Protecting Small Keys in Authentication Protocols for Wireless Sensor Networks

Protecting Sall Keys in Authentication Protocols for Wireless Sensor Networks Kalvinder Singh Australia Developent Laboratory, IBM and School of Inforation and Counication Technology, Griffith University Gold Coast, Queensland, Australia, kalsingh@au.ib.co Kartikey Bhatt, Vallipura Muthukkuarasay School of Inforation and Counication Technology, Griffith University Gold Coast, Queensland, Australia {kartikey.bhatt@student., v.uthu@}griffith.edu.au Abstract Wireless sensor networks provide solutions to a range of onitoring probles. However, they also introduce a new set of probles ainly due to sall eories, weak processors, liited energy and sall packet size. Thus only a very few conventional protocols can readily be used in sensor networks. This paper introduces efficient protocols to distribute keys in wireless sensor networks. We also show how to harden the protocol against brute force attacks on sall security keys. This is achieved without the necessity of using traditional encryption. The proposed protocols guarantee that the new key is fresh and that the counicating nodes use the sae key. The protocols were ipleented in TinyOS and siulated using TOSSIM. Energy consuption and eory requireents are anlysed in detail. 1 Introduction Wireless sensors and actuators have the potential to drastically change the way people live as they pereate the environent. Sensors can be used to onitor objects, space and the interaction of objects within a space. Sensors can onitor a wide range of diverse phenoena by collecting inforation such as vibrations, teperature, sound, and light. Different sensors have different costs. For exaple, a sensor detecting light will have different costs to a sensor recording sound. However, the less costly sensors can be used to detect a phenoena before alerting the ore costly sensors to start their onitoring. As the nuber of heterogeneous sensors increases, so will the aount of interactions between the sensors. Key establishent protocols are used to set up shared secrets between sensor nodes. Sensor nodes suffer fro liited coputational capabilities, battery energy, and available eory. Asyetric cryptography is unsuitable for ost sensor architectures due to higher coputational overhead, and energy and eory consuption. Rando key predistribution schees [4],[7],[14] are a ajor class of key establishent protocols for sensor networks. One of the issues with rando key predistribution schees is that if a certain nuber of sensor nodes becoe coproised, then the entire sensor network can becoe coproised. We propose a protocol that establishes a new pair wise key between two sensor nodes. If the underlying rando key predistribuation schee becoes coproised in this new protocol, it will not affect the entire sensor network. The PIKE [3] and Singh [18] schees showed that there are a class of probles where one or ore sensor nodes act as a trusted interediary to facilitate key establishent. When using syetric key cryptography, if two entities sharing no previous secret want to counicate securely with each other, they generally do so with the assistance of a third party. Typically, the trusted interediary provides an authentication service that distributes a secure session key to the sensor nodes. The issues with using a sensor node as the trusted third party are: the trusted interediary can becoe coproised; key sizes in sensors nodes are not large; sensor networks ay only require authenticated essages, without any need for encryption. Another class of probles occur when huan interaction with sensor networks is required [5]. People authenticating with a sensor network (using a PDA or obile phone) will prefer using short passwords over long binary keys. In this paper we propose a nuber of protocols to address these probles. The proposed protocols cobine traits fro a two party password authenticated key exchange protocol [1] and a syetric key server based key establishent protocol [11]. The proposed protocols do not

require traditional encryption to transport the new session key. We will show the sensor nodes can prove that the new key is fresh. We will also deonstrate how key confiration ensures that the nodes are guaranteed to be using the sae key. The proposed protocols can be extended to use huan readable passwords instead of binary keys. 2 Sensor Networks We refer to a sensor network as a heterogeneous syste cobining sall, sart, cheap, and sensing devices with general purpose coputing eleents. Sensor network applications [2] include tracking bushfires, onitoring wildlife, conducting ilitary surveillance, and onitoring public exposure to containants. The sensor nodes are resource constrained. A typical sensor node is the Mica ote [22]. The Mica otes contain a 4 MHz processor with 512 KB flash eory and 4 KB of data eory. A Mica ote also has a separate 512 KB flash eory unit accessed through a low speed serial peripheral interface. The RF counication data transfer rate is approxiately 40 kbps. The axiu transission range is approxiately 100 etres in open space. One of the ajor issues in sensor networks is to reduce the counication costs. Counication is the ost energy intensive operation, and any protocols are designed to reduce as uch counication overhead as possible. Mica sensor nodes run TinyOS [20], an event driven operating syste specifically designed for wireless sensor environents. The eory footprint for TinyOS is sall: a iniu installation (the core coponents) uses 400 bytes of data and instruction eory. TinyOS is developed in nesc and supports other hardware platfors. The TinyOS network packet wraps the payload during sensor node counication. To save space, it does not transit the source address of the sender. Network security in sensor environents differ in any ways fro other distributed systes. Sensor nodes have little coputational power, thus even efficient cryptographic ciphers ust be used with care. Security protocols should use a inial aount of RAM. Counication is extreely expensive, so any increase in essage size caused by security echaniss coes at significant cost. Energy is the ost iportant resource, so each additional instruction or bit transitted eans the sensor node is a little bit closer to death. Nearly every aspect of sensor networks is designed with extree power conservation. Perrig et al. proposed a cryptography library using syetric keys [17]. However, recent work has shown that asyetric keys can also be used [16]. Until recently it was believed that asyetric key algoriths were too heavy weight. Thus uch of the work on authentication and key establishent protocols have used a syetric key cryptography library, A survey of current authentication echaniss in wireless sensor networks is given in [21]. One of the ajor issues with soe of the key establishent protocols, is that there are situations where if a sufficient nuber of sensor nodes becoe coproised, the entire sensor network ay becoe coproised. The other ajor issue is that the existing key establishent protocols do not allow for huan readable passwords to be used to authenticate devices. 3 Notation and assuptions This paper will use the following notation to describe security protocols and cryptographic operations: A, B The two nodes who wish to share a new session key. S A trusted server. N A, N B Nonces generated by nodes A and B respectively. [[M]] K Encryption of essage M with key K to provide confidentiality. [M] K One way transforation of essage M with key K to provide integrity. K AB, K AB The long ter key initially shared by A and B and the new session key. K AS, K BS Long ter keys initially shared by A and S, and B and S respectively. X, Y The concatenation of data strings X and Y. A B : A sends a essage to B. Another way to define sending of essage. 4 Liitations and Probles This section discusses liitations and probles with existing network protocols when applied to wireless sensor networks. 4.1 Two party password based protocols We first investigate a ethod to create a new key between two sensor nodes, such that even if the old key is coproised, the new key will not be coproised. Password based protocols are a good source of protocols that provide this feature. Another useful feature is that they do not rely on the fact that original key is a strong key. The PPK protocol [1] is an exaple of a password based protocol. It only needs two essages to coplete the key exchange. However, the protocol was defined using the RSA algorith. But the RSA has been shown not to be feasible in sensor networks [16].

4.2 A three party protocol We now exaine a three party key establishent protocol. The Janson Tsudik 3PKDP protocol [11] is a serverbased protocol, and relies upon long ter keys held between the client and the server. The following constructs are used when defining the protocol: AUTH A = [N A, K AB, A] KAS MASK A = [[AUTH A ]] KAS AUTH B = [N B, K AB, B] KBS MASK B = [[AUTH B ]] KBS Janson Tsudik protocol (shown in Protocol 1) uses a novel approach when encrypting the key. This allows the M ASK values to be either generated via an encryption algorith or a MAC algorith. Protocol 1 Janson Tsudik 3PKDP protocol M1 A B : A, N A, N A M2 B S : A, B, N A, N B M3 S B : AUTH A, MASK A K AB, AUTH B, MASK B K AB M4 B A : AUTH A, MASK A K AB, [N A, N B, B] K AB, N B M5 A B : [N A, N B, A] K AB In wireless sensor networks, constraints ay lead to the requireent to have soe sensor nodes as a trusted third party. A proble with sensor nodes is that they can be easily coproised, and any keys that the nodes contain can usually be obtained if soeone has physical access to the node. A proble with Protocol 1 is that if an adversary recorded the protocol between A, B and S, then the adversary could obtain S and have the keys K AS and K BS. The adversary can then calculate the AUTH, MASK values and finally calculate the value for K AB. Also, depending on the size of the keys K AS and K BS, a brute force attack is also possible. If we assue that A is alicious or coproised, then A can perfor the following calculation to coproise the key between B and S. We first specify K i X, where X is the set of all possible keys between B and S. The adversary (in this case A) can perfor the following calculation for each K i as shown in Equation (1). AUTH B = [N B, K AB, B] Ki (1) If there is ore then one K i then for each of the values the following calculation, as shown in Equation(2), can be perfored. MASK B = [AUTH B ] Ki (2) In Protocol 1, an adversary can also perfor an offline attack, without any of the sensor nodes being coproised. The adversary can perfor the following calculations for each K i as shown in Equation (3) and Equation (4). If the Equation (4) returns true, then the adversary has discovered both K AB and K BS. They are the values K and K i respectively fro Equation (3). K = [AUTH B ] Ki (MASK B K AB ) (3) [N A, N B, B] KAB = [N A, N B, B] K (4) It should be noted that this attack is only possible if the keys between the sensor nodes and the interediary node are sall enough to perfor a brute force attack. 4.3 Three Party Password Based Protocols There are several three party protocols, which assue that the long ter keys held by the parties and the trusted server are sall. Gong, Loas, Needha and Saltzer (GLNS) [9] published the first three party password based protocol. The protocol was later revised [8]. However, the protocol relies upon public key cryptography, which ay not be applicable to a sensor node. Steiner et al. [19] created a novel three party protocol, where the server cannot obtain the session key. However, flaws in the protocol were latter found [6], [12]. The Lin et al. [13] protocol has no known attack, however, it does need seven separate essages. Each essage that a sensor node sends or receives requires extra energy, which the sensor ay not have. 5 Proposed Protocols 5.1 Modified PPK Protocol We have developed a Modified Protocol 1, where we use elliptic curves instead of RSA. We have extended soe of the techniques found in [15] to odify the PPK protocol to use elliptic curves. The ost difficult part of this protocol is apping A, B, K AB to a rando point on the elliptic curve. The function f 1 is used to generate a point. A general procedure for this can be found in IEEE 1363 standard [10] (Appendix A.11.1). The function f 2 is used to generate the new key K AB. The procedure involves calculating a hash of the key. The hash value is equal to x in the elliptic curve, and thus y can be calculated. The original key chosen between A and B should be generated such that a point can be easily found in the elliptic curve. Otherwise, according to [10] the procedure becoes non deterinistic. We assue that K AB was originally chosen so that finding a point on an elliptic is deterinistic. However, if K AB is a password rather than

Modified Protocol 1 PPK protocol with elliptic curve Shared Inforation: Generator g of G where y 2 = x 3 + ax + b A B P 1 = r(f 1 (A, B, K AB )) x R Z q t A = xg = t A + P 1 ta = P 1 y R Z q P 2 = r(f 1 (B, A, K AB )) t B = yg t B = P 2 = t B + P 2 Z AB = xt B Z AB = yt A K AB = f 2(A, B,,, Z AB, P 1 ) a binary key, then we are not guaranteed that the first hash value can be directly apped to an elliptic curve. 5.2 Proposed three party protocol When creating our new protocol we assue AS and AS are essages involved in Modified Protocol 1, where the two participants are A and S. There are siilar constructs BS and BS for essages between B and S. Proposed Protocol 1 Janson Tsudik 3PKDP protocol M1 A B : A, N A, N A, AS M2 B S : A, B, N A, N B, AS, BS M3 S B : AUTH A, MASK A K AB, AUTH B, MASK B K AB, AS, BS M4 B A : AUTH A, MASK A K AB, [N A, N B, B] K AB, N B, AS M5 A B : [N A, N B, A] K AB When the node S obtains M2, it will be able to calculate new values for K AS and K BS. It can use these new values to create the AU T H and M ASK constructs. Once the protocol is finished, these new keys can be discarded. Thus, if ever S was coproised, than the value K AB will not be coproised. 6 Analysis and Coparison We first carry out a perforance coparison between the Lin protocol and our Proposed Protocol 1. The values for the Lin protocol were obtained directly fro their publication [13], except that we have also included the nuber of essages sent by each sensor node. If we converted the Lin protocol to use elliptic curves, there would still be one ore ECC ultiplication perfored on both sensor nodes A and B, as well as extra rando nuber calculations (for the apping of the key to an elliptic curve point). As seen fro Table 1, our proposed protocol has less nuber of essages and less MAC calculations. However, the proposed protocol does require ore rando nuber calculations. The nuber of encryption and decryption operations are the sae for both protocols. The flexibility of our protocol allows us to convert the encryption and decryption operations into generating MACs. In this case the nuber of MACs generated will be the sae between the two protocols, and the proposed protocol will not need any encryption or decryption operations. Table 1. Perforance Coparison Lin vs. Proposed Lin Proposed A B S A B S essages sent 3 2 2 2 2 1 odular exponentiation 3 3 4 0 0 0 ECC ultiplication 0 0 0 2 2 4 en(de)cryption 1 1 2 1 1 2 MACs 3 3 4 2 2 2 rando nubers 1 1 2 3 3 2 The Modified Protocol 1 and Proposed Protocol 1 were ipleented in TinyOS [20] and siulation was run using TOSSIM. David Malan s [16] ipleentation of elliptic curve for sensor networks was used. We used the curve y 2 + xy = x 3 + x 2 + 1 and reduced polynoial f(x) = x 163 + x 7 + x 6 + x 3 + 1. The siulation tie for the two party was 13.38 seconds. The siulation tie for the three party protocol was 17.92 seconds. The siulation results for the two protocols are shown in Table 2, where energy coparisons are ade between the sensor nodes and the protocols. All the values are given in icrojoules. Table 2. Siulation results ECC ECC & SKIPJACK ID radio cpu total radio cpu total A 78.56 31.54 110.10 131.68 52.89 184.57 B 80.10 32.16 112.26 117.72 47.27 164.99 A eory distribution coparison of our ipleentation of Proposed Protocol 1 is shown in Table 3. The.bss and.data segents use SRAM, while the.text segent uses ROM. When we used elliptic curve cryptography the size

of the application for both ROM and RAM has doubled in size. Table 3. Meory Overhead In Bytes On MICA2 Platfor 7 Conclusions Meory ECC No ECC ROM 40130 25470 RAM 1478 761.data 264 264.bss 1214 497.text 39866 25206 We have proposed novel key establishent protocols for both two party and three party scenarios. The proposed protocols cobine traits fro a two party password authenticated key exchange protocol and a syetric key server based key establishent protocol. The proposed protocols do not require traditional encryption to transport the new session key. The proposed protocols can be extended to use huan readable passwords instead of binary keys. A coparison study was perfored, showing the frequencies of different cryptographic operations. We ipleented the protocols and copared the energy consuption of the nodes for both the two party and three party scenarios. The ipact on eory by adding elliptic curves to a sensor application was analyzed. References [1] V. Boyko, P. MacKenzie, and S. Patel. Provably secure password-authenticated key exchange using Diffie-Hellan. In B. Preneel, editor, Advances in Cryptology EURO- CRYPT 2000, volue 1807 of Lecture Notes in Coputer Science, pages 156 171. Springer-Verlag, 2000. [2] N. Bulusu. Introduction to wireless sensor networks. In N. Bulusu and S. Jha, editors, Wireless Sensor Networks: A Systes Perspective. Artech House, 2005. [3] H. Chan and A. Perrig. PIKE: Peer interediaries for key establishent in sensor networks. In Proceedings of IEEE Infoco. IEEE Coputer Society Press, Mar. 2005. [4] H. Chan, A. Perrig, and D. Song. Rando key predistribution schees for sensor networks. In SP 03: Proceedings of the 2003 IEEE Syposiu on Security and Privacy, page 197, Washington, DC, USA, 2003. IEEE Coputer Society. [5] W. S. Conner, J. Heideann, L. Krishnaurthy, X. Wang, and M. Yarvis. Workplace applications for sensor networks. In N. Bulusu and S. Jha, editors, Wireless Sensor Networks: A Systes Perspective. Artech House, 2005. [6] Y. Ding and P. Horster. Undetectable on-line password guessing attacks. SIGOPS Oper. Syst. Rev., 29(4):77 86, 1995. [7] W. Du, J. Deng, Y. S. Han, and P. K. Varshney. A pairwise key pre-distribution schee for wireless sensor networks. In CCS 03: Proceedings of the 10th ACM conference on Coputer and counications security, pages 42 51, New York, NY, USA, 2003. ACM Press. [8] L. Gong. Optial authentication protocols resistant to password guessing attacks. In 8th IEEE Coputer Security Foundations Workshop, pages 24 29, June 1995. [9] L. Gong, M. A. Loas, R. M. Needha, and J. H. Saltzer. Protecting poorly chosen secrets fro guessing attacks. IEEE Journal on Selected Areas in Counications, 11(5):648 656, 1993. [10] IEEE. Standard specifications for public key cryptography. Technical Report IEEE 1363-2000, IEEE, 2000. http://grouper.ieee.org/groups/1363/p1363. [11] P. Janson and G. Tsudik. Secure and inial protocols for authenticated key distribution. Coputer Counications, 18(9):645 653, Septeber 1995. [12] C.-L. Lin, H.-M. Sun, and T. Hwang. Three-party encrypted key exchange: attacks and a solution. SIGOPS Oper. Syst. Rev., 34(4):12 20, 2000. [13] C.-L. Lin, H.-M. Sun, M. Steiner, and T. Hwan. Three-party encrypted key exchange without server public-keys. IEEE Counications Letters, 5(12):497 499, 2001. [14] D. Liu and P. Ning. Establishing pairwise keys in distributed sensor networks. In CCS 03: Proceedings of the 10th ACM conference on Coputer and counications security, pages 52 61, New York, NY, USA, 2003. ACM Press. [15] P. MacKenzie. More efficient password-authenticated key exchange. In D. Naccahe, editor, Topics in Cryptology CT RSA 2001, volue 2020 of Lecture Notes in Coputer Science, pages 361 377. Springer-Verlag, 2001. [16] D. J. Malan, M. Welsh, and M. D. Sith. A public key infrastructure for key distribution in tinyos based on elliptic curve cryptography. In Proc. 1st IEEE Counications Society Conference on Sensor and Ah Hoc Counications and Networks (SECON 04), pages 71 80, Santa Clara, CA, USA, October 2004. IEEE Coputer Society Press. [17] A. Perrig, R. Szewczyk, V. Wen, D. Culler, and J. D. Tygar. SPINS: Security protocols for sensor networks. In Seventh Annual International Conference on Mobile Coputing and Networks (MobiCOM 2001), Roe, Italy, July 2001. [18] K. Singh and V. Muthukkuarasay. A inial protocol for authenticated key distribution in wireless sensor networks. In ICISIP 06: Proceedings of the 4th International Conference on Intelligent Sensing and Inforation Processing, Bangalore, India, Deceber 2006. To be published. [19] M. Steiner, G. Tsudik, and M. Waidner. Refineent and extension of encrypted key exchange. SIGOPS Oper. Syst. Rev., 29(3):22 30, 1995. [20] TinyOS. http://www.tinyos.net/, 2006. [21] H. Vogt. Exploring essage authentication in sensor networks. In ESAS, pages 19 30, Heidelberg, Gerany, August 2004. [22] F. Zhao and L. Guibas. Wireless Sensor Networks: An Inforation Processing Approach. Morgan Kaufann, San Francisco, CA, USA, 2004.