[en] Wireless Sensor Networks have become popular during the last years. The introduction of IPv6 which broadened the address space available, IEEE802.15.4 and adaptation layers such as 6loWPAN have allowed the intercommunication of small devices. These networks are useful in many scenarios such as civil monitoring, mining, battlefield operations, as well as consumer products. Hence, practical security solutions for the intercommunication must be provided, ensuring privacy, authenticity, integrity and data freshness. In most cases, WSN nodes are not tamper-proof and have very limited available resources and capabilities which makes PKI currently not attractive for this environment. At the same time, key pre-distribution provide too low security for most applications. Therefore, the communication bootstrapping or the key generation and distribution problem is an important concern to be addressed with the additional difficulty of the constrained capabilities of WSN nodes. In this thesis, a solution to this problem is described. It makes use of ECDH and the curve K-163 for key exchange, AES- CCM-128 for symmetric encryption to lower the processing overhead and a partial challenge solving chain as well as a TAS to provide strong authentication. Several hash functions have been analysed as well as several random number generating approaches. At the same time, in order to fit the key generation and distribution algorithms together with the regular sensor operation, code optimizations were carried out on the cryptographic library Relic-Toolkit, reducing the memory footprint in 4KB; code reductions on Contiki OS allowed it to run using only 18KB of flash; and the peripheral drivers developed for the CC430 reduced as well the computation time. The solution allows to generate and distribute the keys in situ and is proved to be resilient to most adversaries while taking into account scalability, portability, energy consumption and making it suitable for consumer applications.Wireless Sensor Networks have become popular during the last years. The introduction of IPv6 which broadened the address space available, IEEE802.15.4 and adaption layers such as 6loWPAN have allowed the intercommunication of small devices. These networks are useful in many scenarios such as civil monitoring, mining, battlefield operations, as well as consumer products. Hence, practical security solutions for the intercommunication must be provided, ensuring privacy, authenticity, integrity and data freshness. In most cases, WSN nodes are not tamper-proof and have very limited available resources and capabilities which makes PKI currently not attractive for this environment. At the same time, key pre-distribution provide too low security for most applications. Therefore, the communication bootstrapping or the key generation and distribution problem is an important concern to be addressed with the additional difficulty of the constrained capabilities of WSN nodes. In this thesis, a solution to this problem is described. It makes use of ECDH and the curve K-163 for key exchange, AES- CCM-128 for symmetric encryption to lower the processing overhead and a partial challenge solving chain as well as a TAS to provide strong authentication. Several hash functions have been analysed as well as several random number generating approaches. At the same time, in order to fit the key generation and distribution algorithms together with the regular sensor operation, code optimizations were carried out on the cryptographic library Relic-Toolkit, reducing the memory footprint in 4KB; code reductions on Contiki OS allowed it to run using only 18KB of flash; and the peripheral drivers developed for the CC430 reduced as well the computation time. The solution allows to generate and distribute the keys in situ and is proved to be resilient to most adversaries while taking into account scalability, portability, energy consumption and making it suitable for consumer applications.

[es] Las redes de sensores (WSN) se han vuelto populares durante los últimos años. La aparición de IPv6, ampliando el espacio de direcciones disponible, de IEEE802.15.4 y de capas de adaptación como 6loWPAN permiten la intercomunicación de dispositivos pequeños. Estas redes son útiles en escenarios como monitorización civil, la minería o en operaciones en el campo de batalla; pero también para productos comerciales. Por ello, deben de proporcionarse soluciones de seguridad realizables, que asegurent privacidad, autenticidad, integridad y actualidad de los datos. En la mayoría de casos, los nodos de una WSN no están protegidos de la manipulación física y tienen reducidos recursos disponibles. Esto hace que los sistemas PKI no sean atractivos en estos medios. Al mismo tiempo la pre-distribución de claves ofrece un nivel de seguridad demasiado bajo para la mayoría de aplicaciones. Por este motivo, el establecimiento de la comunicación segura (ó problema de la generación y distribución de claves) es una importante preocupación a ser abordada en conjunción con las limitadas habilidades de los nodos WSN. En esta tesis, se describe una solución al problema descrito. Se hace uso de ECDH y la curva K-163 para el intercambio de claves; AES-CCM-128 para cifrado simétrico (lo cual minimiza el overhead de procesamiento); y de cadenas de resolución parcial de retos conjuntamente con un TAS para garantizar autenticación fuerte. Varios algoritmos de hash y generadores de números aleatorios han sido analizados. Al mismo tiempo, con tal de encajar la generación y distribución de claves junto con la operativa normal de un sensor, se han realizado optimizaciones en la librería criptográfica Relic-Toolkit, reduciendo el impacto de memoria en 4KB; se ha reducido la memoria requerida por Contiki OS permitiendo su ejecución en tan sólo 18KB de flash; y se han desarrollado drivers para periféricos de un CC430 reduciendo los tiempos de computación sensiblemente. La solución propuesta permite la generación y distribución de claves in-situ y ha probado ser resistente a la mayoría de adversarios propuestos al mismo tiempo que se tiene en cuenta la escalabilidad, portabilidad y consumo energético, haciéndola adecuada para su uso en aplicaciones comerciales.