Active Attacks. For Protocol MIIA, a traditional impersonation attack where user E successfully completes a protocol (including key computation in our case) with B (resp. A) by impersonating A (resp. B) would occur in step 1 from Section 4. (Recall from the previous section, the Wi released during step 2 provide no extra information.) According to Xxxxxxx 2, this is unlikely. In all of the MP schemes we have investigated thus far, there has been an implicit assumption that if you were able to successfully complete a protocol with several users, then each of these users is honest. Relaxing this assumption introduces the following possible attacks (which are applicable to our schemes as well as the Xxxxxxxxx-Xxxxxxx scheme). Consider a multi-party protocol between users A, B, C and D who are ori- ented on a ring. If C's left and right partners are B and D (i.e. the users with whom C will perform protocol P) then B, C and D can collude by shielding C. By this we mean that B and D can construct their messages such that C can impersonate some Z. This is possible since no direct authentication is performed between users A and C. At the end of the protocol, A could be made believe that the protocol consists of users A, B, Z and D. Of course, this would not allow C (impersonating Z) to compute the key on his own (see Section 3.2) but the key can be given to C by one of B or D (C's colluding partners).
