Multi-party Post-Quantum Dynamic Group Key Exchange Protocols Based on CSURF

Abstract

The advent of large-scale quantum computing renders classical Diffie–Hellman-based group key exchange insecure, motivating a transition toward post-quantum multi-party key exchange (MPKE) primitives. Among post-quantum candidates, isogeny-based group actions are attractive for their compact parameters, and the surface variant CSURF retains a commutative Diffie–Hellman-like structure while exploiting horizontal 2-isogenies for additional efficiency. However, existing CSURF-based MPKE constructions—G-CSURF, CSURFBD and CSURFBDII—are inherently static: the group membership is fixed at initialization, and any join or leave event forces a complete re-execution of the protocol with cost proportional to the group size. This paper proposes D-CSURFBDII, a dynamic group key exchange protocol that extends the tree-structured CSURFBDII with native support for membership changes. By restricting re-keying to the logarithmic-length path from the affected node to the root of the binary tree and by re-sampling ideal-class secrets along this path, D-CSURFBDII achieves forward secrecy and backward secrecy at a per-event computational and communication cost of O(logm), where m is the group size. We formalize the protocol, prove its security under the Surface Commutative Supersingular Decisional Diffie–Hellman (SCSSDDH) assumption in the random-oracle model, and conduct a comprehensive operation-level cost analysis. The evaluation is an operation-count and asymptotic-complexity study rather than a wall-clock benchmark. It establishes that the static phase of D-CSURFBDII is, by construction, cost-identical to CSURFBDII—the two share the same operation-count profile, so dynamic capability is added with no static-phase penalty—that each membership event incurs only logarithmic overhead, and that the design retains the approximately 2% speed-up of CSURF over CSIDH. A closed-form cost decomposition identifies the tree structure and localized re-keying as the dominant sources of efficiency, and a sensitivity analysis over the calibration constants confirms that these qualitative conclusions are robust. The proposed scheme is, to our knowledge, the first CSURF-based MPKE to support dynamic membership with provable forward and backward secrecy.