Toward Reliable Key Distribution in Wireless Ad Hoc Networks: A Software-Based Comparative Analysis of Key Management Schemes

Wireless Ad Hoc Networks (WANETs) represent a paradigm shift in wireless communication, enabling fully decentralized, infrastructure-free networking that is critical for emergency response, military operations, and remote sensing applications [1]. However, the inherent openness and high mobility of subclasses such as Mobile Ad Hoc Networks (MANETs), Vehicular Ad Hoc Networks (VANETs), and Flying Ad Hoc Networks (FANETs) expose them to critical security threats—including eavesdropping, spoofing, and node compromise—thereby necessitating robust mechanisms for secure communication [2].

A fundamental component of WANETs security is the Key Management Scheme (KMS), which serves as a foundation for authentication, key distribution, and secure data transmission [3]. Unlike conventional networks with centralized authorities, WANETs require distributed or hierarchical key management strategies to accommodate dynamic topologies and frequent node mobility. An effective KMS must ensure that only legitimate participants gain access to cryptographic keys while mitigating risks associated with node compromise and unauthorized access. Due to the inherently adversarial nature of open wireless environments, designing a KMS that balances efficiency, scalability, and resilience remains a pressing research challenge [4].

Despite substantial theoretical progress, key management persists as a major bottleneck in real-world deployments. The absence of a fixed infrastructure complicates trust establishment, while resource constraints (e.g., limited bandwidth, energy, and computational power) limit the feasibility of computationally intensive cryptographic schemes. Additionally, WANETs are highly susceptible to a spectrum of cyber threats—including node compromise, Sybil attacks, and man-in-the-middle exploits—that can undermine network integrity [5]. Compounded by vulnerabilities such as malicious packet drops that cripple routing, these threats underscore the critical need for secure communication channels—a need that only a robust KMS can provide. This is the major challenge highlighted in recent MANET security analyses [6].

A key obstacle to practical deployment is the methodological gap between theoretical design and realistic validation. While significant cryptographic advances exist, most studies focus on static or idealized settings and rarely consider dynamic adversarial conditions [7-11]. Moreover, KMS performance is highly sensitive to environmental parameters such as routing protocols, mobility models, and physical constraints. As a result, a scheme that performs well in one context may fail in another. This strong context-dependence challenges the assumption of a single universally optimal solution and underscores the need for flexible, generalized evaluation frameworks capable of benchmarking multiple KMSs across diverse, customizable scenarios [12-14].

Furthermore, the resilience of these frameworks against active adversarial behavior remains inadequately assessed. The lack of evaluation under realistic and dynamic attack conditions limits the practical relevance of existing results, complicates evidence-based decision-making, and ultimately constrains the adoption of KMS in practice [15-18].

To address these interconnected gaps in evaluation rigor and adversarial testing, this study presents an innovative, modular, and extensible simulation-based framework designed to rigorously test KMSs' resilience in realistic MANET environments. Unlike Ad Hoc scripting approaches common in simulators such as OMNeT++, our framework formalizes KMS evaluation as a reusable methodological process rather than a one-off experimental setup. As a key extension, we incorporated and evaluated identity-based schemes. Specifically, we integrate two fundamentally distinct KMS archetypes: a threshold-based [12, 13] and a distributed identity-based KMS [14]. To our knowledge, this work presents the first simulation-based comparative analysis of these two KMSs categories within a unified and controlled evaluation environment tailored for MANETs.

The key contributions of this work are as follows:

(1) The design and implementation of a generic, modular, and extensible simulation framework that enables seamless integration of new protocols, attack models, and evaluation metrics, moving beyond Ad Hoc scripting.

(2) The integration of identity-based KMS into the evaluation framework, addressing a class of schemes not previously covered in comparative studies.

(3) The introduction of two novel evaluation metrics specifically designed for MANET environments: Key Freshness (KF), which quantifies the system’s ability to maintain cryptographic key validity over time, and Secure Connectivity Achievement (SCA), which measures the proportion of node pairs capable of establishing secure communication links.

(4) Enhanced simulation flexibility that allows users to customize network scenarios and adversarial conditions, supporting a wide range of operational environments.

(5) The provision of actionable evaluation outcomes to guide deployment decisions in dynamic and resource-constrained network settings.

The remainder of this paper is organized as follows: Section 2 reviews related work, analyzing existing KMSs and evaluation tools to crystallize the identified research gaps. Section 3 provides the necessary background on WANETs and KMS principles. Section 4 details the architecture and components of the proposed evaluation framework. Section 5 presents a case study on the comparative evaluation of the two integrated KMSs, describing the experimental setup and methodology. Section 6 discusses the obtained results and their implications. Finally, Section 7 concludes the paper with key findings and outlines future research directions.

3.1 WANETs

WANETs are decentralized communication systems that operate without fixed infrastructure, resulting in highly dynamic topologies due to node mobility and energy constraints. This paradigm includes several subtypes, such as MANETs, VANETs, Wireless Sensor Networks (WSNs), and FANETs. Each is tailored to specific application domains.

WANETs are characterized by a set of inherent features that pose significant security challenges:

• Decentralized architecture: The absence of centralized control requires all network functions, including security, to be distributed among participating nodes.

• Dynamic topologies: Frequent node mobility leads to continuous changes in network structure, complicating routing and trust establishment.

• Limited resources: Energy, processing, and storage constraints restrict the use of computationally intensive cryptographic mechanisms.

• Open wireless medium: The broadcast nature of wireless communication increases vulnerability to eavesdropping, spoofing, and malicious data injection.

• Multi-hop communication: Data forwarding through intermediate nodes introduces risks of node misbehavior or compromise along transmission paths.

• Device and context heterogeneity: Nodes vary in capabilities and operate in diverse environments with differing mobility and communication ranges.

These characteristics collectively render WANETs highly susceptible to security threats, underscoring the need for robust and adaptive KMSs that can operate effectively under such constraints. Consequently, it is essential to develop evaluation frameworks that can capture these operational nuances. Such frameworks are needed to assess KMS performance and resilience in realistic scenarios.

3.2 KMSs

A KMS forms the foundation of secure communication in WANETs, overseeing the full cryptographic key lifecycle—generation, distribution, storage, update, and revocation—to ensure confidentiality, integrity, and authentication.

KMS can be categorized along several design dimensions:

• Architecture: Centralized (relying on a trusted authority)/ distributed (shared responsibility among nodes).

• Deployment mode: Pre-distributed (keys installed before deployment) / dynamic (keys generated on-demand).

• Cryptographic paradigm: Symmetric (efficient but challenging for key distribution) / asymmetric (scalable but computationally intensive).

• Scope: Individual (node-to-node) / group-based (supporting multicast or broadcast).

• Trust model: Schemes that integrate trust mechanisms / those that operate independently.

• Key update policy: Static / dynamic key refresh mechanisms.

The key lifecycle, generally comprising generation, distribution, storage, update, and revocation phases, provides a structured basis for evaluating KMS robustness, scalability, and adaptability.

3.3 Selected KMS and their link to evaluation metrics

This study focuses on two fundamentally distinct KMS paradigms—threshold-based and distributed identity-based schemes—selected for their contrasting architectural principles and operational behaviors. Evaluating their effectiveness in dynamic, adversarial MANETs requires metrics that capture both security health and network utility. To this end, we introduce two novel, context-aware metrics:

• KF: Measures the temporal validity and current usability of cryptographic keys across the network. A high KF indicates that keys are recent and have not been compromised or expired, which is critical for preventing replay attacks and ensuring forward secrecy.

$\mathrm{KF}=\frac{\text { Number of up-to-date keys }}{\text { Total-number of keys }}$              (1)

• SCA: Quantifies the proportion of node pairs that can successfully establish an authenticated and encrypted communication link at a given time. SCA reflects the practical security coverage and operational capacity of the network under a given KMS.

$\mathrm{SCA}=\frac{\text { Number of } \text { securely connected } \text { node } \text { pairs }}{\text { Total } \text { number } \text { of } \text { node } \text { pairs }}$              (2)

The architectural design of each KMS directly shapes its performance against these metrics:

• Threshold-based KMS employs a distributed t-of-n secret sharing mechanism, enhancing fault tolerance by requiring a quorum of nodes to perform key operations. This architecture introduces strong dependencies on node availability, network synchronization, and resistance to partial compromise. In highly dynamic or adversarial MANET environments, delays or failures in quorum formation can directly degrade KF, as key updates may be delayed or incomplete. Consequently, in dynamic MANETs, delays in quorum formation can degrade KF and subsequently impact SCA.

• Distributed identity-based KMS also follows a distributed model but derives public keys directly from node identities, decentralizing the Private Key Generator (PKG) functionality. Its resilience depends on the availability and consistency of PKG-share nodes rather than quorum formation. This design can offer more asynchronous and locality-aware key management. Therefore, under network fragmentation, KF may suffer in isolated domains, affecting SCA.

This explicit link between KMS architecture and measurable outcomes forms the core of our comparative analysis. The proposed evaluation framework is designed to quantify these relationships under realistic MANET conditions.

This section presents a case study applying the proposed framework to evaluate the two identity-based KMS paradigms introduced in Section 3.3: the threshold-based KMS [12, 13] and the distributed identity-based KMS [14]. We first describe the experimental setup designed to assess their performance and robustness under varying network conditions, followed by the presentation and analysis of the results.

5.1 Experimental setup

To evaluate the effectiveness and robustness of the proposed evaluation framework and ensure a fair and reproducible assessment of the selected KMS approaches, we designed a comprehensive experimental setup using the OMNeT++ simulator and the INET framework. We conducted the evaluation under two complementary conditions: a basic scenario, derived from study [34], which reflects conventional configurations frequently employed in prior studies, and a realistic scenario that incorporates parameters more closely resembling actual MANET deployments. We adopted both scenarios for the following reason. Basic configurations provide a common benchmark and facilitate comparability with existing work. However, they often overlook the complexities inherent in real-world environments.

As most of the previous evaluations of KMS have been performed under such simplified settings, their reported results may not fully capture the challenges posed by dynamic topologies, resource constraints, and unpredictable mobility patterns. By complementing the basic scenario with a more realistic one, this study seeks to bridge this gap. This approach aims to yield a more reliable understanding of how KMS schemes would perform in operational networks.

The basic scenario was designed according to commonly adopted practices in MANET simulation studies [34], serving as a reference point for comparative evaluation. In this scenario, the transmission rate was fixed at 6 Mbps. We used the Free Space Path Loss propagation model, and performance metrics were collected every 10 s. The simulation parameters are summarized in Table 2.

Table 2. Parameters of the basic scenario

To reflect conditions closer to real MANET deployments, we designed a more demanding, realistic scenario, as summarized in Table 3. This configuration uses FreeSpacePathLoss as the propagation model. For rate control, we employed Minstrel, which adapts across three rates: 6, 12, and 24 Mbps. This configuration introduces a larger number of nodes, extended simulation duration, and more diverse traffic patterns, while also accounting for energy consumption and mobility variations.

Table 3. Parameters of the realistic scenario

In addition to the simulation scenarios, the evaluation incorporates configuration parameters for the two selected KMS: ThreIdBasedCrypto and IdBasedCryptoSystem. For the threshold-based KMS, parameters were scaled proportionally to network size. The number of INITIAL Nodes (i.e., the number of nodes initially holding partial Master Secret Key shares) ranged from 5 to 30, and the threshold value (K) ranged from 3 to 18, corresponding to network sizes from 25 to 150 nodes. This scaling maintains cryptographic principles of security and fault tolerance. Timers for master and session keys were set to 5 seconds. In contrast, the distributed KMS employed a fixed configuration with five Virtual Private Key Generator (VPKG) servers, and timers of 2 and 5 seconds for client-originator and key response phases, respectively. These configurations ensured realistic operation while enabling fair comparative evaluation under consistent constraints.

Performance measurement was carried out at fixed time intervals of 10 seconds during the simulation rather than at the end only, to capture the dynamic evolution of the metrics.

This interval-based monitoring enabled a more accurate evaluation of how each KMS maintains secure connectivity and freshness of keys under highly mobile conditions. Each experiment was repeated with 10 different random seeds (min value = 0 and max value = 9), and the final results are averaged to ensure statistical reliability.

In total, combining the two KMSs with the basic and realistic scenarios yields 14 distinct experimental settings. The outcomes are presented as comparative figures, illustrating the evolution of the metrics across different network sizes and configurations.

This study introduced a flexible and extensible simulation-based framework for the evaluation of KMS in WANETs. By applying the framework to two representative schemes—a threshold-based KMS and a distributed identity-based KMS—we demonstrated that their performance varies substantially across different simulation conditions. Specifically, while one scheme may appear effective under simplified settings, its performance may degrade significantly in more realistic environments, and vice versa. These findings confirm that evaluation outcomes are highly dependent on contextual parameters such as network size, mobility, and communication conditions.

The analysis yields three principal findings. First, no single KMS can be considered universally optimal across all deployment scenarios. Second, static and narrowly defined evaluation settings are insufficient to capture the complex dynamics of real-world environments. Third, there is a pressing need for a generic and customizable evaluation framework that allows users to configure scenarios according to their operational requirements. Such a framework not only enables fairer comparisons between schemes but also empowers researchers and practitioners to select the most appropriate KMS depending on trade-offs between security, efficiency, and scalability.

This work provides a customizable and adversary-aware testbed. Thus, it contributes to bridging a critical gap in the literature. It also offers a foundation for building more robust, scalable, and context-aware key management solutions for wireless Ad Hoc systems.

The comparative analysis conducted through the proposed evaluation framework underscores its unique capability to capture context-dependent performance variations that are often overlooked in conventional evaluations. For instance, the threshold-based KMS performed optimally only under basic conditions, while the distributed identity-based approach demonstrated superior resilience in dynamic environments, albeit with higher initial overhead. These insights would not have been apparent without the flexible evaluation environment proposed in this study. Thus, the proposed evaluation framework not only facilitates a more truthful assessment of KMS suitability but also empowers stakeholders to make informed decisions tailored to specific operational contexts.

To further support practitioners, we provide actionable guidance by means of a decision matrix that consolidates the main results of this study. Table 4 summarizes the decision Matrix for MANET security evaluation and selection.

Table 4. Decision matrix for MANET KMS selection

While the proposed simulation-based framework provides a flexible and extensible environment for evaluating KMS in WANETs, several limitations must be highlighted:

• Limited KMS categories: The current experimental evaluation covers only two representative KMS Categories: A threshold-based KMS and a distributed identity-based scheme. Consequently, the generalizability of findings to other KMS types remains to be validated.

• Simplified realistic scenario: Although the “realistic” scenario incorporates larger network sizes, heterogeneous mobility models, and extended simulation durations, it still relies on simplified representations of node mobility, traffic patterns, and wireless propagation. In addition, the current experimental setup does not yet explicitly model compromised or malicious nodes, and therefore does not evaluate KMS behavior under active adversarial presence. As such, results may not capture all nuances of real-world deployments.

• Partial metric coverage: The current study focuses primarily on KF and SCA. While the framework architecture supports comprehensive metrics (energy, latency, etc.), this specific case study prioritized KF and SCA to isolate the impact of mobility on security availability. Expanding metric coverage will provide a more comprehensive assessment of KMS performance.

• Framework computational overhead and scalability: The present study does not explicitly profile to ensure its feasibility for large-scale evaluations. Beyond MANETs, the framework shows strong potential for adaptation to related wireless domains: for VANETs, integration with realistic mobility models and latency-critical metrics; for FANETs, energy-aware evaluation under strict power constraints; and for IoT, support for lightweight protocols and massive heterogeneous deployments. Finally, we envision the integration of machine learning techniques for adaptive parameter tuning, enabling the framework to not only evaluate but also predict KMS behavior under evolving network conditions.

These limitations naturally point to several promising avenues for future work. First, the framework will be extended to incorporate additional KMS categories—such as pre-distribution, blockchain-based, and post-quantum schemes—to validate its generality beyond the two paradigms studied here. Second, to address the simplified realism of current scenarios, future iterations will integrate explicit adversarial models—including Sybil attacks, denial-of-service, and insider threats—alongside more refined mobility, traffic, and propagation patterns. Third, metric coverage will be expanded to include energy efficiency, latency under congestion, robustness against specific attacks, and quality-of-service impact, providing a more holistic assessment of KMS performance. Furthermore, the computational overhead and scalability of the framework itself will be systematically profiled to ensure its feasibility for large-scale evaluations. Beyond MANETs, the framework shows strong potential for adaptation to related wireless domains: for VANETs, integration with realistic mobility models (e.g., via SUMO) and latency-critical metrics; for FANETs, energy-aware evaluation under strict power constraints; and for IoT, support for lightweight protocols and massive heterogeneous deployments. Finally, we envision the integration of machine learning techniques for adaptive parameter tuning, enabling the framework to not only evaluate but also predict KMS behavior under evolving network conditions.