Section: 4.7.7.4 GPRS ciphering key sequence number
Content: The security parameters for authentication and ciphering are tied together in sets. In a GSM authentication challenge, from a challenge parameter RAND both the authentication response parameter SRES and the GPRS GSM ciphering key can be computed given the secret key associated to the IMSI. In a UMTS authentication challenge, from a challenge parameter RAND, the authentication response parameter RES and the GPRS UMTS ciphering key and the GPRS UMTS integrity key can be computed given the secret key associated to the IMSI. Furthermore, in the USIM a GPRS GSM ciphering key can be computed from the GPRS UMTS integrity key and the GPRS UMTS ciphering key by means of an unkeyed conversion function. Furthermore, in A/Gb mode if a GEA ciphering algorithm that requires a 128-bit ciphering key is taken into use, then a GPRS GSM Kc128 shall also be calculated as described in the subclause 4.7.7.3a. Furthermore, in A/Gb mode, if the MS and the network support integrity protection, when a GIA integrity algorithm that requires a 128-bit integrity key is taken into use, then a GPRS GSM Kint shall also be calculated as described in the subclause 4.7.7.3b. In order to allow start of ciphering on a logical link without authentication, GPRS ciphering key sequence numbers are introduced. The GPRS ciphering key sequence number is managed by the network such that the AUTHENTICATION AND CIPHERING REQUEST message contains the GPRS ciphering key sequence number allocated to the GPRS GSM ciphering key (in case of a GSM authentication challenge) or the GPRS UMTS ciphering key and the GPRS UMTS integrity key (in case of a UMTS authentication challenge) which may be computed from the RAND parameter carried in that message. If an authentication and ciphering procedure has been completed successfully and a GPRS ciphering key sequence number is stored in the network, the network shall include a different GPRS ciphering key sequence number in the AUTHENTICATION AND CIPHERING REQUEST message when it intiates a new authentication and ciphering procedure. If a GPRS ciphering key sequence number is contained in the first message during a GMM procedure, the network shall include a different GPRS ciphering key sequence number in the AUTHENTICATION_AND_CIPHERING REQUEST message when it initiates an authentication and ciphering procedure. The MS stores the GPRS ciphering key sequence number with the GPRS GSM ciphering key (in case of a GSM authentication challenge) and the GPRS UMTS ciphering key and the GPRS UMTS integrity key (in case of a UMTS authentication challenge), and includes the corresponding GPRS ciphering key sequence number in the ROUTING AREA UPDATE REQUEST, SERVICE REQUEST and ATTACH REQUEST messages. If the GPRS ciphering key sequence number is deleted, the associated GPRS GSM ciphering key, GPRS UMTS ciphering key, GPRS UMTS integrity key, GPRS GSM Kc128 and GPRS GSM Kint shall be deleted if any (i.e. the established GSM security context or the UMTS security context is no longer valid). In Iu mode, the network may choose to start ciphering and integrity checking with the stored GPRS UMTS ciphering key and the stored GPRS UMTS integrity key (under the restrictions given in 3GPP TS 42.009[ Security aspects ]  [5] and 3GPP TS 33.102[ 3G security; Security architecture ]  [5a]) if the stored GPRS ciphering key sequence number and the one given from the MS are equal. In A/Gb mode, the network may choose to start ciphering with the stored GPRS GSM ciphering key or GPRS GSM Kc128 (under the restrictions given in 3GPP TS 42.009[ Security aspects ]  [5]) if the stored GPRS ciphering key sequence number and the one given from the MS are equal and the previously negotiated ciphering algorithm is known and supported in the network. When ciphering is requested at GPRS attach, the authentication and ciphering procedure shall be performed since the MS does not store the ciphering algorithm after entering state GMM-DEREGISTERED. NOTE 1: The decision of starting ciphering with the GPRS GSM ciphering key or the GPRS GSM Kc128 depends on whether the network indicates in the AUTHENTICATION AND CIPHERING REQUEST message a GEA ciphering algorithm which requires a 64 or 128-bit ciphering key as specified in 3GPP TS 33.102[ 3G security; Security architecture ]  [5a]. In A/Gb mode, if MS indicates support of integrity protection in the MS network capability IE to the network, if the ME has a Integrity Algorithm IE and a Ciphering Algorithm IE stored in the ME non-volatile memory at MS power on, then the GMM layer shall calculate a GPRS GSM Kint key as described in subclause 4.7.7.3b and a GPRS GSM Kc128 key as described in subclause 4.7.7.3a and indicate to the LLC layer before sending the ATTACH REQUEST message that LLC layer shall start integrity protection with the indicated GPRS GSM Kint key and the integrity algorithm (indicated in the stored Integrity Algorithm IE). The GMM layer shall also assign the GPRS GSM Kc128 key and the ciphering algorithm (indicated in the stored Ciphering Algorithm IE) to the LLC layer. The network shall start integrity protection in the LLC layer after reception of the ATTACH REQUEST message with the stored GPRS GSM Kint and the integrity algorithm identified by the stored GPRS GSMintegrity algorithm used when UE was previously attached if the GPRS GSMintegrity algorithm is known and supported in the network, and if the stored GPRS ciphering key sequence number and the one given from the MS are equal. Upon GPRS attach, if ciphering is to be used, an AUTHENTICATION AND CIPHERING REQUEST message shall be sent to the MS to start ciphering. In A/Gb mode, upon GPRS attach, if the MS and network supports integrity protection, then the network may choose to start ciphering with the stored GPRS GSM ciphering key or GPRS GSM Kc128 (under the restrictions given in 3GPP TS 42.009[ Security aspects ]  [5]) if the stored GPRS ciphering key sequence number and the one given from the MS in the ATTACH REQUEST message or ROUTING AREA UPDATE REQUEST message are equal and the previously negotiated ciphering algorithm is known and supported in the network, without initiating a authentication and ciphering procedure. If the GPRS ciphering key sequence number stored in the network does not match the GPRS ciphering key sequence number received from the MS in the ATTACH REQUEST message, then the network should authenticate the MS. In A/Gb mode, the MS starts ciphering after sending the AUTHENTICATION AND CIPHERING RESPONSE message. The network starts ciphering when a valid AUTHENTICATION AND CIPHERING RESPONSE is received from the MS. In Iu mode, the MS starts ciphering and integrity checking according to the conditions specified in specification 3GPP TS 25.331[ None ]  [23c]. In A/Gb mode, as an option, the network may decide to continue ciphering without sending an AUTHENTICATION AND CIPHERING REQUEST message after receiving a ROUTING AREA UPDATE REQUEST message with a valid GPRS ciphering key sequence number. Both the MS and the network shall use the latest ciphering parameters. The network starts ciphering when sending the ciphered ROUTING AREA UPDATE ACCEPT message to the MS. The MS starts ciphering after receiving a valid ciphered ROUTING AREA UPDATE ACCEPT message from the network. NOTE 2: In some specifications the term KSI (Key Set Identifier) is used instead of the term GPRS ciphering key sequence number.