Protocols for Secure Communication in Wireless Sensor Networks

4.2. Random Key Pre-Distribution 99
messages. The EG scheme is based on a pool of keys of which a subset is
known to every node. Two nodes can derive a pairwise key, a link key, from
the intersection of their subsets. Note that here, link refers to a connection in
the authentication graph of a network, which is not necessarily equivalent to a
radio link.
Such a scheme does not provide “perfect” security since it cannot be guaranteed
that a derived key is known exclusively to one pair of nodes. An attacker
who captures a set of nodes acquires the key material known to these nodes and
can, with a certain probability, derive from that the link key that has been established
between two other, uncompromised nodes. Depending on the chosen
parameters, the scheme provides a certain resilience against such attacks.
Due to its probabilistic nature, the scheme cannot guarantee that two nodes
will be able to establish a link key at all, as it is possible that the intersection
of their key material subsets is empty. The parameters can be chosen such that
connectivity (i.e., the probability with which two nodes can establish a pairwise
link key) will be high, but it will be usually below 1, and a high connectivity
will lead to reduced resilience.
4.2.1 A Model for Key Pre-Distribution
The following elements are required for a random key pre-distribution scheme.
The key space defines the set of values that are eligible as keys. These values
must be of sufficient length to provide computational security when being used
as cryptographic keys. A typical length could be 128 bit.
For some pre-distribution schemes, for example full pairwise key distribution,
keys are drawn from the complete key space. For random key predistribution,
only a subset of the complete key space is used. This subset is
randomly chosen and is called key pool K . 1 The size of the key pool determines
the connectivity and resilience of the scheme, as we will see later. We
will denote the key pool size as S.
We assume that each of the N nodes has a unique identifier IDu (u ∈
{1,...,N}). To each node, a set of keys is assigned, which is called a key ring.
The elements of a key ring are selected from K by using a selection function
F, which will be defined shortly. First, we define the following elements:
• K is the key pool, i.e. an ordered set of keys.
1 It should be noted that some cryptographic algorithms, such as DES or Blowfish, have “weak keys”, i.e. keys
with certain properties that lead to insecure results. Although weak keys are usually very rare, one might check
if the key pool contains such keys and replace them, if a cryptographic algorithm with weak keys is being used.
There are no known weak keys for the current cryptographic standard AES/Rijndael.