to zero), followed by the NONCE_MT value (a total of 296 bytes).
A.6. EAP-Response/SIM/Challenge
The client’s response looks like this:
02 ; Code: Response
02 ; Identifier: 2
00 1c ; Length: 28 octets
12 ; Type: EAP-SIM
0b ; EAP-SIM subtype: Challenge
00 00 ; (reserved)
0b ; Attribute type: AT_MAC
05 ; Attribute length: 20 octets (5*4)
00 00 ; (reserved)
f5 6d 64 33 ; MAC value
e6 8e d2 97
6a c1 19 37
fc 3d 11 54
The MAC is calculated over the EAP packet above (with MAC value set
to zero), followed by the SRES values (a total of 40 bytes).
A.7. EAP-Success
The last packet is an EAP-Success:
03 ; Code: Success
02 ; Identifier: 2
00 04 ; Length: 4 octets
A.8. Fast Re-authentication
When performing fast re-authentication, the EAP-Request/Identity
packet is the same as usual. The EAP-Response/Identity contains the
fast re-authentication identity (from AT_ENCR_DATA attribute above):
02 ; Code: Response
00 ; Identifier: 0
00 56 ; Length: 86 octets
01 ; Type: Identity
59 32 34 66 4e 53 72 7a 38 42 50 32 37 34 6a 4f
4a 61 46 31 37 57 66 78 49 38 59 4f 37 51 58 30
30 70 4d 58 6b 39 58 4d 4d 56 4f 77 37 62 72 6f
61 4e 68 54 63 7a 75 46 71 35 33 61 45 70 4f 6b
6b 33 4c 30 64 6d 40 65 61 70 73 69 6d 2e 66 6f
6f
A.9. EAP-Request/SIM/Re-authentication
The server recognizes the reauthentication identity, so it will
respond with EAP-Request/SIM/Re-authentication. It retrieves the
associated counter value, generates a nonce, and picks a new
reauthentication identity (in this case,
"uta0M0iyIsMwWp5TTdSdnOLvg2XDVf21OYt1vnfiMcs5dnIDHOIFVavIRzMR
yzW6vFzdHW@eapsim.foo").
The following plaintext will be encrypted and stored in the
AT_ENCR_DATA attribute. Note that AT_PADDING is not used because the
length of the plaintext is a multiple of 16 bytes.
13 ; Attribute type: AT_COUNTER
01 ; Attribute length: 4 octets (1*4)
00 01 ; Counter value
15 ; Attribute type: AT_NONCE_S
05 ; Attribute length: 20 octets (5*4)
00 00 ; (reserved)
01 23 45 67 ; NONCE_S value
89 ab cd ef
fe dc ba 98
76 54 32 10
85 ; Attribute type: AT_NEXT_REAUTH_ID
16 ; Attribute length: 88 octets (22*4)
00 51 ; Actual re-auth identity length: 81 octets
75 74 61 30 4d 30 69 79 49 73 4d 77 57 70 35 54
54 64 53 64 6e 4f 4c 76 67 32 58 44 56 66 32 31
4f 59 74 31 76 6e 66 69 4d 63 73 35 64 6e 49 44
48 4f 49 46 56 61 76 49 52 7a 4d 52 79 7a 57 36
76 46 7a 64 48 57 40 65 61 70 73 69 6d 2e 66 6f
6f
00 00 00 ; (attribute padding)
The EAP packet looks like this:
01 ; Code: Request
01 ; Identifier: 1
00 a4 ; Length: 164 octets
12 ; Type: EAP-SIM
0d ; EAP-SIM subtype: Re-authentication
00 00 ; (reserved)
81 ; Attribute type: AT_IV
05 ; Attribute length: 20 octets (5*4)
00 00 ; (reserved)
d5 85 ac 77 ; IV value
86 b9 03 36
65 7c 77 b4
65 75 b9 c4
82 ; Attribute type: AT_ENCR_DATA
1d ; Attribute length: 116 octets (29*4)
00 00 ; (reserved)
68 62 91 a9 d2 ab c5 8c aa 32 94 b6 e8 5b 44 84
6c 44 e5 dc b2 de 8b 9e 80 d6 9d 49 85 8a 5d b8
4c dc 1c 9b c9 5c 01 b9 6b 6e ca 31 34 74 ae a6
d3 14 16 e1 9d aa 9d f7 0f 05 00 88 41 ca 80 14
96 4d 3b 30 a4 9b cf 43 e4 d3 f1 8e 86 29 5a 4a
2b 38 d9 6c 97 05 c2 bb b0 5c 4a ac e9 7d 5e af
f5 64 04 6c 8b d3 0b c3 9b e5 e1 7a ce 2b 10 a6
0b ; Attribute type: AT_MAC
05 ; Attribute length: 20 octets (5*4)
00 00 ; (reserved)
48 3a 17 99 ; MAC value
b8 3d 7c d3
d0 a1 e4 01
d9 ee 47 70
The MAC is calculated over the EAP packet above (with MAC value set
to zero; a total of 164 bytes).
Finally, the server derives new keys. The XKEY’ is calculated as
described in Section 7*:
XKEY’ = 863dc120 32e08343 c1a2308d b48377f6 801f58d4
The new MSK and EMSK are derived using the PRNG (note that K_encr and
K_aut stay the same).
MSK = 6263f614 973895e1 335f7e30 cff028ee
2176f519 002c9abe 732fe0ef 00cf167c
756d9e4c ed6d5ed6 40eb3fe3 8565ca07
6e7fb8a8 17cfe8d9 adbce441 d47c4f5e
EMSK = 3d8ff786 3a630b2b 06e2cf20 9684c13f
6b82f992 f2b06f1b 54bf51ef 237f2a40
1ef5e0d7 e098a34c 533eaebf 34578854
b7721526 20a777f0 e0340884 a294fb73
A.10. EAP-Response/SIM/Re-authentication
The client’s response includes the counter as well. The following
plaintext will be encrypted and stored in the AT_ENCR_DATA attribute:
13 ; Attribute type: AT_COUNTER
01 ; Attribute length: 4 octets (1*4)
00 01 ; Counter value
06 ; Attribute type: AT_PADDING
03 ; Attribute length: 12 octets (3*4)
00 00 00 00
00 00 00 00
00 00
The EAP packet looks like this:
02 ; Code: Response
01 ; Identifier: 1
00 44 ; Length: 68 octets
12 ; Type: EAP-SIM
0d ; EAP-SIM subtype: Re-authentication
00 00 ; (reserved)
81 ; Attribute type: AT_IV
05 ; Attribute length: 20 octets (5*4)
00 00 ; (reserved)
cd f7 ff a6 ; IV value
5d e0 4c 02
6b 56 c8 6b
76 b1 02 ea
82 ; Attribute type: AT_ENCR_DATA
05 ; Attribute length: 20 octets (5*4)
00 00 ; (reserved)
b6 ed d3 82
79 e2 a1 42
3c 1a fc 5c
45 5c 7d 56
0b ; Attribute type: AT_MAC
05 ; Attribute length: 20 octets (5*4)
00 00 ; (reserved)
fa f7 6b 71 ; MAC value
fb e2 d2 55
b9 6a 35 66
c9 15 c6 17
The MAC is calculated over the EAP packet above (with MAC value set
to zero), followed by the NONCE_S value (a total of 84 bytes).
The next packet will be EAP-Success:
03 ; Code: Success
01 ; Identifier: 1
00 04 ; Length: 4 octets
Appendix B. Pseudo-Random Number Generator
The "|" character denotes concatenation, and "^" denotes
exponentiation.
Step 1: Choose a new, secret value for the seed-key, XKEY
Step 2: In hexadecimal notation let
t = 67452301 EFCDAB89 98BADCFE 10325476 C3D2E1F0
This is the initial value for H0|H1|H2|H3|H4
in the FIPS SHS [SHA-1]
Step 3: For j = 0 to m - 1 do
3.1 XSEED_j = 0 /* no optional user input */
3.2 For i = 0 to 1 do
a. XVAL = (XKEY + XSEED_j) mod 2^b
b. w_i = G(t, XVAL)
c. XKEY = (1 + XKEY + w_i) mod 2^b
3.3 x_j = w_0|w_1
Authors’ Addresses
Henry Haverinen (editor)
Nokia Enterprise Solutions
P.O. Box 12
FIN-40101 Jyvaskyla
Finland
EMail: henry.haverinen@nokia.com
Joseph Salowey (editor)
Cisco Systems
2901 Third Avenue
Seattle, WA 98121
USA
Phone: +1 206 256 3380
EMail: jsalowey@cisco.com
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).