Protocols for Secure Communication in Wireless Sensor Networks

102 Chapter 4. Key Establishment
nodes and try to capture them in order to obtain certain keys which he does
not yet possess. The first approach has the additional disadvantage that the
broadcast messages are quite large, comprising at least mlog 2 S bits of index
information.
Another possibility is to broadcast the key indices only in an indirect manner.
As proposed similarly in [143], a node broadcasts the following information:
α,H(x0,α),H(x1,α),...,H(xk−1,α)
where α is a random nonce, H is a keyed hash function, and xi are the keys from
the node’s key ring. A value H(·) is called a hash commitment. An overhearing
node computes H(yi,α) for every key yi in its own key ring. By comparing the
results to the received values, it can determine which node it shares with the
broadcasting node.
This last approach has the advantage that it does not reveal any information
about the key indices unless the corresponding keys are already known. Therefore,
it does not help an adversary to focus his attack on certain nodes. On the
other hand, overhearing nodes have to perform a moderate number of computations.
They have to execute m applications of function H and m 2 comparisons
(each of their own results with each of the received values). Also, the broadcast
message is quite large.
Note that in [143], instead of a keyed hash function, encryption and decryption
operations were used. The broadcasting node encrypts α with each of its
keys, and a receiver decrypts every value with each of its keys, resulting in m 2
decryptions. Additionally, the m 2 comparisons are still necessary. By eliminating
the need to apply each key to each of the transmitted values, our version
reduces complexity from O(m 2 + m 2 ) to O(m + m 2 ) on the receiver’s side.
Sending hash commitments uses a lot of bandwidth. The output of a hash
function has n bits (e.g. n = 160 for SHA-1), and is considered completely
random. The size of a broadcast message can be reduced by including not
the full hash commitments, but only a substring for each of them. Instead of
n bits, only k < n bits could be transmitted for each hash commitment. The
comparisons are then based on these substrings. Since they are smaller, the
likelihood that a comparison yields a false positive result is higher than for the
full length.
The impact of a false positive match would be that a node assumes that its
set of shared keys with another node is larger than it is in reality. This leads
to an attempt at establishing a shared key based on this extended set of keys,
which would fail. The nodes would then not be able to communicate securely.
Therefore, we would like to keep the probability of such an event as small as