## 3 Results
At this point, \(\mathcal{U}_{i}\) is sitting in step (1) waiting for the broadcast of \(\mathcal{U}_{n-1}\). * \(\mathcal{A}\) stops this message, deletes \(C_{i}\) and queries \(\text{Send}(\mathcal{U}_{i+1},s_{i+1},C_{i}^{\prime}=C_{i-1}^{r_{A}})\). * \(\mathcal{U}_{n-1}\) broadcasts \(C_{n-1}=C_{n-2}^{r_{n-1}}\) to the other users \(\mathcal{U}_{1},\ldots,\mathcal{U}_{n-2},\mathcal{U}_{n}\). At this point \(\mathcal{U}_{n}\) computes the key \(K=C_{n-1}^{r_{n}}\). * \(\mathcal{A}\) stops this message for \(\mathcal{U}_{i}\) and queries \(\text{Send}(\mathcal{U}_{n},s_{n},D_{i}=C_{n-1}^{r_{A-1}^{-1}})\). * \(\mathcal{U}_{n}\) broadcasts \[\{D_{1}^{r_{n}\cdot K_{1,n}},D_{2}^{r_{n}\cdot K_{2,n}},\ldots,D_{i}^{r_{n} \cdot K_{x,n}},\ldots,D_{n-1}^{r_{n}\cdot K_{n-1,n}},C_{n-1}\}\] to \(\mathcal{U}_{i}\), \(i=1,\ldots,n-1\). \(\mathcal{A}\) stops this message for \(\mathcal{U}_{i}\). * \(\mathcal{A}\) computes \(K=D_{i}^{r_{n}\cdot K_{x,n}\cdot r_{A}\cdot K_{x,n}^{-1}}\), which is the common key computed by all the remaining users. * \(\mathcal{A}\) chooses \(b\in\mathbb{Z}_{q}^{*}\) and queries \(\text{Send}(\mathcal{U}_{i},s_{i},K^{b})\) as if it was the message that \(\mathcal{U}_{n-1}\) broadcasts in (2). * \(\mathcal{U}_{i}\) sends \(K^{b\cdot r_{i}^{-1}}\) to \(\mathcal{U}_{n}\). * \(\mathcal{A}\) stops this message, deletes it and computes \(K^{r_{i}^{-1}}\) using \(b^{-1}\). Then \(\mathcal{A}\) queries \[\text{Send}(\mathcal{U}_{i},s_{i}\,\{D_{1}^{r_{n}\cdot K_{1,n}},D_{2}^{r_{n} \cdot K_{2,n}},\ldots,K_{1}^{r_{1}\cdot K_{x,i}},\ldots,D_{n-1}^{r_{n}\cdot K _{n-1,n}},C_{n-1}\})\] k \(\mathcal{U}_{i}\) recovers \(K^{r_{i}^{-1}\cdot K_{x,i}\cdot r_{i}\cdot K_{x,i}^{-1}}=K\). The remaining case, i.e., \(\mathcal{A}\) controls communications of \(\mathcal{U}_{n-1}\) and \(\mathcal{U}_{n}\), will require that \(\mathcal{A}\) exchanges private \(n-1\) values \(K_{x,i}\) with each \(\mathcal{U}_{i}\), for \(i=1,\ldots n-1\) and \(n-1\) values \(D_{j}\), \(j=1,\ldots,n-1\) with user \(\mathcal{U}_{n}\). Analogously to the previous case, in the beginning, \(\mathcal{A}\) is a secret group element, and \(r_{\mathcal{A}}\in\mathbb{Z}_{q}^{*}\). Then, \(\mathcal{A}\) proceeds as follows:  
* Step (1) is carried out as usual. * \(\mathcal{A}\) intercepts the broadcast of \(\mathcal{U}_{n-1}\) during step (2) and remembers the value \(C_{n-1}\). At this point, all users except for \(\mathcal{U}_{n-1}\) are sitting in step (2), waiting for the broadcast that was halted. * \(\mathcal{U}_{n-1}\) proceeds to step (4), where he sends \(C_{n-1}^{r_{n-1}^{-1}}=C_{n-2}\) to \(\mathcal{U}_{n}\). This is also intercepted by \(\mathcal{A}\). \(\mathcal{U}_{n-1}\) is now waiting in step (5). * \(\mathcal{A}\) makes \(\mathcal{U}_{n}\) believe that he received the broadcast of step (2), but \(\mathcal{A}\) actually queries \(\text{Send}(\mathcal{U}_{n},s_{n},C_{n-1}^{r_{A}})\). At this point, \(\mathcal{U}_{n}\) computes the shared key \(K=C_{n-1}^{r_{n}\cdot r_{n}}\) and waits in step (4). * \(\mathcal{A}\) now queries \(\text{Send}(\mathcal{U}_{n},s_{n},D_{i})\) for \(i=1,\ldots,n-1\), superseding the others users in step (4). The \(D_{i}\) are random elements of the subgroup generated by \(\alpha\) for \(i=1,\ldots,n-3\), whereas \(D_{n-2}=C_{n-2}\) and \(D_{n-1}=C_{n-1}^{r_{A}}\). * In step (5), \(\mathcal{U}_{n}\) broadcasts, among others, the value \(C_{n-1}^{r_{A}\cdot r_{n}\cdot K_{x,n}}\), which \(\mathcal{A}\) intercepts. The user \(\mathcal{U}_{n}\) is now finished, and \(\mathcal{A}\) can compute the shared key \(K=C_{n-1}^{r_{A}\cdot r_{n}}\). * Until now, \(\mathcal{U}_{1},\ldots,\mathcal{U}_{n-2}\) have been waiting for the broadcast in step (2), which \(\mathcal{A}\) now provides by making the queries \(\text{Send}(\mathcal{U}_{i},s_{i},C_{n-1}^{r_{n}})\), \(i=1,\ldots,n-2\). * \(\mathcal{U}_{i}\), \(i=1,\ldots,n-2\), go to step (4) and sends back \(C_{n-1}^{r_{n}\cdot r_{1}^{-1}}\), which \(\mathcal{A}\) intercepts.