Manipulative Attack Against Physical Layer Key Agreement and Countermeasure

Physical layer key agreement techniques derive a symmetric cryptographic key from the wireless fading channel between two wireless devices by exploiting channel randomness and reciprocity. Current efforts have focused mainly on the security issue and protocol design of the techniques under passive attack and jamming attack. In this paper, we raise the subject of manipulative attack. The attacker wants the keying devices to actually agree on some valid, but manipulated bits. We discuss the feasibility and different means to launch manipulative attack. Aiming at a practical countermeasure, we further propose PHY-UIR (PHYsical layer key agreement with User Introduced Randomness). Both keying devices generate and use random voltage levels <inline-formula><tex-math notation="LaTeX">$\mathbf {X} = \lbrace x[1],x[2] \ldots x[N] \rbrace$</tex-math><alternatives><mml:math><mml:mrow><mml:mi mathvariant="bold">X</mml:mi><mml:mo>=</mml:mo><mml:mo>{</mml:mo><mml:mi>x</mml:mi><mml:mo>[</mml:mo><mml:mn>1</mml:mn><mml:mo>]</mml:mo><mml:mo>,</mml:mo><mml:mi>x</mml:mi><mml:mo>[</mml:mo><mml:mn>2</mml:mn><mml:mo>]</mml:mo><mml:mo>. </mml:mo><mml:mi>x</mml:mi><mml:mo>[</mml:mo><mml:mi>N</mml:mi><mml:mo>]</mml:mo><mml:mo>}</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="jin-ieq1-2895325.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">$\mathbf {Y} = \lbrace y[1],y[2] \ldots y[N] \rbrace$</tex-math><alternatives><mml:math><mml:mrow><mml:mi mathvariant="bold">Y</mml:mi><mml:mo>=</mml:mo><mml:mo>{</mml:mo><mml:mi>y</mml:mi><mml:mo>[</mml:mo><mml:mn>1</mml:mn><mml:mo>]</mml:mo><mml:mo>,</mml:mo><mml:mi>y</mml:mi><mml:mo>[</mml:mo><mml:mn>2</mml:mn><mml:mo>]</mml:mo><mml:mo>. </mml:mo><mml:mi>y</mml:mi><mml:mo>[</mml:mo><mml:mi>N</mml:mi><mml:mo>]</mml:mo><mml:mo>}</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="jin-ieq2-2895325.gif"/></alternatives></inline-formula> to exchange probing frames over reciprocal random fading channels <inline-formula><tex-math notation="LaTeX">$\mathbf {H} = \lbrace h[1],h[2] \ldots h[N] \rbrace$</tex-math><alternatives><mml:math><mml:mrow><mml:mi mathvariant="bold">H</mml:mi><mml:mo>=</mml:mo><mml:mo>{</mml:mo><mml:mi>h</mml:mi><mml:mo>[</mml:mo><mml:mn>1</mml:mn><mml:mo>]</mml:mo><mml:mo>,</mml:mo><mml:mi>h</mml:mi><mml:mo>[</mml:mo><mml:mn>2</mml:mn><mml:mo>]</mml:mo><mml:mo>. </mml:mo><mml:mi>h</mml:mi><mml:mo>[</mml:mo><mml:mi>N</mml:mi><mml:mo>]</mml:mo><mml:mo>}</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="jin-ieq3-2895325.gif"/></alternatives></inline-formula>. At receiving end, they multiply the received channel measurements <inline-formula><tex-math notation="LaTeX">${\mathbf {XH}}$</tex-math><alternatives><mml:math><mml:mi mathvariant="bold">XH</mml:mi></mml:math><inline-graphic xlink:href="jin-ieq4-2895325.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\mathbf {YH}}$</tex-math><alternatives><mml:math><mml:mi mathvariant="bold">YH</mml:mi></mml:math><inline-graphic xlink:href="jin-ieq5-2895325.gif"/></alternatives></inline-formula> with the random sequences <inline-formula><tex-math notation="LaTeX">$\mathbf {Y}$</tex-math><alternatives><mml:math><mml:mi mathvariant="bold">Y</mml:mi></mml:math><inline-graphic xlink:href="jin-ieq6-2895325.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">$\mathbf {X}$</tex-math><alternatives><mml:math><mml:mi mathvariant="bold">X</mml:mi></mml:math><inline-graphic xlink:href="jin-ieq7-2895325.gif"/></alternatives></inline-formula> to compose a common keying sequence <inline-formula><tex-math notation="LaTeX">$\mathbf {XYH}$</tex-math><alternatives><mml:math><mml:mi mathvariant="bold">XYH</mml:mi></mml:math><inline-graphic xlink:href="jin-ieq8-2895325.gif"/></alternatives></inline-formula>. With this solution, the attacker can no longer manipulate the keying sequences established at legitimate sides and infer the subsequent key. We analyze the security strength of PHY-UIR and conduct extensive simulations to evaluate it. We also perform proof-of-concept experiments by using software defined radios in a real-world environment. Both simulations and experiments demonstrate the effectiveness of PHY-UIR.