Section: C.3.3 Profile 3: management of sequence numbers which are entirely time-based
Content: Generation of sequence numbers: This follows the scheme for the generation of sequence numbers specified in Annex C.1.1.3. The following parameter values are suggested for reference: Time unit of the clock: It has to be chosen in such a way that no two requests for a batch of authentication vectors arrive during one time unit. Value = 0.1 seconds Length of in bits = 5. Start conditions: GLC = 1 and, for all users, DIF = 0. Verification of sequence numbers in the USIM: This is done according to the handling of sequence numbers in the USIM specified in Annex C.2. Length of the array: a = 32. This satisfies the requirement in section 6.3.2 that the mechanism for the verification of sequence numbers shall ensure that a sequence number can still be accepted if it is among the last x sequence numbers generated. Protection against wrap around: Choose = 228. Choosing = 228 means that an attack to force the counter in the USIM to wrap around would require at least SEQmax/ = 215 > 32.000 successful authentications (cf. note 6 of C.2.3). Note 7 of C.2.3 does not apply. Age limit for sequence numbers: The use of such a limit is optional. The choice of a value for the parameter L affects only the USIM. It has no impact on the choice of other parameters and it entirely up to the operator, depending on his security policy. Therefore no particular value is suggested here. To give an example: if the policy stipulates that authentication vectors older than x time units shall be rejected then L has to be set to x. User anonymity: the value of SQN does not allow to trace the user over longer periods. Therefore, there may be no need to conceal SQN by an anonymity key as specified in section 6.3.