A flaw in a self-healing key distribution scheme

A self-healing key distribution scheme enables a dynamic group of users to establish a group key over an unreliable channel. In such a scheme, a group manager, to distribute a session key to each member of the group, broadcasts packets along the channel. If some packets get lost, users are still capable of recovering the group key using the received packets, without requesting additional transmission from the group manager. A user must be member both before and after the session in which a particular key is sent in order to recover the key through "self-healing". This novel and appealing approach to key distribution is quite suitable in military applications and in several Internet-related settings, where high security requirements should be satisfied. We show a ciphertext-only attack that applies to a proposed scheme.