Key Calculation. Each Mi checks if its contribution is included correctly and obtains grl by computing (grirl )r−1 . The group key is Note: Key = grl ∗ Πi∈M\{l}grirl = grl(1+Pi∈M\{l} ri).
Key Calculation. Each member checks its contribution is in- cluded correctly and then removes its secret xi from gxixl to get gxl . The group key K is obtained in the following manner: K = gxl ∗ QM gxixl mod p. Naturally, the issue of public key predistribution arises in this case. As we have stated, our requirement of independence prevent us from use of any external trusted third party. This is actually the point, where the ad- xxxxx of a physical presence comes in use – we can let the participants dis- tribute their public keys pubki and visibly verify them according to their hashes in a similar way as used in [15]. Moreover, this round contains each participant’s random nonce ri, to fulfil the requirements of Xxxx-Xxxx com- piler. The first round according to the figure 4.1 arranges distribution of public keys from each member to the leader. In the second round, leader broadcasts nonces and public keys of all participants. Until this point, the communication is not secured in any way. The final round enables to ver- ify the received values. Each participant can visually verify all public keys’ and nonces’ hash values, however, assuming honest behaviour of all par- ticipants, only n comparison is needed, forming a ”cyclic verification”. Mi −→ L: pubki|ri L −→ Mi: pubkl|rl, ∀j.Mj ∈ M : pubkj|rj Pi ←→vis Pi+1: SHA-256(pubkl|rl), ∀j.Mj ∈ M : SHA-256(pubkj|rj) Figure 4.1: Public key predistribution protocol using visual verification. | To force any participant to obtain an invalid public key, the potential attacker needs to find value v, such that SHA-256(v) = SHA-256(pubki ri), which is believed to be infeasible in a relevant time for contemporary com- puters. The random nonce further disables to use rainbow tables to look for potential pubki values and prevent from impersonation in the next instances of protocol, if an alternative successful value v has been computed. We make use of RSA [29] encryption system, when public key cryptog- raphy is needed. When new protocol instance is invoked, its parameters are set to determine the length of the used public key. The application checks in its private storage, whether a key pair with an appropriate length exists. If it does, we use it for the purposes of the current protocol instance, other- wise it is generated and stored to enable its use since. Each participant can initiate a generation of a fresh key pair in an upcoming protocol instance when having a feeling the current key has been compromised, to prevent from impersonati...
