## 2 Authenticated Join Protocols
### Cryptographic Primitives and Notations  
We use public key elliptic curve cryptography (ECC), using parameters secp160r1 given by the Standards for Efficient Cryptography Group [32]. Our implementation of ECC on TelosB is based on the optimized TinyECC library [33]. More precisely, we use the elliptic curve integrated encryption scheme (ECIES 160 bits), the public key encryption system proposed by [PERSON] in 2001 [34].  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Proposed Schemes** & **Standard Algorithms** & **Cryptographic Technique** & **Simulation** & **Implementation** & **Verification** \\ \hline [PERSON] _et al._ 2003 [22] & not specified & symmetric & none & none & none \\ [PERSON] _et al._ 2005 [21] & not specified & symmetric & none & none & none \\ [PERSON] _et al._ 2012 [23] & not specified & symmetric & none & none & none \\ [PERSON] _et al._ 2010 [26] & yes & asymmetric & none & none & none \\ [PERSON] _et al._ 2006[25] & not specified & symmetric & none & none & none \\ [PERSON] _et al._ 2008 [24] & not specified & symmetric & none & none & none \\ [PERSON] _et al._ 2003 [31] & not specified & symmetric & yes & none & none \\ [PERSON] _et al._ 2011 [28] & not specified & symmetric & none & none & none \\ [PERSON] _et al._ 2006 [29] & none & symmetric & none & none & none \\ [PERSON] _et al._ 2010 [30] & not specified & symmetric & yes & none & none \\ [PERSON] _et al._ 2007 [27] & not specified & symmetric & yes & none & none \\ All of our schemes & yes & symmetric/asymmetric & none & TelosB & automatic \\ \hline \end{tabular}
\end{table}
Table 1: Comparison of related work schemes and our proposition.  
For all symmetric encryptions, we use an optimized implementation of AES [35] with a key of 128 bits proposed by [36].  
In what follows, we also use the following notations to describe exchanged messages in our protocols:  
* \(I\): a new node that initiates the protocol,
* \(R\): a neighbor of node \(I\),
* \(S\): the sink of the network (also called the base station),
* \(n_{A}\): a nonce generated by node \(A\),
* \(\{x\}_{k}\): the encryption of message \(x\) with the symmetric or asymmetric key \(k\),
* \(pk(A)\): the public key of node \(A\),
* \(sk(A)\): the secret (private) key of node \(A\),
* \(K(I,S)\) or \(K(S,I)\): the symmetric session key between \(I\) and \(S\),
* \(NK\): the symmetric network key between all nodes of the network,
* \(K_{DH}(N,S)\) or \(K_{DH}(S,N)\): the shared symmetric key between \(N\) and \(S\) using the Diffie-Hellman key exchange without the interaction described below.  
Before deployment, each node \(N\) knows the public key \(pk(S)\) of the sink and also its own pair of public and private keys, denoted \(pk(N)\) and \(sk(N)\), respectively. Based on ECC, we have that \(pk(N)=sk(N)\times G\), where \(G\) is a public generator point of the elliptic curve. From \(pk(N)\) and \(G\), it is difficult to find \(sk(N)\); this problem is called the elliptic curve discrete logarithm problem (ECDLP) [37,38].  
Using this material, each node \(N\) can compute a shared key with the sink \(S\) using a variation of the Diffie-Hellman key exchange without interaction, denoted \(K_{DH}(N,S)=K_{DH}(S,N)\).  
* The sink knows its own secret key \(sk(S)\) and the public key \(pk(N)\) of any node \(N\). The sink computes \(K_{DH}(N,S)=sk(S)\times pk(N)\).
* Node \(N\) multiplies its secret key \(sk(N)\) by the public key of the sink \(pk(S)\) to get \(K_{DH}(N,S)\).  
Both computations give the same shared key, since: \(K_{DH}(N,S)=sk(N)\times pk(S)=sk(N)\times(sk(S)\times G)=(sk(N)\times G)\times sk (S)=pk(N)\times sk(S)\).  
In our protocols, we intensively use this mechanism.