Protocols for Secure Communication in Wireless Sensor Networks

4.2. Random Key Pre-Distribution 101
4.2.3 Identity-based Key Rings
The selection of keys in a key ring can be entirely random, as it has been initially
proposed by Eschenauer and Gligor. Alternatively, it can be based on
a public pseudo-random sequence of indices that is derived from the identity
of the node (as proposed by Zhu et al. [204]). This identity-based selection
of keys has the advantage that during the key agreement phase, nodes have to
exchange only their IDs in order to be able to reconstruct which keys the other
node holds. It has the additional advantage of providing a kind of entity authentication.
More precisely, by verifying that a node has knowledge of a specific
set of keys, it is established that this node belongs to the group of nodes that
are legitimatly participating in the network’s operation.
Since the generator Ψ is accessible to all nodes, every node can determine
the indices of the keys in any other node’s key ring, if the other node’s identity
is known. However, the actual keys are not disclosed. Thereby, nodes can
determine their common set of keys, but a party that does not know the keys in
advance will not learn them.
4.2.4 Establishing the Common Key Set
In order to derive a link key, two nodes have to learn which of the nodes from
the key pool they have in common. There are several possibilities for that, with
different advantages and disadvantages.
As proposed in [64], a node can simply broadcast the indices of the keys in
its key ring. Neighbours overhearing this message compare the indices to their
own and decide whether they are able to establish a link key to the broadcasting
node.
When key rings are selected based on a node’s identity, it is sufficient that
a node broadcasts its own ID. Nodes that receive that message can derive the
set of of key indices from that ID and determine the shared set of keys. This is
easily achieved by making the following function available to each node:
ψ(IDu) = Ψ g (IDu,1,S,m) .
(Since storing the complete output of Ψ during the pre-distribution phase in
each node is infeasible, this is only efficient if Ψ generates its output pseudorandomly,
for example based on a hash function, such that a node can do this
calculation itself.)
These two approaches have the disadvantage that an adversary learns which
keys (more precisely, their indices) are contained in a node’s key ring. This
might facilitate certain attacks since the adversary can now selectively target