S., Cryptographic Key Agreement for Mobile Radio,

Transcription

1 DIGITAL SIGNAL PROCESSING 6, (1996) ARTICLE NO Cryptgraphic Key Agreement fr Mbile Radi Amer A. Hassan,* Wayne E. Stark, Jhn E. Hershey, and Sandeep Chennakeshu* *Ericssn Mbile Cmmunicatins Inc., 1 Triangle Drive, Research Triangle Park, Nrth Carlina 27709; EECS Department, The University f Michigan, Ann Arbr, Michigan 48109; and GE Crprate R&D, 1 River Rad, Schenectady, New Yrk Hassan, A. A., Stark, W. E., Hershey, J. E., and Chennakeshu, S., Cryptgraphic Key Agreement fr Mbile Radi, Digital Signal Prcessing 6 (1996), The prblem f establishing a mutually held secret cryptgraphic key using a radi channel is addressed. The perfrmance f a particular key distributin system is evaluated fr a practical mbile radi cmmunicatins system. The perfrmance measure taken is prbabilistic, and different frm the Shannn measure f perfect secrecy. In particular, it is shwn that by using a channel decder, the prbability f tw users establishing a secret key is clse t ne, while the prbability f an adversary generating the same key is clse t zer. The number f pssible keys is large enugh that exhaustive search is impractical. I. INTRODUCTION r 1996 Academic Press, Inc. The need fr secure data cmmunicatins in mbile systems is apparent. A brker r a banker might need t relay sensitive data t a selected custmer thrugh the radi channel. In ne-key cryptgraphic techniques, such as DES [1], a cmmn secret key is needed between such tw users. Key distributin and prtectin is an extremely imprtant aspect f secure cmmunicatins systems. Hwever, it is nt unlikely that the tw users d nt share a cmmn secret key a priri, but need t use a secure channel. In the case where tw users d nt share a cmmn key it is pssible t use tw-key public key cryptgraphy (PKC) such as described in [2]. As an explratin f an alternative t PKC, a technique prpsed in [3] demnstrated that characteristics f the radi channel might be used t the same effect. These characteristics are the cnfirmed shrt term reciprcity f the channel and the rapid spatial decrrelatin f phase in the radi channel; that is, fr an incrementally shrt perid f time, the impulse respnse f a channel viewed frm the antenna frm A t the antenna fr B is the same as the impulse respnse f the channel viewed frm B t A, excluding thermal nise. In this paper the perfrmance f the key management technique that was prpsed in [3] is evaluated fr the purpse f practical implementatin. In additin t prviding anther paradigm fr establishing a mutually held secret variable ver a public channel, the methd addressed in this paper is further mtivated by the fllwing cnsideratin. The ppular PKC algrithms are unprvably secure. The cmplexity f cmputatin fr cnventinal PKC schemes and the amunt f infrmatin that must be exchanged can be quite severe. As new attacks against the PKC systems are uncvered, these systems have retreated t ever lnger exchange vectrs and ever mre cmplex cmputatins. The technique addressed in this paper is a practical alternate mechanism fr cryptvariable establishment and sharing. The mechanism fr secrecy in this scheme depends upn a physical prcess, and the cryptvariable can be established with cmputatins equivalent t a bunded distance decding algrithm. Thus, the decder we use t establish the cryptgraphic variable may als be used fr prcessing the subsequent data transmissin. Als a cnventinal PKC system requires a (pseud) randm quantity t be generated by each party. With the prpsed system there is n need t d this, as the randmness is prvided by the nn-time statinarity and nnspatial statinarity f the channel itself. Wyner [5] and Ozarw and Wyner [6] explit the channel fr secret cmmunicatins but in a cm /96 $18.00 Cpyright r 1996 by Academic Press, Inc. All rights f reprductin in any frm reserved. 207

2 as prbabilistic secrecy. Als, the number f pssible keys is large enugh that exhaustive search is impractical, this will be referred t as cmputatinal secrecy. The paper is rganized as fllws. The system mdel and the key distributin technique are addressed in Sectin II. The perfrmance f the prpsed technique is analyzed in Sectin III; there, numerical results using Glay cding are evaluated. In Sectin IV we draw cnclusins. II. SYSTEM MODEL FIG. 1. A blck diagram shwing the system cnsidered with tw different time varying channels; n i (t), i 5 1, 2, 3, represent thermal nise. The impulse respnse f channel AB is the same as the impulse respnse f channel BA, but it is different frm that f channel AE r BE. pletely different setting. Their results are existence prfs; in particular, it was shwn that fr given nisy channels (ne fr the cmmunicatrs and ne fr an eavesdrpper) there exists a rate belw which perfect secrecy is pssible. This assumes the eavesdrpper has a nisier channel than the cmmunicatrs channel. In [7] the authr has an interesting verview f cryptgraphic key agreement schemes that use the channel in different ways. In mst f these schemes the tw parties initially share a shrt secret key; the wrk in [7], hwever, relaxes this assumptin and addresses the prblem f generating a shared secret key by tw users each knwing a randm variable and the tw randm variables being dependent. A prtcl is described t establish a cmmn secret key and which uses a nisy channel. Hwever, this prtcl is cmpletely impractical when the eavesdrpper s channel is much better than the cmmunicatrs. The scheme described in this paper is cmputatinally secure even when the eavesdrpper has a substantially better channel than the cmmunicatrs. Finally, the recent wrk in [8] evaluates infrmatin theretic mdels f secret sharing. The authrs were able t determine the largest achievable key rate called key capacity. The perfrmance measure taken in this paper is prbabilistic, and different frm the Shannn measure f perfect secrecy [4]. In particular, it is shwn that by using a channel decder, the prbability f tw users establishing a secret key is clse t ne, while the prbability f an adversary generating the same key is essentially zer; this will be referred t The prpsed system is shwn in Fig. 1, where E is an adversary. During the kth signaling interval (kt, (k 1 1)T], A transmits s(t) cnsisting f tw sinusids at frequencies f 1 and f 2 with equal phases and equal energy E; that is, s(t) 5Π2E T cs (2pf 1t 1f) 1Π2E T cs (2pf 2t 1f). (1) The signal is transmitted thrugh a time-varying faded channel, crrupted by additive white Gaussian nise n(t) with duble-sided pwer spectral density N /2. We assume that cs (2pf 1 t) and cs (2pf 2 t) are rthgnal and separated by at least the cherence bandwidth f the channel. Then the received signal r(t), fr t [ (kt, (k 1 1)T], is given by r(t) 5Π2L 1 2 (k)e T cs (2pf 1 t 1Q 1 (k)) 1Π2L 2 2 (k)e cs (2pf T 2 t 1Q 2 (k)) 1 n(t), where the randm variables L i (k), i 5 1, 2, are independent and identically distributed randm variables due t fading, with Rayleigh prbability density functins 5 l i p L (l i ) 5 s 1 exp 2 l 2 22 i 2 2s, fr l i $ 0, (2) 0 fr l i, 0 where s 2 5 E(L i2 (k)) is a characteristic f the channel (E dentes expectatin with respect t p L ). The randm variables Q 1 (k) and Q 2 (k) are mutually independent, each with a unifrm prbability density functin ver [2p, p]. 208

3 B differentially detects an estimate f D kb 5Q 1 (k)2 Q 2 (k) and quantizes the estimate int ne f M phase values, say Q ( ). Except in sequences, the time index k will be drpped with n ambiguity. The differential baseband signal can be shwn t be U B 52L 1 L 2 E exp 5 j(q 1 2Q 2 )61L 1 N 1 1L 2 N* 2 5X B 1jY B, (3) where N 1 and N 2 are cmplex valued Gaussian randm variables with zer mean and variance 2EN, and * dentes cnjugatin. The estimated phase difference is given by F B 5 tan 21 Y B /X B and the quantizer utput is Q (F B ). Repeating the abve transmissin at times k 5 1, 2,...,n,Bestablishes the sequence S B 5 (Q (F 1 B ) Q (F 2 B ) Q(F n B )). (4) Similarly, B transmits a sequence f tw sinusids at the frequencies f 1 and f 2 and with equal phases, after negligible delay amng transmissins; that is, A transmits, then B, then A, and s n in an interleaved rder t maintain the reciprcity assumptin. Fr instance, cnsider a mbile with speed f 100 km/h and using a carrier in the 900 MHz regin; with a delay f 10 µs, the distance mved by the mbile wuld be m, which is negligible cmpared t the wavelength 0.3 m. Thus A frms the baseband differential signal U A 52L 1 L 2 E exp 5 j(q 1 2Q 2 )61L 1 V 1 1L 2 V* 2 5X A 1jY A, (5) where V 1 and V 2 are independent f N 1 and N 2. The estimated phase difference is F A 5 tan 21 Y A /X A. Ntice that due t the reciprcity f the channel, the nly difference between U A and U B is the additive Gaussian nise. Therefre, A establishes the sequence S A 5 (Q (F 1 A ) Q (F 2 A ) Q(F N A )). (6) An adversary E will have the infrmatin U E 52L 3 L 4 E exp 5 j(q 3 2Q 4 )61L 3 N 3 1L 4 N* 4 5X E 1jY E, (7) where L i, i 5 1, 2, 3, 4 are mutually independent, and the estimated phase difference is F E 5 tan 21 Y E /X E ; als, Q i, i 5 1, 2, 3, 4 are mutually independent randm variables. The adversary E establishes the sequence S E 5 (Q (F 1 E ) Q (F 2 E ) Q(F N E )). (8) The sequences S A, S B, and S E are the input t an errr crrectin decder. The utputs f the decders are the keys K A, K B, and K E. Ntice that there is n encding perfrmed at the transmitter end. The decder essentially limits the number f pssible keys t increase the reliability fr key agreement. III. PERFORMANCE ANALYSIS AND RESULTS The fllwing events will be used t assess the perfrmance f a key distributin system: G i 5 5F A [ R i, F B [ R i 6, B i 5 5F A [ R i, F E [ R i 6; here R i is the regin in phase space that is mapped t symbl i. The prbability f a symbl match amng A, B is p g 5 Pr 5 M < i51 Pr(G i )6 M 5 i51 (Pr(F A [ R i )) 2. (9) The prbability f a symbl match amng A, E is p b 5 Pr 5 M < i51 (B i )6 5 1 M. (10) The prbability f an estimated phase in a decisin regin is derived in the Appendix. Nw cnsider the use f a linear blck cde with minimum Hamming distance d, dimensin k, and a blck length n equal t the length f the secret key needed. Then t 5 c(d 2 1)/2d is the number f errrs that can be crrected by the decder. The prbability f agreement being in success is the prbability f the tw received vectrs being in the same decding regin f a cdewrd. This can be shwn t be Pr(K A 5 K B ) 5 l l A l j50 n2l k50 l2j m 150 j m 250 k m 350 n2l2k m n b2 (1 2 p g) b p g n2b, (11) 209

4 FIG. 2. The perfrmance f (23,12) Glay cde t establish a key f length 64 bits by cncatenating three cdewrds. where A l is the weight enumeratr functin f the cde, and b5m 1 1m 2 1m 3 1m 4 0#j1k#t 0#m 1 1j12m 2 1k2m 3 1m 4 #t. The prbability f adversary success P B is given by a similar equatin substituting p b fr p g. Fr small k, mre redundancy is available and a cde with better errr crrectin capability can be btained; hwever, the number f pssible keys becmes smaller and fr small enugh k exhaustive search by an adversary becmes feasible. Therefre, the chice f the cde parameters are crucial, since the cde restricts the key space, but the reductin shuld nt yield an insecure system. Withut the use f a decder, Pr(K A 5 K B ) 5 Pr(S A 5 S B ) 5 p gn and Pr(K A 5 K E ) 5 Pr(S A 5 S E ) 5 1/M n. It is f interest t discuss mre tradeffs invlved in the key distributin system. Sme tradeffs were pinted ut earlier: small k yields a cde with gd errr crrecting capability, but exhaustive search becmes faster expnentially with decrease k. Fr large M, a larger cde can be used thus increasing the cmputatinal secrecy f the system; als, p b decreases, which results in a gd prbabilistic secrecy. Hwever, this is nt sufficient t btain a gd cryptgraphic system; with increasing M, thermal nise effects becme dminant and an increase in E b /N is required t achieve a key agreement with certain prbabilistic secrecy. Therefre, a tradeff exists between cmputatinal secrecy, prbabilistic secrecy, and transmitted energy. T demnstrate with an example, cnsider the use f a (23,12) Glay cde t establish a key f length 64 bits. This key is the cncatenatin f three subkeys each f length 23 (the last 4 bits can be drpped). The Glay cde is a perfect cde, and, therefre, the decder will always utput a cdewrd. The prbability f key establishment is then given by Pr(K A 5 K B ) 3, where Pr(K A 5 K B ) is given in (11). Figure 2 shws the perfrmance f the system in terms f 1 2 Pr(K A 5 K B ) as a functin f average E/N. The use f a decder is necessary fr A and B t establish a cryptgraphic key. Hwever, a decder des nt help E. The chice f a cde and the crrespnding decder is imprtant. One wuld be tempted t use a Reed Slmn cde with large M, since exhaustive search by an adversary fr such cdes is essentially impssible, and the perfrmance f such cdes is attractive in errr cntrl cding. The prblem with using Reed Slmn cdes is the fact that the cde is sparse. With very high prbability the analyzed prtcl will fail t establish the cryptgraphic key. This is true when using any sparse cdes. 210

5 IV. CONCLUSION prbability density functin f F is given by We have evaluated the perfrmance f an uncnventinal cryptgraphic key agreement technique based n the reversibility f a radi channel. This technique results in superir cmputatinal secrecy as well as prbabilistic secrecy. Using this scheme, arbitrary lng keys can be shared, and a key can change during a sessin. An equivalent system wuld be the transmissin f 2M rthgnal tnes by each user. This system will have the same perfrmance; hwever, it requires a much larger bandwidth, as required by rthgnal signaling. APPENDIX where and p F (f0g) 5 1 exp 52G6 2p 1 1 Œ2p (ŒG cs f) exp 52G sin2 f6 3 [1 2 Q(Œ2G cs f)], G5 L 1 2 L 2 2 L 1 2 1L 2 2 E N In this Appendix, the prbability density functin f F is evaluated. Initially, assume D5Q 1 2Q 2 is given and equal t 0. Cnsider U 5 2L 1 L 2 E 1L 1 N 1 1L 2 N* 2 5X1jY X 5 2L 1 L 2 E 1 Re(L 1 N 1 1L 2 N* 2 ) Y5Im(L 1 N 1 1L 2 N* 2 ), where, cnditined n L 1 and L 2,E(X)52L 1 L 2 E0µ, E(Y) 5 0, and variance (X) 5 variance (Y) 5 2EN 0 (L 12 1 L 22 ) 0 s 2. The cnditinal jint prbability density functin f X and Y is P(x, y0l 1, L 2 ) 5 1 with the change f variables 2ps 2 exp 52[(x 2 µ)2 1 y 2 ]/2s 2 6 R 5 ŒX 2 1 Y 2, and F5tan 21 Y X the cnditinal jint density functin f Q and R is given by p(r, F0L 1, L 2 ) 5 R 2ps 2 exp 52(R 2 1 µ 2 2 2µR cs F)/2s 2 6. Integrating ver R [ [0,`), it can be shwn that the Q(x) 5 1 Œ2p e x ` exp 52u 2 /26 du. The prbability density functin P G (g) can be shwn t be 1 g 1 P G (g) 5 e 0 g x 2 (1 2 x) exp 5 2 g 1 2 g x(1 2 x)6 dx, where g52s 2 E/N is the average signal-t-nise rati. The prbability density functin f F cnditined n Dfi0 is then given by p F (f2d). Finally, nte that Q 1 and Q 2 are identically distributed unifrm randm variables ver [2p, p). The sum D5Q 1 2Q 2 can take values in [22p, 2p) accrding t a triangular functin (the cnvlutin f tw unifrm distributins). Thus t reslve the ambiguities f 2p, define the randm variable D8 5 5 D22p, p#d#2p D, 2p#D#p D12p, 22p#D#2p. It can be shwn that D8 is unifrmly distributed ver [2p, p]. With regins given by R i 5 [2(i 2 1)2p/M, i2p/m), fr i 5 1,...,M, the desired prbability is given by Pr(F [ R i ) 5 1 e ` p e 2p 0 2p e p F (f2d0g)p(g)dfdddg. Ri 211

6 ACKNOWLEDGMENTS The authrs thank a reviewer fr pinting ut a fault in using sparse cdes. They als thank Prfessr J. Massey fr his valuable cmments. REFERENCES 1. Data Encryptin Standard. Federal Infrmatin Prcessing Standards, Publicatin Number 46, Natinal Bureau f Standards, Rivest, R. L., Shamir, A., and Adelman, L. A methd fr btaining digital signatures and public key crypt-systems. Cmmun. ACM 21, n. 2 (1978), Hershey, J. E., Hassan, A. A., and Yarlagadda, R. Uncnventinal cryptgraphic keying variable management. IEEE Trans. Cmmun., in press. 4. Shannn, C. E. Cmmunicatin thery f secrecy systems. Bell Syst. Tech. J. 28 (1949), Wyner, A. D. The wire-tap channel, Bell Syst. Tech. J. 54 (1975), Ozarw, L. H., and Wyner, A. D. Wire tap channel, II. Bell Syst. Tech. J. 63 (1984), Maurer, U. M. Secret key agreement by public discussin frm cmmn infrmatin. IEEE Trans. Infrm. Thery 39 (1993), Ahlswede, R., and Csizár, I. Cmmn randmness in infrmatin thery and cryptgraphy. I. Secret sharing. IEEE Trans. Infrm. Thery 39,