Physical Key Extraction in Galvanic Coupling Communications: Reliability and Security Analysis

Abstract

The evolution toward sixth-generation (6G) networks envisions humans as active nodes within a fully interconnected digital ecosystem, supported by data collected from in-body and on-body sensors. Since many of these devices are not equipped to connect directly to 6G networks, Wireless Body Area Networks (WBANs) serve as an essential intermediate layer. However, conventional radio-frequency technologies face limitations in terms of energy efficiency, security, and data integrity, motivating the adoption of lightweight security mechanisms. Physical Layer Security (PLS), and in particular Physical Key Extraction (PKE), offers a promising solution by enabling legitimate devices to derive shared cryptographic keys from the reciprocal properties of the communication channel. Galvanic coupling (GC) communication has recently emerged as an on-body transmission technology alternative to radio-frequency (RF), which exploits low-power electrical signals propagating through biological tissue. Building on prior feasibility studies, this work proposes a PKE framework tailored to GC channels, integrating a lightweight key reconciliation method, based on Hamming (7,4) error-correction codes, and evaluating system performance through dedicated reliability and security Key Performance Indicators (KPIs). Results reveal a trade-off shaped by electrode placement and channel quantization parameters. Among the ones tested, the optimal configuration is achieved with a 3 cm transverse inter-electrode spacing at both transmitter and receiver, and a 3 cm longitudinal separation between transmitter and receiver, by quantizing the channel impulse response with two quantization bits. While this work focuses on validating the method in controlled conditions in order to establish a reliable study framework, future developments will focus on enhanced reconciliation, privacy amplification, and analysis of the GC channel considering physiological and environmental variations.

1. Introduction

In the emerging paradigm of sixth-generation (6G) networks, humans are envisioned not merely as end-users of mobile connectivity, but as integral components within a pervasive and seamlessly interconnected digital environment [1,2,3]. Such a paradigm relies on a holistic representation of the human being, which is defined through the data acquired and transmitted by devices and sensors deployed inside or on the human body. As many in-body and on-body sensors lack the computational capabilities, energy resources, or physical space to support direct connectivity to 6G networks, an intermediate gateway layer, such as Wireless Body Area Networks (WBANs), is needed. However, traditional communication technologies implemented in WBANs, e.g., Bluetooth or other radio-frequency technologies, experience challenges with respect to energy efficiency, security, and data integrity [4,5,6]. Moreover, in- and on-body devices are often resource-constrained and unable to implement complex and computationally demanding security mechanisms, for example, the generation and exchange of cryptographic keys.

Physical Layer Security (PLS) represents a potential solution to this problem, providing lightweight security techniques suitable for low-resourced devices. PLS techniques exploit intrinsic properties of the communication medium, such as channel randomness, reciprocity, and spatial decorrelation, rather than relying on computationally intensive cryptographic techniques. This allows security to be achieved through signal processing operations that require minimal processing power, memory, and energy consumption. As a result, PLS schemes can be seamlessly integrated into low-resourced devices, offering an inherently lightweight and scalable alternative to traditional security solutions [7]. Within this paradigm, Physical Key Extraction (PKE) constitutes a fundamental mechanism, enabling legitimate devices to derive shared cryptographic keys directly from the physical properties of the communication channel. By exploiting channel reciprocity, PKE allows two on-body devices to independently generate identical keys, while an adversary located elsewhere is unable to correctly reproduce them [8].

Since the effectiveness of PKE is strongly influenced by the physical characteristics of the underlying communication channel, it is of primary interest to investigate novel transmission technologies, particularly when such channels exhibit intrinsic properties that may further enhance the feasibility and robustness of secure key generation.

Recently, galvanic coupling (GC) communications have been introduced as an alternative transmission technology to radio-frequency in the context of WBANs, enabling on-body communication through electrodes placed on the skin as well as intra-body communication via implanted electrodes [9,10]. In this work, only the on-body context is considered. GC also offers an inherent security advantage over RF technologies, since RF signals are broadcast in the surrounding environment, whereas GC signals remain largely confined within the body, reducing the risk of eavesdropping [11]. The electrodes are exploited to send information between in-body and on-body devices by transmitting low-power electrical signals that propagate through biological tissues. A compelling application of GC communications is the exploitation of the channel’s unique physical properties to enable a dedicated PKE method. Recent studies [11,12] have highlighted that the GC channel exhibits a high degree of temporal stability, characterized by slow variations over time. This property is crucial to ensure channel reciprocity and to guarantee that the channel response remains sufficiently invariant during the time interval required for key extraction.

Building on a feasibility study of key extraction from GC channels [13], which was limited to the generation of raw keys, this paper extends this investigation by proposing a complete key extraction framework that incorporates the reconciliation phase and provides an in-depth analysis of the reliability and security of the developed system.

1.1. State of the Art

In the current literature, several studies have investigated the exploitation of different physical and physiological properties of the human body to enable PKE methods. PKE methods found in the current literature exploit RF technologies. An authenticated secret key applied to BANs (ASK-BAN) was defined in [14]. ASK-BAN leverages the intrinsic randomness of the body channel to derive cryptographic keys, while integrating authentication mechanisms to strengthen security. Building on this approach, the movement-aided authenticated secret key BAN (MASK-BAN), developed in [15], incorporates a motion-assisted mechanism to further enhance key extraction efficiency. By exploiting movement-induced variations in the body channel, MASK-BAN increases the entropy of the generated keys and strengthens resilience against adversarial attacks. The authentication during the key extraction process was extended and emphasized in [16] to ensure robustness against eavesdropping and spoofing attacks.

An alternative approach to cryptographic key extraction, beyond the exploitation of channel characteristics, is the utilization of biometric data, which are measurable physiological or behavioral characteristics that can be used to uniquely identify or authenticate an individual. In this context, a method for deriving cryptographic keys from biometric body impedance measurements was introduced in [17]. This strategy leverages the distinctiveness of individual biometric signals to strengthen security while diminishing dependence on conventional cryptographic approaches.

Another significant research area in the context of PKE addresses the enhancement of key generation performance and efficiency. In [18], strategies to optimize secret key generation for on-body devices by minimizing latency and improving robustness were proposed. The study underlines the inherent trade-offs between security and computational efficiency in practical BAN deployments.

Finally, a major challenge in key generation, namely the reconciliation cost, which is particularly critical for resource-constrained devices, was tackled in [19]. Their approach improves the efficiency of key agreement protocols for body-worn health monitoring devices by reducing the overhead of key synchronization, thereby enhancing the practicality of the process in real-time applications.

Although existing approaches provide solid foundations, the exploitation of GC for key extraction remains largely unexplored. This research topic offers considerable potential for advancing security, reliability, and energy efficiency in body area networks and therefore in the context of modeling human body as a node of 6G networks.

1.2. Paper Contributions

The main contributions of this paper are summarized as follows:

• A novel PKE method for GC channels has been developed, building on preliminary feasibility studies conducted on experimental data in [13]. The proposed approach introduces a low-complexity reconciliation phase based on the Hamming (7,4) error-correction code, specifically selected to minimize computational overhead on energy-constrained WBAN nodes, enhancing the reliability by reducing possible mismatches in the keys extracted by legitimate devices;
• Security of the developed PKE method has been evaluated, considering three main attack models within the GC communication context: Direct Contact (DC), Over the Air (OTA) and Message Forgery (MF);
• A comprehensive analysis of system reliability and security has been performed through dedicated Key Performance Indicators (KPIs), enabling quantitative assessment under different operating conditions.

The remainder of this paper is organized as follows. Section 2 describes the implemented PKE method, together with the main attack models and the reliability and security KPIs. Section 3 presents the experimental campaign conducted to obtain the channel impulse responses (CIRs) used to extract the cryptographic keys. The results, measured with reliability and security KPIs, are reported in Section 4. Section 5 discusses the findings of this work, analyzing the trade-off between reliability and security of the implemented PKE method for GC communication systems. Finally, Section 6 concludes the paper.

2. Materials and Methods

The GC communication system considered in this work is shown in Figure 1 and consists of two legitimate devices, Alice and Bob, placed on the skin and communicating via GC technology. Each device is equipped with a pair of electrodes used to transmit and receive low-power electrical signals that carry data at frequencies ranging from 1 kHz to 100 MHz. The transmitting device applies a weak current to the biological tissue through its electrodes: the primary current flows directly between the transmitter’s electrodes, while a secondary weak current, carrying the information, is detected by the receiver’s electrodes [20]. GC devices emit currents on the order of 0.5 mA, which is within the 1 mA safety limit defined by the International Commission on Non-Ionizing Radiation Protection (ICNIRP) [20].

Figure 1. Galvanic Coupling system model for an on-body scenario. Two legitimate devices, Alice and Bob, are equipped with a pair of electrodes and communicate with low-power electrical signals propagating through the human skin.

The GC channel exhibits a subject-specific nature, meaning that it varies according to the individual’s physiological and anatomical features, such as the thickness of the tissues, and therefore it varies from person to person. These characteristics can be exploited by Alice and Bob to extract a cryptographic key. The extracted key depends both on the distance at which the electrodes are positioned on the subject’s skin and on the subject’s intrinsic channel characteristics. In the described system a third illegitimate device, Eve, is considered. Eve, in turn, tries to extract the same cryptographic key used by Alice and Bob.

The PKE procedure implemented for the described GC communication system is presented in Section 2.1. The potential attacks carried out by Eve are described in Section 2.2. Finally, Section 2.3 introduces the KPI used to evaluate the system’s performance, in terms of reliability and security.

2.1. Physical Key Extraction

The distribution of secret keys, used to encrypt the transmitted messages, between communicating nodes is a fundamental requirement for security in telecommunications. Traditional secret key distribution relies on a public key infrastructure (PKI) for key exchange, which involves the presence of a certification authority [21]. However, these mechanisms require a high computational complexity [8] so they are not suitable for the GC communication systems, which generally involve resource-constrained devices.

Physical Key Extraction (PKE) offers a lightweight, yet reliable and secure, solution to the described problem. The core idea is that Alice and Bob can exploit the reciprocity of the communication channel to independently extract a common key. With reference to Figure 2, a PKE procedure, in general, involves the following steps:

Figure 2. General PKE block scheme.

• Channel Probing —Alice and Bob send probing signals, which are exploited to estimate the channel’s parameters. These parameters are then used to define a first version of the key, called raw key, which has a length $L_{\mathrm{raw}}$.
• Information Reconciliation —Discrepancies in the reciprocity of the channel parameters may occur due to noise, interference and asymmetric equipment. These factors can lead to discrepancies between the raw keys extracted by Alice and Bob, which may not match perfectly. To address this problem, information reconciliation is applied. Alice and Bob implement an error-correction technique to derive a matching key. Information reconciliation is carried out by a public discussion conducted by Alice and Bob over the channel.
• Privacy Amplification —The exchange of reconciliation information enhances reliability but comes at the cost of reduced security, leading to possible information leakage towards Eve, who thereby gains partial knowledge of the extracted key. The privacy amplification step estimates the amount of information leaked and applies techniques, e.g., universal hashing functions, to ensure that the resulting key is statistically independent of the information available to Eve. After the privacy amplification step, Alice and Bob obtain a secure key of length $L_{\sec }$, with $L_{\sec }\le L_{\mathrm{rec}}$.

Although the security enhancement provided by the privacy amplification step is essential for the practical implementation of the system, the primary objective of this work is to assess the feasibility of the first two phases, namely channel probing and information reconciliation, of PKE applied to the context of GC communication systems. Once the optimal configuration for these fundamental steps has been established, future work will address the selection and evaluation of suitable hashing functions to integrate privacy amplification into the system. This work also aims to verify that the reconciled key length $L_{\mathrm{rec}}$ provides sufficient margin for applying standard hashing-based privacy amplification while still yielding final keys suitable for modern encryption schemes such as AES-256. The procedures adopted to accomplish channel probing and to perform information reconciliation are described in Section 2.1.1 and Section 2.1.2, respectively. The block diagram of the implemented key extraction process is represented in Figure 3.

Figure 3. GC PKE block scheme.

2.1.1. Galvanic Coupling Channel Estimation

The GC CIR has been used to represent individual features that can be used to extract a cryptographic key [12]. The CIR has been estimated through a correlative channel sounding technique: a pseudo-random noise (PN) sequence is exchanged between Alice and Bob, and the cross-correlation between it and the received signal is exploited to derive the CIR. Without loss of generality, let us focus on Bob’s side; thus, the received signal is expressed as:

$$y\left(t\right)=x\left(t\right)\ast h\left(t\right)+\eta \left(t\right),$$

(1)

where $x\left(t\right)$ is the PN sequence, $\eta \left(t\right)$ is the additive noise, $h\left(t\right)$ is the CIR and ∗ denotes the convolution operation. Correlating the received signal (1) with $x\left(t\right)$, the following expression is obtained:

$$R_{xy}\left(\tau \right)=h\left(\tau \right)\ast R_{xx}\left(\tau \right)+R_{x\eta }\left(\tau \right),$$

(2)

where $R_{xx}\left(\tau \right)$ is the autocorrelation function of $x\left(t\right)$, $R_{xy}\left(\tau \right)$ is the cross-correlation function of $x\left(t\right)$ and $y\left(t\right)$, $R_{x\eta }\left(\tau \right)$ is the cross-correlation function of $x\left(t\right)$ and $\eta \left(t\right)$ and $\tau$ is the time delay. Since $x\left(t\right)$ and $\eta \left(t\right)$ are assumed to be uncorrelated, it follows that $R_{x\eta }\left(\tau \right)=\mathbb{E}[x\left(t\right)\ast \eta (t-\tau )]=0$, where $\mathbb{E}[·]$ denotes the expectation operator. Assuming slow variations in time of the CIR, $h(t-\tau )$ may be expressed as $h\left(\tau \right)$. Equation (2) can be used to estimate $h\left(\tau \right)$ if $R_{xx}\left(\tau \right)$ can be approximated by a Dirac delta, as in this case where the transmitted signal $x\left(t\right)$ is given by PN sequences that show an autocorrelation function with a high correlation peak and much lower off-peak components [12]. Therefore:

$$R_{xy}\left(\tau \right)=h\left(\tau \right)\ast \underset{\delta \left(\tau \right)}{\underbrace{R_{xx}\left(\tau \right)}}+\underset{0}{\underbrace{R_{x\eta }\left(\tau \right)}}=h\left(\tau \right),$$

(3)

Hence, maximal-length PN sequences enable multipath component identification at the receiver through matched filtering with the original sequence [22]. In this work, a polynomial PN sequence of degree $m=14$, transmitted in baseband, was used to measure the CIR. The obtained CIR samples were quantized using $n_q$ quantization bits (see Figure 3). On the one hand, a higher $n_q$ leads to a longer secret key; on the other hand, it also makes the key extraction system more sensitive to noise and interference. To mitigate this issue, uncertainty intervals are introduced between the quantization levels. In this work, an uncertainty interval of $\pm 15\%$ of the quantization level is considered [13]. Quantized channel samples that fall within these uncertainty intervals are censored, i.e., Alice and Bob remove them from their respective channel estimate, as represented in Figure 3. Alice and Bob exchange information on censored channel samples, allowing each terminal to refine its own censored set by adding samples flagged as censored by the counterpart. Once the censoring phase is completed, the quantized channel samples are encoded with $n_q$ bits using Gray encoding to reduce errors caused by small quantization mismatches between Alice and Bob. The final length $L_{\mathrm{raw}}$ of the raw key depends on the number of quantization bits $n_q$ and from the amount of CIR samples discarded during the censoring phase.

In order to eliminate potential mismatch errors between the keys extracted by Alice and Bob, an information reconciliation based on the Hamming (7,4) error-correction code is applied to the raw keys, as described in the following section.

2.1.2. Information Reconciliation Exploiting Hamming (7,4) Code

The information reconciliation method applied in this paper is based on the Hamming (7,4) error-correction code [23]. The Hamming (7,4) code was selected as the reconciliation scheme due to its simplicity, well-established properties, and minimal computational footprint. Its lightweight nature makes it particularly suitable for the low-resourced devices typically employed in GC communication scenarios within WBAN environments [24]. Although alternative lightweight codes, such as BCH, can correct a larger number of errors, this improved capability comes at the cost of increased computational complexity [25,26]. For the purposes of this feasibility study, prioritizing a simple and low-overhead solution allows us to isolate the behavior of the GC-based PKE framework without introducing additional algorithmic burdens. More advanced and efficient codes will be considered in future works. Furthermore, a one-way reconciliation scheme was preferred over more sophisticated interactive protocols such as Cascade. While Cascade can achieve higher reconciliation efficiency, it requires multiple rounds of message exchange between legitimate devices, therefore, increasing protocol complexity. This interactivity also leads to longer key-generation times and higher computational requirements [27]. In contrast, the one-way approach adopted here ensures minimal overhead and aligns with the low-complexity design goals of GC-based PKE in WBAN contexts.

The standard array associated with the Hamming (7,4) linear block code, which reports all the $2^{n_w}$ possible codewords of length $n_w=7$ bits, is reported in Table 1. The first row of the standard array contains all the valid codewords $\mathbf{w}$ of the code. The i-th codeword of the code, ${\mathbf{w}}_i$, corresponding to the i-th message, ${\mathbf{m}}_i$, of length $n_m=4$ bits in the possible message set ($i=1,\dots ,2^{n_m}$), is obtained with the following expression:

$${\mathbf{w}}_i={\mathbf{m}}_i\mathbf{G},$$

(4)

where ${\mathbf{w}}_i$ is a vector of dimension $1\times n_w$, ${\mathbf{m}}_i$ is a vector of dimensions $n_m\times 1$, and $\mathbf{G}$ is the generator matrix of dimensions $n_m\times n_w$ of the code [23]. The first column of the standard array contains all the coset leaders, i.e., the most likely error patterns, which are vectors of dimension $1\times n_w$ with Hamming weight equal to 1. Moreover, the coset leaders represent the minimum-weight error patterns associated with each coset. All the other entries in each row of the standard array are obtained as the modulo-2 sum between the codewords and the coset leader associated with that row.

Table 1. Standard array of the Hamming $(7,4)$ code. In the first row, highlighted in light green, are reported the valid codewords of the code (${\mathbf{w}}_i$ with $i=1,\dots ,16$), while in the first column are reported the coset leaders, highlighted in color blue.

	${\mathbf{w}}_1$	${\mathbf{w}}_2$	${\mathbf{w}}_3$	${\mathbf{w}}_4$	${\mathbf{w}}_5$	${\mathbf{w}}_6$	${\mathbf{w}}_7$	${\mathbf{w}}_8$	${\mathbf{w}}_9$	${\mathbf{w}}_{10}$	${\mathbf{w}}_{11}$	${\mathbf{w}}_{12}$	${\mathbf{w}}_{13}$	${\mathbf{w}}_{14}$	${\mathbf{w}}_{15}$	${\mathbf{w}}_{16}$
Coset 0	0000000	0001111	0010110	0011001	0100101	0101010	0110011	0111100	1000011	1001100	1010101	1011010	1100110	1101001	1110000	1111111
Coset 1	1000000	1001111	1010110	1011001	1100101	1101010	1110011	1111100	0000011	0001100	0010101	0011010	0100110	0101001	0110000	0111111
Coset 2	0100000	0101111	0110110	0111001	0000101	0001010	0010011	0011100	1100011	1101100	1110101	1111010	1000110	1001001	1010000	1011111
Coset 3	0010000	0011111	0000110	0001001	0110101	0111010	0100011	0101100	1010011	1011100	1000101	1001010	1110110	1111001	1100000	1101111
Coset 4	0001000	0000111	0011110	0010001	0101101	0100010	0111011	0110100	1001011	1000100	1011101	1010010	1101110	1100001	1111000	1110111
Coset 5	0000100	0001011	0010010	0011101	0100001	0101110	0110111	0111000	1000111	1001000	1010001	1011110	1100010	1101101	1110100	1111011
Coset 6	0000010	0001101	0010100	0011011	0100111	0101000	0110001	0111110	1000001	1001110	1010111	1011000	1100100	1101011	1110010	1111101
Coset 7	0000001	0001110	0010117	0011000	0100100	0101011	0110010	0111101	1000010	1001101	1010100	1011011	1100111	1101000	1110001	1111110

Let us consider the raw key, of length $L_{\mathrm{raw}}$, produced as an output of the channel probing phase. As a first step to apply an information reconciliation method based on Hamming (7,4) [28], Alice and Bob resize their raw keys so that their length becomes:

$$L_{\mathrm{raw}}^{\prime }=n_{w}F,$$

(5)

where $F\in \mathbb{N}$ is the number of codewords. In particular, both Alice and Bob trim their raw keys by discarding the same number of bits in the same position at the beginning and at the end, so that the resulting length becomes a multiple of $n_w$. The trimmed keys are then divided into F key fragments of length equal to $n_w$. The reconciliation method implemented in this paper exploits the standard array associated with the Hamming (7,4) code to eliminate possible mismatches between Alice’s and Bob’s keys.

Without loss of generality, let Alice be the master node and Bob the slave node, i.e., Alice initiates the reconciliation process. For each of the F key fragments, Alice identifies the element in the standard array that has Hamming distance equal to 0 from the fragment and records both the index of the corresponding coset leader (which is the index of the standard array row) and the column index of the identified element. The index of the coset leader is then transmitted, through the GC channel, to Bob, who searches the row of the standard array associated with that index to find the element with the smallest Hamming distance from his own key fragment and then records its column index. Finally, both Alice and Bob replace their key fragment with the corresponding column index of the standard array. Since the column indexes are represented with 4 bits, the resulting reconciled keys have a length $L_{\mathrm{rec}}<L_{\mathrm{raw}}^{\prime }$.

Hamming (7,4) code can correct only a single error per codeword. Consequently, each pair of key fragments from Alice and Bob can be reconciled only if they differ by at most one bit. This occurs when the two corresponding key fragments, i.e., the codewords, from Alice and Bob fall within the same column of the standard array, which ensures that they differ in at most one bit.

With reference to Eve, the amount of information she possesses about the probing and reconciliation process depends on the type of attack she carries out, as described in the following section.

2.2. Main Attack Models

Eve can employ three main attack strategies, found in the current literature [11,29]:

• Direct Contact (DC)—As shown in Figure 4a, Eve, equipped with a single pair of electrodes located on the same body as Alice and Bob, but in a different position than the legitimate nodes, attempts to capture the galvanic signals exchanged between the legitimate nodes. Therefore, she is capable of overhearing the channel and receiving the PN sequence sent by Alice and using it to extract the CIR. Moreover, Eve also receives information on the censored CIR samples and on the reconciliation phase. Thus, she is capable of refining her CIR by censoring the same samples as Alice and Bob, and can access the coset leader indices publicly exchanged by the legitimate nodes during reconciliation, enabling her to attempt the reconciliation phase.
• Over the Air (OTA)—In this case, as represented in Figure 4b, Eve is equipped with two pairs of electrodes, one transmitting and the other receiving, both located on a different body than Alice and Bob. The legitimate devices carry out the key extraction procedure, exchanging the PN sequence as well as the censoring and reconciliation information through GC communication. Despite the conductive nature of GC transmission, the injected signal generates weak fringing electric fields outside the body that can be sensed at very short distances, enabling near-field eavesdropping. In [11] the authors experimentally assessed the presence of an over the air component of the GC signals, measured through adversary electrodes placed in proximity to the legitimate devices. Although they demonstrated that the bit error rate experienced by a potential eavesdropper is too high to enable correct signal decoding, they also showed that Eve can still receive a signal whose power remains above the noise floor. Consequently, in a worst-case scenario where Eve is equipped with appropriate hardware to detect and amplify the received signal, she is capable of correctly receiving the information publicly exchanged by Alice and Bob during the censoring and reconciliation phases. Therefore, Eve can eavesdrop, e.g., by exploiting an adequate patch antenna, on the information in censored CIR samples and reconciliation while being in proximity to the body hosting the legitimate nodes. To carry out an OTA attack, Eve exploits her two pairs of electrodes to exchange a PN sequence and extract the CIR of the body she is on. Then she leverages the eavesdropped information on censored CIR samples and on reconciliation to refine her CIR and to correct her raw key.
• Message Forgery (MF)—Let us consider a WBAN context in which the cryptographic key extracted from the GC channel is also used to authenticate messages sent from legitimate devices to an on-body hub node, which then forwards them to cloud or external networks. In this scenario, as shown in Figure 4c Eve is an adversarial device that is part of the same WBAN infrastructure but is worn on a different body than Alice and Bob. Eve attempts a Message Forgery attack by assigning her messages a cryptographic key that is as similar as possible to the one used by Alice and Bob. By doing so, she aims to have her forged messages recognized by the WBAN hub or by external networks as if they were transmitted from a legitimate device. Similarly to the OTA case, Eve uses two pairs of electrodes to exchange a PN sequence and extract the CIR of the body she is on. However, since Eve is not close to Alice and Bob, she is not capable of receiving any information on censored CIR samples and the reconciliation phase.

Figure 4. Eve attack schemes considered in this paper: (a) Direct Contact attack, (b) Over the Air attack, and (c) Message Forgery attack.

2.3. Physical Key Extraction KPI

The following KPIs have been used to measure the reliability performance of the GC PKE system:

• Key Hit Ratio (KHR)—The ratio of rounds in which Alice and Bob extract identical keys to the total number of rounds. It is expressed as

  $$\mathrm{KHR}={\displaystyle \frac{|K_M|}{N}},$$

  (6)

  where $K_M$ is the set of exact key matches, with $|·|$ indicating the cardinality of a set, and N is the total number of extracted keys.
• Key Disagreement Rate (KDR)—The fraction of differing bits between Alice’s and Bob’s keys, normalized by key length. It is expressed as:

  $$\mathrm{KDR}={\displaystyle \frac{\left|B\right|}{L}},$$

  (7)

  where B is the set of differing bits between Alice’s and Bob’s keys and L is the length of the key. The protocol ensures that Alice and Bob extract keys of identical length by exchanging information on censored CIR samples.
• Key Generation Ratio (KGR)—The ratio, expressed in bit/s, of the number of the extracted bits to the recording time $T_R$, i.e., the duration of the PN sequence, required to extract it. It is expressed as:

  $$\mathrm{KGR}={\displaystyle \frac{L}{T_R}}.$$

  (8)

The following KPIs have been used to measure the security performance of the GC PKE system:

• Key Similarity Score (KSS)—It is the degree of similarity between the keys extracted from two different channels. It is based on the Levenshtein Distance (D), which is defined as the minimum number of single-character edits (insertions, deletions, or substitutions) required to transform one string into another. Since D is a measure of dissimilarity, its complement to 1 is calculated as a measure of similarity. To ensure comparability across different key lengths, D was normalized by the length of the longer key ($L_{\max }$) of the compared pair. KSS measures the degree of similarity between two extracted keys; therefore, low values when comparing keys obtained from different channels indicate high key uniqueness. It is expressed as:

  $$\mathrm{KSS}=1-{\displaystyle \frac{D}{L_{\max }}}.$$

  (9)
• Eve Hit Ratio (EHR)—EHR is defined as the ratio of the exact key matches achieved by Alice and Bob to the ones achieved by Eve. It represents Eve’s efficiency in replicating the key shared by Alice and Bob. EHR was calculated considering that Eve extracts the same number N of keys as Alice and Bob. To avoid divisions of the type ${\displaystyle \frac{0}{0}}$ occurring when neither the legitimate devices nor Eve achieve any exact match, and divisions of the type ${\displaystyle \frac{|K_M|}{0}}$, occurring when the legitimate devices obtain $|K_M|$ exact matches while Eve achieves none, in this work, a bias was introduced by adding N to both the numerator and the denominator of the expression. Therefore $\mathrm{EHR}\in (0,2]$, where: $0<\mathrm{EHR}<1$ when Eve obtains more exact key matches with Alice than Bob, $\mathrm{EHR}=1$ when Eve and Bob have the same number of exact matches, $1<\mathrm{EHR}\le 2$ when Bob obtains more exact key matches with Alice than Eve. Since the value EHR = 1 may also occur in the specific situation where neither Bob nor Eve achieves any exact key match with Alice, this case is distinguished from the scenario in which they obtain the same non-zero number of exact matches by adding a superscript “∗” when EHR = 1 refers to this particular condition. EHR is expressed as:

  $$\mathrm{EHR}={\displaystyle \frac{|K_M| + N}{|K_E| + N}},$$

  (10)

  where $K_E$ is the set of exact matches between Alice’s and Eve’s extracted keys.

3. Experimental Campaign

Figure 5 shows the considered experimental setup consisting of two PCs operating as transmitter and receiver, and two pairs of disposable pre-gelled Ag/AgCl electrodes (PG10C FIAB) placed on the skin of the inner forearm of a human subject, which are used to transmit and receive the signals. Signal transmission and acquisition were performed through the sound cards of the two PCs, which were connected to the transmitting and receiving electrode pairs via the LINE OUT and LINE IN jacks, respectively. The PN sequence had a duration of $0.68$ s and was generated using MATLAB R2024b.

Figure 5. Experimental setup comprising two PCs acting as transmitter and receiver via their sound cards, connected to pairs of Ag/AgCl electrodes placed on the skin of the inner forearm of a human subject.

After reception, a 50 Hz Notch filter was used to eliminate power line interference, and a convolutional matched filter was used to correlate the channel output with the known PN sequence for CIR estimation. The transmitted and received signals were sampled at 48 kHz and quantized with 16 bits. The two PCs were battery-operated to prevent a shared ground return path. The electrodes were positioned following two parameters: the longitudinal distance $d_l$ between TX and RX electrode pairs, and transverse distance $d_t$ within each pair, as shown in Figure 6. In particular, the following five electrode setups were considered for each subject:

Figure 6. Electrode setup scheme.

• $d_l=3,5,10$ cm, with $d_t=3$ cm;
• $d_l=5,10$ cm with $d_t=5$ cm.

Furthermore, the receiving electrodes were placed 3 cm from the wrist. For each of the five electrode setups, the PN sequence was transmitted and received five times in a row. Figure 7 shows one of the PN sequences received with longitudinal distance between TX and RX electrodes $d_l=3$ cm and transverse distance within each pair $d_t=3$ cm. In the following, the aforementioned electrode setups and the subjects will be referred to by an index c ($c=1,\dots ,5$) and ($s=1,\dots ,8$), respectively. The electrode setups will be associated with the indexes as shown in Table 2:

Figure 7. Example of a PN sequence received through the experimental setup with $d_l=3$ cm and $d_t=3$ cm. The signal amplitude was automatically normalized by Matlab after reception.

Table 2. The electrode setups and their associated indexes.

c	Electrode Setup
1	$(d_l=3$ cm; $d_t=3$ cm)
2	$(d_l=5$ cm; $d_t=3$ cm)
3	$(d_l=10$ cm; $d_t=3$ cm)
4	$(d_l=3$ cm; $d_t=5$ cm)
5	$(d_l=10$ cm; $d_t=5$ cm)

Experimental Data Analysis

The measurement data obtained with the described experiments were post-processed in MATLAB to simulate system performance in key extraction from GC communication channels. This section describes how the experimental data were used to compute the reliability and security KPIs described in Section 2.3.

For each subject s and electrode setup c, five PN sequences were transmitted and received, defining a set of five distinct CIR estimates. To maximize the statistical significance of the limited dataset through a combinatorial data augmentation approach, these five CIRs were recombined in order to define a set $\mathbf{H}$ of ten unique Alice–Bob pairs. It is important to emphasize that, although this approach allows us to extend a limited dataset, the potential introduction of statistical dependence among the generated pairs may lead to an optimistic bias in the reported results. The set $\mathbf{H}$ is defined as:

$$\mathbf{H}={\left\{({\mathbf{h}}_i,{\mathbf{h}}_j)\right\}}_{1\le i<j\le 5}$$

(11)

where ${\mathbf{h}}_i$ is the CIR estimated by Alice and ${\mathbf{h}}_j$ is the CIR estimated by Bob. After the censoring and quantization phase, each Alice–Bob pair extracts from its respective CIR a raw key $\tilde{\mathbf{k}}$. This can be expressed as:

$$({\mathbf{h}}_i,{\mathbf{h}}_j)\stackrel{\mathrm{Quantization}\&\mathrm{Censoring}}{\to }({\tilde{\mathbf{k}}}_p^{\left(A\right)},{\tilde{\mathbf{k}}}_p^{\left(B\right)}),$$

(12)

where, for a given subject s and electrode setup c, p is the index of the raw key extracted by Alice and Bob, with $p=1,\dots ,10$. After the reconciliation process, each couple of raw keys $({\tilde{\mathbf{k}}}_p^{\left(A\right)},{\tilde{\mathbf{k}}}_p^{\left(B\right)})$ extracted by Alice and Bob becomes a couple of reconciled keys:

$$({\tilde{\mathbf{k}}}_p^{\left(A\right)},{\tilde{\mathbf{k}}}_p^{\left(B\right)})\stackrel{\mathrm{Reconciliation}}{\to }({\mathbf{k}}_p^{\left(A\right)},{\mathbf{k}}_p^{\left(B\right)})$$

(13)

The reliability and security KPIs were computed for both raw and reconciled key pairs. Since the expressions introduced in the following for the KPIs are identical for both raw key and reconciled key, a unified formulation valid for both cases is provided, without explicitly distinguishing between the raw and reconciled instances.

KHR was computed using (6) for each subject s and each electrode setup c:

$$\mathrm{KHR}={\displaystyle \frac{|K_M|}{N}},$$

(14)

where $N=10$ is the number of extracted keys, $K_M$ is the set of exact key matches between Alice and Bob with $|·|$. $K_M$ is defined as:

$$K_M={\left\{{\mathbf{k}}_p^{\left(A\right)}={\mathbf{k}}_p^{\left(B\right)}\right\}}_{p=1,\dots ,10}.$$

(15)

KDR was computed using (7), given a subject s and an electrode setup c, for every extracted key couple p:

$${\mathrm{KDR}}_p={\displaystyle \frac{|B_p|}{L_p}},$$

(16)

where $L_p$ is the length of the p-th key, which is equal for Alice and Bob ($L_p^{\left(A\right)}=L_p^{\left(B\right)}=L_p$), and $B_p$ is the set of differing bits between the keys extracted by Alice and Bob:

$$B_p={\left\{{\mathbf{k}}_p^{\left(A\right)}\left(b\right)\ne {\mathbf{k}}_p^{\left(B\right)}\left(b\right)\right\}}_{b=1,\dots ,L_p}.$$

(17)

where ${\mathbf{k}}_p^{\left(A\right)}\left(b\right)$ and ${\mathbf{k}}_p^{\left(B\right)}\left(b\right)$ are the b-th bit of the p-th key extracted by Alice and Bob, respectively. Finally, for each electrode setup c, KHR and KDR were averaged among all subjects:

$$\overline{\mathrm{KHR}}\left(c\right)=\underset{s}{avg}\mathrm{KHR}(s,c)$$

(18)

and:

$$\overline{\mathrm{KDR}}\left(c\right)=\underset{s}{avg}\underset{p}{avg}{\mathrm{KDR}}_p(s,c)$$

(19)

with $s=1,\dots ,8$, and $p=1,\dots ,10$.

KGR was computed with (8) considering $T_R=0.68$ s, which is the duration of the PN sequence used to probe and estimate the channel. The key length was obtained by averaging the lengths $L_p$ of all keys extracted for each subject s and for each electrode setup c:

$$\overline{L}=\underset{p,s,c}{avg}{L}_p(s,c),$$

(20)

Therefore, KGR is expressed as:

$$\mathrm{KGR}={\displaystyle \frac{\overline{L}}{T_R}}.$$

(21)

Concerning security, the three attack schemes described in Section 2.2 were analyzed. In general, for each Alice–Bob pair p defined for each subject s and electrode configuration c, a set ${\mathbf{H}}^{\left(E\right)}$ can be defined for each Eve located in a subject $s_E$ ($s_E=1,\dots ,8)$ with an electrode configuration $c_E$ ($c_E=1,\dots ,5$), where:

• $s_E=s$ and $c_E\ne c$ in the case of a DC attack, since Eve is on the same subject as Alice and Bob;
• $s_E\ne s$ in the case of an OTA or MF attack, since Eve is on a different subject than Alice and Bob.

In general, the set ${\mathbf{H}}^{\left(E\right)}$ is defined as:

$${\mathbf{H}}^{\left(E\right)}={\left\{\mathbf{H}\left(p\right),{\mathbf{h}}_p^{\left(E\right)}\right\}}_{p=1,\dots ,10}$$

(22)

where $\mathbf{H}\left(p\right)=\left({\mathbf{h}}_i,{\mathbf{h}}_j\right)$. In the cases of DC and OTA attacks, Eve overhears from Alice and Bob the information about censoring, while in the case of an MF attack she derives it autonomously. After the censoring phase, Eve uses her CIR to extract a raw key ${\tilde{\mathbf{k}}}^{\left(E\right)}$:

$${\mathbf{h}}_p^{\left(E\right)}\stackrel{\mathrm{Quantization}\&\mathrm{Censoring}}{\to }{\tilde{\mathbf{k}}}_p^{\left(E\right)}.$$

(23)

To attempt reconciliation, similarly to the censoring phase, in the cases of DC and OTA attacks, Eve overhears the information about reconciliation from Alice and Bob, while in the case of an MF attack she derives it autonomously. After reconciliation, Eve obtains a reconciled key ${\mathbf{k}}^{\left(E\right)}$:

$${\tilde{\mathbf{k}}}_p^{\left(E\right)}\stackrel{\mathrm{Reconciliation}}{\to }{\mathbf{k}}_p^{\left(E\right)}.$$

(24)

Security performance for the DC an OTA attacks have been evaluated in terms of EHR, which is computed with (10). Therefore, for a given Alice and Bob on a subject s with an electrode setup c and for each Eve placed on the subject $s_E$ and with an electrode setup $c_E$, the EHR is expressed as:

$$\mathrm{EHR}={\displaystyle \frac{|K_M| + N}{|K_E| + N}}$$

(25)

where $K_M$ is defined as in (15) and $K_E$ is the set of exact key matches between Eve and Alice, and is expressed as:

$$K_E={\left\{{\mathbf{k}}_p^{\left(E\right)}={\mathbf{k}}_p^{\left(A\right)}\right\}}_{p=1,\dots ,10}$$

(26)

Finally, for each electrode setup c and subject s, EHR was averaged among all $c_E$ in the case of a DC attack and among all $s_E$ and all $c_E$ in the case of an OTA attack. Then, the resulting values, for each electrode configuration c, were averaged among all subjects s. Therefore, the average EHR for DC is expressed as:

$${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)=\underset{s,c_E}{avg}{\mathrm{EHR}}_{\mathrm{DC}}(s,c,c_E),$$

(27)

while for the OTA attack, it is expressed as:

$${\overline{\mathrm{EHR}}}_{\mathrm{OTA}}\left(c\right)=\underset{s,s_E,c_E}{avg}{\mathrm{EHR}}_{\mathrm{OTA}}(s,c,s_E,c_E).$$

(28)

Security performance for the MF attack is evaluated in terms of KSS rather than EHR, in order to quantify the degree of risk associated with the MF attack, which depends on the similarity between the keys extracted from different subjects, i.e., different bodies. KSS was computed with (9) given an s, c, $s_E$ and $c_E$, for every couple of Alice–Eve keys:

$${\mathrm{KSS}}_p=1-{\displaystyle \frac{D({\mathbf{k}}_p^{\left(A\right)},{\mathbf{k}}_p^{\left(E\right)})}{\max (L_p^{\left(A\right)},L_p^{\left(E\right)})}},$$

(29)

where $D({\mathbf{k}}_p^{\left(A\right)},{\mathbf{k}}_p^{\left(E\right)})$ is the Levenshtein distance between ${\mathbf{k}}_p\left(A\right)$ and ${\mathbf{k}}_p^{\left(E\right)}$, $L_p^{\left(A\right)}$ and $L_p^{\left(E\right)}$ are the lengths of the p-th key extracted by Alice and Eve, respectively. Finally, ${\mathrm{KSS}}_p$ was averaged among all the key couples and the resulting values were averaged among all s, c, $s_E$ and $c_E$:

$$\overline{\mathrm{KSS}}\left(c\right)=\underset{s,s_E,c_E}{avg}\underset{p}{avg}{\mathrm{KSS}}_p(s,c,s_E,c_E)$$

(30)

4. Numerical Results

This section presents the results obtained with the implemented GC PKE system. The KPIs presented in this section were computed for both the raw and the reconciled keys by quantizing all the estimated CIRs using different amounts of $n_q$ quantization bits. In particular, the analysis considered $n_q=1,2,3$. The reliability and security analysis are reported in Section 4.1 and Section 4.2, respectively.

4.1. Reliability Analysis

4.1.1. KHR Results

Table 3 reports the values of $\overline{\mathrm{KHR}}\left(c\right)$ obtained for raw and reconciled keys. A higher value of $\overline{\mathrm{KHR}}\left(c\right)$ implies that on average Alice and Bob achieve a higher number of exact raw or reconciled key matches. The obtained results show that the performance in terms of average $\overline{\mathrm{KHR}}\left(c\right)$ is strongly dependent on both the quantization bit resolution and the transverse ($d_t$) and longitudinal ($d_l$) spacing between the electrodes. In particular, the results show that as the number of quantization bits increases, the percentage of exact key matches between Alice and Bob rapidly decreases, especially for raw keys. This behavior is due to the fact that a higher $n_q$ makes the system more sensitive to the discrepancies between the CIRs of Alice and Bob, which in turn leads to mismatched keys, as confirmed by the $\overline{\mathrm{KDR}}\left(c\right)$ results shown in Table 4.

Table 3. Reliability performance analysis: $\overline{\mathrm{KHR}}$ values (%) for raw and reconciled keys with 1, 2, and 3 bits of quantization.

Electrode Setup c	Raw $\overline{\mathbf{KHR}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}	Reconciled $\overline{\mathbf{KHR}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}
$1(d_l=3$ cm; $d_t=3$ cm)	{95.00%;  41.25%;  1.25%}	{100%;  91.25%;  17.50%}
$2(d_l=5$ cm; $d_t=3$ cm)	{43.75%;  0%;  0%}	{92.50%;  26.25%;  0%}
$3(d_l=10$ cm; $d_t=3$ cm)	{2.50%;  0%;  0%}	{16.25%;  0%;  0%}
$4(d_l=3$ cm; $d_t=5$ cm)	{91.25%;  11.25%;  0%}	{100%;  82.25%;  0%}
$5(d_l=10$ cm; $d_t=5$ cm)	{0%;  0%;  0%}	{15.00%;  0%;  0%}

Table 4. Reliability performance analysis: $\overline{\mathrm{KDR}}\left(c\right)$ values (%) for raw and reconciled keys. $n_q=1,2,3$ quantization bits for CIR estimation have been considered.

Electrode Setup c	Raw $\overline{\mathbf{KDR}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}	Reconciled $\overline{\mathbf{KDR}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}
$1(d_l=3$ cm; $d_t=3$ cm)	{0.01%;  0.31%;  2.56%}	{0%;  0.04%;  1.83%}
$2(d_l=5$ cm; $d_t=3$ cm)	{0.41%;  3.25%;  12.36%}	{0.08%;  1.37%;  11.77%}
$3(d_l=10$ cm; $d_t=3$ cm)	{4.47%;  17.83%;  26.70%}	{3.35%;  18.33%;  31.35%}
$4(d_l=3$ cm; $d_t=5$ cm)	{0.02%;  0.75%;  5.42%}	{0%;  0.1%;  4.10%}
$5(d_l=10$ cm; $d_t=5$ cm)	{3.50%;  12.74%;  23.05%}	{2.09%;  11.80%;  26.56%}

Concerning electrode setups, the results indicate that increasing the distance leads to a reduction in the $\overline{\mathrm{KHR}}\left(c\right)$ values. Notably, electrode setups 3 and 5 exhibit the worst performance. This degradation can be attributed to the lower Signal-to-Noise Ratio (SNR) given by larger distances between electrodes, which introduces greater errors in the CIR estimation due to noise.

Results also show that the information reconciliation method introduced in this paper brings a general increase in the number of exact key matches between Alice and Bob. However, such improvements are limited in scenarios where the electrode setup conditions produce irreparably different keys that cannot be corrected during reconciliation.

4.1.2. KDR Results

Table 4 presents the values of $\overline{\mathrm{KDR}}\left(c\right)$ obtained for raw and reconciled keys. A higher value of $\overline{\mathrm{KDR}}\left(c\right)$ implies that the raw or reconciled keys extracted by Alice–Bob couples present a larger amount of differing bits. Although the results obtained with $\overline{\mathrm{KDR}}\left(c\right)$ appear to be largely comparable to those achieved with KHR in terms of overall performance as a function of electrode setups, the analysis of $\overline{\mathrm{KDR}}$ provides further insight into the behavior and effectiveness of the reconciliation algorithm based on the Hamming (7,4) code.

More specifically, the performance of the reconciliation method implemented in this paper is intrinsically dependent on $\overline{\mathrm{KDR}}\left(c\right)$. A higher $\overline{\mathrm{KDR}}\left(c\right)$ for raw keys indicates a larger number of bit discrepancies between Alice and Bob for each extracted key, thereby increasing the likelihood that the Hamming (7,4) codewords, in which the respective raw keys are divided, differ by more than a single bit. In such cases, the error-correcting capability of the Hamming (7,4) code is exceeded, and the discrepancies between Alice’s and Bob’s raw keys cannot be reconciled.

The results reported in Table 4 indicate how reconciliation based on Hamming (7,4) is capable of significantly improving overall performance. This improvement is reflected in the reduction observed between $\overline{\mathrm{KDR}}\left(c\right)$ obtained for raw and reconciled keys (and consequently an increase between $\overline{\mathrm{KHR}}\left(c\right)$ for raw and reconciled keys, as shown in Table 3) as long as the $\overline{\mathrm{KDR}}\left(c\right)$ of the raw keys remains below the threshold of approximately 1%.

4.1.3. KGR Results

Table 5 summarizes the obtained KGR values and the average key lengths $\overline{L}$ for the raw and reconciled keys, computed by considering the effective key size after the censoring and encoding phases, both performed during the channel probing step, and therefore accounting for the reduction due to the discarded uncertain samples during censoring. A higher value of KGR implies that the PKE system is capable of generating longer keys with respect to the recording time required to extract them from the channel. The results indicate that the key length is directly dependent on $n_q$. Specifically, the average length of the raw key increases from 440 bits when $n_q=1$ to 849 bits when $n_q=3$. An analogous trend is observed for the reconciled key, which grows from 251 bits at $n_q=1$ to 485 bits at $n_q=3$. These results highlight the strong correlation between the quantization resolution and the achievable key length, confirming that higher values of $n_q$ lead to a more substantial expansion of both raw and reconciled keys. Consequently, KGR also increases as $n_q$ rises.

Table 5. Key Generation Rate (KGR) and average key lengths for raw and reconciled keys.

Quantization Bits	Raw KGR [bit/s]	Raw $\overline{\mathit{L}}$ [bits]	Reconciled KGR [bit/s]	Reconciled $\overline{\mathit{L}}$ [bits]
1	644	440	367	251
2	1007	668	575	393
3	1243	849	710	485

Another interesting aspect to consider is the cost of the reconciliation process in terms of key length. As described in Section 2, reconciliation reduces the length of the generated key by a factor of $7/4$, meaning that the final reconciled key is almost halved compared to the raw key. This reduction has practical consequences for the usability of the keys in cryptographic applications. For instance, the reconciled key obtained with $n_q=1$ has an average length of 251 bits, which is sufficient to implement, e.g., an AES-128 encryption scheme, which requires key of 128 bits to encrypt 128-bit data blocks [30]. However, it is not adequate for the more advanced and secure AES-256 encryption scheme, which requires keys of 256 bits.

4.2. Security Analysis

4.2.1. Direct Contact Attack

Table 6 shows the results of ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)$ for the raw and reconciled keys. Values of $1<{\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)\le 2$ imply that Alice–Bob pairs with electrode setup c obtain more exact raw or reconciled key matches than Alice–Eve couples, considering Eve is placed on the same subject and with every other electrode setup $c_E$.

Table 6. Security performance analysis in the case of a Direct Contact attack: $\overline{\mathrm{EHR}}\left(c\right)$ values for raw and reconciled keys with 1, 2, and 3 bits of quantization, considering an OTA attack. Superscript “∗” indicates that the value ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(\mathbf{c}\right)=1$ results from both Bob and Eve having zero exact matches with Eve.

Electrode Setup c	Raw ${\overline{\mathbf{EHR}}}_{\mathbf{DC}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}	Reconciled ${\overline{\mathbf{EHR}}}_{\mathbf{DC}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}
$1(d_l=3$ cm; $d_t=3$ cm)	{1.70;  1.40;  1.01}	{1.45;  1.64;  1.17}
$2(d_l=5$ cm; $d_t=3$ cm)	{1.28;  1.00 *;  1.00 *}	{1.37;  1.11;  1.00 *}
$3(d_l=10$ cm; $d_t=3$ cm)	{1.03;  1.00 *;  1.00 *}	{1.16;  1.00 *;  1.00 *}
$4(d_l=3$ cm; $d_t=5$ cm)	{1.63;  1.10;  1.00 *}	{1.45;  1.55;  1.00 *}
$5(d_l=10$ cm; $d_t=5$ cm)	{1.00 *;  1.00 *;  1.00 *}	{1.09;  1.00 *;  1.00 *}

The results highlight a degradation of the ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)$ as the distance between Alice and Bob increases. This deterioration can be attributed to two concurrent factors. First, a larger separation between the electrodes of Alice and Bob reduces the SNR, leading to discrepancies in the extracted keys. Second, increasing the distance between Alice and Bob allows Eve to position herself closer to Alice compared to Bob, thereby obtaining a CIR estimate that is more accurate and less affected by noise. It is also important to note that, in any case, increasing both the distance between the electrodes or $n_q$, in particular with $n_q=3$ and $c=2,3,5$, drives the exact raw and reconciled key matches of Alice and Bob as well as those of Eve towards zero. This results in the various instances of ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)=1$ reported in Table 6 for both raw and reconciled keys. In fact, these values do not imply that Eve achieves parity with Alice and Bob in a functional PKE scenario. Instead, they correspond to operating conditions where the strict quantization requirements ($n_q=3$ bits) or low SNR lead to a near-zero KHR for both the legitimate receiver and the eavesdropper ($|K_M|=0$ and $|K_E|=0$). In these cases, ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)$ converges to 1 due to the regularization term N introduced in (10), representing a system outage rather than a successful attack. This interpretation is consistent with the behavior previously observed for $\overline{\mathrm{KHR}}\left(c\right)$ (see Table 3).

Furthermore, these findings emphasize that the implemented reconciliation method generally improves ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)$. This improvement arises because reconciliation increases the number of exact matches between Alice and Bob, while the matches obtained by Eve either decrease or remain constant. The only exception occurs when $n_q=1$, for which the electrode setups $c=1$ and $c=4$ lead to a deterioration of the ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)$ after accomplishing reconciliation. This behavior is explained by the fact that with $c=1$, Eve can have $c_E=1$, and vice versa. With $n_q=1$ the CIR estimated with these electrode setups are very similar, leading to a degradation in ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)$ performance.

4.2.2. Message Forgery Attack

Table 7 reports the obtained values of $\overline{\mathrm{KSS}}\left(c\right)$ obtained for the raw and reconciled keys. A higher value of $\overline{\mathrm{KSS}}\left(c\right)$ denotes a higher similarity between the raw and reconciled keys extracted by Alice and Bob on a given subject, and the ones extracted by Eve on every other subject.

Table 7. Security performance analysis in the case of a Message Forgery attack: $\overline{\mathrm{KSS}}\left(c\right)$ values for raw and reconciled keys considering different electrodes setups, with 1, 2, and 3 bits of quantization.

Electrode Setup c	$\overline{\mathbf{KSS}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}	$\overline{\mathbf{KSS}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}
$1(d_l=3$ cm;$d_t=3$ cm)	{96%;  90%;  83%}	{92%;  85%;  80%}
$2(d_l=5$ cm; $d_t=3$ cm)	{94%;  86%;  79%}	{93%;  84%;  76%}
$3(d_l=10$ cm; $d_t=3$ cm)	{90%;  77%;  75%}	{90%;  76%;  72%}
$4(d_l=3$ cm; $d_t=5$ cm)	{96%; 88%;  82%}	{92%;  85%;  79%}
$5(d_l=10$ cm; $d_t=5$ cm)	{93%;  82%;  76%}	{93%;  81%;  72%}

The data presented in the table clearly indicate that $\overline{\mathrm{KSS}}\left(c\right)$ is primarily influenced by the distance between Alice’s and Bob’s electrodes, with an even stronger dependence on $n_q$. In particular, when quantization is performed with a single bit, the similarity between the generated keys consistently exceeds 90%. Therefore, in scenarios where the electrodes are positioned in close proximity, the vulnerability to an MF attack becomes significantly pronounced, affecting both raw and reconciled keys.

The results suggest that the reconciliation method introduced in this work generally mitigates the risk of an MF attack, leading to a reduction in $\overline{\mathrm{KSS}}\left(c\right)$ and thereby improving the robustness of the system.

4.2.3. Over the Air Attack

Table 8 reports the values of ${\overline{\mathrm{EHR}}}_{\mathrm{OTA}}\left(c\right)$ obtained from raw and reconciled keys. Similarly to ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}$, $1<{\overline{\mathrm{EHR}}}_{\mathrm{OTA}}\left(c\right)\le 2$ implies that Alice–Bob pairs with electrode setup c achieve on average, a higher number of raw or reconciled key matches than Eve, considering that Eve is positioned on every other subject $s_E$ and with every other electrode setup $c_E$.

Table 8. Security performance analysis in the case of an OTA attack: ${\overline{\mathrm{EHR}}}_{\mathrm{OTA}}$ values for raw and reconciled keys with 1, 2, and 3 bits of quantization.Superscript “∗” indicates that the value ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(\mathbf{c}\right)=1$ results from both Bob and Eve having zero exact matches with Eve.

Electrode Setup c	Raw ${\overline{\mathbf{EHR}}}_{\mathbf{OTA}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}	Reconciled ${\overline{\mathbf{EHR}}}_{\mathbf{OTA}}\left(\mathbf{c}\right)$ {${\mathit{n}}_{\mathit{q}}=1$ bit;  ${\mathit{n}}_{\mathit{q}}=2$ bits;  ${\mathit{n}}_{\mathit{q}}=3$ bits}
$1(d_l=3$ cm;$d_t=3$ cm)	{1.66;  1.40;  1.01}	{1.40;  1.62;  1.16}
2 ($d_l=5$ cm; $d_t=3$ cm)	{1.37;  1.00 *;  1.00 *}	{1.35;  1.19;  1.00 *}
$3(d_l=10$ cm; $d_t=3$ cm)	{1.02; 1.00 *;  1.00 *}	{1.14;  1.00 *;  1.00 *}
$4(d_l=3$ cm; $d_t=5$ cm)	{1.66;  1.11;  1.00 *}	{1.38;  1.58;  1.00 *}
$5(d_l=10$ cm; $d_t=5$ cm)	{1.00 *;  1.00 *;  1.00 *}	{1.07;  1.00 *;  1.00 *}

The results reported in Table 8 exhibit a trend analogous to those presented in Table 6 for ${\overline{\mathrm{EHR}}}_{\mathrm{DC}}\left(c\right)$ and can therefore be interpreted in a substantially similar manner. However, this observation introduces a critical factor: the data reveal that Eve is able to achieve comparable performance, with the current channel estimation and reconciliation method, whether positioned on the same body or across different bodies. At the same time, results in Table 8 emphasize once again that Eve’s performance is tightly linked both to $n_q$ and to the effectiveness of the reconciliation process. This implies that increasing $n_q$ and adopting more complex and reliable error-correction schemes than Hamming (7,4) could effectively mitigate both OTA and DC attacks and at the same time improve system reliability.

In summary, the numerical results reveal a critical dependency on quantization depth: $n_q=1$ offers reliability but fails in security (high MF risk), while $n_q=3$ fails in reliability due to SNR limits. This directs the focus towards intermediate configurations, as discussed in the following section.

5. Discussion

The results obtained in this study highlight a tradeoff between reliability and security for GC PKE. On the one hand, reducing the distance between Alice’s and Bob’s electrodes and lowering the number of quantization bits $n_q$ leads to optimal outcomes in terms of reliability, as the probability of achieving an exact key match between Alice and Bob increases under these conditions. On the other hand, such configurations drastically reduce the overall security of the system, since Eve is facilitated in estimating the CIR and thereby obtaining exact matches of her keys. In particular, $n_q=1$ results in keys extracted from different bodies becoming overly similar (high KSS), thereby exposing the system to MF attacks. Yet, the analysis reveals that 3-bit quantization is impractical due to the physical SNR limits of the GC channel, which lead to frequent key generation outages (near-zero KHR). Therefore, the optimal configuration will be achieved by balancing these constraints.

Our findings indicate that, among all the configurations evaluated in this study, the combination of $n_q=2$ and setup $c=1$ for Alice and Bob yields the most favorable trade-off between reliability and security. Under these conditions, considering the reconciled keys, the system achieved $\overline{\mathrm{KHR}}\left(1\right)=91.25\%$ with an associated $\overline{\mathrm{KDR}}\left(1\right)=0.04\%$. With $n_q=2$, the average length of the reconciled keys is $\overline{L}=393$ bits, enough to provide a sufficient margin to implement privacy amplification protocols and to implement an AES-256 encryption scheme. This encryption scheme is more advanced and secure than the standard AES-128; therefore, it is more suitable to protect the highly sensitive health-related data exchanged through GC communications in a WBAN context. Furthermore, these results suggest that the proposed configuration may provide sufficient margin to tolerate the key-length reduction introduced by standard hashing functions used for privacy amplification, while still enabling the usage of AES-256 encryption. Concerning security, with $n_q=2$ and $c=1$, the system shows a quite good resistance against OTA and DC attacks since $\overline{\mathrm{EHR}}\left(1\right)=1.64$ and $\overline{\mathrm{EHR}}\left(1\right)=1.62$, indicating that the Alice–Bob pairs retain on average a clear advantage over Eve in terms of exact reconciled key matches. A quite critical aspect is the achieved $\overline{\mathrm{KSS}}\left(1\right)=85\%$, which denotes a level of key similarity that cannot be regarded as negligible and, in fact, suggests a non-trivial exposure to MF attacks. Therefore, future works should prioritize mitigating this risk by increasing $n_q$ to further reduce inter-subject similarity. Nevertheless, it should also be noted that this value still corresponds to an average 15% mismatch between the keys generated from different subjects with the same electrode configuration. Considering that even a single bit discrepancy between a legitimate and forged key may enable the on-body WBAN hub to detect an MF attempt and subsequently discard Eve’s messages, this residual distance still provides a meaningful operational safeguard. Moreover, Eve would be required to exert considerable effort, such as deploying suitable machine-learning techniques, to compensate for the missing information on Alice’s or Bob’s keys.

In any case, to further enhance both the security and reliability of the system, it is necessary to overcome the limitations of reconciliation based on Hamming (7,4) and to introduce an appropriate privacy amplification method, in order to minimize the information leakage about the key to Eve. Moreover, it would also be useful to increase both the distance between Alice’s and Bob’s electrodes and the number of quantization bits $n_q$, enhancing both security and reliability.

6. Conclusions

In this paper, a PKE system specifically designed for the context of GC communications has been presented. The performance of the proposed system, in terms of both reliability and security, has been analyzed through the implementation of dedicated KPIs. The results highlight a clear trade-off between reliability and security, mainly influenced by the electrode setup, namely, the distance between electrodes, and by the number of bits used to quantize the CIR estimated from the GC channel. Nevertheless, considering the adopted CIR estimation and reconciliation methods, the study has identified the configuration that provides the most effective compromise between reliability and security. This optimal setup consists of positioning the electrodes of the legitimate devices at a transverse and longitudinal distance of 3 cm and of quantizing the CIR with 2 bits.

Future work should address the limitations of the current reconciliation approach based on the Hamming (7,4) error-correction code by adopting more robust yet computationally efficient schemes, together with a proper privacy amplification method to further enhance system security. In addition, the time-variance properties of the GC CIR and their impact on the implemented PKE method should be thoroughly evaluated. While this exploratory study focused on static conditions and specific skin areas to establish a performance baseline, the intrinsic variability of the GC channel remains a critical factor. Future research should therefore assess system robustness under dynamic conditions, such as body movement or varying physiological states (e.g., sweating or skin hydration), where channel noise may exceed the single-bit correction capability of the Hamming (7,4) code, thus requiring more advanced reconciliation strategies to maintain reliability.

Another important aspect to be addressed in future work is the collection of a larger dataset, which could better support the generality of the obtained results while fully eliminating any potential statistical dependence introduced by the use of a combinatorial approach to data augmentation.