Protocols for Secure Communication in Wireless Sensor Networks

114 Chapter 4. Key Establishment
The resilience of the infinite model can be derived from the following simple
combinatorial construction. We assume an urn model, with an urn initially
holding two blue balls and j red balls. The blue balls represent the chain values
of Alice and Bob, while the red balls represent those of Eve. The position
indices on the hash chain are independently chosen. We simulate this by randomly
placing the balls on a line of fixed length. We stipulate that the leftmost
ball on that line represents the chain value with the smallest position index. The
ball next to it corresponds to the key with the second-smallest index and so on.
The two left-most balls determine whether Alice and Bob’s key is secure or
not. If these are both blue balls, their key is secure. Otherwise, at least one red
ball is placed on the left from a blue ball, which means that there is at least one
of Eve’s values from which the key can be constructed.
There are j +2 balls in total, from which the two left-most balls are selected.
Out of all possibilities to choose these two balls, only in one case two blue balls
are chosen, which yields a probability for key security of
β = 1
j+2
j
=
2
( j + 2)( j + 1)
(4.7)
It turns out that the difference between β and Pr[A] is, from a practical point
of view, quite small even for moderate sizes T . This fact is illustrated in Figure
4.4. It is therefore unnecessary to use long hash chains in order to achieve a
good approximation to the theoretically possible resilience. For practical purposes,
T = 256 should be sufficient in most cases. For example, this would
lead, for j = 2, to a difference of β − Pr[A] = 1.29 · 10 −3 . This means that
about one in one thousand link keys is compromised due to the fact that hash
chains are finite. Compared to the overall compromise probability of 5/6, this
is a negligible fraction.
4.3.5 Discussion
Man-in-the-middle attack
Note that the protocol as it stands does not provide any authentication of the
transmitted position indices, and the identities of the involved nodes are not
verified. This makes a man-in-the-middle attack possible. An attacker, Eve,
may intercept Alice’s message to Bob and instead send her own position index
to Bob. Bob would proceed, computing the shared key between him and
Eve, but assuming that he shares this key with Alice. Similarly, Eve tricks Alice
into establishing a shared key with her. Every further message exchange