# Authenticated Multicast in Tiny Networks via an Extremely Low-Bandwidth Medium
## 5 Related Work  
Underwater acoustic communication is the subject of the recently updated JANUS standard [19], which focuses on packet format and channel coding, with cryptography only referenced in the context of confidentiality. The JANUS standard covers neither multicast key management nor source authentication. In [20], the authors proposed an extension of the JANUS standard using a challenge-response authentication mechanism based on a preshared long-term key. The mechanism is designed for unicast communication.  
[PERSON] et al. in [21] proposed a security framework for underwater environments, including authentication methods. Their solution for source authentication relies on short signatures (ZSS, BLS, and Quartz). The authors of [22] also examined digital signatures (ECDSA, ZSS, and BLS) as a way of node authentication. However, both ZSS and BLS schemes are based on pairing-friendly elliptic curves, and require an expensive pairing computation for signature verification, which may be costly for IoT processors without a dedicated hardware accelerator (the cryptographic co-processor from [23] would enable BLS12-381 signatures, which are of size 382 bits). Furthermore, pairing-based signature schemes are not post-quantum-secure. Recent advances in the cryptanalysis of pairing-friendly curves, namely, the Tower Number Field Sieve (TNFS) [24] and its extensions, have an impact on the key lengths for typical security levels (see, e.g., Figure 2 in [25]). This leads to an increase in the communication overhead, which we aim to minimize in this work.  
In [26], [PERSON] et al. summarized the results of the NATO SPS SAFE-UComm project and discussed experiments regarding _physical layer security_ (PLS) with authentication based on the signal characteristics of the physical layer. They also recognized the scalabilityissues in key preloading, and discussed a key agreement scheme based on PLS. Multicast transmission received no treatment in their work, however.  
In [27], the authors investigated authentication based on PLS in the case of mobile nodes. They developed a mechanism based on a Kalman filter to track changes resulting from location shift over time. However, the accuracy of their model is dependent on periodically receiving an acoustic signal from the authenticating node. This dependency is similar to the dependency present in the TESLA protocol. In this context, our proposed mechanism is more general, allowing nodes to communicate completely asynchronously.  
[PERSON] et al. [28] proposed a sender authentication scheme wherein multiple MACs are attached to a message and different receivers know different subsets of the set of keys used to produce these MACs. This scheme takes the upper bound \(w\) for the number of compromised nodes as its input. It is probabilistic, as the keys are distributed randomly. Our work on formalizing the concept of a separating family can be viewed as a derandomization of their construction; however, the aims of the papers are not exactly the same, as the authors of [28] explicitly constructed an authentication protocol against up to \(w\) compromised nodes, with asymptotic efficiency in mind, whereas our work focuses on minimizing the communication overhead assuming a tiny network and at most one compromised node. A more detailed comparison of communication overheads present in actual implementations of the algorithms proposed by [PERSON] et al. and our construction are listed in Table 7.  
The TESLA protocol [15] is an example of a multicast authentication protocol that uses only symmetric keys. Its usability for UUVs is analyzed in Section 4.2.  
Finally, a survey of different source authentication schemes has been provided by [29].