Attacks to Xu-Tilborg's conference key distribution scheme

In this letter, we show that Xu-Tilborg's conference key distribution scheme does not meet the forward secrecy and is vulnerable to impersonation attacks. Also, we propose a modified version which satisfies the forward secrecy and is secure against impersonation attacks.