01
Authenticated threshold recovery
A random 32-byte data key encrypts the secret with ChaCha20-Poly1305. Shamir splits the key, not the plaintext, so invalid combinations fail authentication instead of returning plausible garbage.
Open-source recovery infrastructure
Recovery should fail loudly.
shard-core protects secrets with authenticated encryption and threshold recovery. It is designed for offline ceremonies where corruption, mixed shares, unsafe files, and accidental plaintext output must produce a clear failure instead of a convincing wrong answer.
Stable v0.2.0Python 3.9+Apache-2.0 or MIT-0No telemetryExplicit plaintext output
Quick install
Install the stable package from PyPI.
Version 0.2.0 is published from the immutable release tag through PyPI Trusted Publishing. Pin the version so the package you evaluate is the package documented on this page.
Connected hostPython 3.9+
python3 -m venv .venv
. .venv/bin/activate
python -m pip install 'shard-core==0.2.0'
shard-core --versionOptional SLIP-39 support:shard-core[slip39]==0.2.0
The construction
Encrypt once. Split the key.
The plaintext is encrypted with a random data-encryption key. Shamir sharing then divides that key into the configured threshold. Each shard contains one unique key share and the same authenticated ciphertext.
The repeated ciphertext is intentional. It costs storage, but it makes every valid threshold subset self-contained and easier to distribute, inventory, and recover without a separate ciphertext dependency.
plaintext
|
| ChaCha20-Poly1305 + random DEK
v
authenticated ciphertext C
^
|
random DEK -- Shamir --> K1 K2 ... Kn
| | |
SHRD i = header + unique Ki + repeated CDesigned around failure
The ceremony is part of the system.
Cryptography is only one boundary. The CLI also constrains recovery behavior, filesystem writes, dependency acquisition, and operator evidence.
02
Fail-closed file handling
Plaintext output must be explicit. Existing regular files require explicit --force, symlinks remain refused, multi-file writes are preflighted, and newly created private files and directories receive restrictive permissions.
03
Resilient recovery
Bounded threshold combinations can bypass an extra corrupt share. Conflicting duplicates and multiple independent valid sets fail clearly instead of selecting an arbitrary result.
04
Verifiable offline distribution
A rootless Podman pipeline builds twice from reviewed inputs with networking disabled, compares results, and emits an installable bundle with hashes, an SBOM, and provenance.
Choose the right path
One tool, three explicit workflows.
General secrets
SHEN or SHRD
Encrypt one artifact with a separately held credential, or create threshold shares where any configured subset recovers the authenticated plaintext.
Read the quickstartFordefi
Choose backup first
Fordefi Public Key Upload uses its matching private-key recovery path and does not require shard-core. Recovery Phrases can be protected as SHEN ciphertext or SHRD threshold shares after the organization selects that method.
Open the Fordefi runbookHuman-readable shares
Explicit SLIP-39
Optional SLIP-39 support is available for material independently confirmed to be compatible. The Fordefi wizard never assumes a recovery phrase is BIP-39.
Inspect compatibility detailsAdvanced verified build
Package-index access stays outside the ceremony.
The advanced Linux build starts with reviewed locks and wheelhouses, pins the local build tools and OCI image by digest, disables container networking, builds twice, and compares the resulting wheel bytes before producing an offline bundle.
Inspect the complete build boundaryreviewed commit + locks + wheels
|
+--> OCI build A --+
| +--> byte comparison
+--> OCI build B --+
|
v
bundle + SBOM + SHA256SUMSSecurity posture
Inspectable, not magically safe.
shard-core has extensive normal, optimized-mode, compatibility, file-safety, and release-boundary tests. It has not received an independent professional security audit. Tests and AI-assisted review are engineering evidence, not an audit.
The threat model assumes a trusted offline host and controlled parent directories. It does not solve endpoint compromise, physical coercion, threshold-holder collusion, vendor failure, or guaranteed secure deletion.
AI-assisted operation
The prescribed workflow keeps secrets out of agent context.
Repository-level agent instructions define the safe walkthrough: one step at a time, secrets entered only into local hidden prompts, explicit output files, and chat responses limited to non-secret status and approved artifact hashes. This boundary depends on the operator following the procedure.
Recovery phrases, shards, wrapping credentials, snapshots, private keys, and secret-file hashes do not belong in prompts, logs, issues, screenshots, or pull requests.
Open source, not a custody service
Read it. Rehearse it. Recover before you rely on it.
shard-core is software, not a custodian, recovery provider, warranty, or substitute for Fordefi's recovery tool or any holder agreement. Use synthetic material first, verify every intended threshold combination, and test the real retrieval path before protecting production secrets.