Abstract
The A-GDH.2 and SA-GDH.2 authenticated group key agreement protocols showed to be flawed at CSFW 2001. Even though the corresponding attacks (or some variants of them) have been rediscovered in several different frameworks, no fixed version of these protocols has been proposed until now. In this paper, we describe a proof that it is in fact impossible to design a scalable authenticated group key agreement protocol based on the same building blocks as the A-GDH ones. We proceed by providing a systematic way to derive an attack against any A-GDH-type protocol with at least four participants (and exhibit protocols with two and three participants which we cannot break). As far as we know, this is the first generic insecurity result reported in the literature concerning authentication protocols.