Group key exchange protocols withstanding ephemeral-key reveals Articles uri icon

publication date

  • January 2018

start page

  • 79

end page

  • 86


  • 1


  • 12

International Standard Serial Number (ISSN)

  • 1751-8709

Electronic International Standard Serial Number (EISSN)

  • 1751-8717


  • When a group key exchange protocol is executed, the session key is typically extracted from two types of secrets: long-term keys (for authentication) and freshly generated (often random) values. The leakage of this latter so-called ephemeral keys has been extensively analysed in the 2-party case, yet very few works are concerned with it in the group setting. The authors provide a generic group key exchange construction that is strongly secure, meaning that the attacker is allowed to learn both long-term and ephemeral keys (but not both from the same participant, as this would trivially disclose the session key). Their design can be seen as a compiler, in the sense that it builds on a 2-party key exchange protocol which is strongly secure and transforms it into a strongly secure group key exchange protocol by adding only one extra round of communication. When applied to an existing 2-party protocol from Bergsma et al., the result is a 2-round group key exchange protocol which is strongly secure in the standard model, thus yielding the first construction with this property.


  • Computer Science
  • Mathematics
  • Telecommunications


  • group key exchange; compiler; ephemeral keys; strong security