6 Definition of the example algorithms

35.2313GPPDocument 1: Algorithm specificationRelease 17Specification of the TUAK algorithm set: A second example algorithm set for the 3GPP authentication and key generation functions f1, f1*, f2, f3, f4, f5 and f5*TS

6.1 Derivation of TOP_C

The INSTANCE variable is constructed as follows:

INSTANCE[0] .. INSTANCE[6] = 0,0,0,0,0,0,0

INSTANCE[7] = 0 if the length of K is 128 bits

= 1 if the length of K is 256 bits

The 1600-bit value IN is then constructed as follows:

IN[0] .. IN[255] = TOP[255] .. TOP[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[i] = 0 for 320 ≤ i ≤ 511

IN[512] .. IN[767] = K[255] .. K [0] if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0] if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767 if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

Then apply the permutation:

OUT = Π(IN)

And extract TOP_C as follows:

TOP_C[0] .. TOP_C[255] = OUT[255] .. OUT[0]

6.2 Specification of the function f1

The internal INSTANCE variable is constructed as follows:

INSTANCE[0] .. INSTANCE[1] = 0,0

INSTANCE[2] .. INSTANCE[4] = 0,0,1 if the MAC-A length is 64 bits

= 0,1,0 if the MAC-A length is 128 bits

= 1,0,0 if the MAC-A length is 256 bits

INSTANCE[5] .. INSTANCE[6] = 0,0

INSTANCE[7] = 0 if the length of K is 128 bits

= 1 if the length of K is 256 bits

The 1600-bit value IN is then constructed as follows:

IN[0] .. IN[255] = TOP_C[255] .. TOP_C[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[320] .. IN[447] = RAND[127] .. RAND[0]

IN[448] .. IN[463] = AMF[15] .. AMF[0]

IN[464] .. IN[511] = SQN[47] .. SQN[0]

IN[512] .. IN[767] = K[255] .. K [0] if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0] if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767 if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

Then apply the permutation:

OUT = Π(IN)

And extract function output as follows.

Output of f1 = MAC-A, where

MAC-A[0] .. MAC-A[63] = OUT[63] .. OUT[0] if the MAC-A length is 64 bits

MAC-A[0] .. MAC-A[127] = OUT[127] .. OUT[0] if the MAC-A length is 128 bits

[0] .. MAC-A[255] = OUT[255] .. OUT[0] if the MAC-A length is 256 bits

6.3. Specification of the function f1*

The internal INSTANCE variable is constructed as follows. The construction is very similar to f1, except that INSTANCE[0] is 1 rather than 0:

INSTANCE[0] .. INSTANCE[1] = 1,0

INSTANCE[2] .. INSTANCE[4] = 0,0,1 if the MAC-S length is 64 bits

= 0,1,0 if the MAC-S length is 128 bits

= 1,0,0 if the MAC-S length is 256 bits

INSTANCE[5] .. INSTANCE[6] = 0,0

INSTANCE[7] = 0 if the length of K is 128 bits

= 1 if the length of K is 256 bits

The 1600-bit value IN is then constructed in exactly the same way as for f1 (but note IN[263] will be 1 rather than 0).

Then the permutation:

OUT = Π(IN)

is applied and the function output is extracted as follows.

Output of f1* = MAC-S, where

MAC-S[0] .. MAC-S[63] = OUT[63] .. OUT[0] if the MAC-S length is 64 bits

MAC-S[0] .. MAC-S[127] = OUT[127] .. OUT[0] if the MAC-S length is 128 bits

MAC-S[0] .. MAC-S[255] = OUT[255] .. OUT[0] if the MAC-S length is 256 bits

6.4 Specification of the functions f2, f3, f4 and f5

The internal INSTANCE variable is constructed as follows:

INSTANCE[0] .. INSTANCE[1] = 0,1

INSTANCE[2] .. INSTANCE[4] = 0,0,0 if the length of RES is 32 bits

= 0,0,1 if the length of RES is 64 bits

= 0,1,0 if the length of RES is 128 bits

= 1,0,0 if the length of RES is 256 bits

INSTANCE[5] = 0 if the length of CK is 128 bits

= 1 if the length of CK is 256 bits

INSTANCE[6] = 0 if the length of IK is 128 bits

= 1 if the length of IK is 256 bits

INSTANCE[7] = 0 if the length of K is 128 bits

= 1 if the length of K is 256 bits

The 1600-bit value IN is then constructed as follows:

IN[0] .. IN[255] = TOP_C[255] .. TOP_C[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[320] .. IN[447] = RAND[127] .. RAND[0]

IN[i] = 0 for 448 ≤ i ≤ 511

IN[512] .. IN[767] = K[255] .. K [0] if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0] if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767 if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

Then the permutation:

OUT = Π(IN)

is applied and the function outputs are extracted as follows:

Output of f2 = RES, where:

RES[0] .. RES[31] = OUT[31] .. OUT[0] if the RES length is 32 bits

RES[0] .. RES[63] = OUT[63] .. OUT[0] if the RES length is 64 bits

RES[0] .. RES[127] = OUT[127] .. OUT[0] if the RES length is 128 bits

RES[0] .. RES[255] = OUT[255] .. OUT[0] if the RES length is 256 bits

Output of f3 = CK, where:

CK[0] .. CK[127] = OUT[383] .. OUT[256] if the CK length is 128 bits

CK[0] .. CK[255] = OUT[511] .. OUT[256] if the CK length is 256 bits

Output of f4 = IK, where:

IK[0] .. IK[127] = OUT[639] .. OUT[512] if the IK length is 128 bits

IK[0] .. IK[255] = OUT[767] .. OUT[512] if the IK length is 256 bits

Output of f5 = AK, where:

AK[0] .. AK[47] = OUT[815] .. OUT[768]

6.5 Specification of the function f5*

The internal INSTANCE variable is constructed as follows:

INSTANCE[0] .. INSTANCE[1] = 1,1

INSTANCE[2] .. INSTANCE[4] = 0,0,0

INSTANCE[5] .. INSTANCE[6] = 0,0

INSTANCE[7] = 0 if the length of K is 128 bits

= 1 if the length of K is 256 bits

The 1600-bit value IN is then constructed in exactly the same way as for f2, f3, f4, and f5 (but note that IN[263] will be 1 rather than 0, and that IN[257], IN[258], IN[259], IN[260] , IN[261] will all be 0).

Then the permutation:

OUT = Π(IN)

is applied and the function output is extracted as follows:

Output of f5* = AK, where:

AK[0] .. AK[47] = OUT[815] .. OUT[768]