Here's a paper that talks about a pre-commit DKG in detail https://eprint.iacr.org/2019/114.pdf. It also includes some repudiation and decommitment features.
As a summary, each party does these steps:
- roll a random number
- publish the hash of (some dlp-hard-group-generator to the power of that random number)
- after you get everyone's hashes, publish g to the power of that random number along with a signature, using g, proving ownership of that same random number
- as long as everyone's hashes match up, compute the LagrangeSum(g) for the group
- now you have a distributed M-Of-M key, and a public key corresponding to it, and a proof-of-secret key too. any dishonest players result in the whole protocol failing
- you can redistribute this key to M-Of-N players using VSSS.
A more broadly referenced solution is the ECDKG here:
Which relies on publishing and verifying commitments to polynomial coefficients, and secret communications between parties to ensure sharing was done correctly. It is more robust to dishonest players, and ultimately works in 2 rounds for M of N instead of the 3 rounds (above).
IMO, the pre-commitment scheme is both easier to understand and easier to get right.