The Mobile uses a key and the Challenge to generate the response. Both sides use the A8 algorithm to generate a common session key, which is used to encrypt data during the session.
Mobiles are very trusting, only a one way authentication system.
The base station is not authenticated but trusted without question. A5 is in the data path and must be fast. Mobile can verify that its original message was not tampered with Avoids one private key operation at the mobile, less computing on the mobile side. This is most likely done with a digest function such as MD-5 with both the encrypted random numbers as the input. This is then signed with the private key of the mobile host, and sent to the base station.