If you have $t-1$ shares of an $(t,n)$ system, you have a chance at learning of the roots of the system... as long as some of your shares have a 0 for the $y$ coordinate. You can't learn any other roots.
Demonstration that the possession of a share with a $y$ coordinate of 0 gives you knowledge of a root (and forgive me if this is too obvious):
- A share in Shamir's scheme is a pair $(x, P(x))$, where $x$ is a nonzero coordinate, and $P(x)$ is the secret polynomial evaluated at that coordinate. If the $y$ coordindate listed happens to be 0, we have $P(x) = 0$, which is pretty much the definition of $P$ has a root at $x$.
Demonstration that the attacker cannot learn any roots at locations other than the $x$ coordinates for the shares he has:
- Consider what would happen if he could. By learning of a value $x'$ which does not appear as an $x$ coordinate for any of the shares he has, and for which $P(x')=0$, he could treat that as another share $(x', 0)$, and use that, and his $t-1$ existing shares, and learn the entire polynomial. We know he can't do that, and so he can't learn such an $x'$