Whilst I was studying the mDP protocol I came across into the following step:

Group Key agreement: Each $U_i$ checks whether $z_1 \bigoplus ... \bigoplus z_n = 0$ and whether all signatures $\sigma_i$ are valid and aborts if any of these checks fails. Otherwise, $U_i$ proceeds as follows: iteratively for each $j=i,...i+n-1: z'_{j,j+1}:=z'_{j-1,j} \bigoplus z_j $ ...

But I cannot understand on the notation what does it mean by $z'_{j-1,j}$ where does it find it is the $z_i$ received from the other participants?

The paper is in springler and is titled as;

"Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys (Full Version)" authored by: Abdalla Michel, Chevalier Celine,Manulis Mark,Pointcheval David

an alternative from Pointcheval's web site.

  • $\begingroup$ could you post a link to the article? $\endgroup$
    – kelalaka
    Oct 9 '18 at 20:00
  • $\begingroup$ Info added, keep in mind that the paper is free only via academic vpn but there are many other. $\endgroup$ Oct 10 '18 at 12:28
  • $\begingroup$ Everything is clear now? $\endgroup$
    – kelalaka
    Oct 17 '18 at 18:53
  • $\begingroup$ An another question arose The participant got the $z_i$ from others, ans all $z_i$ Xore'd equals , then where the $z'_j-1,j$ is located at the first time the participant calculates the common key. I would love an execution example (or a link to interactive simulator) $\endgroup$ Oct 17 '18 at 19:05
  • $\begingroup$ Well, I looked at it for fun, when I've found the time. If you look at the $z_i$ calculation, you will see that, if everybody is semi-honest, the $\oplus =0$. The $z'_{j-1,j}$ are stored on the users when calculated. I believe you can program this very easily. $\endgroup$
    – kelalaka
    Oct 17 '18 at 19:38

As said in page 6, Each $U_i$ proceeds as follows;

  • compute $\text{sid}_i:= U_1|y_1,\ldots,U_n|y_n)$,
  • $z'_{i-1,i} := H(k'_{i-1,i}, \text{sid}_i)$,
  • $z'_{i+1,i} := H(k'_{i+1,i}, \text{sid}_i)$,
  • $z_i := z'_{i-1,i} \oplus z'_{i+1,i}$,
  • $\sigma_i := \text{Sign}(sk_i, (U_i,z_i,\text{sid}_i ))$,
  • $\text{broadcast} (U_i,z_i,\sigma_i)$.

since in the beginning, the $(U_i,y_i)$ is broadcasted the above calculation is fine.

When a user $U_j$ gets all $(U_i,z_i,\sigma_i) , 1 \leq i \leq n$, he is ready to verify. Actually, they agree on a key with their neighbors by Diffie-Hellman Key Exchange protocol.

  • $\begingroup$ @MaartenBodewes I started looking back for this a while ago. Nice to hear the same idea. And it is encouraging them to ask questions and sometimes they can be very interesting. This comment will not auto-destruct :P $\endgroup$
    – kelalaka
    Oct 17 '18 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.