Complexity Analysis and Comparison. We analyze the communication and computation costs for join, leave, merge and partition protocols. We focus on the number of rounds, the total number of messages, the serial number of exponentiations, the serial number of signature generations, and the serial number of signature verifications. Note that we use RSA signature for message authenti- cation since RSA is particularly efficient in verification. The serial cost assumes parallelization within each protocol round and represents the greatest cost incurred by any participant in a given round. The total cost is the sum of all participants’ costs in a given round. We also compare our protocol to other contributory group key agreement schemes including GDH.3 [34], BD (Xxxxxxxxx-Xxxxxxx) [14], and STR [22]. Although BD was originally designed to support only group formation, we modify the BD protocol to support dynamic membership operation. This modification is minimal. Table 1 summarizes the communication and computation costs of four protocols. The numbers of current group members, merging members, merging groups, and leaving members are denoted as: and , respectively. The height of the key tree constructed by the TGDH protocol is . The overhead of the TGDH protocol depends on the tree height, the balancedness of the key tree, the location of the joining tree, and the leaving nodes. In our analysis, we assume the worst case configuration and list the worst-case cost for TGDH. Table 1. Communication and Computation Costs Communication Computation Rounds Messages Exponentiations Signatures Verifications GDH Join 4 4 Partition 1 1 1 1 BD Join 2 3 2 The BD protocol has a hidden cost that is not listed in Table 1: BD has modular exponentiations with a small exponent. Unfortunately, such exponentiations can be expensive when is large. For example, BD requires 1024-bit modular multiplications, if modular exponentiation is implemented with the square-and-multiply algorithm. (OpenSSL uses Xxxxxxxxxx reduction and the sliding window algorithm to implement the modular exponentiation, which is faster than simple square-and-multiply algorithm. However, the former requires almost the same time as the latter for small exponents.) Because of this hidden cost, it is hard to compare the computational overhead of BD to the other protocols. Below, we compare the four protocols for each membership event.
Complexity Analysis and Comparison. We analyze the communication and computation costs for join, leave, merge and partition protocols. We focus on the number of rounds, the total number of messages, the serial number of exponentiations, the serial number of signature generations, and the serial number of signature verifications. Note that we use RSA signature for message authenti- cation since RSA is particularly efficient in verification. The serial cost assumes parallelization within each protocol round and represents the greatest cost incurred by any participant in a given round. The total cost is the sum of all participants’ costs in a given round. We also compare our protocol to other contributory group key agreement schemes including GDH.3 [32], BD (Xxxxxxxxx-Xxxxxxx) [12], and STR [20]. Although BD was originally designed to support only group formation, we modify the BD protocol to support dynamic membership operation. This modification is minimal. Table 1 summarizes the communication and computation costs of four protocols. The numbers of current group members, merging members, merging groups, and leaving members are denoted as: n, m, k and p, respectively. The height of the key tree constructed by the TGDH protocol is h. The overhead of the TGDH protocol depends on the tree height, the balancedness of the key tree, the location of the joining tree, and the leaving nodes. In our analysis, we assume the worst case configuration and list the worst-case cost for TGDH. Table 1. Communication and Computation Costs Communication Computation Rounds Messages Exponentiations Signatures Verifications GDH Join 4 n + 3 n + 3 4 n + 3 Leave 1 1 n − 1 1 1 Merge m + 3 n + 2m + 1 n + 2m + 1 m + 3 n + 2m + 1 Leave 1 1 3h 2 1 1 merge log2k + 1 2k 3h 2 log2 k + 1 log2 k Leave 2 2n − 2 3 2 n + 1 Merge 2 2n + 2m 3 2 n + m + 2 Partition 2 2n − 2p 3 2 n − p + 2 − − The BD protocol has a hidden cost that is not listed in Table 1: BD has n 1 modular exponentiations with a small exponent. Unfortunately, n 1 such exponentiations can be expensive when n is large. For example, BD requires O(n2) 1024-bit modular multiplications, if modular exponentiation is implemented with the square-and-multiply algorithm. (OpenSSL uses Xxxxxxxxxx reduction and the sliding window algorithm to implement the modular exponentiation, which is faster than simple square-and-multiply algorithm. However, the former requires almost the same time as the latter for small exponents.) Because of this hidden cost, it is hard to compare the c...
