ShardGate

Inspiration

An AI agent that reads documents needs the plaintext to answer, but the moment a master key exists whole in a config file or in memory, one prompt injection or one compromise exposes every file. We wanted an agent where the master key never exists whole.

What it does

ShardGate is an AI agent that answers questions over encrypted documents while the master key never exists as a single value:

• The master key is split with Shamir's Secret Sharing into 3 shards over GF(2^8), with a 2-of-3 threshold. The shards live in separate stores, and the key is reconstructed only inside RAM for the instant a decryption needs it, then zeroized.
• Every file at rest is AES-256-GCM encrypted. The agent decrypts only in memory, never writes plaintext to disk, and answers the question from the in-RAM text.
• Every query, decrypt, tamper event and refusal is appended to a JSONL audit trail, and a Flask dashboard shows the live state of the shards and the log.
• If a shard is lost (one missing is fine, two are not), the threshold fails and the agent refuses to unlock rather than degrading security.
• Adversarial behavior is built in: flipping a single byte of ciphertext makes AES-GCM authentication fail on the next query, so tampered files are detected, not silently answered.

How we built it

Python end to end. Shamir splitting is implemented over GF(2^8) using polynomial interpolation, file encryption uses PyCryptodome's AES-GCM, the agent loop and audit log are plain Python, and the dashboard is Flask. The answerer is pluggable: the demo uses an offline extractive answerer, and the same interface accepts any LLM.

The whole flow is verified by tests: 6 pytest tests cover the split, the reassembly, tamper detection, threshold refusal, audit logging and the agent answer path, all passing.

Challenges we ran into

The subtle part was making the key exist only as shards everywhere outside the reconstruction instant: key material must be zeroized after use, and nothing may accidentally persist the reconstructed key. Making the tamper case behave correctly (GCM refusing instead of returning garbage) and distinguishing it from a lost-shard case took the most care.

What we learned

How Shamir's Secret Sharing actually works at the field level, why authenticated encryption like AES-GCM matters for tamper detection, and how to design an agent so its convenience (reading your documents) never creates a single point of failure (one master key).

What's next

Distributed shard storage across separate machines, a hardware-backed root of trust, and running the agent against real LLM backends with prompt-injection red-teaming.

Entry for the AI pipelines track, Mathematics for Systems Security.

Built With

• aes-256-gcm
• flask
• pycryptodome
• pytest
• python
• shamir-secret-sharing