VaultSplit

VaultSplit is a Python security library for splitting a 256-bit secret into multiple Shamir Secret Sharing shares and using the reconstructed secret to encrypt data with AES-256-GCM.

Features

• 256-bit cryptographically secure secret generation
• Shamir Secret Sharing
• Default 6-of-10 threshold
• AES-256-GCM authenticated encryption
• HKDF-SHA256 key derivation
• Share/vault integrity metadata
• Text and file encryption APIs
• Command-line interface
• Ready for PyPI packaging

Install locally

py -m pip install -e .

Python API

from vaultsplit import Vault

vault = Vault("./myvault")
vault.create(total_shares=10, threshold=6)

ciphertext = vault.encrypt_text("Merhaba dünya!")
print(vault.decrypt_text(ciphertext))

File encryption

from vaultsplit import Vault

vault = Vault("./myvault")
vault.encrypt_file("secret.txt", "secret.vault")
vault.decrypt_file("secret.vault", "secret_recovered.txt")

CLI

vaultsplit init ./myvault --shares 10 --threshold 6
vaultsplit status ./myvault
vaultsplit encrypt-file ./myvault secret.txt secret.vault
vaultsplit decrypt-file ./myvault secret.vault recovered.txt

Security model

This library does not become secure merely because the shares are stored in ten files. If an attacker can read all ten files, they can reconstruct the secret. Threshold sharing becomes useful when shares are separated across distinct trust domains, such as different machines, accounts, removable media, or physical backups.

AES-GCM provides confidentiality and authentication for encrypted data. The application still needs secure operating-system permissions, safe backup practices, and an appropriate threat model.

This project is educational/experimental and has not been independently audited. Do not use it as the sole protection for high-value production secrets without a professional security review.