Section: 4.7.7.2 Authentication and ciphering response by the MS
Content: In A/Gb mode, an MS shall be ready to respond upon an AUTHENTICATION_AND_CIPHERING REQUEST message at any time. In UMTS, an MS shall be ready to respond upon an AUTHENTICATION_AND_CIPHERING REQUEST message at any time whilst a PS signalling connection exists. If a SIM is inserted in the MS, the MS shall ignore the Authentication Parameter AUTN IE if included in the AUTHENTICATION_AND_CIPHERING REQUEST message and perform the GSM authentication challenge. It shall not perform the authentication of the network described in subclause 4.7.7.5.1. In a GSM authentication challenge, if the AUTHENTICATION_AND_CIPHERING REQUEST message includes the authentication parameters RAND and GPRS CKSN, then upon receipt of the message, the MS processes the challenge information and sends an AUTHENTICATION_AND_CIPHERING RESPONSE message to the network. The value of the received A&C reference number information element shall be copied into the A&C reference number information element in the AUTHENTICATION_AND_CIPHERING RESPONSE message. A GSM authentication challenge will result in the SIM/USIM passing a SRES and a GPRS GSM ciphering key to the ME. The new GPRS GSM ciphering key calculated from the challenge information shall overwrite the previous one and any previously stored GPRS UMTS ciphering and GPRS UMTS integrity keys shall be deleted. The calculated GSM ciphering key shall be stored on the SIM/USIM together with the GPRS ciphering key sequence number before the AUTHENTICATION_AND_CIPHERING RESPONSE message is transmitted. In a UMTS authentication challenge, if the AUTHENTICATION_AND_CIPHERING REQUEST message includes the UMTS authentication parameters GPRS CKSN, RAND and AUTN, then upon receipt of the message, the MS verifies the AUTN parameter and if this is accepted, the MS processes the challenge information and sends an AUTHENTICATION_AND_CIPHERING RESPONSE message to the network. The value of the received A&C reference number information element shall be copied into the A&C reference number information element in the AUTHENTICATION_AND_CIPHERING RESPONSE message. A UMTS authentication challenge will result in the USIM passing a RES, a GPRS UMTS ciphering key, a GPRS UMTS integrity key and a GPRS GSM ciphering key to the ME. The new GPRS UMTS ciphering key, GPRS UMTS integrity key and GPRS GSM ciphering key calculated from the challenge information shall overwrite the previous ones. The new GPRS UMTS ciphering key, GPRS UMTS integrity key and GPRS GSM ciphering key shall be stored on the USIM together with the GPRS ciphering key sequence number before the AUTHENTICATION_AND_CIPHERING RESPONSE message is transmitted. Furthermore, in A/Gb mode if a GEA ciphering algorithm that requires a 128-bit ciphering key is taken into use, then a new GPRS GSM Kc128 shall also be calculated as described in the subclause 4.7.7.3a. In A/Gb mode, in a UMTS authentication challenge, if the MS supports integrity protection, then the MS shall ignore the GPRS GSM ciphering key received from the USIM and not store the GPRS GSM ciphering key in the ME or on the USIM. In addition, in A/Gb mode, in a UMTS authentication challenge, if the MS has indicated support of integrity protection in the MS network capability IE to the network, and if an authentication takes place in the authentication and ciphering procedure, then a new GPRS GSM Kint shall also be calculated by the MS from the new UMTS security context derived from AKA as described in the subclause 4.7.7.3b. The new GPRS GSM Kint shall be used by the MS to check and verify the message authentication code recived in the AUTHENTICATION AND CIPHERING REQUEST message as described in Annex H in 3GPP TS 43.020[ Security related network functions ]  [13]. If the integrity is successfully verified in the MS, then the MS shall check if the replayed MS network capability IE and replayed MS Radio Access Capability IE received in the AUTHENTICATION AND CIPHERING REQUEST message has not been altered compared to the latest MS network capability IE and the latest MS Radio Access Capability IE that the MS sent to the network. If the replayed MS network capability IE and the replayed MS Radio Access Capability IE received in the AUTHENTICATION AND CIPHERING REQUEST message are not the same as the latest MS network capability IE and the MS Radio Access Capability IE that the MS sent to the network, then the MS shall ignore the authentication and ciphering procedure. The network may in addition indicate a GPRS GSM integrity algorithm and a new setting of the ciphering mode and GPRS GSM ciphering algorithm, to be taken into use by the MS. If the integrity of the AUTHENTICATION AND CIPHERING REQUEST message is not successfully verified in the GMM layer, then the MS shall ignore the AUTHENTICATION AND CIPHERING REQUEST message. In A/Gb mode, in a UMTS authentication challenge if the MS has no available UMTS security context and, if the MS has indicated support for integrity protection in MS network capability IE to the network, then if the network does not activate integrity protection by indicating a GPRS GSMintegrity algorithm or does not include a message authentication code to the MS in AUTHENTICATION AND CIPHERING REQUEST message, then the MS shall ignore the AUTHENTICATION AND CIPHERING REQUEST message. In A/Gb mode, in a UMTS authentication challenge, if the MS has indicated support for integrity protection to the network and if the integrity of the AUTHENTICATION AND CIPHERING REQUEST message is successfully verified in the MS and the MS decides to reply by sending an AUTHENTICATION AND CIPHERING RESPONSE message to the network, then the MS shall integrity protect the AUTHENTICATION AND CIPHERING RESPONSE message by calculating an message authentication code at the GMM layer using the new integrity key GPRS GSM Kint calculated by the MS from the new UMTS security context derived from AKA as described in the subclause 4.7.7.3b and as described in Annex H in 3GPP TS 43.020[ Security related network functions ]  [13] and include the new message authentication code into the AUTHENTICATION AND CIPHERING RESPONSE message. When a successful authentication takes place on the USIM the GMM layer in the MS shall request the LLC layer to reset the IOV_updates counter to the value zero before sending the AUTHENTICATION AND CIPHERING RESPONSE message to the network. In Iu mode, an MS not capable of A/Gb mode shall ignore the Ciphering Algorithm IE in the AUTHENTICATION_AND_CIPHERING REQUEST message. An MS capable of both Iu mode and A/Gb mode shall store the received value in the Ciphering Algorithm IE in the AUTHENTICATION_AND_CIPHERING REQUEST message until entering state GMM-DEREGISTERED, in order to use it at an inter system change to A/Gb mode. In A/Gb mode, an MS supporting integrity protection shall store the received value in the Ciphering Algorithm IE when entering GMM-DEREGISTERED and at MS power off as described in subclause 4.7.7.3a. If the AUTHENTICATION_AND_CIPHERING REQUEST message does not include neither the GSM authentication parameters (RAND and GPRS CKSN) nor the UMTS authentication parameters (RAND, AUTN and GPRS CKSN), then upon receipt of the message, the MS replies by sending an AUTHENTICATION_AND_CIPHERING RESPONSE message to the network. In A/Gb mode, in the case of an established UMTS security context, if the MS has indicated support for integrity protection to the network, the network may only indicate a GPRS GSM integrity algorithm or a GPRS GSM ciphering algorithm or a change of ciphering mode setting in the AUTHENTICATION AND CIPHERING REQUEST message without re-authentication to the MS. The AUTHENTICATION AND CIPHERING REQUEST message shall include the new GPRS GSM integrity algorithm or the new GPRS GSM ciphering algorithm; or both, that shall be taken into use. When the MS receives this AUTHENTICATION AND CIPHERING REQUEST message without requiring a new authentication, then a new GPRS GSM Kint shall be calculated using the GPRS UMTS ciphering key and the GPRS UMTS integrity key from the already established UMTS security context stored in the ME as described in the subclause 4.7.7.3b and a new GPRS GSM Kc128 shall be calculated using the GPRS UMTS ciphering key and the GPRS UMTS integrity key from the already established UMTS security context stored in the ME as described in the subclause 4.7.7.3a and the MS replies by sending an AUTHENTICATION AND CIPHERING RESPONSE message to the network. NOTE: If only a change of GPRS GSM integrity algorithm or GPRS GSM encryption algorithm or a change of both algorithms is included in the AUTHENTICATION AND CIPHERING RESPONSE message without authentication, then the MS shall not integrity protect the AUTHENTICATION AND CIPHERING RESPONSE message at GMM layer. The MS does therefore not calculate and include a message authentication code into the AUTHENTICATION AND CIPHERING RESPONSE message at GMM layer. These GMM messages are instead integrity protected at the LLC layer with current UMTS security context. In A/Gb mode, the GMM layer shall notify the LLC layer if ciphering shall be used or not and if yes which GSM ciphering algorithm and GPRS GSM ciphering key that shall be used (see 3GPP TS 44.064[ Mobile Station - Serving GPRS Support Node (MS-SGSN); Logical Link Control (LLC) Layer Specification ]  [78a]). In A/Gb mode, if an established UMTS security context context is available in the network, if the MS has indicated support of integrity protection to the network, then the GMM layer in the MS shall assign the GPRS GSM integrity algorithm and the GPRS GSM Kint integrity key to the LLC layer after it has sent off the AUTHENTICATION AND CIPHERING RESPONSE message to the network (see 3GPP TS 43.020[ Security related network functions ]  [13] and 3GPP TS 44.064[ Mobile Station - Serving GPRS Support Node (MS-SGSN); Logical Link Control (LLC) Layer Specification ]  [78a]). A ME supporting UMTS authentication challenge shall support the following procedure: In order to avoid a synchronisation failure, when the mobile station receives an AUTHENTICATION AND CIPHERING REQUEST message, the mobile station shall store the received RAND together with the RES returned from the USIM in the volatile memory and associate it with the PS domain. When the MS receives a subsequent AUTHENTICATION AND CIPHERING REQUEST message, if the stored RAND value for the PS domain is equal to the new received value in the AUTHENTICATION AND CIPHERING REQUEST message, then the mobile station shall not pass the RAND to the USIM, but shall immediately send the AUTHENTICATION AND CIPHERING RESPONSE message with the stored RES for the PS domain. If, for the PS domain, there is no valid stored RAND in the mobile station or the stored RAND is different from the new received value in the AUTHENTICATION AND CIPHERING REQUEST message, the mobile station shall pass the RAND to the USIM, shall override any previously stored RAND and RES with the new ones and start, or reset and restart timer T3316. The RAND and RES values stored in the mobile station shall be deleted and timer T3316, if running, shall be stopped: - upon receipt of a SECURITY MODE COMMAND (Iu mode only), SERVICE ACCEPT (Iu mode only), SERVICE REJECT (Iu mode only), ROUTING AREA UPDATE_ACCEPT or AUTHENTICATION AND CIPHERING REJECT message; - upon expiry of timer T3316; - if the mobile station enters the GMM states GMM-DEREGISTERED or GMM-NULL; or - if the mobile station enters PMM-IDLE mode (Iu mode only).