# A Key Management Scheme for Mobile Wireless Sensor Networks
## 3 Public-Key Cryptography with an Authentication Table Key Management Scheme (PCAT)
### Key Establishment  
Figure 2 shows the pairwise key establishment. In the example, node 0 is the initiator of the key establishment with node 1, which plays the role of the responder. All nodes periodically broadcast a Hello message. The Hello holds the identifier of the node and its public key. In the example, Node 0 starts the handshake by broadcasting \(\text{ID}_{0}\) and \(\text{Puk}_{0}\).  
When a node receives a Hello from a node without a common pairwise key, it executes an authentication check. The authentication check is composed of two steps. For the former, the responder searches inside the received public key for the bits pointed by the addresses in its mask. The first test is passed if these bits correspond to the ones stored in the row of the authentication table related to the initiator. For the latter, the responder executes the hash function on the bits of the public key that are not pointed out by the mask. If the resulting hash also corresponds to the hash stored in the same row of the table, the initiator is considered authentic. In the example, after receiving the Hello, Node 1 checks if the four bits (\(\text{M}_{0}\)) in \(\text{Puk}_{0}\) at the addresses written in its mask (15, 12, 9, 6) correspond to the four bits in the first row of its table. Then, Node 1 executes the hash (\(\text{h}_{0}\)) on the other bits of \(\text{Puk}_{0}\), by excluding bits 15, 12, 9 and 6, and checks if the result is equal to the content of the second part of row 0 in its identification table. If the Hello passes the authentication check, the responder sends a first acknowledge message (Ack1) to the initiator of the handshake. This  
Figure 2: Handshake.  
message stores the identification of the second node and its public key. In the example, Node 1 sends ID\({}_{1}\) and Puk\({}_{1}\) to Node 0.  
After receiving an Ack1, the initiator checks its authenticity. In the example, after receiving the Ack1, Node 0 checks if the four bits in Puk\({}_{1}\) at the addresses written in its mask (15, 11, 7, 3) correspond to the four bits (M\({}_{1}\)) in the first row of its table. Then, Node 0 executes the hash (h\({}_{1}\)) on the other bits of Puk\({}_{1}\), by excluding bits 15, 11, 7 and 3, and checks if the result is equal to the content of the second part of row 1 in its identification table.  
If the Ack1 message is authentic, the initiator calculates a random number that will be used for the generation of the pairwise key. The required length of the random number is equal to the pairwise key. However, in order to avoid security risks due to the encryption of a short plaintext, eventual additional random bits are added to exploit the whole input of the encryption. The initiator answers with a second acknowledge message (Ack2) that contains the random number encrypted with the public key of the responder. In the example, after computing a first random number (Rand1), Node 0 encrypts it by using Puk\({}_{1}\) and sends a message to Node 1 that contains ID\({}_{0}\) and the encrypted Rand1.  
After receiving an Ack2 from a node that has already passed the authentication check, the responder calculates a random number and sends to the initiator an Ack3 message, that contains this number encrypted with the public key of the initiator. Then, both the nodes decrypt the received number and compute a symmetric pairwise key that corresponds to the bitwise XOR of the two random numbers.  
After receiving the Ack2, also Node 1 computes a second random number (Rand2), encrypts it by using Puk\({}_{0}\) and sends ID\({}_{1}\) and the encrypted Rand2 to Node 0. Finally, both the nodes decrypt the received random number by using their Prk and compute the pairwise key (Sk\({}_{0}\) = Sk\({}_{1}\)) by executing a bitwise XOR operation on Rand1 and Rand2.