Complexity of Group Key

Communication complexity has always been an important issue when designing group key distribution systems. This paper systematically studies what can be achieved for the most common measures of protocol complexity. Lower bounds for the total number of messages, the total number of exchanges, and the number of necessary rounds are established, whereby models that allow broadcasting have to be distinguished from those that do not. For every measure of protocol complexity, we furthermore show that the corresponding bound is realistic for Diie{Hellman-based protocols by referring to or introducing protocols that match the bound or exceed it by only one. 1 Introduction Since the publication of 2-party Diie{Hellman (DH) key exchange in 1976, various solutions have been proposed to extend Diie{Hellman key exchange to multiparty key distribution. Most notable and best known among those proposals are the protocols by Ingemarson et al. ITW82] and Burmester and Desmedt BD94]. Beyond the security of the systems, protocol complexity has always been an important issue when designing group key distribution systems. Steiner et al. STW96], for instance, deened a class of