Source-linked AI summary
Physical Layer Secret Key Generation in Static Environments
Nasser Aldaghri, Hessam Mahdavifar
TL;DR
Static environments can produce ultra-low or zero secret-key rates because conventional generation relies on channel variation. This paper introduces induced randomness for high-rate key generation and evaluates its reliability and security across direct and relay-based scenarios, including an attack-probability bound of 2^-31 for one direct-channel setting.
Problem
Static environments can yield ultra-low or zero secret-key rates because conventional wireless-channel protocols rely on channel dynamics.
Source: 1) Secret key generation over direct… · p. 2Method
Alice and Bob independently generate random bits, exchange QAM-mapped randomness directly or through an untrusted relay, then process, quantize, reconcile, hash, and consistency-check the resulting samples.
Source: §I · p. 1, B. Our Contributions · p. 2, D. Privacy Amplification Consistency… · p. 7Results
2^-31 is the upper bound on Eve’s successful-attack probability for a direct-channel setting with N = 16 and δ = 2; the protocol generates 64 bits/packet and a 32-bit final key.
Source: A. Direct Secret Key Generation · p. 9, 1) Bit Generation Rate · p. 10Takeaways & Limitations
Induced randomness provides a low-complexity approach for generating secret keys at high rates in static environments across direct and relay-based configurations.
Source: §VI · p. 13The paper leaves extension to multi-user scenarios with multiple intermediate relays as future work.
Source: §VI · p. 13
Abstract
from arXiv · showhide
Two legitimate parties, referred to as Alice and Bob, wish to generate secret keys from the wireless channel in the presence of an eavesdropper, referred to as Eve, in order to use such keys for encryption and decryption. In general, the secret key rate highly depends on the coherence time of the channel. In particular, a straightforward method of generating secret keys in static environments results in ultra-low rates. In order to resolve this problem, we introduce a low-complexity method called induced randomness. In this method, Alice and Bob independently generate local randomness to be used together with the uniqueness of the wireless channel coefficients in order to enable high-rate secret key generation. In this work, two scenarios are considered: first, when Alice and Bob share a direct communication channel, and second, when Alice and Bob do not have a direct link and communicate through an untrusted relay. After exchanging the induced randomness, post-processing is done by Alice and Bob to generate highly-correlated samples that are used for the key generation. Such samples are then converted into bits, disparities between the sequences generated by Alice and Bob are mitigated, and the resulting sequences are then hashed to compensate for the information leakage to the eavesdropper and to allow consistency checking of the generated key bit sequences. We utilize semantic security measures and information-theoretic inequalities to upper bound the probability of successful eavesdropping attack in terms of the mutual information measures that can be numerically computed. Given certain reasonable system parameters this bound is numerically evaluated to be $2^{-31}$ and $2^{-10.57}$ in the first and the second scenario, respectively.
I. INTRODUCTION
Conventional wireless-channel secret-key generation can fail in static environments, motivating a low-complexity induced-randomness approach for direct and relay-based settings.
- Physical-layer security uses wireless-channel reciprocity and randomness as sources of common randomness for secret-key generation.Source: §I · p. 1
- Static environments can produce ultra-low or zero secret-key rates because channel-based protocols rely on environmental dynamics.Source: 1) Secret key generation over direct… · p. 2
- The protocols target resource-constrained static settings while addressing the information leakage risks associated with untrusted relays.Source: 2) Secret key generation with the help… · p. 2, B. Our Contributions · p. 2
- The proposed method has Alice and Bob independently generate random bits, map them to QAM symbols, and exchange them directly or through an untrusted relay.Source: B. Our Contributions · pp. 2–3
- After exchange, reciprocity yields highly correlated sequences that undergo quantization, reconciliation, and privacy amplification to form shared keys.Source: §I · p. 1, B. Our Contributions · p. 2
A. Direct Secret Key Generation
The system models direct and relay-assisted wireless secret-key generation using reciprocal fading channels, with Alice and Bob extracting shared keys from received signals and channel uniqueness.
Direct Secret Key Generation
- The direct scenario uses an authenticated but non-secure reciprocal wireless fading channel between Alice and Bob, while Eve passively observes it.Source: A. Direct Secret Key Generation · p. 3
- The channel model uses Gaussian fading and noise, with realistic 5G mmWave coefficients also considered for numerical evaluation.Source: A. Direct Secret Key Generation · p. 3
Direct Secret Key Generation
- Alice and Bob use OFDM and process received signals together with the uniqueness of their wireless channel coefficients to extract a shared secret key.Source: A. Direct Secret Key Generation · p. 3
Relay-based Secret Key Generation
- In the relay scenario, Alice and Bob lack a direct wireless link and communicate through Carol, an amplify-and-forward relay that is compliant but untrusted.Source: B. Secret Key Generation Using a Relay · p. 4
- Carol forwards amplified signals between Alice and Bob, whose indirect channel remains reciprocal and supports extraction from channel coefficients.Source: B. Secret Key Generation Using a Relay · p. 4
C. Evaluation Metrics for SKG Protocols
The protocols are evaluated through rate, reliability, security, randomness, and efficiency measures across staged induced-randomness and post-processing procedures.
- BGR measures quantized bits per packet, while BMR measures mismatches between Alice’s and Bob’s sequences and should be higher at Eve.Source: C. Evaluation Metrics for SKG Protocols · p. 4
- BER measures mismatches in the final Alice–Bob key and at Eve, where an ideal eavesdropper-side value is close to 50%.Source: C. Evaluation Metrics for SKG Protocols · p. 4
- Randomness testing assesses whether the final key is indistinguishable from a random binary sequence, commonly using the NIST statistical test suite.Source: C. Evaluation Metrics for SKG Protocols · p. 4
- Randomness efficiency measures shared-sequence length normalized by Alice’s and Bob’s total available randomness.Source: C. Evaluation Metrics for SKG Protocols · p. 4
- The protocols comprise induced-randomness exchange, quantization, reconciliation, and privacy amplification with consistency checking.Source: §III · pp. 4–5
A. Induced Randomness Exchange
Alice and Bob independently transmit local QAM randomness over either a direct channel or an untrusted relay, then combine received signals with their own transmissions to create correlated random samples. These samples are intended for secret-key extraction.
Direct induced randomness exchange
- Alice and Bob independently generate length-N vectors of uniformly random M-QAM symbols for each session.The direct-exchange protocol uses independently selected vectors, while the relay scenario also uses synchronized transmissions with matched received SNRs.Source: 1) Direct Induced Randomness Exchange · p. 5, 2) Relay-Based Induced Randomness… · p. 6
Protocol overviews
- The protocol overviews describe one-session direct and relay-based secret-key generation procedures.Figures 3 and 4 provide the respective protocol overviews.Source: Figure 3 · p. 5, Figure 4 · p. 6
Direct induced randomness exchange
- In the direct scenario, each party multiplies the symbols it sent by the symbols it received to form local sequences.The resulting sequences are denoted w_i,ab and eŵ_i,ab at Alice and Bob.Source: 1) Direct Induced Randomness Exchange · p. 5
Relay-based induced randomness exchange
- The direct and relay protocols produce vectors that are both random and highly correlated, making them suitable for shared-secret extraction.The relay-based vectors are likewise described as highly correlated and random at each session.Source: 1) Direct Induced Randomness Exchange · p. 5, 2) Relay-Based Induced Randomness… · p. 6
- In the relay scenario, channel estimates and local randomness are used to eliminate self-interference before forming the shared samples.The relay probes the channels, and Alice and Bob use their estimates together with local randomness in subsequent processing.Source: 2) Relay-Based Induced Randomness… · pp. 5–6
B. Quantization
The post-processing pipeline sorts and quantizes the correlated complex samples, reconciles Alice’s and Bob’s bit sequences with a secure sketch, and applies universal hashing for privacy amplification and consistency checking.
Quantization
- Alice and Bob sort the complex-valued shared sequences, determine their data range, and assign values to uniform quantization intervals using resolution δ.The sorted measurements are converted into binary streams through the quantization procedure illustrated in Figure 5.Source: B. Quantization · p. 6
Reconciliation
- Reconciliation mitigates disagreements between Alice’s and Bob’s quantized bit sequences using an error-correcting-code-based secure sketch.The protocol uses a convolutional code, with encoding and Viterbi decoding chosen for implementation simplicity.Source: C. Reconciliation · pp. 6–7
- A secure sketch enables recovery when the Hamming distance between sequences is below threshold t while limiting the conditional min-entropy revealed by the sketch.Its guarantees include exact recovery within the threshold and a lower bound m2 on residual average min-entropy.Source: C. Reconciliation · p. 7
- The code rate trades off error-correction capability against security: higher rates improve security but correct fewer errors.The protocol recommends starting with a high-rate code and reducing the rate after consecutive unsuccessful attempts.Source: C. Reconciliation · p. 7
Privacy amplification and consistency checking
- Universal hash functions reduce information leakage and support consistency checking between Alice’s and Bob’s final keys.The protocol derives the hash choice and hash input from separate portions of the reconciled sequence, producing matched key sequences with high probability.Source: D. Privacy Amplification Consistency… · p. 7
- The probability of accepting a mismatched key as consistent is upper bounded by the universal-hash construction and its hash-table size.The bound follows directly from the universal-hash collision property.Source: D. Privacy Amplification Consistency… · pp. 7–8
IV. ATTACKER MODEL AND THE RESILIENCE OF PROPOSED PROTOCOLS
The security analysis models Eve’s channel correlation with the legitimate parties and bounds key-guessing success using mutual information and semantic-security arguments. Spatial separation reduces channel correlation and therefore the information available to Eve.
Attacker model
- Eve is modeled as passively observing communications in both the direct-channel and relay-assisted scenarios.The analysis seeks an upper bound on Eve’s probability of successfully guessing the generated key.Source: §IV · p. 8
- Eve’s direct-channel strategy assumes access to the induced symbols and the legitimate channel coefficient, while relay analysis considers whether she can estimate the exchanged randomness.Recovering the shared samples requires channel information across the relevant subcarriers.Source: A. Direct Secret Key Generation · p. 8
Channel correlation model
- The correlation coefficient between legitimate and eavesdropper fading channels depends on their spatial separation through ρ = [J0(kd)]^2.J0 is the first-kind Bessel function and k is the wavenumber.Source: A. Direct Secret Key Generation · p. 8
- When Eve is more than half a wavelength away, the fading channels are nearly uncorrelated, so the leaked information is small under the stated assumptions.The analysis assumes negligible quantization effects and, for a dominant term, considers mutual information between Bob’s and Eve’s channel coefficients.Source: A. Direct Secret Key Generation · p. 8
Mutual-information analysis
- As ρ approaches zero, the mutual information between Bob’s and Eve’s channel coefficients also approaches zero.Lemma 2 provides the mutual-information expression used in the security analysis.Source: A. Direct Secret Key Generation · p. 8
Semantic-security bound
- Theorem 3 bounds Eve’s successful key-guessing probability using the number of subcarriers, quantization resolution, and mutual information between Bob’s and Eve’s observations.The proof combines the information-theoretic increase in Eve’s guessing probability with privacy amplification and a union bound.Source: A. Direct Secret Key Generation · pp. 8–9
Numerical implication
- For Eve–Bob separation d = λ/2, the correlation coefficient is at most 0.09 and the resulting mutual information is at most 0.01 under the stated distance ordering.These values provide a numerical input to the theorem’s eavesdropping bound.Source: A. Direct Secret Key Generation · p. 9
B. Relay-based Secret Key Generation
The relay-based protocol analyzes eavesdropping when Eve has the relay’s information plus her own observations, using information-theoretic bounds on her ability to recover quantized bits. Theorem 4 then converts these bounds into a successful-attack probability that can be numerically evaluated.
- Eve is analyzed under a worst-case model in which she has all information available to the untrusted relay, in addition to her own observations.Source: B. Relay-based Secret Key Generation · p. 9
- Spatial correlation does not provide the same security benefit in the relay scenario as in the direct-channel scenario.Source: B. Relay-based Secret Key Generation · p. 9
- Fano’s inequality bounds Eve’s probability of correctly estimating quantized bits using their conditional entropy given Eve’s observations.Source: B. Relay-based Secret Key Generation · pp. 9–10
- Theorem 4 upper bounds Eve’s successful-attack probability using the number of subcarriers, quantization resolution, mutual information Iab,e, and the support size of qa.Source: B. Relay-based Secret Key Generation · p. 9
- Privacy amplification bounds the probability of correctly guessing the secret key by 2^-δN when Eve cannot recover all shared-randomness bits in one session.Source: B. Relay-based Secret Key Generation · p. 10
- 2^-10.57: with 64-QAM, 23 dB received SNR, δ = 2, N = 16, Iab,e ≈ 1.39 bits, and H(qa) ≈ 3.86 bits, the attack probability is upper bounded by this value.Source: B. Relay-based Secret Key Generation · p. 10
V. NUMERICAL RESULTS
The numerical-results section evaluates the proposed protocols for direct-channel and relay-assisted scenarios using stated metrics and channel coefficients generated by the NYUSIM Channel Simulator.
- The evaluation considers both direct-channel and relay-assisted key-generation scenarios using the metrics defined earlier.Source: §V · p. 10
- Channel coefficients are generated with the NYUSIM Channel Simulator to provide numerical results in a realistic environment.Source: §V · p. 10
A. Setup
The direct-channel setup assumes reciprocal communication, 16-QAM local randomness, 16 OFDM subcarriers, and quantization with δ = 2.
- Alice and Bob communicate over a direct reciprocal wireless channel using 16-QAM symbols as transmitted local randomness.Source: 1) Direct Secret Key Generation · p. 10
- The setup uses N = 16 OFDM subcarriers and quantization parameter δ = 2.Source: 1) Direct Secret Key Generation · p. 10
1) Direct Secret Key Generation:
The direct-channel experiment uses NYUSIM-generated coefficients for a 28 GHz non-line-of-sight urban micro-cellular environment with 10-meter node separations.
- The channel coefficients are generated for a non-line-of-sight urban micro-cellular environment at 20°C and 28 GHz.Source: 2) NYUSIM-Based Secret Key Generation · p. 10
- Alice–Bob and Alice–Eve distances are set to 10 meters, with 1 meter of foliage and an outdoor-to-indoor low-loss path.Source: 2) NYUSIM-Based Secret Key Generation · p. 10
2) NYUSIM-Based Secret Key Generation:
The NYUSIM-based setup uses induced randomness over 16 subcarriers to generate high-rate keys in a static-channel setting. Its evaluation examines mismatch, error, randomness, and efficiency across the compared setups.
Key generation
- 64 bits are generated per packet, producing a 32-bit final secret key after post-processing.Four successful sessions can be combined modulo 2 to obtain one 32-bit final key.Source: 1) Bit Generation Rate · p. 10
- The 64-bit-per-packet generation rate exceeds static-environment baselines of 1–2 and 8 bits per packet and is comparable to 60–90 bits per packet in dynamic environments.Source: 1) Bit Generation Rate · pp. 10–11
Bit mismatch rate
- In the NYUSIM setup, Eve’s BMR decreases as average SNR increases, but the decrease becomes slower at higher SNR.Source: 2) Bit Mismatch Rate and Bit Error Rate · p. 11
- The relay-based setup requires about 3 dB higher average SNR than the direct and NYUSIM-based setups to achieve a similar BMR.Source: 2) Bit Mismatch Rate and Bit Error Rate · p. 11
Bit error rate
- Bob’s BER is extremely low, while Eve’s average BER is around 50% because privacy amplification produces uniformly random hash outputs.The consistency-checking step accepts only keys whose consistency is verified with high probability.Source: 2) Bit Mismatch Rate and Bit Error Rate · p. 11
Randomness
- The generated 220-bit sequences pass all 15 NIST statistical tests and are considered random with 99% confidence.Source: 3) Randomness · p. 11
Randomness efficiency
- The relay-based setup has 33% randomness efficiency, reflecting a trade-off between available randomness and security.Source: 4) Randomness Efficiency · pp. 11–12
5) Average Number of Sessions Required to Generate Keys:
The protocol generally needs about four successful sessions at high SNR to generate a 32-bit key, while imperfect channel reciprocity increases the sessions required for agreement. At 15 dB, reducing the correlation coefficient from ζ = 1 to ζ = 0.9 increases the average from around 9 to around 37 sessions.
Session requirements
- At high SNR, the average number of sessions approaches 4 because the 32-bit key combines outputs from four successful sessions.The final key length is 32 bits, obtained by modulo-2 addition of protocol outputs from four successful sessions.Source: 5) Average Number of Sessions Required… · p. 12
Impact of non-reciprocity
- At 15 dB, imperfect reciprocity increases the average sessions from around 9 for ζ = 1 to around 37 for ζ = 0.9.The lower correlation also raises the bit mismatch rate, causing more unsuccessful sessions.Source: 6) Impact of Non-reciprocity · p. 12
- For a BMR around 22%, the required SNR rises from 9 dB at ζ = 1 to 15 dB at ζ = 0.9.This compares the SNR needed to reach the same bit mismatch rate under perfect and imperfect channel correlation.Source: 6) Impact of Non-reciprocity · p. 12
- Lowering the quantization resolution δ or reducing the reconciliation code rate can mitigate degradation from reciprocity imperfections.Reducing the reconciliation code rate increases the information leaked to the eavesdropper.Source: 6) Impact of Non-reciprocity · pp. 12–13