Ad Hoc Networks 1 (2003) 175–192

www.elsevier.com/locate/adhoc

SEAD: secure efficient distance vector routing

for mobile wireless ad hoc networks
a,*
Yih-Chun Hu , David B. Johnson b, Adrian Perrig a

a
Carnegie Mellon University, Pittsburgh, PA 15213, USA
b
Rice University, Houston, TX 77005, USA

Abstract

An ad hoc network is a collection of wireless computers (nodes), communicating among themselves over possibly
multihop paths, without the help of any infrastructure such as base stations or access points. Although many previous
ad hoc network routing protocols have been based in part on distance vector approaches, they have generally assumed a
trusted environment. In this paper, we design and evaluate the Secure Efficient Ad hoc Distance vector routing protocol
(SEAD), a secure ad hoc network routing protocol based on the design of the Destination-Sequenced Distance-Vector
routing protocol. In order to support use with nodes of limited CPU processing capability, and to guard against Denial-
of-Service attacks in which an attacker attempts to cause other nodes to consume excess network bandwidth or pro-
cessing time, we use efficient one-way hash functions and do not use asymmetric cryptographic operations in the
protocol. SEAD performs well over the range of scenarios we tested, and is robust against multiple uncoordinated
attackers creating incorrect routing state in any other node, even in spite of any active attackers or compromised nodes
in the network.

2003 Published by Elsevier B.V.

Keywords: Mobile ad hoc networks; Ad hoc network routing; Secure routing; SEAD; Hash tree chains; Same-distance fraud

1. Introduction of the routing protocol in an ad hoc network is to

allow nodes to learn such multihop paths. Since
In a mobile wireless ad hoc network, computers the nodes in the network may move at any time, or
(nodes) in the network cooperate to forward may even move continuously, and since sources of
packets for each other, due to the limited wireless wireless interference and wireless transmission
transmission range of each individual node. The propagation conditions may change frequently,
network route from some sender node to a desti- the routing protocol must also be able to react to
nation node may require a number of intermediate these changes and to learn new routes to maintain
nodes to forward packets to create a ‘‘multihop’’ connectivity.
path from this sender to this destination. The role Ad hoc networks require no centralized admin-
istration or fixed network infrastructure such as
base stations or access points, and can be quickly
*
Corresponding author. and inexpensively set up as needed. They can thus
E-mail addresses: [email protected] (Y.-C. Hu), dbj@ be used in scenarios where no infrastructure exists,
cs.rice.edu (D.B. Johnson), [email protected] (A. Perrig). or where the existing infrastructure does not meet

1570-8705/$ - see front matter
2003 Published by Elsevier B.V.

doi:10.1016/S1570-8705(03)00019-2
176 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

application requirements for reasons such as se- Each style of ad hoc network routing protocol
curity, cost, or quality. Examples of applications has advantages and disadvantages. In this paper,
for ad hoc networks range from military operations we focus on securing ad hoc network routing using
and emergency disaster relief, to community net- periodic (or proactive) protocols, and in particu-
working and interaction between attendees at a lar, using distance vector routing protocols. Dis-
meeting or students during a lecture. In these and tance vector routing protocols are easy to
other applications of ad hoc networking, security implement, require relatively little memory or
in the routing protocol is necessary in order to CPU processing capacity compared to other types
guard against attacks such as malicious routing of routing protocols, and are widely used in net-
misdirection, but relatively little previous work has works of moderate size within the (wired) Internet
been done in securing ad hoc network routing [14,27,28]. A number of proposed periodic ad hoc
protocols. network routing protocols are based on adapting
Secure ad hoc network routing protocols are the basic distance vector routing protocol design
difficult to design, due to the generally highly dy- for use in mobile wireless ad hoc networks, in-
namic nature of an ad hoc network and due to the cluding PRNET [23], DSDV [34], WRP [31],
need to operate efficiently with limited resources, WIRP [10], and ADV [5]. Distance vector routing
including network bandwidth and the CPU pro- has also been used for routing within a zone in the
cessing capacity, memory, and battery power (en- ZRP hybrid ad hoc network routing protocol [12].
ergy) of each individual node in the network. We present the design and evaluation of a new
Existing insecure ad hoc network routing protocols secure ad hoc network routing protocol using
are often highly optimized to spread new routing distance vector routing. Our protocol, which we
information quickly as conditions change, requir- call the Secure Efficient Ad hoc Distance vector
ing more rapid and often more frequent routing routing protocol (SEAD), is robust against mul-
protocol interaction between nodes than is typical tiple uncoordinated attackers creating incorrect
in a traditional (e.g., wired and stationary) net- routing state in any other node, even in spite of
work. Expensive and cumbersome security mech- active attackers or compromised nodes in the
anisms can delay or prevent such exchanges of network. We base the design of SEAD in part on
routing information, leading to reduced routing the Destination-Sequenced Distance-vector ad hoc
effectiveness, and may consume excessive network network routing protocol (DSDV) [34], which was
or node resources, leading to many new opportu- designed for trusted environments. In order to
nities for possible Denial-of-Service attacks through support use of SEAD with nodes of limited CPU
the routing protocol. processing capability, and to guard against Denial-
Routing protocols for ad hoc networks gener- of-Service attacks in which an attacker attempts to
ally can be divided into two main categories: pe- cause other nodes to consume excess network
riodic protocols and on-demand protocols. In a bandwidth or processing time, we use efficient one-
periodic (or proactive) routing protocol, nodes way hash functions and do not use asymmetric
periodically exchange routing information with cryptographic operations in the protocol.
other nodes in an attempt to have each node al- In Section 2 of this paper, we summarize the
ways know a current route to all destinations (e.g., basic operation of distance vector routing, and we
[4,5,8,10,23,31,34]). In an on-demand (or reactive) describe the DSDV ad hoc network routing pro-
protocol, on the other hand, nodes exchange tocol on which we base our work. Section 3 pre-
routing information only when needed, with a sents our assumptions about the network and
node attempting to discover a route to some nodes involved in the ad hoc network. In Section
destination only when it has a packet to send to 4, we describe possible attacks on distance vector
that destination (e.g., [22,33,35]). In addition, routing protocols and specifically on DSDV
some ad hoc network routing protocols are hy- routing, and in Section 5, we present the design of
brids of periodic and on-demand mechanisms SEAD, our ad hoc network distance vector rout-
(e.g., [12]). ing protocol that protects against those attacks.
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 177

Section 6 presents the results of a simulation-based uses as a next hop the neighbor that advertised the
study of the performance of SEAD in ad hoc smallest metric in its update for that destination;
networks of 50 mobile nodes, comparing its per- the node sets the metric in its table entry for that
formance to that of the original (insecure) DSDV destination to 1 (hop) more than the metric in that
protocol; we show the overhead created by the neighborÕs update. A common optimization to this
security mechanisms and the impact of these basic procedure to spread changed routing infor-
mechanisms on the protocolÕs ability to success- mation through the network more quickly is the
fully route packets. In Section 7, we discuss related use of triggered updates, in which a node transmits
work, and finally, in Section 8, we present con- a new update about some destination as soon as
clusions. the metric in its table entry for that destination
changes, rather than waiting for its next scheduled
periodic update to be sent.
2. Distance vector routing and DSDV Distance vector routing protocols are simple,
but they cannot guarantee not to produce routing
A distance vector routing protocol finds short- loops between different nodes for some destina-
est paths between nodes in the network through a tion. Such loops are eventually resolved by the
distributed implementation of the classical Bell- protocol through many rounds of routing table
man–Ford algorithm. As noted in Section 1, dis- updates in what is known as ‘‘counting to infinity’’
tance vector protocols are easy to implement and in the metric for this destination; to reduce time
are efficient in terms of memory and CPU pro- needed for this resolution, the maximum metric
cessing capacity required at each node. A popular value allowed by the protocol is typically defined
example of a distance vector routing protocol is to be relatively small, such as 15 as is used in RIP
RIP [14,28], which is widely used in IP networks of [14,28]. To further reduce these problems, a num-
moderate size. Distance vector routing can be used ber of extensions, such as split horizon and split
for routing within an ad hoc network by having horizon with poisoned reverse [14,28], are widely
each node in the network act as a router and used. These extensions, however, can still allow
participate in the routing protocol. some loops, and the possible problems that can
In distance vector routing, each router main- create routing loops are more common in wireless
tains a routing table listing all possible destina- and mobile networks such as ad hoc networks, due
tions within the network. Each entry in a nodeÕs to the motion of the nodes and the possible
routing table contains the address (identity) of changes in wireless propagation conditions.
some destination, this nodeÕs shortest known dis- The primary improvement for ad hoc networks
tance (usually in number of hops) to that desti- made in DSDV over standard distance vector
nation, and the address of this nodeÕs neighbor routing is the addition of a sequence number in
router that is the first hop on this shortest route to each routing table entry. The use of this sequence
that destination; the distance to the destination is number prevents routing loops caused by updates
known as the metric in that table entry. When being applied out of order; this problem may be
routing a packet to some destination, the node common over multihop wireless transmission,
transmits the packet to the indicated neighbor since the routing information may spread along
router, and each router in turn uses its own routing many different paths through the network. Each
table to forward the packet along its next hop node maintains an even sequence number that it
toward the destination. includes in each routing update that it sends, and
To maintain the routing tables, each node pe- each entry in a nodeÕs routing table is tagged with
riodically transmits a routing update to to each of the most recent sequence number it knows for that
its neighbor routers, containing the information destination. When a node detects a broken link to
from its own routing table. Each node uses this a neighbor, the node creates a new routing update
information advertised by its neighbors to update for that neighbor as a destination, with an ‘‘infi-
its own table, so that its route for each destination nite’’ metric and the next odd sequence number
178 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

after the even sequence number in its corre- often bidirectional, and many MAC layers require
sponding routing table entry. When a node re- bidirectional frame exchange to avoid collisions [20].
ceives a routing update, for each destination in the Network physical layer and MAC layer attacks
update, the node prefers this newly advertised are beyond the scope of this paper. Use of spread
route if the sequence number is greater than in the spectrum has been studied for securing the physi-
corresponding entry currently in the nodeÕs rout- cal layer against jamming [40]. MAC protocols
ing table, or if the sequence numbers are equal and that do not employ some form of carrier sense,
the new metric is lower than in the nodeÕs current such as ALOHA and Slotted ALOHA [1], are less
table entry for that destination; if the sequence vulnerable to Denial-of-Service attacks, although
number in the update is less than the current se- they generally use the channel less efficiently.
quence number in the table entry, the new update We assume that the wireless network may drop,
for that destination is ignored. corrupt, duplicate, or reorder packets. We also
DSDV sends both periodic routing updates and assume that the MAC layer contains some level of
triggered updates. These updates may be either a redundancy to detect randomly corrupted packets;
‘‘full dump’’, listing all destinations, or an ‘‘incre- however, this mechanism is not designed to replace
mental’’ update, listing only destinations for which cryptographic authentication mechanisms.
the route has changed since the last full dump sent The network diameter of an ad hoc network is
by that node. A node in DSDV chooses to send a the maximum, across all pairs of nodes in the
triggered update when important routing changes network, of the length of the optimal route be-
should be communicated as soon as possible, al- tween that pair of nodes. As noted in Section 2,
though there are multiple interpretations suggested standard distance vector routing protocols limit
in the published description of DSDV as to which the maximum metric value (and thus the maxi-
changes should cause a triggered update. One in- mum network diameter supported by the proto-
terpretation suggests that the receipt of a new col). We also limit the maximum network
metric for some destination should cause a trig- diameter, and we use m
1 to denote this upper
gered update, while the alternative interpretation bound, such that all routes that can be used by the
suggests that the receipt of a new sequence number routing protocol are of length less than m hops.
also should cause a triggered update. The latter Internal to a nodeÕs routing table, the value m can
interpretation has been shown to outperform the be used to denote the infinity metric in distance
former in detailed ad hoc network simulations vector routing, although in SEAD, entries in the
[6,21] and is referred to as DSDV-SQ (for sequence routing table with an infinite metric are not in-
number) to distinguish it from the interpretation cluded in routing update messages sent by a node.
based only on metrics. We assume that nodes in the ad hoc network
may be resource constrained. Thus, in securing our
distance vector ad hoc network routing protocol
3. Assumptions SEAD, we use efficient one-way hash chains [26]
and Merkle hash trees [30] rather than relying on
As a matter of terminology in this paper, we use expensive asymmetric cryptographic operations.
the acronym ‘‘MAC’’ to refer to the network Especially on CPU-limited devices, symmetric
Medium Access Control protocol at the link layer, cryptographic operations (such as block ciphers
and not to a Message Authentication Code used and hash functions) are three to four orders of
for authentication. magnitude faster than asymmetric operations
We assume that all wireless links in the network (such as digital signatures).
are bidirectional, since this is necessary for the
distributed Bellman–Ford algorithm of distance 3.1. One-way hash chains
vector routing to function correctly. Specifically, if
a node AÕs wireless transmissions reach B, then BÕs A one-way hash chain is built on a one-way
transmissions would reach A. Wireless links are hash function. Like a normal hash function, a one-
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 179

way hash function, H , maps an input of any length we assume that a node generates its hash chain so

to a fixed-length bit string. Thus, H : f0; 1g ! that n is divisible by m. When a node first enters
q
f0; 1g , where q is the length in bits of the output the network, or after a node has used most of its
of the hash function. The function H should be available hash chain elements, it can pick a new
simple to compute yet must be computationally random x, generate a new hash chain from this x,
infeasible in general to invert. A more formal and send the new generated hn value to a trusted
definition of one-way hash functions is provided entity or an alternative authentication and distri-
by Goldwasser and Bellare [11], and a number of bution service, as described above.
such functions have been proposed, including
MD5 [44] and SHA-1 [32]. 3.2. Tree-authenticated values
To create a one-way hash chain, a node chooses
q
a random initial value x 2 f0; 1g and computes The mechanism of tree-authenticated values is
the list of values an efficient hash tree authentication mechanism,
first presented by Merkle and also known as
h0 ; h1 ; h2 ; h3 ; . . . ; hn
Merkle hash trees [30]. To authenticate values
where h0 ¼ x, and hi ¼ H ðhi
1 Þ for 0 < i 6 n, for v0 ; v1 ; . . . ; vw
1 , we place these values at the leaf
some n. The node at initialization generates the nodes of a binary tree. (For simplicity we assume a
elements of its hash chain as shown above, from balanced binary tree, so w is a power of two.) We
‘‘left to right’’ (in order of increasing subscript i) first blind all the vi values with a one-way hash
and then over time uses certain elements of the function H to prevent disclosing neighboring val-
chain to secure its routing updates; in using these ues in the authentication information (as we de-
values, the node progresses from ‘‘right to left’’ (in scribe below), so v0i ¼ H ½vi . We then use the
order of decreasing subscript i) within the gener- Merkle hash tree construction to commit to the
ated chain. values v00 ; . . . ; v0w
1 . Each internal node of the bi-
Given an existing authenticated element of a nary tree is derived from its two child nodes.
one-way hash chain, it is possible to verify ele- Consider the derivation of some parent node mp
ments later in the sequence of use within the chain from its left and right child nodes ml and mr :
(further to the ‘‘left’’, or in order of decreasing mp ¼ H ½ml kmr , where k denotes concatenation.
subscript). For example, given an authenticated hi We compute the levels of the tree recursively from
value, a node can authenticate hi
3 by computing the leaf nodes to the root node. Fig. 1 shows this
H ðH ðH ðhi
3 ÞÞÞ and verifying that the resulting construction over the eight values v0 ; v1 ; . . . ; v7 ,
value equals hi . e.g., m01 ¼ H ðv00 kv01 Þ, m03 ¼ H ½m01 km23 .
To use one-way hash chains for authentication, The root value of the tree is used to commit to
we assume some mechanism for a node to dis- the entire tree, and in conjunction with additional
tribute an authentic element such as hn from its
generated hash chain. A traditional approach for
this key distribution is for a trusted entity to sign
public-key certificates for each node; each node
can then use its public-key to sign new a hash
chain element for itself. Hubaux, Butty
an, and
 apkun bootstrap trust relationships from PGP-
C
like certificates without relying on a trusted public
key infrastructure [19]. Alternatively, a trusted node
can securely distribute an authenticated hash chain
element using only symmetric-key cryptography
[17,39] or non-cryptographic approaches [46].
Since in SEAD, a node uses elements from its
one-way hash chain in groups of m (Section 5.2), Fig. 1. Tree authenticated values.
180 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

information, it can be used to authenticate any leaf advertising a zero metric for all destinations can
value. To authenticate a value vi the sender dis- cause all nodes around it to route packets for all
closes i, vi , and all the sibling nodes of the nodes destinations toward it rather than toward each
on the path from vi to the root node. The receiver actual destination. Alternatively, an attacker can
can then use these nodes to verify the path up to modify the source address of the advertisement,
the root, which authenticates the value vi . For thus spreading inaccurate next-hop information.
example, if a sender wants to authenticate key v2 in An attacker can mount a replay attack by
Fig. 1, it includes the values v03 ; m01 ; m47 in the sending an old advertisement to some node, in an
packet. A receiver with an authentic root value m07 attempt to get that node to update its routing table
can then verify that with stale routes.
A more subtle type of attack is the creation of a
H ½H ½m01 kH ½H ½v2 kv03 km47 
wormhole in the network, using a pair of attacker
equals the stored root value m07 . If the verification nodes A and B linked via a private network con-
is successful, the receiver knows that v2 is au- nection. In a wormhole, every packet that A re-
thentic. ceives from the ad hoc network, A forwards
The extra v00 ; v01 ; . . . ; v07 in Fig. 1 are added to the through the wormhole to B, to then be forwarded
tree to avoid disclosing (in this example) the value normally by B; similarly, B may send all ad hoc
v3 for the authentication of v2 . network packets to A. Such an attack potentially
disrupts routing by short circuiting the normal
flow of routing packets, and the attackers may also
4. Attacks create a virtual vertex cut of nodes in the network
that they control. We describe the wormhole at-
Kumar [25] and Smith et al. [45] discuss attacks tack and solutions [38] and we give more details on
against distance vector routing protocols. In ad- the vertex cut and other attackers [17] elsewhere.
dition, in prior work we presented some attacks An attacker may be a compromised node. If so,
against ad hoc network routing protocols [17]. In it will have access to all cryptographic keys of that
this section, we summarize relevant attacks. compromised node, and it may cooperate with
An attacker can attempt to reduce the amount other attackers or compromised nodes.
of routing information available to other nodes, by
failing to advertise certain routes or by destroying
or discarding routing packets or parts of routing 5. Securing distance vector routing
packets. A node failing to advertise a route indi-
cates its unwillingness to forward packets for those 5.1. Basic design of SEAD
destinations. We do not attempt to defend against
this attack, since the attacker could also otherwise We base the design of our secure routing pro-
drop data packets sent to those destinations. A tocol SEAD on the DSDV-SQ version [6] of the
node can drop routing packets it receives, in which insecure DSDV ad hoc network routing protocol,
case it becomes ignorant of links available to it and as described in Section 2. In particular, to avoid
fails to pass potentially improved knowledge to its long-lived routing loops in SEAD, we use desti-
neighbors. This ignorance attack has even more nation sequence numbers, as in DSDV; we also use
limited impact than failing to advertise routes that these destination sequence numbers to provide
the node itself knows. Finally, an intruder can jam replay protection of routing update messages in
routing packets; we will disregard such attacks in SEAD.
this paper, since prevention of such attacks begins We differ from DSDV in that we do not use an
at the physical layer. average weighted settling time in sending triggered
An attacker can modify an advertisement by updates. To reduce the number of redundant
changing the destination, metric, or source address triggered updates, each node in DSDV tracks, for
(and hence next-hop). For example, an attacker each destination, the average time between when
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 181

the node receives the first update for some new in this section and the neighbor authentication in
sequence number for that destination, and when it the following section. Whereas DSDV-SQ (and
receives the best update for that sequence number DSDV) are subject to all of the attacks in Section
for it (with the minimum metric among those re- 4, SEAD thus resists those attacks. SEAD is ro-
ceived with that sequence number); when deciding bust against multiple uncoordinated attackers
to send a triggered update, each DSDV node de- creating incorrect routing state in any other node,
lays any triggered update for a destination for this even in spite of active attackers or compromised
average weighted settling time, in the hope of only nodes in the network. A description of the detailed
needing to send one triggered update, with the best security properties provided by the complete
metric, for that sequence number. SEAD protocol is provided in Section 6.1.
SEAD does not use such a delay, in order to One possible approach that could be used for
prevent attacks from nodes that might maliciously authenticating routing updates in a distance vector
not use the delay. Since a node selects the first routing protocol is for each node to sign each of its
route it receives with highest sequence number and routing updates using asymmetric cryptography.
lowest metric, an attacker could otherwise attempt However, this approach raises three distinct
to cause more traffic to be routed through itself, by problems for use in an ad hoc network.
avoiding the delay in its own triggered updates. First, an attacker could send a large number of
Such an attack could otherwise put the attacker in arbitrary forged routing updates to some victim
a position to eavesdrop on, modify, or discard node, such that the victim is forced to spend all of
other nodesÕ packets. its CPU resources attempting to verify this stream
In addition, unlike DSDV, when a node detects of updates, creating an effective Denial-of-Service
that its next-hop link to some destination is bro- attack; this attack would be particularly easy in
ken, the node does not increment the sequence many ad hoc networks, since ad hoc network
number for that destination in its routing table nodes tend to have less powerful CPUs than
when it sets the metric in that entry to infinity. workstations in wired networks. Second, an at-
Since higher sequence numbers take priority, this tacker who has compromised a node can send
nodeÕs routing update with this new sequence updates claiming that any other node is a neighbor
number must be authenticated, but we did not (metric 1), causing other nodes to incorrectly direct
include a mechanism for authenticating these lar- packets for this destination node toward the at-
ger sequence numbers. Instead, the node flags its tacker. Finally, even with no attacker present, the
routing table entry for this destination to not ac- larger signatures and longer signature generation
cept any new updates for this same sequence and verification times of asymmetric cryptography
number, effectively preventing the possible routing would reduce the resources that could otherwise be
loop and traditional distance vector ‘‘counting to used for running useful applications and doing
infinity’’ problem [14,28] that could otherwise oc- useful communication; this problem is more severe
cur in this case. in an ad hoc network than in a traditional (i.e.,
wired and stationary) network due to the limited
5.2. Metric and sequence number authenticators resources of nodes and links in an ad hoc network,
such as available bandwidth, CPU capacity, and
In addition to the differences between our battery power (energy).
SEAD protocol and DSDV-SQ described in Sec- Instead, in securing routing in SEAD, we use
tion 5.1, the lower bound on each metric in a efficient one-way hash chains [26]. The basic op-
routing update in SEAD is secured through au- eration of a one-way hash chain was described in
thentication; in addition, the receiver of SEAD Section 3. Each node in SEAD uses a specific
routing information also authenticates the sender single next element from its hash chain in each
(ensures that the routing information originates routing update that it sends about itself (metric 0).
from the correct sender). We describe the authen- Based on this initial element, the one-way hash
tication of the lower bound on the distance metric chain conceptually provides authentication for the
182 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

lower bound of the metric in other routing updates that update, it sets the address in that entry to its
for this destination; the authentication provides own node address, the metric to 0, the sequence
only a lower bound on the metric, since it does not number to its own next sequence number, and the
prevent a malicious node from claiming the same hash value to the first element in the group of its
metric as the node from which it heard this route. own hash chain elements corresponding to that
In particular, the one-way hash function provides sequence number. In the example given above for
the property that another node can only increase a sequence number i, the node sets the hash value in
metric in a routing update, but cannot decrease it. that entry to its hkm . If the node lists an entry for
Due to the properties of the one-way hash func- some other destination in that update, it sets the
tion, given any value in the hash chain, an attacker address in that entry to that destination nodeÕs
cannot generate any value in the chain that will be address, the metric and sequence number to the
used by this node in a future update that it sends values for that destination in its routing table, and
about itself (a value to the ‘‘left’’ of the given value the hash value to the hash of the hash value re-
in the chain, with smaller subscript). Similarly, for ceived in the routing update entry from which it
each entry in its routing update describing a route learned that route to that destination.
to another destination, the hash chain of that This use of a hash value corresponding to the
destination node allows the metric in that entry to sequence number and metric in a routing update
be authenticated by nodes receiving it. entry prevents any node from advertising a route
As noted in Section 3, we assume that an upper to some destination claiming a greater sequence
bound can be placed on the diameter of the ad hoc number than that destinationÕs own current se-
network, and we use m
1 to denote this bound. quence number, due to the one-way nature of the
Thus, within the routing protocol, all metrics in hash chain. Likewise, no node can advertise a
any routing update are less than m. The method route better than those for which it has received an
used by SEAD for authenticating an entry in a advertisement, since the metric in an existing route
routing update uses the sequence number in that cannot be decreased.
entry to determine a contiguous group of m ele- Nodes receiving any routing update can easily
ments from that destination nodeÕs hash chain, one authenticate each entry in the update, given any
element of which must be used to authenticate that earlier authentic hash element from the same hash
routing update. The particular element from this chain, as described in Section 3. In order to guard
group of elements that must be used to authenti- against attacks in which a malicious update
cate the entry is determined by the metric value claiming a high sequence number attempts to force
being sent in that entry. Specifically, if a nodeÕs a receiving node to perform a large number of
hash chain is the sequence of values hash operations in order to authenticate the up-
h0 ; h1 ; h2 ; h3 ; . . . ; hn date, a receiving node may limit the number of
hashes it is willing to perform for each such au-
and n is divisible by m, then for a sequence number thentication, discarding updates that cannot be
i in some routing update entry, let k ¼ ðn=mÞ
i. authenticated; since DSDV-SQ (and thus SEAD)
An element from the group of elements spreads new routing information across the net-
hkm ; hkmþ1 ; . . . ; hkmþm
1 work, this limit assumes a bound on the number of
routing updates about a destination that the re-
from this hash chain is used to authenticate the ceiving node may have missed before any au-
entry; if the metric value for this entry is thentic update is received. A similar solution to
j; 0 6 j < m, then the value hkmþj here is used to such an attack would be to have each node tie its
authenticate the routing update entry for that se- own sequence number generation to a loosely
quence number. synchronized clock value, thus allowing a receiving
When a node in SEAD sends a routing update, node to determine if a claimed sequence number in
the node includes one hash value with each entry an update could be authentic before performing
in that update. If the node lists an entry for itself in the implied hashes to confirm that fact.
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 183

When a node receives a routing update, for each An alternative approach that does not require
entry in that update, the node checks the authen- time synchronization is to assume a shared secret
tication on that entry, using the destination ad- key among each pair of nodes, and to use the re-
dress, sequence number, and metric in the received spective key in conjunction with a Message Au-
entry, together with the latest prior authentic hash thentication Code. The sender would include one
value received by this node from that destinationÕs Message Authentication Code for each neighbor
hash chain. Based on the sequence number and with each routing update. Since SEAD includes
metric in the received entry and the sequence periodic neighbor sensing functionality, each node
number and metric of this latest prior authentic knows the set of neighbors for which it needs to
hash value for that destination, the node hashes authenticate routing updates. In particular, each
the hash value received in this entry the correct node trusts any zero-metric update with a valid
number of times, according to the description authenticator; if a node has received such an up-
above as to which hash value must be used for any date from another node for a recent sequence
given sequence number and metric, to confirm that number, it considers that node a neighbor and
the resulting value equals the prior authentic hash computes a Message Authentication Code for it in
value. If so, the entry is authentic and the node subsequent updates.
processes it in the routing algorithm as a normal When two nodes first become neighbors, one of
received routing update entry; otherwise, the node the two nodes will transmit a routing update first.
ignores the received entry and does not modify its That update will cause the receiving node to detect
routing table based on it. the new neighbor. As a result of hearing this up-
It may be possible for an attacker to modify date, the receiving node will send a triggered
routing update messages in transit, and such an routing update, allowing the other node to detect
attacker would be able to prevent certain routes the new neighbor.
from being advertised; however, such an attacker
would also be able to corrupt the entire routing 5.4. Preventing same-distance fraud
update, which is equivalent to a jamming attack.
The protocol can also be secured against modifi- In Section 5.2, we authenticate the metric and
cation of the source address for a routing update sequence number with a one-way hash chain. This
and against wormhole attacks, by use of other solution does not protect against same-distance
mechanisms at the MAC layer, including mecha- fraud: that is, a node receiving an advertisement
nisms that rely only on symmetric cryptography for sequence number s and distance (metric) d can
[38]. In particular, these MAC layer approaches re-advertise the same sequence number s and dis-
authenticate the transmitting source of a packet tance d. To defend against same-distance fraud, we
and ensure that this transmitting source is within designed hash tree chains, which have properties
some distance of the receiver. similar to hash chains but allow the detection of
same-distance fraud, when used in conjunction
5.3. Neighbour authentication with packet leashes [18] to prevent an adversary
from replaying a routing update in wireless net-
The source of each routing update message in works.
SEAD must also be authenticated, since otherwise, We prevent same-distance fraud by tying the
an attacker may be able to create routing loops. authenticator to the address of the node sending a
Any efficient broadcast authentication mechanism, route advertisement, thus preventing an attacker
such as TESLA [37], HORS [42], or TIK [38], can from replaying an authenticator that it hears from
be used to authenticate the neighbor. The draw- a neighbor. We construct a special one-way chain,
backs of these approaches are that they require which we call a hash tree chain, where each ele-
synchronized clocks, and that they incur either an ment of the chain encodes the node id, thus forcing
authentication delay or a relatively high commu- a node to increase the distance metric if it wants to
nication overhead. encode its own id. Each step in this one-way chain
184 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

contains a collection of values, one or more of the previous value of the one-way chain vi
1 ¼ b0n .
which are used to authenticate any particular Fig. 2 shows an example. The node with the id 1
node. This approach is similar to that used in the forwards the shaded values b00 , b1 , and b23 to the
HORS signature scheme [43]. These values are neighboring nodes, which can compute the one-
authenticated using a Merkle tree, and the root of way hash tree chain forward to verify the au-
that Merkle tree is used to generate the collection thenticity of values b00 , b1 , and b23 , and use the
of values in the next step. value b03 to sign their own id when forwarding
A hash tree chain is a hybrid between a hash the route update, thus automatically increasing
tree and a one-way chain. The one-way chain the distance metric.
property is used in the same way as in Section 5.2 We now present two examples of how the hash
(to enforce that nodes cannot decrease the distance tree chain can be used: when a single value corre-
metric), and the hash tree property is used to au- sponds to a node, and when a c-tuple of values
thenticate the node id. We construct the hash tree corresponds to a node. For notational and analytic
between each pair vi
1 ; vi of one-way chain values convenience, we describe hash tree chains for
as follows. From the value vi , we derive a set of which the number of values between each hash
values b0 ; . . . ; bn , using a one-way hash function H chain value is a power of two.
as bj ¼ H ½vi kj, for each j. We then build a hash In a small network, each value bj can corre-
tree above those values for authentication, as de- spond to a single node; since no two nodes share a
scribed in Section 3.2. The root of the tree becomes single value, an attacker has no way to derive its

Fig. 2. Authenticating one distance metric within a sequence of a hash tree chain. In this example, each element bi stands for one
router, so this hash tree chain supports four routers.
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 185

value from the advertisements of neighboring To allow nodes to authenticate these anchors
nodes, and hence it must follow the hash tree chain hk;s , each node builds a hash tree, using the hash
to the next step in order to provide a valid au- chain anchors as leaves (Section 3.2). When a node
thenticator. sends an update with a new sequence number s, it
In larger networks, with n nodes, the OðnÞ includes the root of the hash chain h0;s , the anchor
overhead of generating each step of the chain may of the hash chain hk;s , and the path to the root of
be too great; as a result, we authenticate each node the hash tree. To authenticate any update, the
with a c-tuple of values. Although no two nodes node verifies the anchor by following the path to
share the same c-tuple of values, an attacker could the root of the hash tree. It then verifies the hash
learn each of its c values from different neighbors value hm;s by verifying that hk;s ¼ H k
m ½hm;s . Since
that advertise the same metric, and could then the maximum hash chain length is k and the an-
forge an advertisement without increasing the chor verification requires OðlogðsÞÞ effort, where s
metric. We show that an attackerÕs probability of is the number of sequence numbers represented by
success may be sufficiently small. We also change any root, the computation required to verify any
the encoding of a node id for each update, so that update is bounded by k þ logðsÞ.
an attacker in a static network cannot continue to
forge updates once it finds an appropriate set of
values from its neighbors. Consider a hash tree 6. Evaluation
chain with 2m values in each step (and thus a hash
tree of height m þ 1). For example, if
eachnode 6.1. Security analysis
2m
has a unique node id between 0 and
1,
c Securing a distance vector protocol seems fun-
then the c-tuple encodes

m damentally harder than securing link-state or on-
2 demand protocols such as DSR [22]. Since distance
x ¼ ðnode id þ H ½sequence numberÞ mod
c vector protocols compress the route information
into a hop count value and a next hop, it is chal-
such that the c-tuple changes for each sequence lenging to verify the correctness of the hop count
number. value. In this section, we discuss some of the se-
curity properties of the SEAD protocol.
5.5. Bounding verification overhead Using SEAD, any attacker cannot create a valid
advertisement with larger (better) sequence num-
The overhead to verify authentication values ber that it received. Furthermore, for advertise-
can be large if a node has missed several routing ments sent using the largest received sequence
updates. In particular, an attacker can force a number, attackers that do not collude cannot ad-
victim node to verify a hash chain as long as OðksÞ, vertise a route shorter than the one it has heard.
where k is the maximum number of hops and s is For example, if the best metric m received by a
the maximum number of sequence numbers rep- node at the current sequence number s, the at-
resented by a hash chain. We can prevent this at- tacker cannot advertise a better metric than m.
tack by using a new hash chain for each sequence When hash tree chains are used (as described in
number. Section 5.4), SEAD achieves even stronger prop-
A node using this scheme generates a random erties:
hash chain root h0;s for each sequence number s,
for example by using a PRF F and a secret master • If each node corresponds to a single hash tree
key X to derive h0;s ¼ FðX; sÞ. Given the au- chain value ðc ¼ 1Þ, the attacker is forced to ad-
thentic anchor of this hash chain hk;s ¼ H k ½h0;s  vertise metric at best m þ 1.
(where k is the maximum metric), any node can • Otherwise, the attacker is forced to advertise met-
authenticate hm;s , which is the authenticator for ric at best m þ 1 with high probability, and other-
sequence number s and metric m. wise cannot advertise with metric better than m.
186 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

We now explore the probability of successful If each node using SEAD (including attackers)
metric replay using the hash tree chain scheme keeps routing tables where the next-hop for a given
when each node corresponds to a set of hash tree destination is set to the authenticated source ad-
chain values ðc 6¼ 1Þ. Let Ai be the set of combi- dress of the first advertisement received by that
nations of nodes that do not include value bi node containing the minimum metric for the
needed by the attacker. The attacker, then, has greatest sequence number, then the next-hop
j [ci¼1 Ai j ways to fail. We now apply the inclusion– pointers in all nodesÕ routing tables will describe a
exclusion principle: route back to the destination.
    With SEAD, no routing loop is possible, unless
[ c  X X \ c 
  cþ1   the loop contains one or more attackers. Fur-
 Ai  ¼ jAi j
jAi1 \ Ai2 j þ  þ ð
1Þ  Ai 
 i¼1  i i1 ;i2
 i¼1
 thermore, no loop is possible unless no non-
0
m 1 attacker node on the loop has received a better
X c
 2
i
iþ1 c @ A: advertisement (in terms of sequence number and
¼ ð
1Þ c
i metric) for this destination than the best adver-
i¼1 q
tisement received by some attacker on the loop.
Then the probability of a successful defense is If a collection of attackers form a vertex cut


2m
i  ! between two groups of nodes in the network [17],
Pc
iþ1 c
ð
1Þ c the attackers can arbitrarily control the routes
i¼1 i q

m ! : between any node in one group and a node in the
2 other group. Since in a vertex cut, any packet be-

1
c tween such nodes must physically pass through a
q node on the vertex cut, no routing protocol can
This probability can be quite high; for example, eliminate such attacks.
when m ¼ 6, c ¼ 3, and q ¼ 3 as before, an at-
tacker has a 1.675 · 10
3 probability of success; 6.2. Simulation evaluation methodology
when three consecutive advertisements are re-
quired for the same metric before a routing change To evaluate the performance impact of our se-
is made, the attacker succeeds once every 6.74 curity approach in SEAD without attackers, we
years. modified the DSDV-SQ implementation in our
An attacker that has not compromised any extensions to ns-2 [6]. Specifically, we increased the
node (and hence does not possess any crypto- size of each routing update to represent the au-
graphic keys from a node) cannot successfully send thentication hash value in each table entry. We
any routing messages, since an uncompromised also removed the settling time and the sequence
neighbor node will reject the messages due to the number changes, as described in Section 5.1. We
failed neighbor authentication. A repeater can did not simulate the mechanisms in Section 5.4
function as a one-node wormhole; this is not ad- because they provide minimal protection without
dressed by SEAD, though TIK [38] can prevent the use of packet leashes, and packet leashes pro-
this attack. vide no-cost packet authentication. Because we
A collection of a number of attackers that have wanted to determine the cost of SEAD without
compromised one or more nodes can only redirect significant additional assumptions, we simulated
the path from a source to a destination through pairwise shared key authentication. We also did
one or more attackers if the length of the best not simulate the mechanisms in Section 5.5, be-
(minimum metric) attacker-free route for which cause such precautions are not always necessary.
the source receives an advertisement is at least as For example, if nodes are loosely time synchro-
large as the number of nodes between the desti- nized, an upper bound on the maximum sequence
nation and the first attacker, plus the number of number can be easily determined. Alternatively,
nodes between the last attacker and the destina- intrusion detection techniques can be used to
tion. avoid the need to authenticate many bogus up-
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 187

dates. In particular, a node can check the neighbor We evaluated SEAD by comparing it to DSDV-
authentication very easily. If certain neighbors SQ, as described in Section 2. We measured per-
persist in sending updates with bogus metric au- formance along four metrics:
thenticators, those neighbors can be ignored, or
the verification of their updates can be relegated to • Packet delivery ratio. The total over all nodes of
a lower priority. the number of application-level packets re-
We chose the ns-2 simulator for this study be- ceived, divided by the total number of applica-
cause it realistically models arbitrary node mobility tion-level packets originated.
as well as physical radio propagation effects such as • Byte overhead. The total over all hops of the
signal strength, interference, capture effect, and number of overhead bytes transmitted.
wireless propagation delay. Our propagation model • Packet overhead. The total over all hops of the
is based on the two-ray ground reflection model [41]. number of overhead packets transmitted.
The simulator also includes an accurate model of • Median latency. The median packet delivery la-
the IEEE 802.11 Distributed Coordination Func- tency, where latency is calculated as the elapsed
tion (DCF) wireless MAC protocol [20]. time between the application layer passing a
In our simulations, nodes moved according to packet to the routing layer and that packet first
the random waypoint mobility model [22]. Each being received at the destination.
node is initially placed at a random location and
pauses for a period of time called the pause time; it 6.3. Simulation results
then chooses a new location at random and moves
there with a velocity randomly chosen uniformly The results of our performance study of SEAD
between 0 and the maximum speed vmax . When it are shown in Fig. 3 as a function of pause time in
arrives, it repeats the process of pausing and then the random waypoint mobility model. Each figure
selecting a new destination to which to move. The represents the average over 65 randomly generated
data communication pattern in our study uses 20 runs at each pause time, and the error bars show
source-destination pairs, each sending a Constant the 95% confidence intervals; the runs used for
Bit Rate (CBR) flow of 4 data packets/s. Each data SEAD and those for DSDV-SQ were identical. On
packet is 512 bytes in size. Table 1 details the pa- the right side of each graph (pause time 900), the
rameters used in our simulations. nodes are stationary, and on the left side of each
graph (pause time 0), the nodes are all in contin-
uous motion.
Table 1 The packet delivery ratios for SEAD and
Parameters for SEAD performance study
DSDV-SQ are shown in Fig. 3(a), and the median
Scenario parameters latency of delivered application-level packets for
Number of nodes 50
these simulations is shown in Fig. 3(b). Surpris-
Maximum velocity ðvmax Þ 20 m/s
Dimensions of space 1500 · 300 m2 ingly, SEAD consistently outperforms DSDV-SQ
Nominal radio range 250 m in terms of packet delivery ratio. By not using a
Source–destination pairs 20 weighted settling time delay in sending triggered
Source data rate (each) 4 packets/s updates in SEAD, the number of routing adver-
Application data payload size 512 bytes/packet
tisements sent by SEAD generally increases rela-
Total application data load 327 kilobytes/s
Raw physical link bandwidth 2 Megabytes/s tive to DSDV-SQ, allowing nodes to have more
up-to-date routing tables.
SEAD parameters
However, SEAD also increases overhead, both
Periodic route update interval 15 s
Periodic updates missed before 3 due to this increased number of routing adver-
link is declared broken tisements, and due to the increase in size of each
Maximum packets buffered 5 advertisement from the addition of the hash value
per node per destination on each entry for authentication. This increased
Hash length (q) 80 bits
overhead is shown in Fig. 3(c) and (d), which show
188 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

Fig. 3. SEAD performance evaluation results (average over 65 runs): (a) packet delivery ratio; (b) median latency; (c) packet overhead
and (d) byte overhead.

the number of routing overhead packets and the model. Although the initial node locations and the
number of routing overhead bytes, respectively, locations to which each node moves during the run
caused by the two protocols in these same simu- are uniformally chosen over the space, the straight
lations. The vertical scale in Fig. 3(c) is magnified line path of a node from one location to the next
to show the difference between the two protocols; tends to distribute nodes on average closer to the
the vertical scale here ranges only between 40 and center of the space; at higher pause times, nodes
46. spend most (or all) of the time in their initial
The increased overhead in SEAD causes some uniformally distributed locations. For example
congestion in the network in these simulations, as over the 65 simulation runs, the average route
shown in the latency results in Fig. 3(b). At all length used by SEAD at pause time 900 was about
pause times, SEAD exhibits higher latency than 28% longer than at pause time 0 (for DSDV-SQ,
DSDV-SQ, due to the decreased available network the average route length at pause time 900 was
capacity from the increased overhead in SEAD. about 33% longer than at pause time 0). This in-
The rise in latency at higher pause times is due to creased route length, together with SEADÕs in-
the nonuniform distribution of nodes in space creased overhead, created additional congestion at
caused by node motion in the random waypoint higher pause times in the simulations.
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 189

7. Related work technique for authenticating HELLO packets is to

verify that the incoming network interface is the
Kumar [25] discusses attacks against distance expected interface and that the IP TTL of the
vector routing protocols, and describes mecha- packet is 255. In a wireless network, this technique
nisms to secure them using Message Authentica- cannot be used. Heffernan [15] and Basagni et al.
tion Codes. Although these mechanisms ensure the [3] use shared keys to secure routing communica-
integrity of router-to-router communications, they tion, which is vulnerable to some single-node
do not withstand node compromise. In particular, compromises. Perrig et al. [39] use symmetric
they do not secure the metric in each routing table primitives to secure routing only between nodes
entry, and thus a compromised router could claim and a trusted base station.
routes of any length to any destination. As mentioned in Section 3, some researchers
Smith et al. [45] discuss attacks against distance have explored the establishment of trust relation-
vector routing protocols, and present counter- ships and authenticated keys in ad hoc networks
measures that provide security. However, their [17,19,39,46].
techniques do not apply well in an ad hoc network Marti et al. [29] consider the problem of de-
since they require knowledge of which links are tecting intermediate nodes that do not forward
possible, whereas in an ad hoc network, any pair packets. However, their scheme is limited to certain
of nodes could be within range and form a link. types of network Medium Access Control layers
Zapata [47] proposes SAODV, which uses a and may trigger false alarms in congested networks.
new one-way hash chain for each Route Discovery In other work, we have designed a secure on-
to secure the metric field in an RREQ packet. demand routing protocol for ad hoc networks,
ZapataÕs protocol differs in two ways. First, it uses called Ariadne [17]. The mechanisms we used for
a digital signature to authenticate the anchor of security in Ariadne are end-to-end in nature,
each such chain, which is significantly more ex- whereas our approach here for SEAD operates on
pensive than the use of a single hash chain (Section a hop-by-hop basis due to the basic operation of
5.1) or the use of Merkle hash trees (Section 5.2). distance vector routing. Furthermore, unlike Ari-
Second, SAODV operates on-demand, which re- adne, the techniques presented here do not rely on
sults in somewhat different assumptions in areas a Message Authentication Code to authenticate
such as neighbor authentication. routing table entries, but instead directly use ele-
A number of security protocols have been de- ments from a one-way hash chain to provide au-
signed for RIPv2 [2,28]. These protocols protect thentication for both the sequence number and the
the integrity of the packet from modification, but metric in each entry. An earlier version of SEAD
they do not prevent a node from advertising a appeared as [16].
route that does not actually exist.
Several researchers have proposed the use of
asymmetric cryptography to secure both wired and 8. Conclusions and future work
ad hoc network routing protocols [9,24,36,47,48].
However, when the nodes in an ad hoc network In this paper, we have presented the design and
are unable to verify asymmetric signatures quickly evaluation of SEAD, a new secure ad hoc network
enough, these protocols may not be suitable and routing protocol using distance vector routing.
may create Denial-of-Service attacks; these pro- Many previous routing protocols for ad hoc net-
tocols also generally require more network band- works have been based on distance vector ap-
width than does SEAD with its hash values. proaches (e.g., [5,10,12,23,31,34]), but they have
Cheung [7] and Hauser et al. [13] describe generally assumed a trusted environment. Instead,
symmetric-key approaches to the authentication of in designing SEAD, we carefully fit inexpensive
updates in link state protocols, but neither work cryptographic primitives to each part of the protocol
discusses the mechanisms for detecting the status functionality to create an efficient, practical proto-
of these links. In wired networks, a common col that is robust against multiple uncoordinated
190 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

attackers creating incorrect routing state in any References

other node, even in spite of active attackers or
compromised nodes in the network. Together with [1] N. Abramson, The ALOHA system––another alternative
for computer communications, in: Proceedings of the Fall
existing approaches for securing the physical layer
1970 AFIPS Computer Conference, November 1970, pp.
and MAC layer within the network protocol stack, 281–285.
the SEAD protocol provides a foundation for the [2] F. Baker, R. Atkinson, RIP-2 MD5 Authentication, RFC
secure operation of an ad hoc network. 2082, January 1997.
We base the design of SEAD in part on the [3] S. Basagni, K. Herrin, E. Rosti, D. Bruschi, Secure
Pebblenets, in: ACM International Symposium on Mobile
DSDV ad hoc network routing protocol [34], and
Ad Hoc Networking and Computing (MobiHoc 2001),
in particular, on the DSDV-SQ version of the Long Beach, CA, October 2001, pp. 156–163.
protocol, which has been shown to outperform [4] B. Bellur, R.G. Ogier, A reliable, efficient topology
other DSDV versions in previous detailed ad hoc broadcast protocol for dynamic networks, in: Proceedings
network simulations [6,21]. For security, we use ef- of the Eighteenth Annual Joint Conference of the IEEE
Computer and Communications Societies (INFO-
ficient one-way hash functions and do not use asym-
COMÕ99), March 1999, pp. 178–186.
metric cryptographic primitives. Consequently, [5] R.V. Boppana, S. Konduru, An adaptive distance vector
SEAD is efficient and can be used in networks of routing algorithm for mobile, ad hoc networks, in:
computation- and bandwidth-constrained nodes. Proceedings of the Twentieth Annual Joint Conference of
SEAD actually outperforms DSDV-SQ in terms of the IEEE Computer and Communications Societies (IN-
FOCOM 2001), 2001, pp. 1753–1762.
packet delivery ratio, although it does create more
[6] J. Broch, D.A. Maltz, D.B. Johnson, Y.-C. Hu, J.G.
overhead in the network, both due to an increased Jetcheva, A performance comparison of multi-hop wireless
number of routing advertisements it sends, and due ad hoc network routing protocols, in: Proceedings of the
to the increase in size of each advertisement due to Fourth Annual ACM/IEEE International Conference on
the addition of the hash value on each entry for Mobile Computing and Networking (MobiComÕ98),
October 1998, pp. 85–97.
authentication.
[7] S. Cheung, An efficient message authentication scheme for
In future work, we plan to also consider link state routing, in: 13th Annual Computer Security
mechanisms to detect and expose nodes that ad- Applications Conference, 1997.
vertise routes but do not forward packets, and to [8] T. Clausen, P. Jacquet, A. Laouiti, P. Minet, P. Muhle-
merge this work with our other work in securing thaler, A. Qayyum, L. Viennot, Optimized Link State
Routing Protocol, Internet-draft, draft-ietf-manet-olsr-
on-demand routing protocols to create a secure
05.txt, October 2001, Work in Progress.
protocol based on ZRP [12]. We are also consid- [9] K. Sanzgiri, B. Dahill, B.N. Levine, E. Royer, C. Shields, A
ering the possibility of extending DSDV to behave secure routing protocol for ad hoc networks, in: Proceed-
like a path-vector routing protocol, allowing the ings of the 10th IEEE International Conference on
source address of each advertisement to be more Network Protocols (ICNPÕ02), November 2002.
[10] J.J. Garcia-Luna-Aceves, C.L. Fullmer, E. Madruga, D.
readily authenticated.
Beyer, T. Frivold, Wireless Internet Gateways (WINGS),
in: Proceedings of IEEE MILCOM Õ97, November 1997,
pp. 1271–1276.
Acknowledgements [11] S. Goldwasser, M. Bellare, Summer course cryptography
and computer security at MIT, 1996–1999, in: Lecture
This work was supported in part by NSF under Notes on Cryptography, August 1999.
grant CCR-0209204, by NASA under grant [12] Z.J. Haas, A routing protocol for the reconfigurable
wireless network, in: 1997 IEEE 6th International Confer-
NAG3-2534, and by gifts from Schlumberger and ence on Universal Personal Communications Record:
Bosch. The views and conclusions contained here Bridging the Way to the 21st Century (ICUPC Õ97), vol.
are those of the authors and should not be inter- 2, October 1997, pp. 562–566.
preted as necessarily representing the official poli- [13] R. Hauser, A. Przygienda, G. Tsudik, Reducing the cost of
cies or endorsements, either express or implied, of security in link state routing, in: Symposium on Network
and Distributed Systems Security (NDSSÕ97), February
NSF, NASA, Schlumberger, Bosch, Rice Univer- 1997, pp. 93–99.
sity, Carnegie Mellon University, or the US Gov- [14] C. Hedrick, Routing Information Protocol, RFC 1058,
ernment or any of its agencies. November 1988.
 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192 191

[15] A. Heffernan, Protection of BGP sessions via the TCP [31] S. Murthy, J.J. Garcia-Luna-Aceves, An efficient routing
MD5 signature option, RFC 2385, August 1998. protocol for wireless networks, Mobile Networks and
[16] Y.-C. Hu, D.B. Johnson, A. Perrig, Secure efficient Applications 1 (2) (1996) 183–197.
distance vector routing in mobile wireless ad hoc networks, [32] National Institute of Standards and Technology (NIST),
in: Fourth IEEE Workshop on Mobile Computing Systems Secure hash standard, May 1993, Federal Information
and Applications (WMCSA Õ02), June 2002, pp. 3–13. Processing Standards (FIPS) Publication 180-1.
[17] Y.-C. Hu, A. Perrig, D.B. Johnson, Ariadne: A secure on- [33] V.D. Park, M.S. Corson, A highly adaptive distributed
demand routing protocol for wireless ad hoc networks, in: routing algorithm for mobile wireless networks, in: Pro-
Proceedings of the Eighth Annual International Confer- ceedings of INFOCOM Õ97, April 1997, pp. 1405–1413.
ence on Mobile Computing and Networking (MobiCom [34] C.E. Perkins, P. Bhagwat, Highly Dynamic Destination-
2002), September 2002, pp. 12–23. Sequenced Distance-Vector routing (DSDV) for mobile
[18] Y.-C. Hu, A. Perrig, D.B. Johnson, Packet leashes: a computers, in: Proceedings of the SIGCOMM Õ94 Confer-
defense against wormhole attacks in wireless ad hoc ence on Communications Architectures, Protocols and
networks, in: Proceedings of IEEE Infocomm 2003, April Applications, August 1994, pp. 234–244. Available <http://
2003. www.cs.umd.edu/projects/mcml/papers/Sigcomm94.ps> (a
[19] J.-P. Hubaux, L. Butty
an, S. C  apkun, The quest for revised version).
security in mobile ad hoc networks, in: Proceedings of the [35] C.E. Perkins, E.M. Royer, Ad-hoc On-demand Distance
Third ACM Symposium on Mobile Ad Hoc Networking Vector routing, in: Proceedings of the Second IEEE
and Computing (MobiHoc 2001), Long Beach, CA, Workshop on Mobile Computing Systems and Applica-
October 2001. tions (WMCSAÕ99), February 1999, pp. 90–100.
[20] IEEE Computer Society LAN MAN Standards Commit- [36] R. Perlman, Interconnections: Bridges and Routers, Ad-
tee, Wireless LAN Medium Access Control (MAC) and dison-Wesley, Reading, MA, 1992.
Physical Layer (PHY) specifications, IEEE Std 802.11- [37] A. Perrig, R. Canetti, D. Song, J.D. Tygar, Efficient and
1997, The Institute of Electrical and Electronics Engineers, secure source authentication for multicast, in: Network and
New York, 1997. Distributed System Security Symposium (NDSSÕ01), Feb-
[21] P. Johansson, T. Larsson, N. Hedman, B. Mielczarek, M. ruary 2001.
Degermark, Scenario-based performance analysis of rout- [38] A. Perrig, Y.-C. Hu, D.B. Johnson, Wormhole protection
ing protocols for mobile ad-hoc networks, in: Proceedings in wireless ad hoc networks, Technical Report TR01-384,
of the Fifth Annual ACM/IEEE International Conference Department of Computer Science, Rice University, De-
on Mobile Computing and Networking (MobiComÕ99), cember 2001.
August 1999, pp. 195–206. [39] A. Perrig, R. Szewczyk, V. Wen, D. Culler, J.D. Tygar,
[22] D.B. Johnson, D.A. Maltz, Dynamic source routing in SPINS: security protocols for sensor networks, in: Seventh
ad hoc wireless networks, in: T. Imielinski, H. Korth Annual ACM International Conference on Mobile Com-
(Eds.), Mobile Computing, Kluwer Academic Publishers, puting and Networks (MobiCom 2001), Rome, Italy, July
Dordrecht, 1996, pp. 153–181 (Chapter 5). 2001.
[23] J. Jubin, J.D. Tornow, The DARPA Packet Radio network [40] R.L. Pickholtz, D.L. Schilling, L.B. Milstein, Theory of
protocols, Proceedings of the IEEE 75 (1) (1987) 21–32. spread spectrum communications––a tutorial, IEEE Trans-
[24] S. Kent, C. Lynn, J. Mikkelson, K. Seo, Secure Border actions on Communications 30 (5) (1982) 855–884.
Gateway Protocol (S-BGP)––real world performance and [41] T.S. Rappaport, Wireless Communications: Principles and
deployment issues, in: Symposium on Network and Dis- Practice, Prentice-Hall, Englewood Cliffs, NJ, 1996.
tributed Systems Security (NDSSÕ00), February 2000, pp. [42] L. Reyzin, N. Reyzin, Better than BiBa: short one-time
103–116. signatures with fast signing and verifying, Cryptology
[25] B. Kumar, Integration of security in network routing ePrint Archive, Report 2002/014, 2002, Available <http://
protocols, SIGSAC Review 11 (2) (1993) 18–25. eprint.iacr.org/>.
[26] L. Lamport, Password authentication with insecure com- [43] L. Reyzin, N. Reyzin, Better than Biba short one-time
munication, Communications of the ACM 24 (11) (1981) signatures with fast signing and verifying, in: J. Seberry
770–772. (Ed.), Information Security and Privacy––7th Australasian
[27] G.S. Malkin, RIP version 2 protocol applicability state- Conference (ACSIP 2002), Lecture Notes in Computer
ment, RFC 1722, November 1994. Science, vol. 2384, Springer, Berlin, 2002.
[28] G.S. Malkin, RIP version 2, RFC 2453, November 1998. [44] R.L. Rivest, The MD5 message-digest algorithm, RFC
[29] S. Marti, T.J. Giuli, K. Lai, M. Baker, Mitigating routing 1321, April 1992.
misbehaviour in mobile ad hoc networks, in: Proceedings [45] B.R. Smith, S. Murthy, J.J. Garcia-Luna-Aceves, Securing
of the Sixth Annual International Conference on Mobile distance vector routing protocols, in: Symposium on
Computing and Networking (MobiCom 2000), Boston Network and Distributed Systems Security (NDSSÕ97),
MA, August 2000, pp. 255–265. February 1997.
[30] R. Merkle, Protocols for public key cryptosystems, in: 1980 [46] F. Stajano, R. Anderson, The resurrecting duckling secu-
IEEE Symposium on Security and Privacy, 1980. rity issues for ad-hoc wireless networks, in: B. Christianson,
192 Y.-C. Hu et al. / Ad Hoc Networks 1 (2003) 175–192

B. Crispo, M. Roe (Eds.), Security Protocols, 7th Interna- standards development body for the Internet, where he was one
tional Workshop, Springer, Berlin, 1999. of the main designers of the IETF Mobile IP protocol for IPv4
and is the primary designer of Mobile IP for IPv6. He is cur-
[47] M.G. Zapata, Secure Ad hoc On-demand Distance Vector rently serving as the General Chair for MobiCom 2003; he has
(SAODV) routing, IETF MANET Mailing list, Message- been a member of the Technical Program Committee for over
ID [email protected], Available <ftp:// 30 international conferences and workshops and has been an
manet.itd.nrl.navy.mil/pub/manet/2001-10.mail>, 8 Octo- editor for several journals. He is an Executive Committee
member and the Treasurer for SIGMOBILE, the ACM Special
ber 2001. Interest Group on Mobility of Systems, Users, Data, and
[48] L. Zhou, Z.J. Haas, Securing ad hoc networks, IEEE Computing, and is a member of the ACM, IEEE, IEEE
Network Magazine 13 (6) (1999). Computer Society, IEEE Communications Society, USENIX,
and Sigma Xi.
Yih-Chun Hu received his B.S. from
the University of Washington in 1997 Adrian Perrig is an Assistant Professor
and his Ph.D. from Carnegie Mellon in Electrical and Computer Engineer-
University in 2003. In his thesis work ing, and Engineering and Public Policy
at Carnegie Mellon, he focused on se- at Carnegie Mellon University. He
curity and performance in wireless earned his Ph.D. in Computer Science
ad hoc networks. Yih-ChunÕs research from Carnegie Mellon University in
interests include mobility and security 2001, and spent three years during his
in wired and wireless networks. He is Ph.D. with his advisor Doug Tygar at
currently a postdoctoral research fel- the University of California at Berke-
low at Rice University and is a mem- ley. He received his B.S. in Computer
ber of the ACM. Engineering from the Swiss Federal
Institute of Technology in Lausanne
(EPFL) in 1997. AdrianÕs research in-
David B. Johnson is an Associate Pro- terests revolve around building secure
fessor of Computer Science and Elec- systems and include network security, security for sensor net-
trical and Computer Engineering at works and mobile applications.
Rice University. Prior to joining the
faculty at Rice in 2000, he was an
Associate Professor of Computer Sci-
ence at Carnegie Mellon University,
where he had been on the faculty for
eight years. Professor Johnson is
leading the Monarch Project, devel-
oping adaptive networking protocols
and architectures to allow truly seam-
less wireless and mobile networking.
He has also been very active in the
Internet Engineering Task Force (IETF), the principal protocol