I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David Pointcheval (presented in [AfricaCrypt][1] in 2010) on nodejs.

What the protocol says is:

Let suppose we have participants on an $n$-sized cycle $U=(U_1,U_2,...U_n)$

  1. Each participant $U_i$ selects an $x_i$ and calculated the $y_i= g^x_i$ and broadcasts $(U_i,x_i)$.
  2. Upon receive of a key message the following are calculated:
    1. $\text{sid}_i=(U_1|y_1,\ldots,U_n|y_n)$
    2. $k'_{i-1} = y_{i-1}^{x_i}$ and $k'_{i+1}=y_{i+1}^{x_i}$
    3. $z'_{i,i-1} = H(k'_{i-1},\text{sid}_i)$ and $z'_{i+1,i} = H(k'_{i+1},\text{sid}_i)$
    4. $z_i= XOR(z'_{i-1},z'_{i+1})$
    5. $\sigma_i = Sign(\text{SIGN_KEY}_i,(U_i,z_i,sid_i))$
    6. Broadcast: $U_i,z_i,sid_i$
  3. Group Key Computation: If either $XOR(z_1,z_2,...,z_n) === 0 $ or received invalid Signature then abort the the key computation. Else $z'_{j,j+1} = XOR(z'_{j_j-1},z'_{j})$

    And the final Key will be: $k_i=H_g(z'_{1,2},\ldots,z'_{n,1},sid_i)$

Also it mentions a P2P Stage:

  1. $k'_{i,j} = y_i^{x_i}$
  2. $k'_{i,j} = H_p (k_{i,j},U_i|y_i,U_j|y_j).$

The H function mentioned above is an auxiliary hash function according to the paper but I have problems of finding one that can lead me of having the $XOR(z_1,z_2,...,z_n) === 0 $ statement to be true. So far I used the SHA-256 but seems to have problems on making the statement mentioned previously to be true.

So I want to ask which hash function to use as the auxiliary one;


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.