= Multilateral Diffie-Hellman key exchange
In a <cyclic group> with generator $g$, $n$ participants with secret exponents $a_j$ can exchange $n$ tokens around a ring. Token $j$ starts at $g^{a_j}$ and is successively exponentiated by its next $n-2$ recipients before being sent to the final recipient, whose exponent is the only one missing. That recipient completes the exponentiation locally. Each token makes $n-1$ transmissions, and everyone obtains $g^{\prod_j a_j}$. Thus $n(n-1)$ transmitted group elements suffice. As with two-party <Diffie-Hellman key exchange>, authentication is needed.
Back to article page
