Protocols for Secure Communication in Wireless Sensor Networks

6.4. Security Evaluation 193
The secret suffix construction has the disadvantage that if the underlying
hash function h is not resistant to finding second preimages, a MAC can be
easily constructed for forged messages. This is particularly undesirable since
the attack can be executed offline, i.e. no interaction with the receiving node
is necessary. The original message m is known, so the attacker can use this
knowledge to search for a message m ′ that yields the same hash output as m.
The attacker can then transmit m ′ and the original MAC a. The verification
done by the receiver will be successful.
It is not known whether modern cryptographic hash functions, such as the
family of SHA functions, is indeed resistant to second preimage attacks. Weaknesses
are continously showing up but it hasn’t been demonstrated yet that arbitrary
second preimages can be easily found. SHA-1 has been found to be weak
against collision attacks [188], meaning that pairs of messages m1 and m2 can
be found that yield the same hash value. However, this does not immediately
lead to a vulnerability regarding second preimages, which requires to find a
second message that yields the same hash value as a given message. Thus, we
can safely use SHA-1 as an example hash function. However, any other hash
function can be used in the Canvas scheme as well.
It is important to note that public key signature schemes are vulnerable to
the same preimage attack as the secret suffix MAC if the signature is created on
the hashed message. Only if the signature is created on the message directly,
this attack does not apply. However, this is only possible if the message is short
enough. Thus in general, hash-based signatures are applied. To conclude, the
secret suffix method will yield a similar security level as a public key signature
scheme.
6.4.6 Example: A Dynamic Application Scenario
Figure 6.19 shows the layout of a building with a number of rooms and a hall
connecting these rooms. A possible application of a wireless sensor network
in such a scenario is the reporting of sensor data to a guard walking through
the hall. Sensor nodes are distributed throughout the area. The sensor data is
reported to the node that is closest to the guard. It is assumed that the guard
walks straight through the hall and collects data at regular intervals, twenty
times in total. Each time, a randomly selected node from each room sends a
message towards the location of the guard.
Figure 6.20 shows the number of non-tampered messages that are obtained
by the guard while the network is under a random spread attack. With a small
number of compromised nodes (up to 50, in this case), more than 80% of the