  Since ancient Greece, handshaking has been commonly practiced between two
people as a friendly gesture to express trust and respect, or form a mutual
agreement. In this paper, we show that such physical contact can be used to
bootstrap secure cyber contact between the smart devices worn by users. The key
observation is that during handshaking, although belonged to two different
users, the two hands involved in the shaking events are often rigidly
connected, and therefore exhibit very similar motion patterns. We propose a
novel Shake-n-Shack system, which harvests motion data during user handshaking
from the wrist worn smart devices such as smartwatches or fitness bands, and
exploits the matching motion patterns to generate symmetric keys on both
parties. The generated keys can be then used to establish a secure
communication channel for exchanging data between devices. This provides a much
more natural and user-friendly alternative for many applications, e.g.
exchanging/sharing contact details, friending on social networks, or even
making payments, since it doesn't involve extra bespoke hardware, nor require
the users to perform pre-defined gestures. We implement the proposed
Shake-n-Shack system on off-the-shelf smartwatches, and extensive evaluation
shows that it can reliably generate 128-bit symmetric keys just after around 1s
of handshaking (with success rate >99%), and is resilient to real-time
mimicking attacks: in our experiments the Equal Error Rate (EER) is only 1.6%
on average. We also show that the proposed Shake-n-Shack system can be
extremely lightweight, and is able to run in-situ on the resource-constrained
smartwatches without incurring excessive resource consumption.
