# A Secure and Efficient Group Key Management Scheme for Clusters of String Inverters
## 6 Discussion
### Security Analysis  
In this section, we considered the security of the join, leave and key refresh operation with respect to two kinds of attacker, the external attacker and the evicted inverter. An external attacker shares no secret with the cluster. In contrast, an evicted inverter holds one or more group keys it obtained when it was a member of the group.  
Regarding the external attacker, we claimed that the execution of the join, leave and key refresh operations is secure with respect to this kind of attacker. More precisely, in the execution of the join and leave operations, communications between the KDC and any inverter takes place through a TLS secure channel which, by assumption, provides confidentiality, integrity and mutual authentication.  
As to the leave operation, we must also observe that its execution revoked the certificate of the leaving inverter and installed an up-to-date certificate revocation list (CRL) on every non-compromised inverter of the group (steps 1 and 2b). As a consequence, the leaving, possibly compromised, inverter became unable to later establish a TLS connection with any inverter in the group. Indeed, any attempt by an evicted inverter to establish a TLS connection with any group member raises a certificate-revoked failure during the TLS handshake, so making the connection to abort.  
As to replay attacks during the execution of the join and leave operations, both messages <SetKey, \(\tau\), K\({}_{G}\); and <SetKey, \(\tau\), LS, CRL, \(K_{G}\), conveying the current group key and the newly generated one respectively, carry a timestamp \(\tau\) that guarantees the freshness of messages and thus prevents this kind of attacks.  
In the key refresh operation, the multicast message containing the refreshed group key, namely <SetKey, IV, \(\left\{\mathsf{t},K_{G}^{\prime}\right\}_{K_{G}}\),\(H_{K_{G}}\)\(\left(\left\{\mathsf{t},K_{G}^{\prime}\right\}_{K_{G}}\right)\), guarantees confidentiality, integrity and authenticity as it exploits a scheme of authenticated encryption known as Encrypt-then-MAC (EtM). The security of this message depends on the length of the group key used. In this respect, we assumed a 128-bit symmetric group key. Moreover, also in this case, the presence of a timestamp provides protection against replay attacks. Finally, the IV serves as a randomizer and takes a new value for each newly generated SetKey message.  
As to an evicted inverter, let \(l\) be such an inverter when the current group key is K\({}_{G}\). As soon as the leave operation successfully completes, a new random key \(K_{G}\) gets installed as the new group key (step 2). Since that moment, the group uses key \(K_{G}^{\prime}\) to encrypt its communication. It follows that inverter \(l\) holds the previous key \(K_{G}\) and thus can neither eavesdrop nor inject fake messages. Inverter \(l\) cannot either eavesdrop the new group key \(K_{G}^{\prime}\) during the execution of the leave operation because the key is always transmitted by the KDC through point-to-point secure channels, namely TLS connections. In addition, as the new group key \(K_{G}^{\prime}\) is securely randomly generated, an evicted inverter cannot guess it even though it holds several past keys.