Protocols for Secure Communication in Wireless Sensor Networks

2.8. Cryptography for Sensor Networks 55
output length of the hash function. If this output is truncated to, for example,
its m-bit prefix, where m is large enough (depending on the anticipated attacker
strength), this would still provide a sufficiently high security level.
It is important to distinguish between offline and online attacks on a MAC.
If only online attacks are possible, for example if HMAC is being used for creating
MACs, a relatively small MAC size would be adequate. As an example,
assume a sensor node requires a time of t = 10 ms for receiving a message and
verifying its authentication code. With a bitlength m = 32 of the authentication
code, around 2 32 attempts are necessary before the sensor node accepts the
message as being valid. Thus, the node would accept the message only after
approximately 5965 hours (248 days). Obviously, running under constant load,
a battery-powered sensor node would run out of energy long before that time
has passed.
The same MAC length would be insufficient to prevent offline attacks, however.
In offline attack, the computations are performed without interaction with
the attack target and can be massively parallelized. To prevent such attacks,
at least 80 bits are required, which would still lead to a 10 byte overhead per
MAC.
2.8.6 Key Management
Cryptographic keys are necessary to establish secure channels between communicating
nodes. The main tasks of key management are the distribution,
refreshment, and revocation of keys. In centralized architectures, one can use
key distribution centers (KDC) to which nodes securely connect (by means of a
predefined secret between the KDC and each node) in order to receive updates
on their keys or to retrieve new keys for pairwise communication among nodes.
Generally, sensor networks are highly distributed, multi-hop systems in
which communication to a central entity is expensive. Transient disconnectedness
of parts of the network would even make it impossible to reach a KDC
and thus prevent nodes from exchanging messages. Therefore, a distributed
solution to key management in sensor networks is preferable.
One viable approach is to pre-load a set of keys onto each sensor node before
deployment. This can be done in a secure environment that has no tight energy
restrictions. These keys can serve various purposes after deployment:
• Secure interaction with the base station – Each node is assigned a secret
key that is only known to the node itself and the base station.
• Key agreement between nodes – A key agreement scheme based on (random)
subsets of a large key pool such as proposed in [64] can be used to