Secret Key.

As in RSA, there exists a corresponding secret key DK_i=(n_i,d_i) where $d_i*e_i=1 \pmod{\phi(n_i)}$. However, as mentioned above, no one has possession of d_i. Instead, d_i is effectively split into two parts d_i^u and d_i^sem which are held by the user U_i and a SEM, respectively. The relationship among them is:

$$d_i\;=\;d_i^{sem}\;+\;d_i^u \; \bmod \; \phi(n)$$