# Difference between revisions of "Experimental Security Analysis"

(→Eavesdropping Information Reconciliation Data) |
|||

(9 intermediate revisions by the same user not shown) | |||

Line 20: | Line 20: | ||

To analyze potential statistical defects of quantization schemes, the following metric is introduced. The BER indicates the percentage of bits that are in disagreement between the initial key material of two parties. With decreasing BER, the effort needed to detect and correct errors | To analyze potential statistical defects of quantization schemes, the following metric is introduced. The BER indicates the percentage of bits that are in disagreement between the initial key material of two parties. With decreasing BER, the effort needed to detect and correct errors | ||

decreases as well. BER is evaluated after quantization by the relation: BER = be b where be is the number of bits in the sequence that disagree and b is the length of the initial key. A defect is given if the quantizers output leads to a BER lower than 0.5 for low correlated observations. | decreases as well. BER is evaluated after quantization by the relation: BER = be b where be is the number of bits in the sequence that disagree and b is the length of the initial key. A defect is given if the quantizers output leads to a BER lower than 0.5 for low correlated observations. | ||

− | To evaluate quantization schemes, we first applied the Monte-Carlo simulation environment presented in <ref> | + | To evaluate quantization schemes, we first applied the Monte-Carlo simulation environment presented in <ref name="c76">Ren´e Guillaume, Andreas Mueller, Christian T Zenger, Christof Paar, and Andreas Czylwik. |

+ | Fair comparison and evaluation of quantization schemes for phy-based key generation. OFDM 2014, 2014.</ref>. Two independent random sequences of length 1, 000, 000 are modeled as temporally correlated Rayleigh distributed random variables. The maximum Doppler shift specifies the assumed Jake’s Doppler spectrum. To achieve a quantitative measure for the grade of reciprocity, we define <math>\rho_{\alpha\beta}\in [0;1]</math> as the correlation coefficient between the channel measurements of two nodes. | ||

Further, based on all data of the extensive measurement campaign, we evaluated the BER versus the correlation coefficient <math>\rho</math>. Therefore, we calculated the block-wise correlation as well as the corresponding block-wise BER and sorted those by correlation value. Further, we sorted those by correlation strength and calculated the BER distribution for the following subgroups: | Further, based on all data of the extensive measurement campaign, we evaluated the BER versus the correlation coefficient <math>\rho</math>. Therefore, we calculated the block-wise correlation as well as the corresponding block-wise BER and sorted those by correlation value. Further, we sorted those by correlation strength and calculated the BER distribution for the following subgroups: | ||

− | [0 : 0.05, 0.05 : 0.1, ..., 0.95 : 1]. Figure 5.5 shows the distribution of the block-wise BER of the preliminary key material as well as the simulation results of both quantization schemes of Jana et al. <ref> | + | [0 : 0.05, 0.05 : 0.1, ..., 0.95 : 1]. Figure 5.5 shows the distribution of the block-wise BER of the preliminary key material as well as the simulation results of both quantization schemes of Jana et al. <ref>Suman Jana, Sriram Nandha Premnath, Mike Clark, Sneha Kumar Kasera, Neal Patwari, and Srikanth V. Krishnamurthy. On the effectiveness of secret key extraction from wireless signal strength in real environments. In Kang G. Shin, Yongguang Zhang, Rajive Bagrodia, and Ramesh Govindan, editors, Proceedings of the 15th Annual International Conference on Mobile Computing and Networking, MOBICOM 2009, Beijing, China, September 20-25, 2009, pages 321–332. ACM, 2009.</ref>. |

[[File:Esa-fig5-5.png|500px|thumb|right|Figure 5.5: Evaluation results based on simulation and real-world measurements for both quantization | [[File:Esa-fig5-5.png|500px|thumb|right|Figure 5.5: Evaluation results based on simulation and real-world measurements for both quantization | ||

− | scheme of Jana et al. <ref> | + | scheme of Jana et al. <ref name="c103">Suman Jana, Sriram Nandha Premnath, Mike Clark, Sneha Kumar Kasera, Neal Patwari, and Srikanth V. Krishnamurthy. On the effectiveness of secret key extraction from |

+ | wireless signal strength in real environments. In Kang G. Shin, Yongguang Zhang, Rajive Bagrodia, and Ramesh Govindan, editors, Proceedings of the 15th Annual International | ||

+ | Conference on Mobile Computing and Networking, MOBICOM 2009, Beijing, China, September 20-25, 2009, pages 321–332. ACM, 2009.</ref>. The bit disagreement rate versus correlation coefficient <math>\rho</math> is presented.]] | ||

− | The BER distribution of the real-world measurements is very similar to the pattern of the simulation. Our results show that the single-bit scheme of Jana et al. <ref> | + | The BER distribution of the real-world measurements is very similar to the pattern of the simulation. Our results show that the single-bit scheme of Jana et al. <ref name="c81">Sana Tmar Ben Hamida, Jean-Benoˆıt Pierrot, and Claude Castelluccia. An adaptive quantization algorithm for secret key generation using radio channel measurements. In Khaldoun Al Agha, Mohamad Badra, and Gregory B. Newby, editors, NTMS 2009, 3rd International Conference on New Technologies, Mobility and Security, 20-23 December 2009, Cairo, Egypt, pages 1–5. IEEE, 2009.</ref> has an approximately linearly increasing BER for decreasing correlation. Thereby the BER for correlations higher than <math>\rho = 0.75</math> is smaller than <math>\rho = 0.03</math> and BER values larger than BER= 0.4 are reached if the correlation is smaller than 0.2. This indicates that passive attackers with low correlated observations can reconstruct a large amount of the preliminary key material. The BER function of the multi-bit scheme shows a stable correlation coefficient behaviour of over 0.4 between 0 and 0.7, which strongly decreases towards higher correlations. The BER for high correlations is not as low as for the single-bit version, which leads to stronger error correction capabilities, but the behaviour for low correlations fulfills the security requirement, as we will present in the following Section. |

− | Further, for statistical analysis we evaluated the preliminary key material off-line by applying a subset of the NIST suite of statistical tests <ref> | + | Further, for statistical analysis we evaluated the preliminary key material off-line by applying a subset of the NIST suite of statistical tests <ref name="c167">Andrew Rukhin, Juan Soto, James Nechvatal, Miles Smid, Elaine Barker, Stefan Leigh, Mark Levenson, Mark Vangel, David Banks, Alan Heckert, James Dray, and San Vo. A statistical test suite for random and pseudorandom number generators for cryptographic |

− | The success (or acceptance) rates of the NIST statistical tests for each quantizer are listed in Table 5.1. The single-bit quantizer’s output passes the tests with high rates, whereas the blocks produced by the multi-bit quantizer by Jana et al. <ref | + | applications. Technical report, National Institute of Standards and Technology, 2010. Special Publication 800-22, Revision 1a.</ref>. As some of these tests require a large number of bits, we constrain the evaluated tests to those who can evaluate blocks of 128 bit. |

− | [[File:Esa-tab5-1.png|500px|thumb|right|Table 5.1: Pass rates of several NIST statistical tests for preliminary key material of the quantization schemes by Jana et al. <ref | + | The success (or acceptance) rates of the NIST statistical tests for each quantizer are listed in Table 5.1. The single-bit quantizer’s output passes the tests with high rates, whereas the blocks produced by the multi-bit quantizer by Jana et al. <ref name="c103"/> do not have high pass rates. The results of the sub-test FFT implicate the same result as our frequency analysis of the raw measurement sequence. With the knowledge of the statistical defect, a subset of the preliminary key space can be easily constructed, but it is not performed in this work. |

+ | [[File:Esa-tab5-1.png|500px|thumb|right|Table 5.1: Pass rates of several NIST statistical tests for preliminary key material of the quantization schemes by Jana et al. <ref name="c103"/>. A block size of 128 bit was applied.]] | ||

==Measurement Attack== | ==Measurement Attack== | ||

Line 58: | Line 62: | ||

For example, transmitted parity check bits always reveal information of the encoded information. Further, considering an attacker knowing statistical defects in the preliminary key material or even measuring correlated observations, the attack might be more effective. We summarize | For example, transmitted parity check bits always reveal information of the encoded information. Further, considering an attacker knowing statistical defects in the preliminary key material or even measuring correlated observations, the attack might be more effective. We summarize | ||

this potential knowledge of an attacker in the variable Y . The left-over secret information per bit between Alice and Bob is called conditional min-entropy <math>H_\infty(r|Y )</math>, where r is the mutual information between Alice and Bob. | this potential knowledge of an attacker in the variable Y . The left-over secret information per bit between Alice and Bob is called conditional min-entropy <math>H_\infty(r|Y )</math>, where r is the mutual information between Alice and Bob. | ||

− | Consider a ''state-of-the-art'' information reconciliation approach, e.g., the one by Dodis et al. <ref> | + | Consider a ''state-of-the-art'' information reconciliation approach, e.g., the one by Dodis et al. <ref name="c51">Yevgeniy Dodis, Rafail Ostrovsky, Leonid Reyzin, and Adam Smith. Fuzzy extractors: |

− | However, the assumption, that '''k''' bit entropy for each codeword is retained, is not true if the conditional min-entropy <math>H_\infty(c|Y)</math> or even the min-entropy <math>H_\infty(r)</math> is low. Here, we do not perform the attack, but introduce concrete security boundaries for secure parametrization of the secure sketch information reconciliation scheme <ref | + | How to generate strong keys from biometrics and other noisy data. SIAM J. Comput. 38(1):97–139, 2008.</ref>, where no parity check bits are transmitted and instead syndrome decoding is used. The observed quantity is interpreted as a received codeword '''r'''. The transmitted syndrome usually only reveals information about the error e of a received codeword '''r = c + e''' and not about the codeword '''c''' itself. Therefore, the amount of information that an attacker can infer from eavesdropping syn(r) corresponds to the number of transmitted bits: '''p = n−k''', where '''n''' is the codeword length and '''k''' the number information bits. |

− | <math>0 < H^{WC}(\textbf{r}| Y,syn(\textbf{r})) = \frac{ (H_{\infty}(\textbf{r}|Y \cdot n) - (n-k)}{n} | + | However, the assumption, that '''k''' bit entropy for each codeword is retained, is not true if the conditional min-entropy <math>H_\infty(c|Y)</math> or even the min-entropy <math>H_\infty(r)</math> is low. Here, we do not perform the attack, but introduce concrete security boundaries for secure parametrization of the secure sketch information reconciliation scheme <ref name="c51/> based on estimated entropy, e.g., by using on-line entropy estimation. Addressing the worst-case (WC) where the potential knowledge of statistical defects of an attacker and the revealed syndrome information are independent, the following condition needs to be fulfilled to secure the system against passive eavesdropping: |

− | = H_{\infty | + | <math>0 < H^{WC}(\textbf{r}| Y,syn(\textbf{r})) = \frac{ (H_{\infty}(\textbf{r}|Y \cdot n) - (n-k)}{n} |

+ | = H_{\infty}(\textbf{r}|Y) - \frac{n-k}{n}. </math> | ||

==Manipulating Channel== | ==Manipulating Channel== | ||

− | The attacker might be capable of manipulating the environment or forcing one or both legitimate parties into an artificial environment, e.g., using a Faraday cage to artificially build a static scenario. The aim of the attacker is to determine the symmetric key material by ex-ploiting statistical defects. For simple physical setups, manipulation attacks on RSSI-based key extraction schemes are presented in <ref | + | The attacker might be capable of manipulating the environment or forcing one or both legitimate parties into an artificial environment, e.g., using a Faraday cage to artificially build a static scenario. The aim of the attacker is to determine the symmetric key material by ex-ploiting statistical defects. For simple physical setups, manipulation attacks on RSSI-based key extraction schemes are presented in <ref name="c103"/>. Here, the attacker intermittently blocks the line of sight path causing a predictable drop in the RSS values. |

− | An active key recovery attack on physical layer key generation schemes was introduced by Eberz et al. <ref> | + | An active key recovery attack on physical layer key generation schemes was introduced by Eberz et al. <ref name="c56">Simon Eberz, Martin Strohmeier, Matthias Wilhelm, and Ivan Martinovic. A practical |

− | We implemented the attack on a fourth Raspberry Pi with attached TL-WN722N Wi-Fi USB stick. We applied the setup for different positions and with several antennas, gains, and channels. First results of the proposed key recovery attack lead to a recovery rate of 0% (also for the quantization scheme by [[Mathur]] et al. <ref> | + | man-in-the-middle attack on signal-based key generation protocols. In Sara Foresti, Moti Yung, and Fabio Martinelli, editors, Computer Security - ESORICS 2012 - 17th European Symposium on Research in Computer Security, Pisa, Italy, September 10-12, 2012. Proceedings, volume 7459 of Lecture Notes in Computer Science, pages 235–252. Springer, 2012.</ref>. The attack is based on an active channel-influencing attack through packet injection. The attack’s performance was verified for the quantization scheme by Mathur et al. <ref name="c132"/> which is a robust bit extraction scheme utilizing a guard interval and, therefore, leads to a recovery rate of 47 %. |

+ | We implemented the attack on a fourth Raspberry Pi with attached TL-WN722N Wi-Fi USB stick. We applied the setup for different positions and with several antennas, gains, and channels. First results of the proposed key recovery attack lead to a recovery rate of 0% (also for the quantization scheme by [[Mathur]] et al. <ref name="c132">Suhas Mathur, Wade Trappe, Narayan B. Mandayam, Chunxuan Ye, and Alex Reznik. | ||

+ | Radio-telepathy: extracting a secret key from an unauthenticated wireless channel. In J. J. Garcia-Luna-Aceves, Raghupathy Sivakumar, and Peter Steenkiste, editors, Proceedingsof the 14th Annual International Conference on Mobile Computing and Networking, MOBICOM 2008, San Francisco, California, USA, September 14-19, 2008, pages 128–139. ACM, 2008. formerly known as: mathur2008radio.</ref>). The reason for this could be the different RF front end (Eberz et al. <ref name="c56"/> applied MicaZ hardware). More advanced manipulation techniques are conceivable and are also part of the scope of our future work. | ||

==References== | ==References== | ||

<references/> | <references/> |

## Latest revision as of 08:59, 27 October 2017

In this section, we provide an experimentally-supported security analysis of the PHYSEC system. Therefore, we analyzed the child nodes of the attack tree. Child nodes are conditions that must be satisfied to make the direct parent node true. Recent security analyses of systems from correlated observations are based on broad channel abstractions or claims based on elusively experimental evaluations and thus are not fully substantiated as we will see later.

## Contents

- 1 Testbed Implementation
- 2 Statistical Defect of Raw Readings
- 3 Statistical Defect of Quantizers
- 4 Measurement Attack
- 5 Environment Dependent Results of Spatial Cross-corelation Behavior Between Channel Profile
- 6 Repetition / Reconstruction Attack
- 7 Eavesdropping Information Reconciliation Data
- 8 Manipulating Channel
- 9 References

## Testbed Implementation

The protocol ensures that all three common measurements are done within the probing duration of **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle r_{p}^{-1} \leq 5 ms}**
. The sampling rate is **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle r_s \approx (10ms)^{-1}}**
. Figure 3.5 illustrates the procedure for synchronized measurements between Alice, Bob, and a potential passive attacker. The common channel measurement process is implemented on the hardware platform Raspberry Pi. This credit card sized computer is universally deployable with a Linux-based operating system and flexible expansion options. We equipped the computer with a TP-Link TL-WN722N wireless USB adapter as well as with a battery for mobility. Alice is mounted on a cyclic moving robotic measurement platform.

Motion is required because otherwise no channel reciprocity is given due to a low reciprocityto-noise ratio. Additionally, in realistic scenarios no unpredictable motion leads to no new entropy. Bob and Eve are mounted on an automated antenna positioning setup. Please refer to Figure 5.3 for illustration. With this setup, we evaluate the correlation possibilities of a potential measurement attack for different distances between Bob and Eve. The minimum distance between Bob and Eve is 1mm and the maximum is 300mm. Due to a servo motor 1000 (angular) position in this 300mm range of Eve are programmable.

## Statistical Defect of Raw Readings

Statistical defects of the random source, as introduced in Threats Against Environment-Dependent Security, is the very first attack
vector we utilize. Our analysis showed that for measurements within **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle \approx}**
300 ms still exhibit temporal correlation. Several further approaches for analyzing the statistical defect could be applied. For instance, temporal correlations or the mutual information I(X; Y ) between the observation X of a legitimized node and the observation Y of an eavesdropper represents further potential statistical defects.
For simplicity, we analyzed the statistical defect of the raw sensor readings by applying a spectrum analysis. The magnitude spectrum of both setups is illustrated in Figure 5.4. Clearly, the frequencies are not entirely uniformly distributed; a bias towards low frequencies is given.
After quantization, the defect will lead to symbol frequencies that dramatically reduce the space of the preliminary key material. For this reason, on-line statistical testing is urgently required. Further, we address in Experimental Security Analysis#Eavesdropping Information Reconciliation Data how such a defect can affect the security even more drastically.

## Statistical Defect of Quantizers

To analyze potential statistical defects of quantization schemes, the following metric is introduced. The BER indicates the percentage of bits that are in disagreement between the initial key material of two parties. With decreasing BER, the effort needed to detect and correct errors
decreases as well. BER is evaluated after quantization by the relation: BER = be b where be is the number of bits in the sequence that disagree and b is the length of the initial key. A defect is given if the quantizers output leads to a BER lower than 0.5 for low correlated observations.
To evaluate quantization schemes, we first applied the Monte-Carlo simulation environment presented in ^{[1]}. Two independent random sequences of length 1, 000, 000 are modeled as temporally correlated Rayleigh distributed random variables. The maximum Doppler shift specifies the assumed Jake’s Doppler spectrum. To achieve a quantitative measure for the grade of reciprocity, we define **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle \rho_{\alpha\beta}\in [0;1]}**
as the correlation coefficient between the channel measurements of two nodes.

Further, based on all data of the extensive measurement campaign, we evaluated the BER versus the correlation coefficient **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle \rho}**
. Therefore, we calculated the block-wise correlation as well as the corresponding block-wise BER and sorted those by correlation value. Further, we sorted those by correlation strength and calculated the BER distribution for the following subgroups:
[0 : 0.05, 0.05 : 0.1, ..., 0.95 : 1]. Figure 5.5 shows the distribution of the block-wise BER of the preliminary key material as well as the simulation results of both quantization schemes of Jana et al. ^{[2]}.

The BER distribution of the real-world measurements is very similar to the pattern of the simulation. Our results show that the single-bit scheme of Jana et al. ^{[4]} has an approximately linearly increasing BER for decreasing correlation. Thereby the BER for correlations higher than **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle \rho = 0.75}**
is smaller than **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle \rho = 0.03}**
and BER values larger than BER= 0.4 are reached if the correlation is smaller than 0.2. This indicates that passive attackers with low correlated observations can reconstruct a large amount of the preliminary key material. The BER function of the multi-bit scheme shows a stable correlation coefficient behaviour of over 0.4 between 0 and 0.7, which strongly decreases towards higher correlations. The BER for high correlations is not as low as for the single-bit version, which leads to stronger error correction capabilities, but the behaviour for low correlations fulfills the security requirement, as we will present in the following Section.
Further, for statistical analysis we evaluated the preliminary key material off-line by applying a subset of the NIST suite of statistical tests ^{[5]}. As some of these tests require a large number of bits, we constrain the evaluated tests to those who can evaluate blocks of 128 bit.
The success (or acceptance) rates of the NIST statistical tests for each quantizer are listed in Table 5.1. The single-bit quantizer’s output passes the tests with high rates, whereas the blocks produced by the multi-bit quantizer by Jana et al. ^{[3]} do not have high pass rates. The results of the sub-test FFT implicate the same result as our frequency analysis of the raw measurement sequence. With the knowledge of the statistical defect, a subset of the preliminary key space can be easily constructed, but it is not performed in this work.

## Measurement Attack

The attacker measures corresponding quantities of the random source between legitimate parties and itself. We assume that a (partial) access to the random source depends on the physical position of the attacker. To evaluate the correlation between Bob’s and Eve’s channel measurements over distance, we measured the channel 100, 000 times per millimeter. Then the absolute value of the Pearson correlation coefficient was calculated for blocks of 1000 measured values. The distributions of the correlation coefficients for different experiments are exemplarily illustrated in Figure 5.6. The three illustrations represent a good example of the diversity of the correlation function.

Several positions for the automated antenna position setup were applied. The positions of each experiment are marked in a certain graphic. The correlation over distance function strongly depends on the positioning of the setup. As the results show, the usual assumption which
claims, that the closer Eve gets to Bob the higher its observation correlates to that of the legitimate parties, is only true for certain positions of the setup, e.g., position 10 as illustrated in Figure 5.6(b). The reason for this may be that the positions of the (multipath-creating) scatterers are not uniformly distributed as required.

## Environment Dependent Results of Spatial Cross-corelation Behavior Between Channel Profile

We evaluated the environment dependent behaviour of the spatial cross-correlation at a different point c.f. section 4. An interesting overall result is the fact that cross-correlations and recorrelations are extremely hard to predict. A potential attack will have heavy problems to estimate when he receives (high) correlated observations. Furthermore, it will be hard to verify how high its eavesdrop observations are correlated to the observations of the legitimate users.

## Repetition / Reconstruction Attack

We evaluated the repetition attack using the cyclic moving robotic platform. We measured 10, 000 runs of the robotic platform passing the entire elliptic course. The robotic platform was moving with a speed of 0.6m/s along a trail of length 3m. One run is represented by approximately 700 RSSI values. The results of the correlation between one observation and the resulting repetitions are illustrated in Figure 5.7. The results show that reproduction of correlated channel measurements is possible.
The success rate of the attack depends strongly on the applied quantizations scheme. E.g., the bad BER behaviour for low correlations of the single-bit scheme leads to very similar preliminary key material. Repetitions of the attack lead to a **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle \approx 96%}**
reproduction of the key material after quantization and 100% after information reconciliation.

## Eavesdropping Information Reconciliation Data

Information of the key material might be revealed due to the publicly transmitted error correction information. The passive eavesdropper Eve is able to listen to communication in the network. The distance of our attacker eavesdropping the communication on the channel was 100m. With special equipment, e.g. directed antennas, the attack works even outside the connection range of network specifications.
For example, transmitted parity check bits always reveal information of the encoded information. Further, considering an attacker knowing statistical defects in the preliminary key material or even measuring correlated observations, the attack might be more effective. We summarize
this potential knowledge of an attacker in the variable Y . The left-over secret information per bit between Alice and Bob is called conditional min-entropy **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle H_\infty(r|Y )}**
, where r is the mutual information between Alice and Bob.
Consider a *state-of-the-art* information reconciliation approach, e.g., the one by Dodis et al. ^{[6]}, where no parity check bits are transmitted and instead syndrome decoding is used. The observed quantity is interpreted as a received codeword **r**. The transmitted syndrome usually only reveals information about the error e of a received codeword **r = c + e** and not about the codeword **c** itself. Therefore, the amount of information that an attacker can infer from eavesdropping syn(r) corresponds to the number of transmitted bits: **p = n−k**, where **n** is the codeword length and **k** the number information bits.
However, the assumption, that **k** bit entropy for each codeword is retained, is not true if the conditional min-entropy **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle H_\infty(c|Y)}**
or even the min-entropy **Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle H_\infty(r)}**
is low. Here, we do not perform the attack, but introduce concrete security boundaries for secure parametrization of the secure sketch information reconciliation scheme ^{[6]} based on estimated entropy, e.g., by using on-line entropy estimation. Addressing the worst-case (WC) where the potential knowledge of statistical defects of an attacker and the revealed syndrome information are independent, the following condition needs to be fulfilled to secure the system against passive eavesdropping:
**Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://api.formulasearchengine.com/wikimedia.org/v1/":): {\displaystyle 0 < H^{WC}(\textbf{r}| Y,syn(\textbf{r})) = \frac{ (H_{\infty}(\textbf{r}|Y \cdot n) - (n-k)}{n} = H_{\infty}(\textbf{r}|Y) - \frac{n-k}{n}. }**

## Manipulating Channel

The attacker might be capable of manipulating the environment or forcing one or both legitimate parties into an artificial environment, e.g., using a Faraday cage to artificially build a static scenario. The aim of the attacker is to determine the symmetric key material by ex-ploiting statistical defects. For simple physical setups, manipulation attacks on RSSI-based key extraction schemes are presented in ^{[3]}. Here, the attacker intermittently blocks the line of sight path causing a predictable drop in the RSS values.
An active key recovery attack on physical layer key generation schemes was introduced by Eberz et al. ^{[7]}. The attack is based on an active channel-influencing attack through packet injection. The attack’s performance was verified for the quantization scheme by Mathur et al. ^{[8]} which is a robust bit extraction scheme utilizing a guard interval and, therefore, leads to a recovery rate of 47 %.
We implemented the attack on a fourth Raspberry Pi with attached TL-WN722N Wi-Fi USB stick. We applied the setup for different positions and with several antennas, gains, and channels. First results of the proposed key recovery attack lead to a recovery rate of 0% (also for the quantization scheme by Mathur et al. ^{[8]}). The reason for this could be the different RF front end (Eberz et al. ^{[7]} applied MicaZ hardware). More advanced manipulation techniques are conceivable and are also part of the scope of our future work.

## References

- ↑ Ren´e Guillaume, Andreas Mueller, Christian T Zenger, Christof Paar, and Andreas Czylwik. Fair comparison and evaluation of quantization schemes for phy-based key generation. OFDM 2014, 2014.
- ↑ Suman Jana, Sriram Nandha Premnath, Mike Clark, Sneha Kumar Kasera, Neal Patwari, and Srikanth V. Krishnamurthy. On the effectiveness of secret key extraction from wireless signal strength in real environments. In Kang G. Shin, Yongguang Zhang, Rajive Bagrodia, and Ramesh Govindan, editors, Proceedings of the 15th Annual International Conference on Mobile Computing and Networking, MOBICOM 2009, Beijing, China, September 20-25, 2009, pages 321–332. ACM, 2009.
- ↑
^{3.0}^{3.1}^{3.2}^{3.3}Suman Jana, Sriram Nandha Premnath, Mike Clark, Sneha Kumar Kasera, Neal Patwari, and Srikanth V. Krishnamurthy. On the effectiveness of secret key extraction from wireless signal strength in real environments. In Kang G. Shin, Yongguang Zhang, Rajive Bagrodia, and Ramesh Govindan, editors, Proceedings of the 15th Annual International Conference on Mobile Computing and Networking, MOBICOM 2009, Beijing, China, September 20-25, 2009, pages 321–332. ACM, 2009. - ↑ Sana Tmar Ben Hamida, Jean-Benoˆıt Pierrot, and Claude Castelluccia. An adaptive quantization algorithm for secret key generation using radio channel measurements. In Khaldoun Al Agha, Mohamad Badra, and Gregory B. Newby, editors, NTMS 2009, 3rd International Conference on New Technologies, Mobility and Security, 20-23 December 2009, Cairo, Egypt, pages 1–5. IEEE, 2009.
- ↑ Andrew Rukhin, Juan Soto, James Nechvatal, Miles Smid, Elaine Barker, Stefan Leigh, Mark Levenson, Mark Vangel, David Banks, Alan Heckert, James Dray, and San Vo. A statistical test suite for random and pseudorandom number generators for cryptographic applications. Technical report, National Institute of Standards and Technology, 2010. Special Publication 800-22, Revision 1a.
- ↑
^{6.0}^{6.1}Yevgeniy Dodis, Rafail Ostrovsky, Leonid Reyzin, and Adam Smith. Fuzzy extractors: How to generate strong keys from biometrics and other noisy data. SIAM J. Comput. 38(1):97–139, 2008. - ↑
^{7.0}^{7.1}Simon Eberz, Martin Strohmeier, Matthias Wilhelm, and Ivan Martinovic. A practical man-in-the-middle attack on signal-based key generation protocols. In Sara Foresti, Moti Yung, and Fabio Martinelli, editors, Computer Security - ESORICS 2012 - 17th European Symposium on Research in Computer Security, Pisa, Italy, September 10-12, 2012. Proceedings, volume 7459 of Lecture Notes in Computer Science, pages 235–252. Springer, 2012. - ↑
^{8.0}^{8.1}Suhas Mathur, Wade Trappe, Narayan B. Mandayam, Chunxuan Ye, and Alex Reznik. Radio-telepathy: extracting a secret key from an unauthenticated wireless channel. In J. J. Garcia-Luna-Aceves, Raghupathy Sivakumar, and Peter Steenkiste, editors, Proceedingsof the 14th Annual International Conference on Mobile Computing and Networking, MOBICOM 2008, San Francisco, California, USA, September 14-19, 2008, pages 128–139. ACM, 2008. formerly known as: mathur2008radio.