## 3 Results  
The aim of the attack that we are introducing in this section is that the adversary, \(\mathcal{A}\), and the users \(\mathcal{U}_{1},\ldots,\mathcal{U}_{n}\) agree on a shared key, as it is obtained after running the protocol, but \(\mathcal{A}\) will know the key as well and can listen and send messages using that common key, exactly the same as another group member. However, \(\mathcal{U}_{i}\), \(i=1,\ldots,n\) will not know anything about the existence of \(\mathcal{A}\). Contrary to other attacks of this type, the adversary does not share a specific key with the attacked group member in order to decrypt the information sent among the other group members and then, using this second special key, encrypt the information for the hacked group member and vice versa when it wants to send a message to the rest of the group members. As assumed in the security model [17], \(\mathcal{A}\) has absolute control of the whole group's communications. However, in practice, \(\mathcal{A}\) needs to have full control over the communication of a single user \(\mathcal{U}_{i}\), \(i\in\{1,\ldots,n\}\) only during the pre-setup stage, when this user exchanges a key with \(\mathcal{U}_{n}\), \(K_{i,n}\), and during the key exchange protocol, i.e., the cryptographic model is more restrictive than is actually necessary to develop the attack in a real situation. Moreover, unlike in a regular man-in-the-middle attack, \(\mathcal{A}\) does not need to maintain this control after the key exchange is completed. We are assuming that \(i<n-1\). The case where \(\mathcal{A}\) controls the communications of \(\mathcal{U}_{n-1}\) or \(\mathcal{U}_{n}\) will be followed in an analogous way as is given in [10], as we will explain later. As we can observe below, unlike what it is assumed in that case, the attacker just needs to execute control over the communications of a single user and not necessarily these two detached users simultaneously. Given that the protocol requires that both users \(\mathcal{U}_{i}\) and \(\mathcal{U}_{n}\) to have shared a key previously, let us assume that the attack starts by executing a typical man-in-the-middle attack on the key exchange among \(\mathcal{U}_{i}\) and \(\mathcal{U}_{n}\) by means of a query \(\text{Send}(\mathcal{U}_{i},s_{i},\mathcal{U}_{n},s_{n})\), which provokes the Diffie-Hellman key-exchange among these two users, and then both users' public keys are obtained and used by \(\mathcal{A}\) to share a common key with \(\mathcal{U}_{i}\), say \(K_{x,i}\) and a second common key with \(\mathcal{U}_{n}\), say \(K_{x,n}\). After that, the authenticated group key exchange \(A-GDH2\) starts. In our security model, we are assuming that the adversary has access to the oracles Reveal and Corrupt, so we can even consider the case where this previous exchange among \(\mathcal{U}_{i}\) and \(\mathcal{U}_{n}\) is made through a secure channel that avoids the man-in-the-middle attack. In those cases, an instance \(\text{Reveal}(\mathcal{U}_{i},s_{i-1})\), where \(s_{i-1}\) denotes the previous session to the session \(s_{i}\) where the group key is to be built by all users, outputs the session key agreed by \(\mathcal{U}_{i}\) and \(\mathcal{U}_{n}\), and even \(\text{Corrupt}(\mathcal{U}_{i})\) would reveal the secret key used by \(\mathcal{U}_{i}\), which simplifies clearly the attack. Thus, let us start explaining the attack once \(\mathcal{A}\) shares two keys with both \(\mathcal{U}_{i}\) and \(\mathcal{U}_{n}\): \(K_{x,i}\) and \(K_{x,n}\). In the beginning, \(\mathcal{A}\) chooses a secret group element \(r_{\mathcal{A}}\in\mathbb{Z}_{q}^{*}\). Then, \(\mathcal{A}\) proceeds as follows:  
1. The adversary \(\mathcal{A}\) queries \(\text{Send}(\mathcal{U}_{1},s_{1},\ldots,\mathcal{U}_{n},s_{n})\) to initiate a protocol instance. After this query, the first step of the protocol is executed. * Step (1) is carried out as usual until \(\mathcal{U}_{i}\) sends \(C_{i}=C_{i-1}^{r_{i}}\) to \(\mathcal{U}_{i+1}\).