Security Analysis on a Group Key Transfer Protocol Based on Secret Sharing

• The insider and outsider attacks against the improved version (Subsection 3.1, Methods 1 and 2; Subsection 3.2 Method 1) are limited by the success of a guessing attack against the hash function. We highlight that the attacks assume the guessing of a random number (not a password, which would have been feasible!). Hence, if the hash function is properly selected, the attacks are infeasible1. • The attacks mounted in Section 3.2, Method 2 and Section 3.3 are incorrect: the value α is chosen uniformly random for each session (see step 4 of the improved version) and therefore α(k1) 6= α(k2).