# LoRaWAN Physical Layer-Based Attacks and Countermeasures, A Review
## 4 Protection Techniques
### Wireless Key Generation  
The lack of a root-key (i.e., **AppKey** and **NwkKey**) update in LoRaWAN has motivated research towards novel key-generation techniques. As LoRaWAN devices are often based on microcontrollers, it is crucial that added security features do not contribute to a large increase in computational and communication overhead. A potential candidate, which allows for light-weight implementations, is the so called wireless secret-key-generation technique depicted in Figure 7. With its roots in information theory [77], many experimental works on the subject have indicated successful key-agreement results for several wireless protocols [26; 78]. One of the basic variants of key generation, illustrated in Figure 8, involves, firstly, a channel-probing phase, i.e., the collection of RSSI values for two wireless devices communicating with each other in a bidirectional manner. Since a wireless channel is reciprocal over a finite time frame, the RSSI readings on both devices are close to each other. Furthermore, due to the randomness and the temporal variations in the channel characteristics, an eavesdropper is unable to arrive at measurements with a similar degree of correlation as the legitimate users. During the second step, a random secret key is extracted out of the RSSI values, e.g., with a simple 1-bit quantization operation. Due to noise and analog component imperfections, the extracted key sequences contain a few bit errors. Those errors can be compensated by so called reconciliation protocols, which allow for error correction without exposing the secret-key material. Finally, privacy amplification techniques should be utilized to minimize key-bit leakage during the error correction phase. Figure 7: Secret-key-generation in a LoRaWAN network. As LoRa communication can be established bidirectionally in LoRaWAN with downlink messages (or, alternatively, in a point-to-point fashion with LoRa packets), RSSI-based key generation becomes an option for LoRa-based key generation. One of the first works to demonstrate experimental results for point-to-point LoRa link was [65], which considered several communication scenarios. It is revealed that a larger SF leads to increased bit errors in extracted keys, which most likely stems from an increased channel measurement delay. Thus, it is challenging to implement LoRa-based key generation, e.g., in mobile scenarios with rapidly changing channel fading conditions. Another work [19] on LoRa-based key generation indicated the importance of differential quantization in channel measurements, with dynamics stemming from path loss and fading. With a suitable key extraction algorithm, the correlation between eavesdropper and the legitimate user(s) can be reduced. Typically wireless key generation necessitates a fast bidirectional message exchange to avoid imbalance in channel-state estimation. While pure LoRa communication with a low SF can achieve this, the delays in LoRaWAN downlink windows cause latency in channel probing, which potentially gives rise to key bit errors. Furthermore, static channel conditions might result in keys with low entropy, which increases the risk of key-guessing attacks. A potential solution involves randomness injection via a reconfigurable antenna in combination with a novel RSSI preselection algorithm, as presented in [21], which achieves key generation for LoRaWAN communication up to 7 km distance. With such a setting, **AppKey** can be refreshed approximately once per month despite the EU868 channel duty cycle limitations, challenging RF channel conditions (SNR < 0) and the assumed strong eavesdropped attacker model. Additionally, with the RSSI preselection algorithm, the key disagreement rate can be suppressed from 29% down to 18%. In further works, the challenges connected to LoRaWAN-key generation have been tackled with an optimized key-generation algorithm, as reported in [66; 67; 68].