A method of establishing a direct wireless communication link between a first device and a second device (the first device being designated as a sender and the second device being designated as a receiver) comprises: a proximity authentication operation that comprises determining, based on signals received by the first and second devices over one or more RF channels from a plurality of wireless access points, that the first device is proximate the second device; following the proximity authentication operation, a key generation operation that comprises: generating a shared secret by performing randomness extraction on respective signals received at the first and second devices over a selected channel of the one or more RF channels; and establishing the direct wireless communication link using the shared secret.