Multilateral Diffie-Hellman key exchange

In a cyclic group with generator $g$, $n$ participants with secret exponents $a_j$ can exchange $n$ tokens around a ring. Token $j$ starts at $g^{a_j}$ and is successively exponentiated by its next $n-2$ recipients before being sent to the final recipient, whose exponent is the only one missing. That recipient completes the exponentiation locally. Each token makes $n-1$ transmissions, and everyone obtains $g^{{\prod }_j{a}_j}$. Thus $n(n-1)$ transmitted group elements suffice. As with two-party Diffie-Hellman key exchange, authentication is needed.