Section: 6.4.3 Cipher key and integrity key lifetime
Content: Authentication and key agreement, which generates cipher/integrity keys, is not mandatory at call set-up, and there is therefore the possibility of unlimited and malicious re-use of compromised keys. A mechanism is needed to ensure that a particular cipher/integrity key set is not used for an unlimited period of time, to avoid attacks using compromised keys. The UE shall therefore contain a mechanism to limit the amount of data that is protected by an access link key set. For this purpose, a value called THRESHOLD is set by the operator, stored in the USIM and read out by the ME upon power on. Each time an RRC connection is released the values STARTCS and STARTPS of the bearers that were protected in that RRC connection are compared with THRESHOLD. If STARTCS and/or STARTPS are greater than or equal to THRESHOLD, the ME sets the START value in the ME for the corresponding core network domain(s) to zero, deletes the cipher key and the integrity key stored on the USIM and the ME and sets the KSI to invalid (refer to section 6.4.4). Otherwise, the STARTCS and STARTPS are stored in the ME. The ME shall write back the values of STARTCS and/or STARTPS to the USIM only when the UE is about to power off in a controlled manner and there are valid UTRAN keys for that domain. When the UE has powered on and before attempting to connect to any network, the ME reads the START values from the USIM and stores them in the volatile memory of ME. If STARTCS and/or STARTPS read from the USIM are greater than or equal to THRESHOLD or the KSI on the USIM is invalid, the ME sets the START value in the ME for the corresponding core network domain(s) to zero. The ME then marks the START values in the USIM as invalid by setting STARTCS and STARTPS to THRESHOLD. In addition for the former case, the ME deletes the cipher key and the integrity key stored on the USIM and sets the KSI to invalid (refer to section 6.4.4). When an RRC connection is established the ME uses the START values from the volatile memory of the ME. The ME shall trigger the generation of a new access link key set (a cipher key and an integrity key) for a core network domain if either the START value for that domain in the ME is greater than or equal to THRESHOLD or if there are no valid keys in the ME nor in the USIM for that domain. In addition for the former case, the ME deletes the cipher key and the integrity key stored on the USIM, sets the KSI to invalid (refer to section 6.4.4) and sets the corresponding START value(s) in the ME to zero. This mechanism will ensure that a cipher/integrity key set cannot be reused beyond the limit set by the operator. When the user is attached to a UTRAN, a R99+ ME with a SIM inserted shall use a default value for maximum value of STARTCS or STARTPS as described in section 6.8.2.4. This maximum value of STARTCS or STARTPS corresponds to THRESHOLD as described in the present clause.