Notation

The following notation is used to describe the protocols:

$N$: Number of members that are in the group or that want to join it initially.

$E$_k(M): Encryption of plaintext $M$ with key $k$.

$D$_k(C): Decryption of ciphertext $C$ with key $k$.

$H(M)$: Hash of message $M$.

$S$_A(M): Sign message M with A's key.

$A\; \to B:\; M$: $A$ sends message $M$ to $B$.

$A\; \to *:\; M$: $A$ broadcasts message $M$.

In the description of the protocols,  $$d denotes the depth of the key tree. The root is at level $0$ and the lowest leaves are at level $d$. The nodes are denoted as$l,\; i$, where $l$ stands for the level and $i$ for the node number in the level, where $1\; \le i\; \le 2l$ since each level $l$ hosts at most $2l$ nodes.  For each node $l,\; i$, there is a corresponding key $K$_{l, i} . The members are always placed at a leaf node. I also use the notion of subtree: in a binary tree, every non-leaf node has a right and left subtree.  An example of a binary key tree is shown in the figure below.