Postscript document

Member Join Protocol

 

We assume the group has $n$ users ($\{M$₁,&ldots;,M_n}), when the group communication system announces the arrival of a new member. Both the new member and the prior group receive this notification simultaneously. The new member $M$_n+1 broadcasts a join request message that contains its own blinded key $bk$_n+1. (which is the same as its blinded session random $br$_n+1) At the same time, the current group's sponsor($M$_n) computes a blinded version of the current group key ($bk$_n) and sends the current tree $BT$_n to $M$_n+1 with all blinded keys and blinded session randoms.

Next, each $M$_i first increments $n=n+1$ and creates a new root key node $IN$_n with two children: the root node $IN$_n-1 of the prior tree $T$_i on the left and the new leaf node $LN$_n corresponding to the new member on the right. Note that every member can compute the group key (see Remark 2):

$$ All existing members only need the new member's blinded session random

$$ The new member needs the blinded group key of the prior group

In a join operation, the sponsoris always the topmost leaf node, i.e., the most recent member in the current group.

As described, the join protocol takes one communication round and two cryptographic operations to compute the new group key (one before the message exchange and one after.)

The join protocol provides backward secrecy since a new member is only given a blinded key of the existing group. However, the protocol does not provide key independence since knowledge of a group key used before the join can be used to compute the group key used after the join. To remedy the situation, we can modify the protocol to require the sponsorto change its session random and the corresponding blinded value, $br$_n.