NAC

In the c++ code, the comment for Manager::getGroupKeys() method says :

* This method creates a group key if it does not
* exist, and encrypts the key using public key of
* all eligible members.
*
* @p needRegenerate should be true if  
    1.first time to call  
    2.a member was removed
*  and it can be false if  
    1.not the first time to call  
    2.a member was added

I want to suggest changing the default of needRegenerate to false to fit the description of the method. And rephrase "it can be false" to "it should be false".

I don’t know if it is just me, but does the statement "it can be false if…" sound to you like “it doesn't need to be false if it is not the first time to call” ?

Actually, if needRegenerate == false and it is the first time to call, the method will

1) creates a group key if no existing key is found, or
2) return the existing key.

This behavior more precisely matches the statement ‘This method creates a group key if it does not exist’