3GPP TSG-S3 Meeting #8
Sophia Antipolis, 16 - 19 November, 1999	Tdoc S3-99402	

3GPP TSG-T3 (USIM) Meeting #10
Austin, USA, 2 - 5 November, 1999	Tdoc T3-99364	

Liaison statement

To:	3GPP TSG-S3

From:	3GPP TSG-T3

Title:	Clarification of USIM related security issues in 33.102

Introduction
T3 has reviewed the latest specifications of the security architecture (TS 33.102 V3.2.0). Some questions arose where clarification by S3 is needed to complete the USIM specification.

Items to be clarified.

	Clause	Item	Description	
	6.8.1	Interoperability	It is described in the text that GSM authentication data is to be used 'when the MS is located in the GSM radio access network'.
However, figure 13 implies that in some cases (GSM access network in conjunction with a UMTS MSC/VLR or a UMTS capable GSM MSC/VLR) UMTS authentication data can also be used.
T3 asks for clarification. 	
	Annex C	Resync	T3 understands that the resynchronisation is required in all scenarios except the one described in C.2.
T3 asks for confirmation.	
	Annex C.3	SQN window	Is the SQN accepted if a SQN larger than the stored SQNMS is received?

Does the window have to be updated if a SQN is received in the range [SQNMS –w, SQNMS] ? If yes, how?
T3's understanding is that the window itself is not updated, but instead the particular SQN is marked as used.	
	Annex C.4	SQN list	Is the SQN accepted if a SQN larger than the stored SQNMS is received ?	
	Annex C	No. of options for SQN mgmt.	T3 feels that there is too large a variety of options for SQN management as these have an affect on the security management of network operators, and the interoperability of products from various vendors.
T3 asks S3 to investigate if the number of options can be reduced.	
	Annex C.6	Generalised SQN mgmt option	T3's interpretation is that from the USIM perspective this option is only a combination of the options of annexes C.1, C.4, C.5.
Why is option 3 omitted?	
	Annex F.3	CS / PS authentication data	The MODE parameter within the AMF offers the possibility to use separate authentication vectors for CS and PS domains.
T3 asks whether separate locations are required to store the CKs and IKs for CS and PS modes.

Even if the MODE parameter is not provided in the AMF by the HE, it could make sense to provide these separate locations, as the mobile knows in which domain the authentication is being performed.	
	6.8.1	Conversion of KcGPRS	In case of being served by a non-UMTS capable GSM or GPRS switch, the USIM is requested by the mobile to use the conversion functions according to TS 33.102.
T3's assumption is that in case of being in a GPRS domain the same conversion function is applicable as for GSM 'circuit switched'. Subsequently the returned Kc will be stored in the dedicated EF KcGPRS by the mobile.

T3 asks for confirmation.	

TSG-T3 would appreciate if TSG-S3 could provide clarifications on these matters.