an authenticated key agreement scheme for sensor networks

186 Pages·2014·1.69 MB·English

AN AUTHENTICATED KEY
AGREEMENT SCHEME FOR
SENSOR NETWORKS
A THESIS SUBMITTED TO AUCKLAND UNIVERSITY OF TECHNOLOGY
IN FULFILMENT OF THE REQUIREMENTS FOR THE DEGREE OF
DOCTOR OF PHILOSOPHY
By
MeeLoongYang
SchoolofEngineering
October2014
Copyright
Copyright in text of this thesis rests with the Author. Copies (by any process) either
infull,orofextracts,maybemadeonlyinaccordancewithinstructionsgivenbythe
Authorandlodgedinthelibrary,AucklandUniversityofTechnology. Detailsmaybe
obtainedfromtheLibrarian. Thispagemustformpartofanysuchcopiesmade. Further
copies(by anyprocess) ofcopies madein accordancewithsuch instructionsmay not
bemadewithoutthepermission(inwriting)oftheAuthor.
The ownership of any intellectual property rights which may be described in this
thesisisvestedintheAucklandUniversityofTechnology,subjecttoanyprioragreement
to the contrary, and may not be made available for use by third parties without the
writtenpermissionoftheUniversity,whichwillprescribethetermsandconditionsof
anysuchagreement.
Furtherinformationontheconditionsunderwhichdisclosuresandexploitationmay
takeplaceisavailablefromtheLibrarian.
(cid:13)c Copyright2014. MeeLoongYang
ii
Declaration
I hereby declare that this submission is my own work and
that, to the best of my knowledge and belief, it contains no
material previously published or written by another person
normaterial whichtoa substantialextent hasbeenaccepted
for the qualification of any other degree or diploma of a
universityorotherinstitutionofhigherlearning.
Signatureofcandidate
iii
Acknowledgements
Iwouldliketoexpressmydeepandsinceregratitudetomyprimarysupervisor,Profes-
sorAdnanAl-AnbukyoftheSchoolofEngineering,AUTUniversity,forhisguidance
throughout. Mythanksandappreciationalsoto mysecondsupervisorDrWilliamLiu
of the School of Computer and Mathematical Science, AUT University for his great
supportandhelpfulcriticisms.
I am grateful to Professor Ajit Narayanan, who as Head of School of Computer and
MathematicalSciences,encouragedandprovidedmewitheveryresourceandsupport
to undertake this study. My thanks also to the Research committee of the School
of Computer and Mathematical Sciences for support in funding for publications and
conferencepresentations.
Iamdeeplygratefultomylovelymywifeforherencouragement,supportandunder-
standing while I am away, leaving her to hold the fort. Last, but not least, I cannot
thankmyparentsenoughbecauseitwastheirvisionandsacrificethatallowedmean
educationinthefirstplace.
iv
Abstract
In wireless sensor networks, the messages between pairs of communicating nodes
are open to eavesdropping, tampering, and forgeries. These messages can easily be
protected using cryptographic means but the nodes need to share a common secret
pairwisekey. Thisthesisproposesanewscheme,theBlom-Yangkeyagreement(BYka)
scheme,thatenablespairsofsensornodesinlargenetworkstocomputetheirpairwise
keysquicklyandefficiently. Priortodeployment,theTrustedAuthority(TA),assigns
each node their public IDs, and using its master keys, computes and stores in the
nodestheirprivatekey-sets. Whenapairofnodesneedtoobtaintheirpairwisekeys,
theyexchange theirpublickey identifierIDswhichare just16-bitintegers. Usingthe
counterpart’sIDwithitsownsetofprivatekeys,thenodesareabletocomputealarge
common pairwise key, but only if they have obtained their keying material from the
same TA. Hence, the scheme is also mutually authenticating. The computations use
simplearithmeticoperationswhicharefastandefficient,easilyundertakenbysensor
deviceswhichhavelimitedcomputational,memory,andenergyresources. Forexample,
itisabletocomputekeysof128bitsin279millisecondsintheMICAzmote,requiring
1170 bytes of memory to store the private keying material. Similar key agreement
schemes, already widely used in computer networks, use public key cryptographic
algorithmswhichrequire computationally expensivemathematical operations,taking
muchlongertime,andrequiringmuchmoreresources.
ThesecurityoftheBYkaschemeisbasedonthedifficultyofobtaininginformation
v
about the private-public-master-key associations (PPMka). The private keys in each
node are computed by the TA using all the permutations of its multiple master keys
and the node’s public keys operating over a small prime field, and then stored in a
randomorderinthenode. Ifthesearecaptured,theprivatekeyscannotbeuseddirectly
as the adversary would first have to discover the PPMka. The analysis showed that,
with suitable keying parameters, even if sufficient number of private keys are stolen,
anadversarywithpowerfulcomputingresourceswouldneedtoexpendaninfeasibly
largeamountoftimeandresourcestotryallthepossiblePPMkatobreakthescheme.
The adversary may try to discover the PPMka by using pairs of captured nodes to
computetheirpairwisekeys, butthiswouldrequirethecaptureof tensofthousandsof
nodes. Alternatively,evenwhenusingthemostefficientmethod,theadversaryneeds
totryalargenumberof possibilitiesequivalenttosecuritystrengthsof80to192bits.
Overall, the adversary has only a small probabilistic chance of breaking the scheme.
Theseanalyticalresults wereverifiedusingcomputersimulatedattacksand areusedto
provide someguidelines andtables forthe selection ofthe keying parametersto meet
implementation and performance requirements including computation times, memory
availability,networksizes,andpairwisekeysizes.
The proposed key agreement scheme is in effect a non-interactive identity-based
scheme which uses the node’s identity (ID) as its public key. This allows a node to
encrypt messages to a target node once its ID is known. It can be used by nodes in
dynamic,mobileandadhocsituationstoopportunisticallysendauthenticatedmessages
toeachotherwhentheyareinrange. Asinglemessageauthenticatedprotocol(SMAP)
usingtheBYkaschemeasthecryptographicprimitiveisproposed. Thespeed,efficiency,
andresilienceoftheBYkaschemewouldmakeitusefulasthecryptographicprimitive
inotherapplicationssuchasemailandvoicecommunications.
vi
Contents
Copyright ii
Declaration iii
Acknowledgements iv
Abstract v
GlossaryandNotations xiv
1 Introduction 1
1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2.1 TheProposedScheme . . . . . . . . . . . . . . . . . . . . . 5
1.3 SecurityModel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3.1 SystemModel . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3.2 AdversaryModel . . . . . . . . . . . . . . . . . . . . . . . . 8
1.3.3 SecurityOutcomes . . . . . . . . . . . . . . . . . . . . . . . 8
1.4 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.5 StructureofThesis . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.6 Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.7 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2 LiteratureReview 14
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.2 KeyTransportSchemes . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.2.1 Pre-distributionSchemes . . . . . . . . . . . . . . . . . . . . 16
2.2.2 KeyDistributionCenters . . . . . . . . . . . . . . . . . . . . 20
2.3 KeyAgreementSchemes . . . . . . . . . . . . . . . . . . . . . . . . 21
2.3.1 PublicKeyCryptographicSchemes . . . . . . . . . . . . . . 21
2.3.2 Identity-BasedCryptography . . . . . . . . . . . . . . . . . . 27
2.3.3 Symmetric-keyKeyAgreementSchemes . . . . . . . . . . . 29
2.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
vii
3 TheBYKaScheme 37
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.2 TheBlom’sKeyAgreementScheme . . . . . . . . . . . . . . . . . . 37
3.2.1 FeaturesoftheBlom’sScheme . . . . . . . . . . . . . . . . . 39
3.2.2 WeaknessesoftheBlom’sScheme . . . . . . . . . . . . . . . 41
3.3 TheBYkaScheme . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.3.1 BaseStationandSetup . . . . . . . . . . . . . . . . . . . . . 42
3.3.2 Bootstrapping . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.3.3 PairwiseKeyDerivation . . . . . . . . . . . . . . . . . . . . 46
3.4 FeaturesoftheBYkaScheme . . . . . . . . . . . . . . . . . . . . . . 49
3.4.1 ImplicitMutualAuthentication . . . . . . . . . . . . . . . . 49
3.4.2 LowCommunicationOverhead . . . . . . . . . . . . . . . . 50
3.4.3 CompactCode . . . . . . . . . . . . . . . . . . . . . . . . . 50
3.4.4 MemoryRequirements . . . . . . . . . . . . . . . . . . . . . 50
3.4.5 Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
3.4.6 PairwiseKeyspaceSize . . . . . . . . . . . . . . . . . . . . . 52
3.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
4 SecurityAnalysis 56
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
4.2 VulnerabilityofKeys . . . . . . . . . . . . . . . . . . . . . . . . . . 57
4.2.1 ResistanceAgainstBruteForceAttacks . . . . . . . . . . . . 57
4.2.2 PublicKeys . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
4.2.3 PrivateKeys . . . . . . . . . . . . . . . . . . . . . . . . . . 58
4.2.4 PairwiseKeys . . . . . . . . . . . . . . . . . . . . . . . . . . 59
4.3 SecurityoftheBlom’sScheme . . . . . . . . . . . . . . . . . . . . . 60
4.3.1 MasqueradeAttacks–SybilAttacks . . . . . . . . . . . . . . 60
4.3.2 RequirementsofPublicKeys: . . . . . . . . . . . . . . . . . 62
4.3.3 AttackingtheMasterKey . . . . . . . . . . . . . . . . . . . 64
4.3.4 EffortRequiredtoBreaktheScheme . . . . . . . . . . . . . 67
4.3.5 LimitationsoftheBlom’sScheme . . . . . . . . . . . . . . . 68
4.4 SecurityoftheBYkaScheme . . . . . . . . . . . . . . . . . . . . . . 69
4.4.1 CaptureThreshold . . . . . . . . . . . . . . . . . . . . . . . 69
4.4.2 Private-Public-Master-KeyAssociation(PPMka) . . . . . . . 69
4.4.3 IndiscernibilityofthePrivate-Public-Master-KeyAssociation 69
4.4.4 ResilienceAgainstSybilAttacks . . . . . . . . . . . . . . . . 71
4.4.5 ResilienceAgainstAttacksontheMasterKeys . . . . . . . . 73
4.5 OtherSecurityIssues . . . . . . . . . . . . . . . . . . . . . . . . . . 74
4.5.1 ImmunitytoMITMAttacks . . . . . . . . . . . . . . . . . . 74
4.5.2 KeyEscrow . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
4.5.3 DoSAttacks . . . . . . . . . . . . . . . . . . . . . . . . . . 74
4.5.4 Compromised-keyImpersonationAttacks . . . . . . . . . . 75
4.5.5 ForwardSecrecy . . . . . . . . . . . . . . . . . . . . . . . . 76
4.5.6 KeyRevocation . . . . . . . . . . . . . . . . . . . . . . . . . 76
viii
4.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
5 CryptanalysisofthePPMka 79
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
5.2 PairwiseKey-setAttack . . . . . . . . . . . . . . . . . . . . . . . . . 80
5.2.1 WithoutAmbiguities . . . . . . . . . . . . . . . . . . . . . . 80
5.2.2 WithAmbiguities . . . . . . . . . . . . . . . . . . . . . . . . 81
5.2.3 PairingAttacks . . . . . . . . . . . . . . . . . . . . . . . . . 83
5.3 PairingAttackwithUnlimitedCapture . . . . . . . . . . . . . . . . . 87
5.3.1 TheTraitorNode . . . . . . . . . . . . . . . . . . . . . . . . 87
5.3.2 FindingaTraitorNode . . . . . . . . . . . . . . . . . . . . . 89
5.3.3 TraitorNodePermutations . . . . . . . . . . . . . . . . . . . 91
5.3.4 ProbabilityofFindingaTraitorNode . . . . . . . . . . . . . 97
5.3.5 NodeCapturetoFindaTraitorNode . . . . . . . . . . . . . 99
5.3.6 UseoftheTraitorNode . . . . . . . . . . . . . . . . . . . . 100
5.4 PairingAttackwithLimitedCapture . . . . . . . . . . . . . . . . . . 102
5.4.1 BinomialDistributionApproximation . . . . . . . . . . . . . 103
5.5 SecurityStrengthoftheBYkaScheme . . . . . . . . . . . . . . . . . 105
5.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
6 EvaluationandPerformance 109
6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
6.2 Experiment–AttackstoObtainthePPMka . . . . . . . . . . . . . . 109
6.2.1 SimulationofAttacks . . . . . . . . . . . . . . . . . . . . . 110
6.2.2 ExperimentalResults . . . . . . . . . . . . . . . . . . . . . . 112
6.3 HardwareImplementation . . . . . . . . . . . . . . . . . . . . . . . 117
6.3.1 HardwareandSoftwarePlatforms . . . . . . . . . . . . . . . 118
6.3.2 ExperimentalProcedure . . . . . . . . . . . . . . . . . . . . 118
6.3.3 PerformanceMeasures . . . . . . . . . . . . . . . . . . . . . 118
6.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
7 ImplementationandApplication 124
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
7.2 SystemImplementation . . . . . . . . . . . . . . . . . . . . . . . . . 125
7.2.1 DesignEquations . . . . . . . . . . . . . . . . . . . . . . . . 125
7.2.2 SelectionofParameters . . . . . . . . . . . . . . . . . . . . . 127
7.2.3 KeyGenerationandDistribution . . . . . . . . . . . . . . . . 129
7.3 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
7.3.1 TheSingleMessageAuthenticationProtocol(SMAP) . . . . 129
7.3.2 CorporateEmail . . . . . . . . . . . . . . . . . . . . . . . . 137
7.4 ComparisonwithotherSchemes . . . . . . . . . . . . . . . . . . . . 137
7.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
ix
8 Conclusion 141
8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
8.2 KeyAgreementSchemes . . . . . . . . . . . . . . . . . . . . . . . . 141
8.3 ResearchObjective . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
8.4 TheBYkaScheme . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
8.5 FutureWork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
8.5.1 IdentityTheft . . . . . . . . . . . . . . . . . . . . . . . . . . 146
8.5.2 ForwardSecrecy . . . . . . . . . . . . . . . . . . . . . . . . 146
8.5.3 NonLinearlyIndependentPublicKeys . . . . . . . . . . . . 146
8.5.4 SMAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
8.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
References 149
A DesignandPerformanceTables 154
B SOURCECODES 161
B.1 SimulateProbabilityofFindingaTraitorNode . . . . . . . . . . . . 161
B.2 SimulateCapturetoFindaTraitorNode . . . . . . . . . . . . . . . . 162
B.3 EstimatingTraitorNodeCaptureSizeandΦ . . . . . . . . . . . . . . 167
B.4 TinyOSCodefortheMICAzmote . . . . . . . . . . . . . . . . . . . 170
x