ΠCCAP Protocol: Proximity-Aware Key Agreement

• ΠCCAP Protocol is a proximity-bound, physical-layer key agreement method that utilizes Wi-Fi CSI phase measurements to generate cryptographically strong passphrases.
• It employs synchronized channel sounding and window-based quantization to extract unpredictable features from OFDM/MIMO transmissions, ensuring high entropy and resistance to attacks.
• The protocol enforces a strict 3-meter proximity, using BCH-based fuzzy extraction and PBKDF2 mapping to automatically create WPA2/WPA3-compliant credentials.

The ΠCCAP (Proximity-Aware Common Passphrase Agreement Protocol) is a Wi-Fi device provisioning protocol that employs physical layer security (PLS) to generate high-entropy, unguessable passphrases directly from reciprocal, random physical parameters observed between two nearby devices. Introduced in the ComPass system, ΠCCAP is designed to supplement WPA2/WPA3 personal mode, eliminate human-chosen passphrase weaknesses, and enforce a natural proximity bound for key agreement. The protocol utilizes channel state information (CSI), focusing on phase parameters rather than amplitude or received signal strength, and automatically creates cryptographically strong WPA2/WPA3-compliant passphrases without user interaction (Reaz et al., 2021).

1. Protocol Architecture and Workflow

ΠCCAP operates between two Wi-Fi devices (Station/Enrollee and Access Point/Authenticator) placed within 3 meters. The protocol supports discovery, credential generation, and device onboarding. The central mechanism is the extraction of reciprocal and unpredictable physical channel features from OFDM/MIMO transmissions using synchronous channel sounding and sanitized phase decomposition.

The protocol flow consists of these stages:

1. Discovery & Trigger: The Enrollee broadcasts identification and a nonce (e.g., via a re-purposed WPS button or boot event). The Authenticator confirms the request via a user interface.
2. Synchronous CSI Collection: Both devices synchronize clocks and conduct controlled channel sounding. The AP instructs the STA to send $N$ dummy packets after a specified delay, with both sides recording CSI per-packet within the channel coherence time $T_c$.
3. Channel Estimation & Phase Extraction: Each received packet is modeled as $y_k = H_k x_k + z_k$, with complex per-subcarrier channel response $H_k = |H_k| e^{j\phi_k}$. The raw phase per subcarrier is extracted as $\phi_k = \angle H'_k(f_k)$. CSI phase vectors are sanitized using the DAPPER algorithm via nonlinear least-squares fitting to:

$$\phi_k = \arctan\left(\epsilon_g \frac{\sin(2\pi f_s k \zeta + \epsilon_\theta)}{\cos(2\pi f_s k \zeta)}\right) - 2\pi f_s k \lambda + \beta$$

Only the gain-mismatch parameter $\{\epsilon_g\}$ is retained, provided the associated delay $\lambda$ is below a threshold $\lambda_0$.

1. Quantization (MOW): The mean round-trip time determines the moving window size $w$. The sequence $T_c$0 is partitioned into windows of size $T_c$1, with each value compared to its window mean:

$T_c$2

Both parties derive bitstrings $T_c$3 and $T_c$4.

1. Information Reconciliation: The protocol employs a BCH-based fuzzy extractor (PinSketch) over $T_c$5 ($T_c$6, $T_c$7). The STA transmits helper data $T_c$8 for the AP to correct mismatches and reconcile bits.
2. Passphrase Mapping: The reconciled bits are grouped in octets, mapped to printable UTF-8 code points, and transformed via PBKDF2 (per IEEE 802.11 PSK spec) to create the WPA2/WPA3 passphrase.
3. Network Join: The STA sends an association request with the passphrase hash. The AP verifies, repeats the process if needed, and admits the STA.

A compact protocol pseudocode summary:

$\phi_k = \angle H'_k(f_k)$5

Both parties follow a two-state machine progressing through discovery, sounding, quantization, reconciliation, mapping, and completion.

2. Mathematical Model and Signal Processing

ΠCCAP builds on a classical OFDM/MIMO wireline model:

$T_c$9

with $y_k = H_k x_k + z_k$0 comprising magnitude and phase. The central innovation is leveraging sanitized phase, not amplitude, as the extractable, reciprocal source of shared randomness robust to passive attack.

The sanitized phase model accounts for hardware nonidealities through the DAPPER model, which fits and subtracts channel- and hardware-dependent offsets, retaining the physical gain-mismatch $y_k = H_k x_k + z_k$1 as the randomness source. Differential phase is not explicitly used; instead, quantization directly targets $y_k = H_k x_k + z_k$2 under proximity constraint.

Quantization applies a window mean rule to discretize $y_k = H_k x_k + z_k$3 into binary sequences, which are then reconciled using BCH error correction. Helper data leakage is upper-bounded by $y_k = H_k x_k + z_k$4 bits, with empirical designs yielding $y_k = H_k x_k + z_k$5 bits (Reaz et al., 2021).

3. Entropy, Security Analysis, and Attacker Model

The protocol's security analysis centers on entropy and resistance to both passive and active adversaries.

• Shannon Entropy: Empirical measurements yield mean entropy of 34 bits for human-chosen passphrases, 113 bits for ΠCCAP-generated passphrases, and 168 bits for Apple Keychain. The ΠCCAP protocol thus provides over 3× the entropy of typical user-selected credentials.
• Guessing Effort: Analysis using zxcvbn summarizes minimal brute-force attempts needed:

Source	$y_k = H_k x_k + z_k$6 guesses
Human	≤ $y_k = H_k x_k + z_k$7
Machine	≈ $y_k = H_k x_k + z_k$8
ΠCCAP	$y_k = H_k x_k + z_k$9–$H_k = |H_k| e^{j\phi_k}$0

• Attacker Uncertainty: A passive eavesdropper (Eve) positioned within half-wavelength ($H_k = |H_k| e^{j\phi_k}$1) still obtains a CSI phase $H_k = |H_k| e^{j\phi_k}$2 uncorrelated to $H_k = |H_k| e^{j\phi_k}$3, so the mutual information $H_k = |H_k| e^{j\phi_k}$4. Experiments show the minimum brute-force effort for Eve is at least $H_k = |H_k| e^{j\phi_k}$5 guesses.

Replay attacks are rendered ineffective, as each protocol instance uses fresh nonces and synchronized timestamps. MITM is constrained by the protocol's discovery flow and hidden configuration of authenticators. The protocol assumes devices possess CSI-extraction capability, that channel coherence time $H_k = |H_k| e^{j\phi_k}$6 exceeds round-trip time, and that key agreement occurs within 3 m.

4. Proximity Binding and Physical Layer Authentication

A defining attribute of ΠCCAP is its in-built proximity enforcement, deriving from the spatial decorrelation of wireless channel phase. Empirical evaluation at various distances ({1, 3, 5, 10, 15} m) establishes that the post-reconciliation bit agreement rate is ≈100% for $H_k = |H_k| e^{j\phi_k}$7 m, but degrades rapidly as distance increases. Representative correlation values for the gain-mismatch parameter:

• $H_k = |H_k| e^{j\phi_k}$8 m: Correlation $H_k = |H_k| e^{j\phi_k}$9
• $\phi_k = \angle H'_k(f_k)$0 m: Correlation $\phi_k = \angle H'_k(f_k)$1
• $\phi_k = \angle H'_k(f_k)$2 m: Correlation $\phi_k = \angle H'_k(f_k)$3

This enforces a practical 3 m limit for secure physical pairing, as multipath decorrelation at greater ranges negates phase reciprocity required for key agreement (Reaz et al., 2021).

5. Implementation Details and Empirical Evaluation

ΠCCAP was implemented on TP-Link N750 v1.5/v1.6 routers (via patched ath10k driver) and Android 8.0+ phones using an OpenWrt kernel module (size 143 kb, ACT CSI-tool). The protocol operates over 802.11n (5 GHz, channel 40, bandwidth 20 MHz, MCS 16, 3×3 spatial streams), exchanging approximately 100–200 packets per run for CSI collection.

• Bit Extraction: Each CSI packet yields one bit post-MOW quantization. With 192 packets, a 128-bit key (16 UTF-8 codepoints) is generated.
• Timing: End-to-end protocol duration is ≈500 ms on commodity hardware.
• Robustness: Static indoor environments yield 100% bit agreement at ≤3 m; environments with moderate motion experience ≤5% reconciliation failures, correctable with BCH encoding $\phi_k = \angle H'_k(f_k)$4. Even with ±5 dB SNR degradation, bit agreement remains ≥95%.

6. Security Properties and Protocol Limitations

ΠCCAP maintains resistance to passive eavesdropping, since observed packets alone are insufficient to derive matching CSI phase parameters, preserving entropy. Replay attacks are precluded through nonce and timestamp dependencies, and MITM attacks are constrained by protocol design and out-of-band manual verification. The protocol’s primary constraints are requirements for compatible hardware with CSI extraction and operation within a 3 m proximity.

A plausible implication is that the protocol is not universal for all Wi-Fi chipsets, given current CSI access limitations. Its physical layer authentication property is natively enforced for device proximity—a security feature not present in manual passphrase entry or WPS/PBC scenarios.

---

ΠCCAP as instantiated in ComPass represents a physical-layer-derived protocol for automatic, proximity-bound passphrase agreement, offering high entropy, robustness, and usability in modern Wi-Fi onboarding (Reaz et al., 2021).