Given a group of peer processes, how can they agree on a key with
which to encrypt their communications? The paper presents several
protocols that address this problem in the cases of initial group
formation and various group change scenarios. The protocols, which are
related to the original Diffie-Hellman protocol, have each member
contribute a random number that is used to compute the key.

I do work in group communications systems and have a passing
familiarity with security, and so I'm certainly someone to whom this
paper should be aimed.

1) Section 2 is tough going. Part of the problem is the frequent use of
   acronyms. For example, "DPG" doesn't immediately cause "dynamic peer
   group" to spring to my mind, and outside of the paragraph in which the
   term is introduced, it is used infrequently (but frequently enough
   that it's meaning cannot be forgotten.)  PFS and KKA are also
   troublesome. You use DDH, IKA and AKA often enough that I didn't
   stumble over these.

2) Your argument (page 3, starting at line 10) is not very compelling yet
   it is important to your research. You assume that underlying your
   protocol is some group membership protocol. For benign failure models
   (which I can't say are sufficient - you are worried about untrusted
   members enough that you include the third requirement on the top of
   page 3) group membership can be used to solve all of the scaling,
   performance bottleneck, and adaptability to partition problems you
   mention. For non-benign failure models, I'm not sure what utility your
   protocols have - I guess I would have to read [1] to see if you
   elaborate.

   To address this point, i recommend that you add a section on group
   membership - what failure assumptions and timing assumptions you make
   and what properties you require of group membership. This doesn't need
   to be a long section - most likely a page - but without it, it is hard
   to evaluate the utility of your protocols.

3) Figure 1 doesn't help at all. What do the colors and patterns signify?
   What about the shapes and coloration of the black dots? My background
   may bias me, but the ideas in this figure are simple - they don't
   require a figure - but the way that they are illustrated make them
   appear complex. Deleting Figure 1 would help.

4) I didn't check the proof of Section 3.2 carefully, although I found no
   problems with a first reading. I believe that this theorem is already
   proven in your citation [25]. If so, then you should just simply cite
   [25] and delete this proof. If not, you should explain why (footnote 3
   isn't a sufficient explanation).

5) Section 4.1: IKA.1 doesn't work for n = 2, which is troubling. It is
   also presented in a very complex way. I made some progress by changing
   i to i + 1 (which made it obvious that the first round is indeed
   numbered "1"). There is a notational change on page 2 (actions 2 and
   3). And, all communication is non-broadcast based which threw a group
   communications person like me for a loop. At the first reading, it
   seemed that this observation holds even for the last "broadcast" (your
   word, line -8, last word): the messages M_n sends to the other M_i are
   distinct. Given this, I didn't know what you mean when you say
   "Assuming atomic, one-message broadcast" (Footnote 4). Later, it
   became clear that you indeed meant the last to be a broadcast, since
   the final intermediate values help with AKA (you don't need it for
   IKA, hence my initial confusion - why send all this extra
   information??) Even with this late information, I don't know what an
   "atomic one-message" broadcast is.

6) Page 12, M_i's actions 2 and 3 use a different notation for describing
   INT.

7) Figure 2 is not very helpful. In the upper part, you describe a
   message from M_i to M_{i+1}, while in the lower part you describe a
   message from M_n to all M_i, i \neq n. Hence, the meaning of M_i
   changes. In the figure you describe the actions in round i (while in
   the text you do it as round i-1; i prefer the former as I have noted
   above).

   You later rely on the figures rather than the text to describe the
   protocols. If you wish to continue to do so, then some further work on
   the notation you use in the figures is well worth the time.

8) Section 5, line 1: M_n doesn't really collect these values but
   rather computes them given the information that it has collected.

9) Figure 3: You're now writing \Pi\{S\} rather than \PI(S); please be
   consistent with your notation. In Stage 2, the closing brace (which
   should be a closing parenthesis) is in the wrong location, and in
   Stage 3 the closing parenthesis in the product is missing.

10) Figure 5: Rounds now start with 0 rather than 1?? And, in the
    upflow, the second exponent is missing a closing parenthesis.

11) I don't understand the point you are making in Footnote 6. This is
    the kind of function one gets from group membership
    protocols. Perhaps you can explain this (or remove this point)
    once you have a section on the requirements of the underlying
    group membership protocol.