## 4 Discussion
In the same way, \(\mathcal{U}_{3}\) computes \(K=r_{3}\cdot(K_{3-4}^{-1}mod103)\cdot(81,22)=89\cdot(11^{-1}mod103)\cdot(81,2 2)=89\cdot 75\cdot(81,22)=(4,36)\), which also coincides with the previously computed points, and thus, \(\mathcal{U}_{1}\), \(\mathcal{U}_{3}\), \(\mathcal{U}_{4}\) and \(\mathcal{A}\) are sharing the same point,so \(\mathcal{A}\) needs to provide the corresponding information to \(\mathcal{U}_{2}\) in so that this participant also obtains the same value. \(\mathcal{A}\) chooses \(b=8\) and provides \(\mathcal{U}_{2}\), \(b\cdot K=8\cdot(4,36)=(37,76)\), which was the message that \(\mathcal{U}_{3}\) broadcasted in step d. \(\mathcal{U}_{2}\) sends \(\mathcal{U}_{4}\)\((r_{2}^{-1}mod103)\cdot(37,76)=(71^{-1}mod103)\cdot(37,76)=74\cdot(37,76)=(39,88)\). \(\mathcal{A}\) stops this message and computes \((b^{-1}mod103)\cdot(39,88)=(96,15)\) and forges the message that was broadcasted by \(\mathcal{U}_{4}\) in step f, but only \(\mathcal{U}_{2}\) receives this message: \[\{(58,50),K_{x,2}\cdot(96,15),(81,22),(53,49)\}=\{(58,50),(17,70),(81,22),(53,49 )\}\] \(\mathrm{k}\) Finally, to recover the common point, \(\mathcal{U}_{2}\) computes \(r_{2}\cdot(K_{x,2}^{-1}mod103)\cdot(17,70)=71\cdot(56^{-1}mod103)\cdot(17,70)= (4,36)\). We remark that in the classical man-in-the-middle attack of the Diffie-Hellman key exchange for two participants, \(\mathcal{A}\) shares two different keys for both users, and when some information is sent from one of them to the other one, \(\mathcal{A}\) has to decrypt it using one of these keys and then, if the attacker decides to allow the information to reach the destination, then \(\mathcal{A}\) has to encrypt the information with the corresponding second key before sending it. In this case, the adversary \(\mathcal{A}\) forms part of the communication group as a legal participant and shares the same key with the rest of the participants, so \(\mathcal{A}\) can forge a message from one party to another without the intermediate encryption-decryption process mentioned above in the classical case. We end this section by introducing a strategy for \(\mathcal{A}\) to leave the group without the attack being noticed. We first point out that there is not any explanation on how rekeying operations are developed using the key authentication mode in [12]. Let us suppose that any member of the group can send a rekeying message similarly to in the CLIQUES protocol [9]. We can distinguish two different cases:  
**Case 1**. : _The private values \(K_{j,n}\) are not used in the rekeying messages. In this case, \(\mathcal{U}_{n}\) does not obtain authentication of any rekeying message. \(\mathcal{U}_{j}\) for any \(j=1,\ldots,n\) chooses \(r_{j}^{{}^{\prime}}\) and computes a new key \(K^{{}^{\prime}_{j}}\) and queries_  
\[\mathrm{Send}(\mathcal{U}_{i},s_{i}^{\prime},\{\mathrm{D}_{1}^{r_{n}\cdot K_ {1,n}\cdot r_{j}^{{}^{\prime}}},\ldots,\mathrm{D}_{j}^{r_{n}\cdot K_{1,n}}, \ldots,\mathrm{D}_{n-1}^{r_{n}\cdot K_{n-1,n}\cdot r_{j}^{{}^{\prime}}},C_{n- 1}^{{}^{\prime}}\})\;\mathrm{i}=1,\ldots n\]  
In this situation, \(\mathcal{A}\), after carrying out the attack on \(\mathcal{U}_{i}\), can choose \(r_{\mathcal{A}}^{{}^{\prime}}\) and compute a new key \(K^{{}^{\prime}_{\mathcal{A}}}\). Then, \(\mathcal{A}\) will query  
\[\mathrm{Send}(\mathcal{U}_{i},s_{i}^{\prime\prime},\{\mathrm{D}_{1}^{r_{n} \cdot K_{1,n}\cdot r_{\mathcal{A}}},\ldots,K_{i}^{r_{1}\cdot K_{\mathcal{A}} \cdot r_{\mathcal{A}}^{{}^{\prime}}},\ldots,D_{n-1}^{r_{n}\cdot K_{n-1,n} \cdot r_{\mathcal{A}}^{{}^{\prime}}},C_{n-1}^{{}^{\prime}}\})\;\mathrm{i}=1, \ldots n\]  
Thus, \(\mathcal{A}\) could repeat this as long as desired, taking control of the group, and leave it at any time without letting the users notice the attack. **Case 2**. : _The private values \(K_{j,n}\) are used in the rekeying messages. In this case, \(\mathcal{U}_{n}\) can use these values to obtain authentication as in [12] for the initial key agreement.