Whilst I was studying the mDP protocol I came across into the following step:

Group Key agreement: Each $U_i$ checks whether $z_1 \bigoplus ... \bigoplus z_n = 0$ and whether all signatures $\sigma_i$ are valid and aborts if any of these checks fails. Otherwise, $U_i$ proceeds as follows: iteratively for each $j=i,...i+n-1: z'_{j,j+1}:=z'_{j-1,j} \bigoplus z_j $ ...

But I cannot understand on the notation what does it mean by $z'_{j-1,j}$ where does it find it is the $z_i$ received from the other participants?

The paper is in springler and is titled as;

"Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys (Full Version)" authored by: Abdalla Michel, Chevalier Celine,Manulis Mark,Pointcheval David

an alternative from Pointcheval's web site.

  • $\begingroup$ could you post a link to the article? $\endgroup$
    – kelalaka
    Oct 9, 2018 at 20:00
  • $\begingroup$ Info added, keep in mind that the paper is free only via academic vpn but there are many other. $\endgroup$ Oct 10, 2018 at 12:28
  • $\begingroup$ Everything is clear now? $\endgroup$
    – kelalaka
    Oct 17, 2018 at 18:53
  • $\begingroup$ An another question arose The participant got the $z_i$ from others, ans all $z_i$ Xore'd equals , then where the $z'_j-1,j$ is located at the first time the participant calculates the common key. I would love an execution example (or a link to interactive simulator) $\endgroup$ Oct 17, 2018 at 19:05
  • $\begingroup$ Well, I looked at it for fun, when I've found the time. If you look at the $z_i$ calculation, you will see that, if everybody is semi-honest, the $\oplus =0$. The $z'_{j-1,j}$ are stored on the users when calculated. I believe you can program this very easily. $\endgroup$
    – kelalaka
    Oct 17, 2018 at 19:38

1 Answer 1


As said in page 6, Each $U_i$ proceeds as follows;

  • compute $\text{sid}_i:= U_1|y_1,\ldots,U_n|y_n)$,
  • $z'_{i-1,i} := H(k'_{i-1,i}, \text{sid}_i)$,
  • $z'_{i+1,i} := H(k'_{i+1,i}, \text{sid}_i)$,
  • $z_i := z'_{i-1,i} \oplus z'_{i+1,i}$,
  • $\sigma_i := \text{Sign}(sk_i, (U_i,z_i,\text{sid}_i ))$,
  • $\text{broadcast} (U_i,z_i,\sigma_i)$.

since in the beginning, the $(U_i,y_i)$ is broadcasted the above calculation is fine.

When a user $U_j$ gets all $(U_i,z_i,\sigma_i) , 1 \leq i \leq n$, he is ready to verify. Actually, they agree on a key with their neighbors by Diffie-Hellman Key Exchange protocol.

  • $\begingroup$ @MaartenBodewes I started looking back for this a while ago. Nice to hear the same idea. And it is encouraging them to ask questions and sometimes they can be very interesting. This comment will not auto-destruct :P $\endgroup$
    – kelalaka
    Oct 17, 2018 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.