name: AK
full_form: Authentication Key
context: This annex shows how the AUTS calculation could be modified in order to avoid keystream re-use during AKA re-synchronisations procedure. The f5* function given in clause 6.3.3 only has RAND as a non-key input and hence if an authentication challenge (RAND, AUTN) is replayed, then the same AK is calculated which is then used to protect different SQNMS values. This possibly leaks some bits of SQNMS as shown in Borgaonkar et al (2019) [43]. If this is a concern to an operator, then a modified f5* function using MAC-S as an additional input can be used as shown in figure J.1-1 with the dashed line showing the change from clause 6.3.3. NOTE: Including MAC-S as an input to f5* ensures that AK is unique for each SQNMS. It is home network decision to include or not MAC-S as input to f5*. Figure J.1-1: Construction of the parameter AUTS with a modified f5* function When using the modified f5* function, the re-synchronisation proceeds as described in clauses 6.3.3. and 6.3.5 with the following changes: - in clause 6.3.3, the USIM calculates AUTS = Conc(SQNMS ) || MAC-S where Conc(SQNMS) = SQNMS f5*K(RAND, MAC-S) and MAC-S is calculated as given in clause 6.3.3; and - in clause 6.3.5, the HE/AuC retrieves SQNMS from Conc(SQNMS) by computing Conc(SQNMS) f5*K(RAND, MAC-S).
description: The Authentication Key (AK) is a parameter used in the AKA re-synchronisations procedure to ensure secure authentication and protect sensitive information such as SQNMS values. It is calculated using the f5* function, which can be modified to include MAC-S as an additional input to prevent keystream re-use and potential leakage of SQNMS bits.
explanation: AK is classified as a Parameter because it serves as a specific value used in the authentication process, influencing how data is protected during AKA re-synchronisations. Its calculation involves inputs like RAND and MAC-S, aligning with the context provided about modifying the f5* function to enhance security.
section_title: J.1 Modified f5* function
biotag_Context: O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Device,O,B-Parameter,O,O,O,O,B-Parameter,O,O,O,B-Parameter,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O
biotag_Description: O,B-Parameter,I-Parameter,O,O,O,O,O,O,O,B-Protocol,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O,O,O,O,O,O,O,O,O,O,O,O,B-Parameter,O