Threshold secret sharing

An $(r,s)$ threshold secret-sharing scheme issues $s$ shares: every collection of at least $r$ shares reconstructs the secret, while every collection of fewer than $r$ shares has a distribution independent of the secret.

Shamir's secret sharing places a secret $N$ at the constant term of a random polynomial $f\in {\mathbb{F}}_p[X]$ of degree at most $r-1$ and issues distinct nonzero evaluation pairs $(x_i,f(x_i))$. Any $r$ shares recover $f$ by polynomial interpolation. Given fewer than $r$ shares, every candidate constant term has the same number of compatible coefficient tuples, which gives perfect secrecy.

Conditioned on any $r-1$ shares in Shamir's secret sharing, each candidate secret in ${\mathbb{F}}_p$ remains equally likely. Appending $(0,N)$ to those shares determines exactly one degree-at-most-$(r-1)$ polynomial for every candidate $N$, by the nonzero Vandermonde determinant.