Modelling ephemeral leakage in group key exchange protocols