From key predistribution to key redistribution

Abstract

One of crucial disadvantages of key predistribution schemes for ad hoc networks is that if devices A and B use a shared key K to determine their session keys, then any adversarial device that holds K can impersonate A against B (or vice versa). Also, the adversary holding such a device can eavesdrop on communication between A and B for the lifetime of the system.We develop a dynamic scheme where the devices are preloaded with permanent keys according to a predistribution scheme, but these keys are not used directly for setting up session keys. For this purpose devices use a pool of temporal keys, which periodically are selected at random by a system provider. The temporal keys are broadcast by the system provider in an encrypted form (e.g. using the GSM network or local broadcasting services). For the transmission, the temporal keys are encrypted with permanent keys, each temporal key occurring m times encrypted with m different permanent keys. (Parameter m is a small constant.)Encrypting the same temporal key with different permanent keys has the effect that with a high probability two devices share many more temporal keys than the permanent keys from the main pool of keys. Also, the shared temporal keys come not only from ciphertexts encrypted with shared permanent keys but predominantly from ciphertexts encrypted with the permanent keys that are not shared by the devices. After each re-distribution different pairs of permanent keys provide such shared temporal keys. This feature is the key property of our design. It makes it possible not only to protect communication against an adversary that has collected a large fraction of keys from the main pool of keys, but also enables using key predistribution for authentication in the presence of such an adversary.Finally, we present a scheme for renewing the permanent keys in a way that an adversary loses the knowledge of permanent keys except for the keys that it learns via the legitimate devices that he holds. The scheme is based on projective plane techniques.