## 4 Security Analysis and Performance Assessment
### Active Attacks  
Most active attacks currently target RSS-based systems, as these are easier for attackers to exploit due to the low level of detail in the key material. [PERSON] et al. [31] provided a classification of various attacks. Active attacks against PLKG can generally be divided into two main categories.  
The first type is jamming attacks, which aim to disrupt the key exchange process between legitimate communication parties, thereby preventing successful key generation. This type of attack primarily introduces additional errors during the key generation process by transmitting high-power jamming signals and injecting noise, significantly increasing computational costs and achieving a denial-of-service (DoS) effect. [PERSON] and [PERSON] demonstrated through theoretical analysis that the effective key rate decreases rapidly as the power of the adversarial signal increases [32]. Figure 7 illustrates the key generation rate (KGR) of the proposed protocol under varying SNRs. When a ship encounters a jamming attack, selecting a lower quantization bit number \(m\) in MAQ can enhance the protocol's resistance to noise, ensuring a certain level of key generation rate even under low-SNR conditions. Additionally, existing anti-jamming mechanisms, such as channel hopping and spread-spectrum modulation, can be employed to mitigate the effects of jamming. Furthermore, if [PERSON] and [PERSON] can identify or detect which probing signals are contaminated by jamming and discard the affected messages, the resistance to jamming attacks can be further strengthened.  
The second type is the session hijacking attack. Unlike jamming attacks, the objective of this attacker is not to disrupt the channel probing process but to inject high-power signals, forcing the key material to become predictable. In this scenario, [PERSON] and [PERSON] unknowingly use the key material manipulated by [PERSON]. Under such an attack, part of the signal received by [PERSON] and [PERSON] is controlled by the active attacker. Although [PERSON] and [PERSON] may achieve a high key generation rate, a portion of the shared key bits is leaked without their awareness. This situation is considered more detrimental than destructive interference attacks. In RSS-based key generation systems, session hijacking attacks have been shown to compromise up to 47.4% of the legitimate key bits [33].  
Figure 6: Simulation of received signal.  
To counter session hijacking attacks, some studies have proposed using probing signals containing random bits. When the channel is controlled, both parties can still rely on these random bits for key generation [8]. While this is a viable countermeasure, it reduces the robustness of PLKG against passive attacks. If [PERSON] successfully eavesdrops on the random signals exchanged between [PERSON] and [PERSON], [PERSON] can infer a portion of the key bits, further compromising security.  
In a system utilizing the CIR, the impact of session hijacking attacks is mitigated because the CIR vector contains information across multiple dimensions. The key is derived from the response of the entire channel rather than depending on a single bit or simple signal strength variations. Injecting interference alters the entire CIR vector, making it nearly impossible for an attacker to accurately manipulate a specific bit or a portion of the key material. While extracting the CIR for key generation introduces additional complexity during the channel probing phase, it simultaneously enhances the overall security of the system.