3GPP TSG-T3 meeting #3
Tokyo 19-21 April, 1999
	Document T3-99103
Page 1 of 3 	

Source: T-Mobil
Title: Proposed text on authentication command for “new 11.11”, clauses 3, 8, 9 and 11.

3.3	Symbols
||	Concatenation
Å	Exclusive or
f1	Message authentication function used to compute MAC
f2	Message authentication function used to compute RES and XRES
f3	Key generating function used to compute CK
f4	Key generating function used to compute IK

8.16	AUTHENTICATE
This function is used during the procedure for authenticating the USIM to its HE and vice versa. In addition, a cipher key and an integrity key are calculated. For the execution of the command the card uses the subscriber authentication key K, which is stored in the USIM.
The USIM first computes the anonymity key AK = f5K (RAND) and retrieves the sequence number SQN = (SQN Å AK) Å AK. 
Next the USIM computes XMAC = f1K (SQN || RAND || MODE) and compares this with MAC which is included in AUTN. If they are different, the USIM aborts the function.
Next the user verifies the freshness of the received sequence number SQN. For each mode the USIM keeps track of one counter: SQNMS/CS for authentications initiated by the circuit switched core network nodes, and SQNMS/PS for authentications initiated by the packet switched core network nodes. To verify the freshness of the sequence number SQN, the USIM compares SQN (calculated as decribed above) with SQNMS/MODE. If SQN > SQNMS/MODE the sequence number is considered as fresh and the USIM subsequently sets SQNMS/MODE  to SQN.
If the USIM considers the sequence numbers not fresh, the USIM aborts the function.
If the sequence number is considered fresh however, the USIM computes RES = f2K (RAND) and includes this parameter in the command response. Finally the USIM computes the cipher key CK = f3K (RAND) and the integrity key IK = f4K (RAND). Note that if this is more efficient, RES, CK and IK could also be computed earlier at any time after receiving RAND.
The function is related to a particular USIM and shall not be executable unless the USIM or any sub- has been selected as the Current Directory and a successful CHV1 verification procedure has been performed (see 11.3.1).
Input:
‑	RAND, AUTN (AUTN := SQN Å AK || MODE || MAC).
Output:
‑	RES, CK, IK.
8.xx	Resynchronise
This function allows for resynchronisation of the SQNMS/CS and  SQNMS/PS counters in the HLR/AuC. The function returns a RAND and AUTN pair where SQN the value of the SQNMS/CS or SQNMS/PS counters stored in the SIM, depending on the indicated mode. AUTN is computed as AUTN := SQN Å AK || MODE || MAC.
NOTE: The USIM has several ways to produce RAND || AUTN. Either it stores and returns the latest received RAND || AUTN pair, or it only stores the received RAND and re-computes AUTN, or it generates a RAND and computes the corresponding AUTN. 

9.2.16	AUTHENTICATE
COMMAND	CLASS	INS	P1	P2	P3	
Authenticate	'Ax'	'88'	'01'	'00'	Lgth	

Command parameters/data:
Byte(s)	Description	Length	
1	Length of RAND (L1)	1	
2 – (L1+1)	RAND	L1	
(L1+2)	Length of AUTN (L2)	1	
(L1+3) – (L1+L2+2)	AUTN	L2	

Response parameters/data:
Byte(s)	Description	Length	
1	Length of RES (L3)	1	
2 – (L3+1)	RES	L3	
(L3+2)	Length of CK (L4)	1	
(L3+2) – (L3+L4+2)	CK	L4	
(L3+L4+3) 	Length of IK (L5)	1	
L3+L4+4) – (L3+L4+L5+3)	IK	L5	
The most significant bit of RES is coded on bit 8 of byte 2. The most significant bit of CK is coded on bit 8 of byte (L3+2). The most significant bit of IK is coded on bit 8 of byte (L3+L4+3). 
9.2.xx	Resynchronise
COMMAND	CLASS	INS	P1	P2	P3	
Resynchronise	'Ax'	'??'	mode	'00'	Lgth	

Parameter P1 specifies the mode:
‑	01 = circuit switched;
‑	02 = pacekt switched.

Response parameters/data:
Byte(s)	Description	Length	
1	Length of RAND (L1)	1	
2 – (L1+1)	RAND	L1	
(L1+2)	Length of AUTN (L2)	1	
(L1+3) – (L1+L2+2)	AUTN	L2	

11.4.1	Authentication
The ME selects a USIM and uses the Authenticate function (see 8.16). The response  is sent to the ME (in case of the T=0 protocol when requested by a subsequent GET RESPONSE command).
11.4.x	Resynchronisatiom
The ME selects a USIM and uses the Resynchronise function (see 8.xx). The response  is sent to the ME (in case of the T=0 protocol when requested by a subsequent GET RESPONSE command).