This document has been prepared by the 3GPP Task Force, and contains an example set of algorithms which may be used as the GSM authentication and key generation functions A3 and A8. (It is not mandatory that the particular algorithms specified in this document are used - the A3 and A8 functions are operator-specifiable rather than being fully standardised).

The present document contains an example set of algorithms which may be used as the GSM authentication and key generation functions A3 and A8. (It is not mandatory that the particular algorithms specified in this document are used - the A3 and A8 functions are operator-specifiable rather than being fully standardised). Clause 3 (normative) introduces the algorithms and describes their input and output parameters. Clause 4 (normative) defines the algorithms. Clause 5 (informative) describes an alternative algorithm that some operators may prefer. Clause 6 (informative) provides test data.

The following documents contain provisions which, through reference in this text, constitute provisions of the present document.

• References are either specific (identified by date of publication, edition number, version number, etc.) or non specific.
• For a specific reference, subsequent revisions do not apply.
• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same Release as the present document.

An example algorithm set for UMTS, called MILENAGE (note 1), is specified in TS 35.206. GSM-MILENAGE makes use of MILENAGE. Specifically, the functions from the UMTS MILENAGE which we make use of are the following (we prefix all input and output names by "MIL3G-" to distinguish them clearly from the inputs and outputs of A3 and A8):

The GSM-MILENAGE functions are defined as follows:

• Let (MIL3G-K[0]…MIL3G-K[127]) = (Ki[0]…Ki[127])
• Let (MIL3G-RAND[0]…MIL3G-RAND[127]) = (RAND[0]…RAND[127])
• Compute MIL3G-RES, MIL3G-CK and MIL3G-IK from MIL3G-K and MIL3G-RAND, using the MILENAGE functions f2, f3, and f4 respectively
• Set (KC[0]…KC[63]) =
  (MIL3G-CK[0]…MIL3G-CK[63]) ⊕
  (MIL3G-CK[64]…MIL3G-CK[127]) ⊕
  (MIL3G-IK[0]…MIL3G-IK[63]) ⊕
  (MIL3G-IK[64]…MIL3G-IK[127])
• Derive SRES from MIL3G-RES using an operator-selected SRES Derivation Function. This function must be precisely specified for the GSM-MILENAGE A3 algorithm to be fully defined. The two main recommended options are as follows (note 2):
• Recommended SRES Derivation Function #1:
  (SRES[0]…SRES[31]) = (MIL3G RES[0]…MIL3G-RES[31]) ⊕ (MIL3G RES[32]…MIL3G-RES[63]).
• Recommended SRES Derivation Function #2:
  (SRES[0]…SRES[31]) = (MIL3G RES[0]…MIL3G-RES[31]).

Alternative SRES Derivation Functions may be specified.

The GSM-MILENAGE algorithms defined in clause 3 are obtained by applying standard 3G-to-2G conversion functions defined in TS 33.102 to the outputs of the UMTS MILENAGE algorithms. If there is no desire to retain this compatibility with UMTS MILENAGE used in its 2G mode, a much simpler and more efficient algorithm would be to set TEMP = EKi (RAND), where E is the 128-bit block cipher used as a basic building block in MILENAGE, i.e. TEMP = the result of encrypting RAND using the key Ki; then choose non-overlapping substrings of TEMP to be SRES and KC, e.g. SRES = TEMP[0]...TEMP[31] and KC = TEMP[64]…TEMP[127]. This alternative does not form any part of the GSM-MILENAGE algorithms; it is included just for information.