# Gennaro & Goldfeder Key Generation Protocol

As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10):

In Phase 1, they create a (commitment, decommitment) pair using a commitment scheme. Earlier in the paper, they mention that “in practice one can use any secure hash function H and define the commitment to x as h = H(x, r), for a uniformly chosen r of length λ and assume that H behaves as a random oracle. We use this efficient random oracle version in our implementation” (see p.6, bottom). As I understand, they reduce commitment to an HMAC with a key r. What is the decommitment string in this case? Is it r or is it x? What purpose does decommitment string serve at all?

In Phase 1, the commitment string is broadcast. Then, in Phase 2, the decommitment string is broadcast. As I understand, separation is done so that everybody makes their commitment before seeing anybody's decommitment.

Next sentence: “Let yi be the value decommitted by Pi”. So does yi = KGDi = r?

Next sentence: “The player Pi performs a (t, n) Feldman-VSS of the value ui, with yi as the “free term in the exponent”. In your typical polynomial secret sharing (e.g. Shamir), whatever value you are sharing is the free term in the polynomial. So to me this looks like it contradicts itself saying that we are sharing ui and yi at the same time. Does “free term in the exponent” not mean the free term of the polynomial? Does Feldman-VSS work differently from Shamir?

Then, “the resulting values xi are a (t, n) Shamir’s secret sharing of the secret key x = $$\sum$$i ui”. Why? Is this secret key paired to the public key y?

Any comments would be very welcome!

For example, assuming that we have a secure hash function H(x,r)=H($$X·h^r$$) where X=$$g^x$$ as the public key, x is the secret value, r is a random value, then we can generate a commitment C= H($$g^x·h^r$$). To prove the correctness of commitment value C, the sender should send the decommitment value R= $$h^r$$ to the receiver with a ZK proof of knowing r, then receiver check whether C = H(X·R) is hold.
The above commitment scheme was just an unsound example. But in my understanding, the $$y_i$$ maybe the R I thought.