# mDP kay agreement protocol where z's are found on the step where the common key is generated?

Whilst I was studying the mDP protocol I came across into the following step:

Group Key agreement: Each $$U_i$$ checks whether $$z_1 \bigoplus ... \bigoplus z_n = 0$$ and whether all signatures $$\sigma_i$$ are valid and aborts if any of these checks fails. Otherwise, $$U_i$$ proceeds as follows: iteratively for each $$j=i,...i+n-1: z'_{j,j+1}:=z'_{j-1,j} \bigoplus z_j$$ ...

But I cannot understand on the notation what does it mean by $$z'_{j-1,j}$$ where does it find it is the $$z_i$$ received from the other participants?

The paper is in springler and is titled as;

"Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys (Full Version)" authored by: Abdalla Michel, Chevalier Celine,Manulis Mark,Pointcheval David

an alternative from Pointcheval's web site.

• could you post a link to the article? – kelalaka Oct 9 '18 at 20:00
• Info added, keep in mind that the paper is free only via academic vpn but there are many other. – Dimitrios Desyllas Oct 10 '18 at 12:28
• Everything is clear now? – kelalaka Oct 17 '18 at 18:53
• An another question arose The participant got the $z_i$ from others, ans all $z_i$ Xore'd equals , then where the $z'_j-1,j$ is located at the first time the participant calculates the common key. I would love an execution example (or a link to interactive simulator) – Dimitrios Desyllas Oct 17 '18 at 19:05
• Well, I looked at it for fun, when I've found the time. If you look at the $z_i$ calculation, you will see that, if everybody is semi-honest, the $\oplus =0$. The $z'_{j-1,j}$ are stored on the users when calculated. I believe you can program this very easily. – kelalaka Oct 17 '18 at 19:38

As said in page 6, Each $$U_i$$ proceeds as follows;

• compute $$\text{sid}_i:= U_1|y_1,\ldots,U_n|y_n)$$,
• $$z'_{i-1,i} := H(k'_{i-1,i}, \text{sid}_i)$$,
• $$z'_{i+1,i} := H(k'_{i+1,i}, \text{sid}_i)$$,
• $$z_i := z'_{i-1,i} \oplus z'_{i+1,i}$$,
• $$\sigma_i := \text{Sign}(sk_i, (U_i,z_i,\text{sid}_i ))$$,
• $$\text{broadcast} (U_i,z_i,\sigma_i)$$.

since in the beginning, the $$(U_i,y_i)$$ is broadcasted the above calculation is fine.

When a user $$U_j$$ gets all $$(U_i,z_i,\sigma_i) , 1 \leq i \leq n$$, he is ready to verify. Actually, they agree on a key with their neighbors by Diffie-Hellman Key Exchange protocol.

• @MaartenBodewes I started looking back for this a while ago. Nice to hear the same idea. And it is encouraging them to ask questions and sometimes they can be very interesting. This comment will not auto-destruct :P – kelalaka Oct 17 '18 at 17:45