getsops/sops · error

threshold cannot exceed 255

Error message

threshold cannot exceed 255

What it means

Like parts, the threshold is encoded in the polynomial degree and share tags as a single byte, so it cannot exceed 255. Split() rejects larger thresholds.

Source

Thrown at shamir/shamir.go:206

// Split takes an arbitrarily long secret and generates a `parts`
// number of shares, `threshold` of which are required to reconstruct
// the secret. The parts and threshold must be at least 2, and less
// than 256. The returned shares are each one byte longer than the secret
// as they attach a tag used to reconstruct the secret.
func Split(secret []byte, parts, threshold int) ([][]byte, error) {
	// Sanity check the input
	if parts < threshold {
		return nil, fmt.Errorf("parts cannot be less than threshold")
	}
	if parts > 255 {
		return nil, fmt.Errorf("parts cannot exceed 255")
	}
	if threshold < 2 {
		return nil, fmt.Errorf("threshold must be at least 2")
	}
	if threshold > 255 {
		return nil, fmt.Errorf("threshold cannot exceed 255")
	}
	if len(secret) == 0 {
		return nil, fmt.Errorf("cannot split an empty secret")
	}

	// Allocate the output array, initialize the final byte
	// of the output with the offset. The representation of each
	// output is {y1, y2, .., yN, x}.
	out := make([][]byte, parts)
	for idx := range out {
		// Store the x coordinate for each part as its last byte
		// Add 1 to the xCoordinate because if the x coordinate is 0,
		// then the result of evaluating the polynomial at that point
		// will be our secret
		out[idx] = make([]byte, len(secret)+1)
		out[idx][len(secret)] = uint8(idx) + 1
	}

View on GitHub (pinned to 13442bb981)

Solutions

1. Reduce threshold to <= 255 (and to <= parts).
2. Validate both parts and threshold ranges at the call site.
3. Use multiple independent splits for larger quorum schemes.

Example fix

// before
shares, err := shamir.Split(secret, 400, 300)
// after
shares, err := shamir.Split(secret, 255, 128)

if threshold > 255 {
    return fmt.Errorf("threshold must be <= 255, got %d", threshold)
}

When it happens

Trigger: Calling Split(secret, parts, threshold) with threshold > 255 (and implicitly parts >= threshold > 255).

Common situations: Very large quorums computed from cluster size, or validation done only on parts but not threshold.

Related errors

• parts cannot exceed 255
• parts cannot be less than threshold
• threshold must be at least 2
• cannot split an empty secret
• less than two parts cannot be used to reconstruct the secret

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/9975bb18036331c5. Report an issue: GitHub.