--- title: Channel Reciprocity Attack (CRACK) Overview url: https://www.emergentmind.com/topics/channel-reciprocity-attack-crack type: topic --- # Channel Reciprocity Attack (CRACK) Overview Searching arXiv for recent and foundational papers on channel reciprocity attacks, RIS-based reciprocity attacks, and countermeasures. arxiv_search(query="channel reciprocity attack physical layer key generation RIS attack reciprocity arXiv", max_results=10, sort_by="relevance") arxiv_search(query="CRACK channel reciprocity attack TDD RIS physical-layer key generation", max_results=10, sort_by="relevance") arxiv_search("channel reciprocity attack TDD RIS physical-layer key generation", 10) Channel Reciprocity Attack (CRACK) denotes a class of physical-layer attacks that target the reciprocity assumption used by time-division duplex wireless systems. In one branch of the literature, CRACK exploits reciprocity together with channel coherence across adjacent probing rounds to bias or predict secret-key bits in channel-reciprocity-based key generation. In another, it deliberately breaks reciprocity during uplink and downlink probing or precoding, so that two legitimate nodes no longer observe sufficiently correlated channels, or a base station uses a downlink precoder matched to the wrong channel. The term is therefore best understood as a generic label for attacks that weaponize reciprocity itself, rather than as the name of a single protocol or hardware platform [2106.02731][2309.11665]. ## 1. Reciprocity as an attack surface In narrowband TDD key generation, reciprocity means that within the channel coherence time the baseband channel responses satisfy \[ h_{ab}(t) \approx h_{ba}(t), \] so that Alice and Bob can extract highly correlated scalar measurements such as RSS or CSI amplitude from the same probing round. In reciprocity-based downlink precoding, the same principle appears in matrix form: the base station estimates an uplink channel and assumes that the downlink channel is its transpose. Both uses convert a propagation symmetry into an algorithmic dependency. Once that dependency is explicit, it becomes attackable [2106.02731][2309.11665]. The literature distinguishes two main CRACK mechanisms. The first preserves reciprocity locally while exploiting temporal stability across rounds. This is the logic of man-in-the-middle key-injection attacks: the attacker first observes a favorable channel state and then uses reactive jamming and packet injection before the channel changes. The second introduces a non-reciprocal or direction-dependent component during probing or data transmission. RIS-assisted manipulating attacks, RIS-jamming, and non-diagonal or nonreciprocal intelligent surfaces belong to this second family. In both cases, the attacker does not need to defeat the physics of reciprocity outright; it is enough to redirect, desynchronize, or structurally distort the channel observations on which the protocol depends [2108.05497][2303.07015]. A recurring misconception is that reciprocity is only a source of common randomness or beamforming gain. The CRACK literature shows the opposite: reciprocity and coherence are also exploitable control surfaces. In key generation, they can let an adversary learn or imprint bits. In multi-antenna TDD systems, they can turn an apparently valid uplink estimate into a misleading surrogate for the actual downlink channel [2106.02731][2309.11665]. ## 2. Man-in-the-middle CRACK in physical-layer key generation The canonical active CRACK against RSS-based key generation is the Eberz-style man-in-the-middle model formalized in "Man-in-the-Middle Attack Resistant Secret Key Generation via Channel Randomization" [2106.02731]. Mallory overhears Alice’s and Bob’s probes, can inject packets with arbitrary timing and power, and can reactively jam a legitimate probe on the fly. Her objective is not full impersonation but biasing and learning key bits. The attack is a wait-then-attack procedure. During probing round \(i\), Mallory measures \(\text{RSS}_m^a(i)\) and \(\text{RSS}_m^b(i)\) and declares an opportunity when the two are sufficiently similar and already lie beyond the quantization thresholds. In the refined form, \[ O_0:\ |\text{RSS}_m^a-\text{RSS}_m^b|q_+,\ \text{RSS}_m^b>q_+. \] An \(O_0\) event is used to inject a \(0\) in the next round, and an \(O_1\) event to inject a \(1\) [2106.02731]. In round \(i+1\), Mallory jams Alice’s probe to Bob and immediately transmits her own, so Bob measures \(\text{RSS}_b^m(i+1)\) instead of \(\text{RSS}_b^a(i+1)\); she repeats the same operation in the reverse direction so that Alice measures \(\text{RSS}_a^m(i+1)\). The attack works because the channel is assumed coherent across rounds \(i\) and \(i+1\), and reciprocal within each direction pair. Consequently, \[ \text{RSS}_a^m(i+1)\approx \text{RSS}_m^a(i),\qquad \text{RSS}_b^m(i+1)\approx \text{RSS}_m^b(i), \] so the previous-round observation predicts the next-round quantized bit. The paper formalizes the per-bit success probabilities as \[ p_0=\mathbb{P}\big(\text{RSS}_a^m(i)q_+,\ \text{RSS}_b^m(i)>q_+ \mid O_1 \text{ at } i-1\big). \] Without a defense, \(p_0\approx p_1\approx 1\) in many environments, leading to key recovery efficiency close to \(100\%\) [2106.02731]. The same paper adopts the Eberz metrics of key recovery efficiency, \[ KRE=\frac{m}{n}, \] and key recovery rate, \[ KRR=\frac{m}{\ell}, \] where \(m\) is the number of correctly recovered attacked bits, \(n\) the number of opportunities, and \(\ell\) the final key length. In its baseline omnidirectional-antennna simulations, every attacked bit is recovered: for \(d=2\), \(KRE=100\%\) and \(KRR=14.84\%\); for \(d=3\), \(KRE=100\%\) and \(KRR=19.46\%\). These figures make explicit that CRACK is not a marginal leakage effect but a mechanism for targeted key recovery under otherwise standard probing assumptions [2106.02731]. ## 3. Channel randomization with reconfigurable antennas The principal countermeasure developed against this MitM CRACK is per-round channel randomization with a reconfigurable antenna. Alice is equipped with a reconfigurable antenna whose mode \(u_j\) changes the gain pattern \(g(u_j,\theta_l)\), yielding the mode-dependent channel model \[ h(u_j,t_i)=\sum_{l=0}^{P} g(u_j,\theta_l)\, a_l(t_i). \] Alice selects \(u_i\in U\) independently and uniformly at random at the beginning of each probing round, keeps the mode fixed for the duration of that round, and changes it again at the next round [2106.02731]. This design preserves reciprocity where the legitimate protocol needs it and destroys predictability where the attacker needs it. Because the mode is fixed within a probing round, Alice and Bob still measure the same A–B channel realization. Because the mode changes independently across rounds, the Mallory–Alice channel is decorrelated over time even when the physical environment remains static. Proposition 1 in the paper states that under i.i.d. uniform mode selection, Mallory’s per-bit success probabilities reduce to the marginal probabilities \[ p_0=\mathbb{P}(\text{RSS}_a^m(i)q_+), \] so they no longer depend on the previous opportunity round. The attacker’s previous observation ceases to be predictive [2106.02731]. The protocol, termed RAKG, keeps reconciliation and verification unchanged and modifies only probing and quantization. Because antenna-mode changes make long excursions rare, the excursion length is set to \(e=1\). The defense is therefore not a cryptographic wrapper around the old protocol; it is a restructuring of the common-randomness source itself. The performance results are explicit. In simulation, Mallory’s estimated bit-success parameters under RAKG are \(p_0=0.53\), \(p_1=0.32\) in Monte Carlo evaluation, and \(p_0=0.65\), \(p_1=0.37\) in one topology used for the full-key analysis. For \(d=2\), RAKG yields opportunities in \(6.66\%\) of rounds, a key length of \(36{,}200{,}668\), \(KRE=41.78\%\), and \(KRR=3.04\%\); for \(d=3\), opportunities rise to \(9.57\%\), but \(KRE\) remains \(42.21\%\) and \(KRR\) only \(4.41\%\). The paper further argues that under these parameters the probability of recovering the entire key becomes worse than pure random guessing [2106.02731]. The experimental results are equally important because they show that channel randomization can improve both security and functionality in static settings. In a static indoor same-room experiment, the omnidirectional baseline is effectively unusable: bit mismatch fraction \(0.4717\), secret bit rate essentially zero. Under RAKG, the bit mismatch drops to \(0.2117\), approximate entropy is \(0.4914\), and secret bit rate reaches \(0.3909\) bits/sample. In a lab experiment with human activity, RAKG reduces KRR to \(4.75\text{–}6.94\%\), compared with \(33.55\text{–}42.58\%\) under the omnidirectional scheme. In a different-rooms experiment, RAKG yields KRR \(3.70\text{–}5.54\%\), versus \(20.28\text{–}22.89\%\) without randomization. These measurements show that the defense does not merely blunt Mallory’s prediction advantage; it can also restore usable key extraction where hardware non-reciprocity and static channels would otherwise dominate [2106.02731]. ## 4. RIS-enabled CRACK against OFDM key generation A second major CRACK line replaces direct signal injection with environmental manipulation. In "On the RIS Manipulating Attack and Its Countermeasures in Physical-layer Key Generation" [2108.05497], Eve controls an RIS and assigns one reflection vector \(\boldsymbol{\Theta}_b\) during the uplink probing direction and another, \(\boldsymbol{\Theta}_a\), during the downlink direction. Alice and Bob then estimate \[ \widehat{\mathbf H}_b = \mathbf H_d + \mathbf H_r \boldsymbol{\Theta}_b + \tilde{\mathbf N}_b, \qquad \widehat{\mathbf H}_a = \mathbf H_d + \mathbf H_r \boldsymbol{\Theta}_a + \tilde{\mathbf N}_a. \] The direct path \(\mathbf H_d\) remains reciprocal, but the RIS-induced term is intentionally non-reciprocal, so the correlation between Alice’s and Bob’s CFR estimates is reduced. On each subcarrier, \[ \rho_\ell=\frac{\sigma_{d,\ell}^2}{\sigma_{d,\ell}^2+\xi_\ell+\sigma_{n,\ell}^2}, \] where \(\xi_\ell\) is the RIS-path variance. The RIS term increases the denominator without contributing to the cross-correlation term; as \(\xi_\ell\to\infty\), \(\rho_\ell\to 0\) [2108.05497]. The impact is quantified by the attacked-path power ratio \(\gamma\). With one quantization bit per CFR coefficient and \(\gamma=0.17\), the bit disagreement rate tends to about \(0.27\) at high SNR. The paper cites \(0.11\) as a maximum tolerable BDR for practical reconciliation; above that threshold, reconciliation fails and the key generation rate is effectively zero. The proposed countermeasure transforms CFR to CIR, identifies the attacked tap by a multi-probe slewing-rate test across \(Q=16\) rounds, discards the attacked path, and applies path-wise flexible quantization to the remaining reciprocal taps. At \(23.04\) MHz bandwidth, where the RIS path is resolvable, the mitigated KGR is reported as about \(35\) bits/channel use, close to the unattacked case; at \(7.68\) MHz, one legitimate path shares the attacked delay bin, so post-mitigation KGR is lower [2108.05497]. "RIS-Jamming: Breaking Key Consistency in Channel Reciprocity-based Key Generation" generalizes the same idea to RIS-based breaking of key agreement consistency [2303.07015]. The attack is implemented in three ways: active nonreciprocal circuits, asynchronous time-varying controls, and SNR reduction. The common mechanism is that the RIS-induced path differs between forward and reverse directions, so Alice’s and Bob’s channel measurements no longer match closely enough for reconciliation. Experimentally, using commodity Wi-Fi devices and a fabricated \(16\times 16\) RIS with \(256\) unit cells, the average BDR of raw secret keys increases by \(20\%\), and favorable attacker positions can produce about \(30\%\) BDR increase. The corresponding countermeasure is contaminated path removal in wideband systems: map the channel to delay domain, identify the RIS-affected path by its anomalous temporal behavior, remove it, and generate keys from the remaining paths as long as source-of-randomness and RIS propagation paths are separable [2303.07015]. The two RIS-based PKG papers jointly establish that CRACK need not rely on packet injection. An adversary can instead manipulate the environment so that reciprocity is selectively weakened or nullified during the measurement stage itself. This shifts the problem from packet authentication to propagation-structure integrity. ## 5. Passive reciprocity breaking in TDD precoding The same reciprocity dependence appears in multi-user MISO downlink precoding, where the base station designs MRT or ZF precoders from uplink pilots under the assumption that \[ \mathbf H_{\text{down}}=\mathbf H_{\text{up}}^T. \] "Channel Reciprocity Attacks Using Intelligent Surfaces with Non-Diagonal Phase Shifts" shows that an adversarial non-diagonal RIS can break this assumption passively [2309.11665]. The uplink composite channel is \[ \mathbf H_{\text{up}}=\mathbf H_{r,b}\mathbf{\Phi}^* \mathbf H_{r,u} + \mathbf H_{b,u}, \] but the base station infers a downlink channel involving \((\mathbf{\Phi}^*)^T\), whereas the actual downlink contains \(\mathbf{\Phi}^*\) itself. For a conventional diagonal RIS, \(\mathbf{\Phi}^T=\mathbf{\Phi}\), so reciprocity is preserved. For the malicious ND-RIS, \(\mathbf{\Phi}^*=\mathbf J\mathbf\Phi\) is generally non-symmetric, so \[ \mathbf H_{\text{down}}^* \neq \mathbf H_{\text{up}}^T. \] The result is systematic precoder mismatch rather than transient jamming [2309.11665]. This attack is entirely passive, requires no synchronization with uplink or downlink slots, and can operate with a fixed malicious configuration. Even without CSI, it is strong. For Rayleigh RIS–user fading with \(M=128\) and \(N=32\), a random ND-RIS reduces the sum rate by about \(32\%\) under MRT and about \(83\%\) under ZF. As \(N\) grows to \(512\), the sum ergodic rate drops by roughly \(82\%\). A genetic algorithm using partial CSI can optimize the ND structure so aggressively that the sum ergodic rate approaches near zero over a wide range of \(M\); a \(1\)-bit ND-RIS remains nearly as destructive as a full-resolution one [2309.11665]. A subsequent extension, "Nonreciprocal RIS-Aided Covert Channel Reciprocity Attacks and Countermeasures," uses a physically consistent nonreciprocal RIS model and reaches the same conclusion at larger scale [2509.11117]. There the effective uplink and downlink channels differ because the NR-RIS scattering matrix is unitary but non-symmetric, and the BS cannot separate direct and RIS-induced components in uplink training. With \(M=128\) and \(N=256\), blind NR-RIS CRACK reduces ergodic sum rate by about \(90\%\) under MRT and about \(92\%\) under ZF. It also facilitates passive eavesdropping by degrading legitimate rates and misdirecting beams. The paper’s countermeasure, "SecureCoder," uses deep reinforcement learning with estimated uplink CSI and user rate feedback; at \(N=256\), it outperforms ZF under CRACK by nearly \(300\%\) and improves both throughput and secrecy behavior [2509.11117]. These results sit on top of a non-adversarial baseline established in "Massive MIMO performance with imperfect channel reciprocity and channel estimation error" [1803.02732]. That work models reciprocity loss as RF-chain mismatch and shows that reciprocity errors create hard SINR ceilings, with ZF much more sensitive than MRT. In the CRACK setting, this means that the attacker is not creating a fundamentally new dependency; the attacker is taking a pre-existing sensitivity of TDD linear precoding to reciprocity error and turning it into a covert propagation-layer weapon. ## 6. Countermeasures, misconceptions, and broader implications The CRACK literature does not support a single universal defense. Instead, it suggests that the correct response depends on which part of the reciprocity assumption is under attack. When the adversary exploits coherence across probing rounds, channel randomization is effective because it preserves within-round reciprocity while removing cross-round predictability. When the adversary injects a non-reciprocal path through an RIS, path-domain separation and attacked-path removal are effective provided the system is sufficiently wideband to resolve the contaminated tap. When reciprocity failure manifests as downlink precoder mismatch, robust precoding and reciprocity verification become central, and recent work uses learning-based control because the BS has access only to uplink CSI and rate feedback, not to the malicious surface configuration [2106.02731][2108.05497][2509.11117]. Another misconception is that “passive” adversaries are necessarily non-perturbative. "The Passive Eavesdropper Affects my Channel" shows experimentally that a close-range passive eavesdropper can affect the Alice–Bob channel statistics and secret-key rate, and that the attacker’s position can change cross-correlation and mutual information in a reproducible way. The paper concludes that “the attacker himself affects the outcome,” which weakens standard decorrelation assumptions in real deployments [1701.03904]. This suggests that CRACK should not be restricted to active signal injection or programmable surfaces; proximity itself can become a reciprocity-affecting mechanism. A further complication is that reciprocity imperfections are not always hostile. "Exploiting Lack of Hardware Reciprocity for Sender-Node Authentication at the PHY Layer" uses non-reciprocal RF hardware as a fingerprint for binary hypothesis testing, learning a legitimate sender’s reciprocity parameters during training and comparing them against later measurements [1610.02658]. Likewise, "Wavelet-Based CSI Reconstruction for Improved Wireless Security Through Channel Reciprocity" shows that low-cost IoT devices often exhibit severely degraded practical reciprocity, and uses wavelet coherence and time-lagged cross-correlation to reconstruct more consistent CSI and to detect replay attacks through temporal inconsistency [2504.08078]. These results imply that CRACK detection cannot simply flag every deviation from ideal reciprocity as malicious; normal hardware and sampling asymmetries already produce substantial reciprocity loss. The principal open issues are therefore architectural rather than incremental. RIS-based attacked-path removal depends on bandwidth and path separability. ND-RIS and NR-RIS attacks remain hard to detect because they need no fast switching or overt RF transmission. Threshold design for attacked-path detection under unknown attack strength is not fully analyzed in the RIS-manipulation literature. Learning-based countermeasures improve robustness but do not remove the need for explicit reciprocity verification. A plausible implication is that future reciprocity-dependent systems will require joint treatment of propagation integrity, hardware asymmetry, and protocol-level freshness, rather than treating reciprocity as a benign primitive available for free. CRACK is thus best understood as a unifying threat model for reciprocity-dependent wireless security and signal processing. In key generation it can recover bits or collapse agreement. In TDD precoding it can covertly invalidate the uplink-to-downlink inference that massive MIMO depends on. In RIS-rich environments it can be realized passively, without synchronization and often without channel-state knowledge. The resulting research agenda is correspondingly broad: build reciprocity into the threat model, not merely into the system model. Source: https://www.emergentmind.com/topics/channel-reciprocity-attack-crack