## 4 Discussion  
We now give a detailed explanation in a particular case on how the attack can be developed. As we previously pointed out, cryptography on elliptic curves is highly recommended for group key management, especially in those cases where the communication system is composed of light devices with limited computing and storage capabilities. Although actual recommendations suggest the use of elliptic curves over a field whose elements have a 256-bit length, we will use much shorter elements in order to make the explanation easy to read. At the end of this section, we will make some considerations concerning aspects that are not considered in the original work on the rekeying process. Let us start by recreating the group key exchange without any external intervention. Therefore, let \(\mathcal{U}=\{\mathcal{U}_{1},\mathcal{U}_{2},\mathcal{U}_{3},\mathcal{U}_{4}\}\), and assume that every user has made a secure exchange with \(\mathcal{U}_{4}\), so the shared keys used for authentication are \(K_{1,4}=3\), \(K_{2,4}=38\) and \(K_{3,4}=11\), and that they agree on the curve \(y^{2}=x^{3}+46x+78\) over \(\mathbb{Z}_{97}\), which is a curve that contains exactly 103 points, and on \(\alpha=(21,35)\), a point of this curve. Now, every user chooses a private key in the rank \(\{2,102\}\), so let \(r_{1}=23\), \(r_{2}=71\), \(r_{3}=89\) and \(r_{4}=59\). They start a protocol execution and thus:  
1. \(\mathcal{U}_{1}\) computes \(C_{1}=r_{1}\cdot\alpha=23\cdot(31,35)=(29,75)\) and sends it to \(\mathcal{U}_{2}\). After receiving \(C_{1},\mathcal{U}_{2}\) computes \(C_{2}=r_{2}\cdot C_{1}=71\cdot(29,75)=(39,88)\), which is sent to \(\mathcal{U}_{3}\). Then, \(\mathcal{U}_{3}\) computes \(C_{3}=r_{3}\cdot C_{2}=89\cdot(39,88)=(71,30)\). 2. \(\mathcal{U}_{3}\) broadcasts the point \(C_{3}=(71,30)\). 3. Now \(\mathcal{U}_{4}\) is able to compute what will be the group-shared secret \(K=r_{4}\cdot C_{3}=59\cdot(71,30)=(83,52)\) and from which the group-shared key might be derived somehow, for instance, considering the result of applying some pre-agreed function to the coordinates of the shared point. 4. Every user computes \(D_{i}=(r_{i}^{-1}mod103)\cdot C_{3}\), \(i=1,2,3\), which is sent to \(\mathcal{U}_{4}\). Thus, \(\mathcal{U}_{1}\), \(\mathcal{U}_{2}\) and \(\mathcal{U}_{3}\) send, respectively, \(D_{1}=9\cdot(71,30)=(56,88)\), \(D_{2}=74\cdot(71,30)=(6,52)\) and \(D_{3}=22\cdot(71,30)=(39,88)\) to \(\mathcal{U}_{4}\). 5. After receiving these messages, \(\mathcal{U}_{4}\) makes use of the private information \(r_{4}\) and the corresponding shared keys with the other users \(K_{i,4}\), \(i=1,2,3\) to broadcast the following message: \[\{r_{4}\cdot K_{1,4}\cdot D_{1},r_{4}\cdot K_{2,4}\cdot D_{2},r_{4}\cdot K_{3,4 }\cdot D_{3},C_{3}\}=\] \[\{59\cdot 3\cdot(56,88),59\cdot 38\cdot(6,52),59\cdot 11\cdot(39,88),(7 1,30)\}=\] \[\{(33,73),(81,75),(57,2),(71,30)\}\]
6. Finally, every user recovers the shared secret by computing \(r_{i}\cdot K_{i,4}^{-1}\cdot(r_{4}\cdot K_{i,4}D_{i})\)\(i=1,2,3\). Thus, \(\mathcal{U}_{1}\) computes \(r_{1}\cdot(K_{1,4}^{-1}mod103)\cdot(33,73)=23\cdot 69\cdot(33,73)=(83,52)\). Analogously, \(\mathcal{U}_{2}\) computes \(r_{2}\cdot(K_{2,4}^{-1}mod103)\cdot(81,75)=71\cdot 19\cdot(81,75)=(83,52)\) and \(\mathcal{U}_{3}\) recovers \(r_{3}\cdot(K_{3,4}^{-1}mod103)\cdot(57,2)=89\cdot 75\cdot(57,2)=(83,52)\). Let us now observe how an adversary \(\mathcal{A}\) with the capabilities described in Section 2.2 affects the result of the protocol and the consequences. We are going to show an example where the attacked participant is \(\mathcal{U}_{2}\). Therefore, the first task that \(\mathcal{A}\) has to carry out is to share a secret with this user as if \(\mathcal{A}\) was \(\mathcal{U}_{4}\) in order to properly run the attack we are introducing.