# Mdpj _sciences_
## 3 Review of the DMRN Protocol
### Protocol Description
#### 3.4.3 Phase C: The Authentication Phase  
(6) Once the HMAC value \(c_{3}\) is verified, the HN proceeds to retrieve the UE's long-term key \(K\) associated with the received SUPI. Using the public key \(pk_{U}\), the HN then employs the Encaps() algorithm to derive the secret key \(K_{S2}\) and generate the ciphertext \(c_{4}\). After obtaining the secret key \(K_{S2}\), the HN computes \(\text{AK}\gets f_{S}(K,K_{S2})\), \(\text{CONC}\gets R_{SN}\oplus AK\), CK \(\gets f_{3}(K,K_{S2})\), and \(\text{IK}\gets f_{4}(K,K_{S2})\). In turn, it forms the AUTN by concatenating CONC and MAC. Furthermore, it computes the expected response XRES using a cryptographic function \(f_{2}\), with \(K\) and \(K_{S2}\) as inputs. Additionally, an enhanced expected response XRES* is calculated using a KDF that combines CK, IK, \(K_{S2}\), XRES, and \(ID_{SN}\). The HN alsocomputes HXRES* by applying the SHA-256 hash function to \(R_{SN}\) concatenated with XRES*. Afterwards, the key \(K_{AUSF}\) is calculated using a KDF with CK, IK, \(K_{S2}\), CONC, and \(1D_{SN}\) as inputs. Subsequently, the key \(K_{SEAF}\) is derived from \(K_{AUSF}\) and \(1D_{SN}\), followed by computing the key \(K_{3}\) by XORing XRES* and the AK. Finally, the HN generates encrypted message M, which contains the concatenation of \(K_{SEAF}\) and SUPI using the key \(K_{3}\).  
Figure 2: DMRN Protocol.  
(7)-(8) The HN transmits {AUTN, HXRES*, M, \(c_{4}\)} to the SN in the secure channel. Then, the SN relays {AUTN, \(c_{4}\)} to the UE in the open channel.  
(9)-(10) When obtaining the message from the SN, the ME derives the secret key \(K_{S2}\) using the Decaps(0) algorithm with the stored secret key \(sk_{U}\) and ciphertext \(c_{4}\) as input, namely, \(K_{S2}\leftarrow\) Decaps(\(sk_{U},c_{4}\)). Then, the ME parses the AUTN into the two values CONC and MAC, where CONC is derived from XORing \(R_{SN}\) with AK, followed by computing AK \(\leftarrow\)\(f_{5}(K,K_{S2})\) and recovering \(R_{SN}\) through XORing AK with CONC. Next, UE verifies the MAC within the AUTN by checking if it matches the output cryptographic function \(f_{1}\) applied to \(K\), \(K_{S2}\), and \(R_{SN}\). If the check fails, the process is aborted. Otherwise, the UE continues to compute RES, CK, IK, and RES*. Finally, two session keys, \(K_{AUSF}\) and \(K_{SEAF}\), are derived for secure communication. Then, the UE forwards the RES* to the SN.  
(11)-(12) Upon obtaining the RES* value from the UE, the SN proceeds to verify its integrity and authenticity. For that, it computes the hash using the SHA-256 algorithm on the concatenation of \(R_{SN}\) and RES*. This generated hash is then compared against the HXRES* value provided by the HN to ensure consistency and validity. If the check fails, the process is aborted, indicating a failure in the authentication. Otherwise, the SN proceeds to the next step. In more detail, the SN parses the AUTN received earlier into its components: CONC and MAC. Using \(R_{SN}\), the SN extracts the AK by XORing \(R_{SN}\) with CONC. This step allows the SN to reverse the operation performed earlier by the HN to conceal \(R_{SN}\). Next, the SN computes the key \(K_{3}\) by XORing the extracted AK with the received RES*. After computing the key \(K_{3}\), the SN uses it to decrypt the message M into the SUPI and the key anchor key \(K_{SEAF}\), which will be used for securing further communication between the UE and the SN. Then, the SN forwards the RES* to the HN.  
(13)-(14) Upon receiving the RES* (the UE's response relayed through the SN), the HN verifies its authenticity by comparing it to the expected response XRES* that the HN had previously computed based on its knowledge of the cryptographic keys and the authentication parameters. If the check passes, confirming that XRES* equals RES*, the HN sends a confirmation message to the SN. This message informs the SN that the UE has been successfully authenticated and that the session keys and other security parameters are valid.