[Samsung Galaxy Nexus] RobotJune:
Details of the authentication

This is a relatively old report, but back in March 2013 a MitM attack on wifi calling revealed some details about the authentication process.

I'm new here, so I can't post links to the report, but you can search for EECS-2013-18.pdf to find it.

Some of this AKA auth stuff will come from the iSIM applet on the SIM.

That may help, for anyone still interested in this.

[I]A. Initial DNS conversation from Wi-Fi calling client[/I]

> NAPTR wifi.msg.pc.t-mobile.com
< NAPTR 100 10 S SIPS+D2T _sips._tcp.sba.sip.t-mobile.com

> SRV _sips._tcp.sba.sip.t-mobile.com
< SRV 10 10 5061 sba.sipgeo.t-mobile.com

> A sba.sipgeo.t-mobile.com
< A <[B][I]IP[/I][/B]>

> PTR <[B][I]reverse(IP)[/I][/B]>.in-addr.arpa
< PTR m<[B][I]hex(IP)[/I][/B]>.tmodns.net

[I]B. Initial REGISTER message from Wi-Fi calling client[/I]

REGISTER sip:msg.pc.t-mobile.com SIP/2.0
To: <sip:[B][I]src-phone#[/I][/B]@msg.pc.t-mobile.com>
Max-Forwards: 70
Supported: 100rel, eventlist
User-Agent: T-mobile TAS
P-Last-Access-Network-Info: 3GPP-UTRAN-TDD; utran-cell-id-3gpp=[B][I]ID#1[/I][/B]
P-Access-Network-Info: IEEE-802.11; i-wlan-node-id=[B][I]ID#2[/I][/B]
P-Preferred-Identity: sip:[B][I]src-phone#[/I][/B]@msg.pc.t-mobile.com
Call-ID: [B][I]UUID#1[/I][/B]@[B][I]src-IP[/I][/B]
From: <sip:[B][I]src-phone#[/I][/B]@msg.pc.t-mobile.com>;tag=[B][I]UUID#2[/I][/B]
CSeq: 1 REGISTER
Content-Length: 0
Via: SIP/2.0/TLS[B][I] src-IP[/I][/B]:[B][I]src-port[/I][/B];branch=[B][I]UUID#3 [/I][/B]
Contact: <sip:[B][I]src-phone#[/I][/B]@[B][I]src-IP[/I][/B]:[B][I]src-port[/I][/B];transport=TLS>;expires=3600;
[INDENT]reg-id=1;+sip.instance="<urn:gsma:imei:IMEI;svn=00>";
+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";
+g.3gpp.smsip;
+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.e-location"[/INDENT]
Authorization: Digest username="[B][I]IMSI[/I][/B]@msg.pc.t-mobile.com",
[INDENT]realm="msg.pc.t-mobile.com", nonce="",
uri="sip:msg.pc.t-mobile.com", response="", algorithm=AKAv1-MD5[/INDENT]
Privacy: none

[I]C. INVITE message for call originating from Wi-Fi calling client[/I]

INVITE sip:[B][I]dest-phone#[/I][/B]@msg.pc.t-mobile.com;user=phone SIP/2.0
To: <sip:[B][I]dest-phone#[/I][/B]@msg.pc.t-mobile.com>
Max-Forwards: 70
Supported: 100rel
User-Agent: T-mobile TAS
P-Early-Media: supported
P-Last-Access-Network-Info: 3GPP-UTRAN-TDD; utran-cell-id-3gpp=[B][I]ID#1 [/I][/B]
P-Access-Network-Info: IEEE-802.11; i-wlan-node-id=[B][I]ID#2[/I][/B]
Call-ID: [B][I]UUID#1[/I][/B]@[B][I]src-IP[/I][/B]
From: <sip:[B][I]src-phone#[/I][/B]@msg.pc.t-mobile.com>;tag=[B][I]UUID#2[/I][/B]
CSeq: 1 INVITE
Content-Length: size
Via: SIP/2.0/TLS [B][I]src-IP[/I][/B]:[B][I]src-port[/I][/B];branch=[B][I]UUID#3[/I][/B]
Contact: <sip:[B][I]src-phone#[/I][/B]@[B][I]src-IP[/I][/B]:[B][I]src-port[/I][/B];transport=TLS>;
[INDENT]+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";
+sip.instance="<urn:gsma:imei:[B][I]IMEI[/I][/B];svn=00>"[/INDENT]
Allow: INVITE, CANCEL, ACK, OPTIONS, BYE, PRACK, UPDATE, NOTIFY,REFER, MESSAGE
Accept-Contact: *;
[INDENT]+g.3gpp.icsi_ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";
+g.3gpp.smsip[/INDENT]
Content-Type: application/sdp

v=0
o=- [B][I]session-ID[/I][/B] 1 IN IP4 [B][I]src-IP[/I][/B]
s=-
t=0 0
m=audio [B][I]src-port[/I][/B] RTP/SAVP 0
i=StreamMediaAudio
c=IN IP4 [B][I]src-IP [/I][/B]
a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:[B][I]base64-encoded key (16B) and salt (14B)[/I][/B]
a=rtpmap:0 PCMU/8000
a=sendrecv