getsops/sops · error

parts cannot exceed 255

Error message

parts cannot exceed 255

What it means

Split() internally stores each share's x-coordinate in a single byte, so the total number of parts is capped at 255. Requesting more parts than a byte can index is rejected.

Source

Thrown at shamir/shamir.go:200

// add combines two numbers in GF(2^8)
// This can also be used for subtraction since it is symmetric.
func add(a, b uint8) uint8 {
	// Addition in GF(2^8) equals XOR:
	return a ^ b
}

// Split takes an arbitrarily long secret and generates a `parts`
// number of shares, `threshold` of which are required to reconstruct
// the secret. The parts and threshold must be at least 2, and less
// than 256. The returned shares are each one byte longer than the secret
// as they attach a tag used to reconstruct the secret.
func Split(secret []byte, parts, threshold int) ([][]byte, error) {
	// Sanity check the input
	if parts < threshold {
		return nil, fmt.Errorf("parts cannot be less than threshold")
	}
	if parts > 255 {
		return nil, fmt.Errorf("parts cannot exceed 255")
	}
	if threshold < 2 {
		return nil, fmt.Errorf("threshold must be at least 2")
	}
	if threshold > 255 {
		return nil, fmt.Errorf("threshold cannot exceed 255")
	}
	if len(secret) == 0 {
		return nil, fmt.Errorf("cannot split an empty secret")
	}

	// Allocate the output array, initialize the final byte
	// of the output with the offset. The representation of each
	// output is {y1, y2, .., yN, x}.
	out := make([][]byte, parts)
	for idx := range out {
		// Store the x coordinate for each part as its last byte
		// Add 1 to the xCoordinate because if the x coordinate is 0,

View on GitHub (pinned to 13442bb981)

Solutions

1. Reduce parts to <= 255; split into multiple independent shards if more are needed.
2. Validate the parts value before calling Split.
3. Re-architect to nested splitting (split shares again) if >255 holders are truly required.

Example fix

// before
shares, err := shamir.Split(secret, 300, 5)
// after
if parts > 255 { parts = 255 }
shares, err := shamir.Split(secret, parts, 5)

if parts > 255 {
    return fmt.Errorf("parts must be <= 255, got %d", parts)
}

When it happens

Trigger: Calling Split(secret, parts, threshold) with parts > 255, e.g. Split(secret, 300, 5).

Common situations: Mass-distributing shares to hundreds of nodes, misconfigured replica counts, or a parts value read from user input without bounds checking.

Related errors

• threshold cannot exceed 255
• parts cannot be less than threshold
• threshold must be at least 2
• cannot split an empty secret
• less than two parts cannot be used to reconstruct the secret

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/01251127b69b5720. Report an issue: GitHub.