## 4 Discussion
Then, \(\mathcal{U}_{j}\) for any \(j=1,\ldots,n-1\) chooses \(r_{j}^{{}^{\prime}}\) and computes a new key \(K^{{}^{\prime}_{j}}\) and queries_  
\[\mathrm{Send}(\mathcal{U}_{i},s_{i}^{\prime},\{\mathrm{D}_{1}^{r_{n}\cdot K_ {1,n}\cdot r_{j}^{{}^{\prime}}},\ldots,D_{j}^{r_{n}\cdot K_{j,n}},\ldots,D_{n-1 }^{r_{n}\cdot K_{n-1,n}\cdot r_{j}^{{}^{\prime}}},C_{n-1}^{{}^{\prime}}\})\; \mathrm{i}=1,\ldots n\]  
In this situation \(\mathcal{A}\), after carrying out the attack on \(\mathcal{U}_{i}\), can choose \(r_{\mathcal{A}}^{{}^{\prime}}\) and compute a new key \(K^{{}^{\prime}_{\mathcal{A}}}\). Then, \(\mathcal{A}\) will query \[\{59\cdot 3\cdot(56,88),59\cdot 38\cdot(6,52),59\cdot 11\cdot(39,88),(7 1,30)\}=\]0  
\(\mathcal{A}\) can repeat this strategy, taking control of the group as previously done or stay as another group member until any other user \(\mathcal{U}_{j}\), \(j\
eq i,n\) rekeys the group. In that case, the attack will not be discovered until either \(\mathcal{U}_{i}\) or \(\mathcal{U}_{n}\) send a rekeying message, since they will use \(K_{x,i}\) or \(K_{x,n}\), respectively, which are not shared by \(\mathcal{U}_{i}\) and \(\mathcal{U}_{n}\). In the case of CLIQUES, as was noted above, the values \(K_{i,n}=1\) for every \(i=1,\ldots,n-1\), and there is no possibility of discovering the attack since only Case 1 is applied. In [12], a strongly authenticated protocol, SA-GDH is proposed too. In this case, any two users \(\mathcal{U}_{i}\) and \(\mathcal{U}_{j}\) share a private value \(K_{i,j}\). Then, the above arguments are also applicable for attacking the SA-GDH protocol in the previously considered case of GDH2 ([9]). In [15], the authors introduced a Diffe-Hellman key exchange in a more general setting, i.e., using semigroup actions on an arbitrary set, and later, [PERSON] et al. extended the protocol from two users to an arbitrary finite group of users [16], following the ideas of [9]. [PERSON] et al. 's protocol [12] can also be extended to this setting, but instead of using semigroups, given that we need the existence of inverses, these actions have to be defined by groups. In [12], we have a group acting on a second group, so the setting considered by [PERSON] et al. is much more general. However, under the same cryptographic model, the same attack runs as well, so this could be used only in an authenticated links mode, i.e., there must exist some kind of public key infrastructure or any other method to allow participants to authenticate both information and the source of such information. Let us now explain some implications of this attack in a real situation. When this attack is developed on a traditional model of human-to-human or human-to-machine communication, the essential implication is the lack of confidentiality, which in some cases, is a crucial point. In the case of a multiconference among humans in a group, the attacker could stay in the meeting, receiving the transmitted information at the exact same time as the legal group members, and if the attacker, as assumed in the cryptographic model, has control ove the communications not only during the key exchange, then this could send false information to some (or perhaps the rest of the group members), possibly causing misunderstandings in the communication. If the communication is human-to-machines, the consequences can be even worse. Let us assume that, in a medical situation, several machines are sending the vital signs of one or more patients to a medical doctor who has to control the values and decide the appropriate treatment. Firstly, this information must be kept confidential by law, but the real serious situation is when the attacker can, as before, manipulate the transmitted data and cause the doctor to make wrong decisions that could seriously affect the patient's health condition. Therefore, this absence of privacy affects the confidentiality and integrity of the transmitted data.