A wireless device (24) includes a modem (56) and processing circuitry (50, 52). The modem is configured to modulate signals for transmission over wireless channels, and demodulate signals received over the wireless channels. The processing circuitry is configured to receive a first frame from a second wireless device over a wireless channel via the modem, and transmit a second frame to the second wireless device via the modem over the wireless channel, to calculate a first Channel State Information (CSI) based on the first frame, to calculate a first normalized CSI by applying to the first CSI a normalization procedure, and generate, based on the first normalized CSI, a first key that due to the normalization procedure has an increased likelihood to match a second key generated in the second wireless device based on the second frame, and to communicate securely with the second wireless device over the wireless channel using the first key.