# Which Auxiliary Hash Function to use for Pointcheval's mDP protocol

I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David Pointcheval (presented in [AfricaCrypt] in 2010) on nodejs.

What the protocol says is:

Let suppose we have participants on an $$n$$-sized cycle $$U=(U_1,U_2,...U_n)$$

1. Each participant $$U_i$$ selects an $$x_i$$ and calculated the $$y_i= g^x_i$$ and broadcasts $$(U_i,x_i)$$.
2. Upon receive of a key message the following are calculated:
1. $$\text{sid}_i=(U_1|y_1,\ldots,U_n|y_n)$$
2. $$k'_{i-1} = y_{i-1}^{x_i}$$ and $$k'_{i+1}=y_{i+1}^{x_i}$$
3. $$z'_{i,i-1} = H(k'_{i-1},\text{sid}_i)$$ and $$z'_{i+1,i} = H(k'_{i+1},\text{sid}_i)$$
4. $$z_i= XOR(z'_{i-1},z'_{i+1})$$
5. $$\sigma_i = Sign(\text{SIGN_KEY}_i,(U_i,z_i,sid_i))$$
6. Broadcast: $$U_i,z_i,sid_i$$
3. Group Key Computation: If either $$XOR(z_1,z_2,...,z_n) === 0$$ or received invalid Signature then abort the the key computation. Else $$z'_{j,j+1} = XOR(z'_{j_j-1},z'_{j})$$

And the final Key will be: $$k_i=H_g(z'_{1,2},\ldots,z'_{n,1},sid_i)$$

Also it mentions a P2P Stage:

1. $$k'_{i,j} = y_i^{x_i}$$
2. $$k'_{i,j} = H_p (k_{i,j},U_i|y_i,U_j|y_j).$$

The H function mentioned above is an auxiliary hash function according to the paper but I have problems of finding one that can lead me of having the $$XOR(z_1,z_2,...,z_n) === 0$$ statement to be true. So far I used the SHA-256 but seems to have problems on making the statement mentioned previously to be true.

So I want to ask which hash function to use as the auxiliary one;