As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10):

Clip of the key generation protocol from Gennaro & Geldfeder, 2018

In Phase 1, they create a (commitment, decommitment) pair using a commitment scheme. Earlier in the paper, they mention that “in practice one can use any secure hash function H and define the commitment to x as h = H(x, r), for a uniformly chosen r of length λ and assume that H behaves as a random oracle. We use this efficient random oracle version in our implementation” (see p.6, bottom). As I understand, they reduce commitment to an HMAC with a key r. What is the decommitment string in this case? Is it r or is it x? What purpose does decommitment string serve at all?

In Phase 1, the commitment string is broadcast. Then, in Phase 2, the decommitment string is broadcast. As I understand, separation is done so that everybody makes their commitment before seeing anybody's decommitment.

Next sentence: “Let yi be the value decommitted by Pi”. So does yi = KGDi = r?

Next sentence: “The player Pi performs a (t, n) Feldman-VSS of the value ui, with yi as the “free term in the exponent”. In your typical polynomial secret sharing (e.g. Shamir), whatever value you are sharing is the free term in the polynomial. So to me this looks like it contradicts itself saying that we are sharing ui and yi at the same time. Does “free term in the exponent” not mean the free term of the polynomial? Does Feldman-VSS work differently from Shamir?

Then, “the resulting values xi are a (t, n) Shamir’s secret sharing of the secret key x = $\sum$i ui”. Why? Is this secret key paired to the public key y?

Any comments would be very welcome!


A general commitment scheme consists of two pharse:

  1. commitment phase: the sender encrypts a message to a commitment value by using one-way function with some random values, such as the coin tosses r in your post. This pharse can make sure that no malicious receiver gain any information about the message.
  2. decommitment phase: the sender should transmit some evidence to prove that the above commitment value is correct.

For example, assuming that we have a secure hash function H(x,r)=H($X·h^r$) where X=$g^x$ as the public key, x is the secret value, r is a random value, then we can generate a commitment C= H($g^x·h^r$). To prove the correctness of commitment value C, the sender should send the decommitment value R= $h^r$ to the receiver with a ZK proof of knowing r, then receiver check whether C = H(X·R) is hold.

The above commitment scheme was just an unsound example. But in my understanding, the $y_i$ maybe the R I thought.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.