mDP kay agreement protocol where z's are found on the step where the common key is generated? Whilst I was studying the mDP protocol I came across into the following step:


  Group Key agreement:
  Each $U_i$ checks whether $z_1 \bigoplus ... \bigoplus z_n = 0$ and whether all signatures $\sigma_i$ are valid and aborts if any of these checks fails. Otherwise, $U_i$ proceeds as follows:
  iteratively for each $j=i,...i+n-1: z'_{j,j+1}:=z'_{j-1,j} \bigoplus z_j $
  ...


But I cannot understand on the notation what does it mean by $z'_{j-1,j}$ where does it find it is the $z_i$ received from the other participants?

The paper is in springler and is titled as;

"Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys (Full Version)" authored by: Abdalla Michel, Chevalier Celine,Manulis Mark,Pointcheval David

an alternative from Pointcheval's web site.
As said in page 6, Each $U_i$ proceeds as follows;


compute $\text{sid}_i:= U_1|y_1,\ldots,U_n|y_n)$, 
$z'_{i-1,i} := H(k'_{i-1,i}, \text{sid}_i)$,
$z'_{i+1,i} := H(k'_{i+1,i}, \text{sid}_i)$,
$z_i := z'_{i-1,i} \oplus z'_{i+1,i}$,
$\sigma_i := \text{Sign}(sk_i, (U_i,z_i,\text{sid}_i ))$,
$\text{broadcast} (U_i,z_i,\sigma_i)$.


since in the beginning, the $(U_i,y_i)$ is broadcasted the above calculation is fine.

When a user $U_j$ gets all $(U_i,z_i,\sigma_i) , 1 \leq i \leq n$, he is ready to verify. Actually, they agree on a key with their neighbors by Diffie-Hellman Key Exchange protocol.