getsops/sops · error

less than two parts cannot be used to reconstruct the secret

Error message

less than two parts cannot be used to reconstruct the secret

What it means

Combine() needs at least 2 shares to perform Lagrange interpolation; with 0 or 1 parts reconstruction is impossible. The library validates the minimum count before doing any math.

Source

Thrown at shamir/shamir.go:259

			// Add 1 to the xCoordinate because if it's 0,
			// then the result of p.evaluate(x) will be our secret
			x := uint8(i) + 1
			// Evaluate the polynomial at x
			y := p.evaluate(x)
			out[i][idx] = y
		}
	}

	// Return the encoded secrets
	return out, nil
}

// Combine is used to reverse a Split and reconstruct a secret
// once a `threshold` number of parts are available.
func Combine(parts [][]byte) ([]byte, error) {
	// Verify enough parts provided
	if len(parts) < 2 {
		return nil, fmt.Errorf("less than two parts cannot be used to reconstruct the secret")
	}

	// Verify the parts are all the same length
	firstPartLen := len(parts[0])
	if firstPartLen < 2 {
		return nil, fmt.Errorf("parts must be at least two bytes")
	}
	for i := 1; i < len(parts); i++ {
		if len(parts[i]) != firstPartLen {
			return nil, fmt.Errorf("all parts must be the same length")
		}
	}

	// Create a buffer to store the reconstructed secret
	secret := make([]byte, firstPartLen-1)

	// Buffer to store the samples
	xSamples := make([]uint8, len(parts))

View on GitHub (pinned to 13442bb981)

Solutions

1. Collect and pass at least `threshold` shares (minimum 2).
2. Check the collection step that assembled the parts slice for empty/failed reads.
3. Guard the call site with len(parts) >= expectedThreshold.

Example fix

// before
secret, err := shamir.Combine([][]byte{share1})
// after
if len(shares) < threshold { return fmt.Errorf("need %d shares, have %d", threshold, len(shares)) }
secret, err := shamir.Combine(shares)

if len(parts) < threshold {
    return fmt.Errorf("need at least %d shares to combine, got %d", threshold, len(parts))
}

When it happens

Trigger: Calling Combine(parts) with an empty slice or a single share, e.g. Combine([][]byte{}) or Combine([][]byte{share1}).

Common situations: Only one custodian responded with their share, shares were lost/never collected, or an empty slice from a failed read of stored shares.

Related errors

• parts cannot be less than threshold
• threshold must be at least 2
• parts cannot exceed 255
• threshold cannot exceed 255
• cannot split an empty secret

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/6c74a117b611bc3e. Report an issue: GitHub.