## 4 Discussion
Therefore, we will start by showing a classical man-in-the-middle attack during a classical Diffie-Hellman key exchange, as depicted in Section 2.3 among users \(\mathcal{U}_{2}\) and \(\mathcal{U}_{4}\) through an insecure channel in order to establish a secret shared value \(K_{2,4}\). At this point, we again note that even if this exchange is developed through a secure channel, we are considering that \(\mathcal{A}\) has access to the oracle Reveal, which would provide \(\mathcal{A}\) with this secret value, and the attack can be developed in the same way. 1. Let us assume, without loss of generality, that both users \(\mathcal{U}_{2}\) and \(\mathcal{U}_{4}\) are using the same elliptic curve and the same point \(\alpha=(31,35)\). 2. Then \(\mathcal{U}_{2}\) and \(\mathcal{U}_{4}\) choose \(r_{2}^{\prime}=16\) and \(r_{4}^{\prime}=47\) as private values. 3. Both users exchange \(P_{2}=16\cdot(31,35)=(80,3)\) and \(P_{4}=47\cdot(31,35)=(54,59)\). At this point, \(\mathcal{A}\) stops these messages and accesses the exchanged values by means of the oracle \(Send\) and substitutes them by the message \(P_{\mathcal{A}}=75\cdot(31,35)=(58,50)\). 4. Finally, \(\mathcal{U}_{1}\) recovers \(16\cdot P_{\mathcal{A}}=16\cdot(58,50)=(56,9)\) and \(\mathcal{U}_{4}\) computes \(47\cdot P_{\mathcal{A}}=47\cdot(58,50)=(29,75)\), obtaining what they think is a point from they can derive \(K_{2,4}\), but they are, in fact, two points that will give them, respectively, \(K_{x,2}\) and \(K_{x,4}\). 5. On the other hand \(\mathcal{A}\) computes \(r_{\mathcal{A}}\cdot P_{2}=75\cdot(80,3)=(56,9)\) and \(r_{\mathcal{A}}\cdot P_{4}=75\cdot(54,49)=(29,75)\). If we assume, for simplicity, that the function used on a point to derive a secret value is the projection on the first coordinate, we thus obtain that \(K_{x,2}=56\) and \(K_{x,4}=29\). Therefore, let us start with the attack on the group key agreement protocol. At this point, we have to recall that the secret keys of every user \(\mathcal{U}_{i}\), i=1,2,3,4, are, respectively, \(r_{1}=23\), \(r_{2}=71\), \(r_{3}=89\) and \(r_{4}=59\). On his side, \(\mathcal{A}\) chooses \(r_{\mathcal{A}}=39\). Let us recall as well that \(\mathcal{U}_{1}\) and \(\mathcal{U}_{3}\) could successfully exchange a secret with \(\mathcal{U}_{4}\), namely, \(K_{1,4}=3\) and \(K_{3,4}=11\). Then, we have the following steps: 1. \(\mathcal{U}_{1}\) sends \(C_{1}=23\cdot\alpha=23\cdot(31,35)=(29,75)\) to \(\mathcal{U}_{2}\), who computes \(C_{2}=71\cdot C_{1}=(39,88)\). 2. \(\mathcal{A}\) stops \(C_{2}\) when this is sent to \(\mathcal{U}_{3}\). 3. \(\mathcal{A}\) replaces \(C_{2}\) by \(C_{2}^{\prime}=r_{\mathcal{A}}\cdot C_{1}=39\cdot(29,75)=(83,45)\). 4. \(\mathcal{U}_{3}\) computes \(C_{3}=r_{3}\cdot C_{2}^{\prime}=89\cdot(83,45)=(53,49)\), which is broadcasted to every participant, and \(\mathcal{U}_{4}\) computes the point \(K=r_{4}\cdot C_{3}=59\cdot(53,49)=(4,36)\). 5. Now \(\mathcal{A}\) stops the broadcasted message for \(\mathcal{U}_{2}\) and gives \(\mathcal{U}_{4}\), \(D_{2}=(r_{\mathcal{A}}^{-1}mod103)\cdot C_{3}=37\cdot(53,49)=(6,52)\). In the meantime, \(\mathcal{U}_{4}\) receives the points \(D_{1}=(r_{1}^{-1}mod103)\cdot C_{3}=9\cdot(53,49)=(64,29)\) and \(D_{3}=(r_{3}^{-1}mod103)\cdot C_{3}=22\cdot(53,49)=(83,45)\) from the other users. 6. Thus, \(\mathcal{U}_{4}\) broadcasts the message \[\{r_{4}\cdot K_{1,4}\cdot D_{1},r_{4}\cdot K_{x,4}\cdot K,r_{4}\cdot K_{3,4} \cdot D_{3},C_{3}\}=\] \[=\{59\cdot 3\cdot(64,29),37\cdot 29\cdot(60,54),59\cdot 11\cdot(83,45),(53,49 )\}=\] \[=\{(58,50),(26,41),(81,22),(53,49)\}\] 9. \(\mathcal{A}\) computes \(K=r_{\mathcal{A}}\cdot(K_{x,4}^{-1}mod103)\cdot r_{4}\cdot K_{x,4}\cdot D_{2} =39\cdot(29^{-1}mod103)\cdot 59\cdot 29\cdot(6,52)=(4,36)\), which results in the same point computed by \(\mathcal{U}_{4}\) in step d. At this step, \(\mathcal{U}_{1}\) computes \(K=r_{1}\cdot(K_{1-4}^{-1}mod103)\cdot(58,50)=23\cdot(3^{-1}mod103)\cdot(58,50 )=23\cdot 69\cdot(58,50)=(4,36)\), which is the same point previously computed by \(\mathcal{U}_{4}\) and \(\mathcal{A}\).