# 5G-AKA-FS: A 5G Authentication and Key Agreement Protocol for Forward Secrecy
## 4 A 5G-AKA Protocol for Forward Secrecy
### The Challenge-Response Phase: Step 2
#### 4.2.3 Step 2.3 (UE)  
**Step 2.3 (UE)**  
_Inputs._ Upon receiving \((RAND,AUTN)\) from SN, UE executes the following steps:  
1. In the UE, the ME forwards the received \(RAND\) and \(AUTN\) to the SIM
2. The SIM computes a Diffie-Hellman key \(DHK=r\cdot RAND\)
3. Run the SIM card command AUTMENTICATE\((RAND,DHK,AUTN)\)
4. Compute \(AK\leftarrow\texttt{f}_{5}(k,RAND\oplus DHK)\)
5. Parse \(AUTN\) as \((CONC,AMF,MAC)\)
6. De-concel \(SQN_{HN}\gets AK\oplus CONC\)
7. Check \(\texttt{f}_{1}(k,SQN_{HN},AMF,RAND\oplus DHK)=MAC\)  
* If this check does not pass, the SIM card returns \(\bot\) and then UE sends a failure message Mac_Failure to SN (see _Case i_)
* Otherwise, proceed to the next step
8. Check \(SQN_{UE}<SQN_{HN}<SQN_{UE}+\Delta\) (The first condition \(SQN_{UE}<SQN_{HN}\) ensures the freshness of \((RAND,AUTN)\). Also, the second condition \(SQN_{HN}<SQN_{UE}+\Delta\), which is optional in the non-normative Anne C of TS 33.102 [27], prevents a wrap-around of \(SQN_{UE}\). For example, if \(A\) is too small (i.e., \(\Delta=2\)), an attacker can make a synchronization failure by sending \(SUCI\) computed by the attacker with a fake SUPI. After this attack, the honest UE and HN can no longer authenticate each other. In TS 33.102 [27], a recommended value of \(\Delta\) is \(2^{\text{28}}\) so as to decrease the synchronization failure rate.)  
* If this check does not pass, the SIM card computes \(MAC^{*}\leftarrow\texttt{f}_{1}^{*}(k,SQN_{UE},AMF,RAND\oplus DHK)\) and returns \(AUITS\leftarrow(AK^{*}\oplus SQN_{UE},AMF,MAC^{*})\) where \(AK^{*}\leftarrow\texttt{f}_{5}^{*}(k,RAND\oplus DHK)\). Then, UE re-synchronizes with HN by sending a failure message Sync_Failure and \(AUTS\) to SN (see _Case ii_)
* Otherwise, proceed to the next step
9. Set \(SQN_{UE}\gets SQN_{HN}\)
10. Compute \(CK\leftarrow\texttt{f}_{3}(k,RAND\oplus DHK)\) and \(IK\leftarrow\texttt{f}_{4}(k,RAND\oplus DHK)\)
11. Compute \(RES\leftarrow\texttt{f}_{2}(k,RAND\oplus DHK)\) and SIM returns \(RES\), \(CK\), and \(IK\) to ME
12. The ME calculates \(RES^{*}\leftarrow\textsf{KDF}(CK||IK,ID_{SN}||RAND||RES)\) and derives \(K_{AUSF}\leftarrow\textsf{KDF}(CK||IK,ID_{SN}||CONC||CHK)\) and \(K_{SEAF}\leftarrow\textsf{KDF}(K_{AUSF},ID_{SN})\)
13. The UE returns \((K_{SEAF},RES^{*})\)  
_Outputs._ The UE stores \(K_{SEAF}\) and sends \(RES^{*}\) to SN (see _Case iii_)  
_Case i_ **(The SIM card returns \(\bot\)):** The UE re-synchronizes with HN by sending a failure message Sync_Failure and \(AUTS\) to SN. Upon receiving (Sync_Failure, \(AUTS\)), SN sends \((\textsf{Sync\_Failure},AUTS,RAND,SUCI)\) to HN. Then, HN parses \(AUTS\) as \((AK^{*}\oplus SQN_{UE},AMF,MAC^{*})\), and de-concelos \(SQN_{UE}\gets AK^{*}\oplus SQN_{UE}\oplus f_{5}^{*}(k,RAND\oplus DHK)\). Next, HN checks its authenticity by comparing \(MAC^{*}=f_{1}^{*}(k,SQN_{UE},AMF,RAND\oplus DHK)\). If the check holds, HN re-sets \(SQN_{HN}\) by \(SQN_{UE}+1\) (i.e., \(SQN_{HN}\gets SQN_{UE}+1\)).  
_Case iii_ **(The SIM card returns \((K_{SEAF},RES^{*})\)):** The UE stores \(K_{SEAF}\) and sends \((RES^{*})\) to SN. Upon receiving \((RES^{*})\), SN computes a hashed value \(HRES^{*}\leftarrow\textsf{LEFT}(128,\)  
\(H_{\text{SHA-256}}(RAND||RES^{*}))\) and checks its validity by comparing \(HRES^{*}=HXRES^{*}\). If \(HRES^{*}=HXRES^{*}\), SN forwards \((RES^{*})\) to HN. Next, HN authenticates UE by comparing \(RES^{*}=XRES^{*}\). If \(RES^{*}=XRES^{*}\), HN sends its result and \((SUPI,K_{SEAF})\) to SN. The SN continues the protocol only if both checks hold, and aborts the protocol otherwise. When all checks pass, UE and SN communicate with session keys derived from anchor keys (i.e., \(K_{SEAF}\)) in the subsequent 5G procedures. According to TS 33.501 [3], UE and SN should confirm the keys agreed and the identities of each other implicitly through the successful use of keys in subsequent procedures, which can be expressed by a key-confirmation round trip with \(K_{SEAF}\).