

    All seats sit in this one tab, so this tab sees everything — this mode is for understanding, not privacy. It runs the exact same code path: random shares, real ECDH + AES-GCM envelopes, partial sums, total.

    // how it works

    Split, seal, sum

    1. Everyone gets a key. Each seat creates an ECDH P-256 key pair in the browser (Web Crypto) and posts only the public key. A short fingerprint of each key is shown so people can compare them out of band.
    2. Split your number. Your value v (scaled to an integer with 9 decimals) is split into N shares: N−1 uniformly random numbers modulo the prime p = 2²⁵⁵ − 19, plus one more chosen so all N add up to v mod p. Any N−1 of them look like pure noise.
    3. Seal one share per seat. Share j is encrypted to seat j with AES-256-GCM, using a key derived by HKDF-SHA-256 from the ECDH secret between you and j, bound to the room and the direction. You keep your own share. The relay just stores the envelopes.
    4. Publish a partial sum. Once all envelopes are in, each seat decrypts the N−1 shares addressed to it, adds its own kept share, and publishes that single partial sum. It is a sum of shares from everyone, so on its own it reveals nothing about anyone.
    5. Anyone adds it up. The partial sums add up to the total of all values mod p. Every browser, even an observer's, computes the total and the average from the public partials itself.
    Σj partialj = Σj Σi sharei→j = Σi ( Σj sharei→j ) = Σi vi (mod p)
    // privacy model

    What stays at your seat, and what doesn't

    Hidden

    • Your individual number — from the server, from observers, and from any group smaller than everyone else at the table
    • Each share in transit: the relay only sees AES-GCM ciphertext
    • Who contributed more or less: partial sums are random-looking on their own
    • Your private key: generated non-extractable, in this tab only

    Revealed or leaked

    • The total and the average — that is the point, and it is public to everyone who opens the link
    • Collusion of N−1: if everyone else pools their numbers, total minus theirs is yours. With 3 people, the other two together learn your value
    • Who sat down, their display names and when they acted (and the server sees IP addresses)
    • If you use the balance lookup: which address you asked about, to this server and its RPC provider

    Fairsum reduces information exposure: a group can learn an aggregate without collecting everyone's raw numbers. It does not provide anonymity, and it cannot make people honest.

    Known limitations — please read

    • The total leaks by design. Small groups learn a lot from it: if you know everyone else's number, you know the last one. An average of 3 people says more than an average of 30.
    • Collusion of N−1 breaks it. Any N−1 participants who share what they know can compute the last person's value. Fewer colluders learn only the sum of the remaining people.
    • People can lie. Nothing proves a contributed number is true or in range — not even the balance option, since an address is not proven to be yours. One participant can push the total anywhere. There are no range proofs.
    • Seat squatting and Sybils. Anyone with the invite link can take a seat until it is full, and one person can take several seats (which counts as collusion). Share the link only with the intended group and check names and key fingerprints.
    • The relay could swap keys. A malicious server could hand out its own public keys and read shares (a man-in-the-middle). Compare fingerprints over another channel if that matters. This server's code relays keys unchanged.
    • Everyone must finish. If one seat leaves, the round stalls and nothing can be recovered — start a new table. Reloading a tab gives up the seat.
    • Memory only. Rooms are held in server memory with size limits, expire after 2 hours (30 minutes after a result) and vanish on restart.
    • No token, no on-chain program. The ticker is a placeholder label and nothing is written to Solana. The only mainnet use is reads (current slot, optional balance).
    • Experimental and unaudited. The protocol is honest-but-curious secure only, implemented in this page for demonstration. Do not use it for anything where a wrong or leaked number causes harm.