TUAK算法笔记

笔记源自规范3GPP TS 35.231、3GPP TS35.232

1、参数

AK	匿名秘钥	48-bit
AMF	鉴权管理域	16-bit
CK	加密秘钥	128-bit or 256-bit
IK	完整性秘钥	128-bit or 256-bit
IN	一个输入值	1600-bit
INSTANCE	一个用于指定不同的操作模式和不同的参数长度的值	8-bit
K	用户秘钥	128-bit or 256-bit
MAC-A	网络身份验证代码	64-bit, 128-bit or 256-bit
MAC-S	重新同步身份验证代码	64-bit, 128-bit or 256-bit
TOP	Operator Variant Algorithm Configuration Field	256-bit
TOPC	一个由TOP和K派生的值	256-bit
OUT	f1~f5函数的输出	1600-bit
RAND	随机数	128-bit
SQN	序列号	48-bit
RES	响应值	32-bit, 64-bit, 128-bit or 256-bit

2、其他输入子串

ALGONAME[0] .. ALGONAME[55] =

0,1,0,1,0,1,0,0,  0,1,0,1,0,1,0,1,  0,1,0,0,0,0,0,1,  0,1,0,0,1,0,1,1,  0,0,1,1,0,0,0,1,  0,0,1,0,1,1,1,0,  0,0,1,1,0,0,0,0

( 即“TUAK1.0”ASIIC码的二进制表示)

INSTANCE[0] .. INSTANCE[1]  指出正在实现的功能

INSTANCE[2]…INSTANCE[4]  指示MAC-A/MAC-S或RES输出的长度，或者在导出TOPC时，它们都设置为零

INSTANCE[5] ..  INSTANCE[7]  指示CK/IK/K的长度是否为256位

 3、函数f1 ~f5

f1    网络认证功能；

f1*    重新同步消息认证功能；

f2    用户认证功能；

f3    加密密钥导出函数

f4    完整性密钥导出函数

f5    匿名密钥导出函数；

f5*    用于重同步的匿名密钥导出函数

4、TUAK算法框架

 

第一个图说明了TOPC的由来。

第二个图说明了MAC-A(f1)或MAC-S(f1*)的派生，每种情况下实例字节的值都不同。

第三个图说明了RES(f2)、CK(f3)、IK(使用f4)和AK(f5)的派生，或者是AK(f5*)的派生。

4.1  TOPC的计算

INSTANCE[0] .. INSTANCE[6] = 0,0,0,0,0,0,0

INSTANCE[7]  = 0   if the length of K is 128 bits

                        = 1   if the length of K is 256 bits

IN[0] .. IN[255] = TOP[255] .. TOP[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[i] = 0 for 320 ≤ i ≤ 511        

IN[512] .. IN[767] = K[255] .. K [0]        if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0]        if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767                    if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

OUT = Π(IN)            (Kaccak-f[1600],负责对内部状态进行搅拌的函数f,内部状态的比特长度1600。)

提取TOPC:

TOPC[0] .. TOPC[255] = OUT[255] .. OUT[0]

4.2 函数f1

INSTANCE[0] .. INSTANCE[1] = 0,0

INSTANCE[2] .. INSTANCE[4] = 0,0,1   if the MAC-A length is 64 bits

         = 0,1,0   if the MAC-A length is 128 bits

                                        = 1,0,0   if the MAC-A length is 256 bits

INSTANCE[5] .. INSTANCE[6] = 0,0

INSTANCE[7] = 0   if the length of K is 128 bits

                       = 1   if the length of K is 256 bits

IN[0] .. IN[255] = TOPC[255] .. TOPC[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[320] .. IN[447] = RAND[127] .. RAND[0]

IN[448] .. IN[463] = AMF[15] .. AMF[0]

IN[464] .. IN[511] = SQN[47] .. SQN[0]

IN[512] .. IN[767] = K[255] .. K [0]        if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0]        if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767                    if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

OUT = Π(IN)

提取MAC-A：

Output of f1 = MAC-A, where

MAC-A[0] .. MAC-A[63]  = OUT[63] .. OUT[0]    if the MAC-A  length is 64 bits

MAC-A[0] .. MAC-A[127] = OUT[127] .. OUT[0]   if the MAC-A  length is 128 bits

MAC-A[0] .. MAC-A[255] = OUT[255] .. OUT[0]   if the MAC-A  length is 256 bits

4.3函数f1*

INSTANCE[0] .. INSTANCE[1] = 1,0

INSTANCE[2] .. INSTANCE[4] = 0,0,1   if the MAC-S length is 64 bits

         = 0,1,0   if the MAC-S length is 128 bits

                                       = 1,0,0   if the MAC-S length is 256 bits

INSTANCE[5] .. INSTANCE[6] = 0,0

INSTANCE[7] = 0   if the length of K is 128 bits

                       = 1   if the length of K is 256 bits

 

IN[0] .. IN[255] = TOPC[255] .. TOPC[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[320] .. IN[447] = RAND[127] .. RAND[0]

IN[448] .. IN[463] = AMF[15] .. AMF[0]

IN[464] .. IN[511] = SQN[47] .. SQN[0]

IN[512] .. IN[767] = K[255] .. K [0]        if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0]        if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767                    if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

OUT = Π(IN)

提取MAC-S：

Output of f1* = MAC-S, where

MAC-S[0] .. MAC-S[63]   = OUT[63] .. OUT[0]     if the MAC-S  length is 64 bits

MAC-S[0] .. MAC-S[127] = OUT[127] .. OUT[0]   if the MAC-S  length is 128 bits

MAC-S[0] .. MAC-S[255] = OUT[255] .. OUT[0]   if the MAC-S  length is 256 bits

4.4 函数f2, f3, f4 和 f5

INSTANCE[0] .. INSTANCE[1] = 0,1

INSTANCE[2] .. INSTANCE[4] = 0,0,0   if the length of RES is 32 bits

                                                 = 0,0,1   if the length of RES is 64 bits

                                                 = 0,1,0   if the length of RES is 128 bits

                                                 = 1,0,0   if the length of RES is 256 bits

INSTANCE[5] = 0  if the length of CK is 128 bits

                       = 1  if the length of CK is 256 bits

INSTANCE[6] = 0  if the length of IK is 128 bits

                       = 1  if the length of IK is 256 bits

INSTANCE[7] = 0  if the length of K is 128 bits

                       = 1  if the length of K is 256 bits

IN[0] .. IN[255] = TOPC[255] .. TOPC[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[320] .. IN[447] = RAND[127] .. RAND[0]

IN[i] = 0 for 448 ≤ i ≤ 511

IN[512] .. IN[767] = K[255] .. K [0]        if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0]        if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767                       if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

OUT = Π(IN)

提取RES：

Output of f2 = RES, where:

RES[0] .. RES[31]   = OUT[31] .. OUT[0]   if the RES length is 32 bits

RES[0] .. RES[63]   = OUT[63] .. OUT[0]   if the RES length is 64 bits

RES[0] .. RES[127] = OUT[127] .. OUT[0]   if the RES length is 128 bits

RES[0] .. RES[255] = OUT[255] .. OUT[0]   if the RES length is 256 bits

 

提取CK：

Output of f3 = CK, where:

CK[0] .. CK[127] = OUT[383] .. OUT[256]  if the CK length is 128 bits

CK[0] .. CK[255] = OUT[511] .. OUT[256]  if the CK length is 256 bits

 

提取IK：

Output of f4 = IK, where:

 IK[0] .. IK[127]   = OUT[639] .. OUT[512]  if the IK length is 128 bits

 IK[0] .. IK[255]   = OUT[767] .. OUT[512]  if the IK length is 256 bits

 

提取AK：

Output of f5 = AK, where:

AK[0] .. AK[47]  =  OUT[815] .. OUT[768]

4.5 函数f5*

INSTANCE[0] .. INSTANCE[1] = 1,1 

INSTANCE[2] .. INSTANCE[4] = 0,0,0 

INSTANCE[5] .. INSTANCE[6] = 0,0

INSTANCE[7] = 0  if the length of K is 128 bits

                       = 1  if the length of K is 256 bits

IN[0] .. IN[255] = TOPC[255] .. TOPC[0]

IN[256] .. IN[263] = INSTANCE[7] .. INSTANCE[0]

IN[264] .. IN[319] = ALGONAME[55] .. ALGONAME[0]

IN[320] .. IN[447] = RAND[127] .. RAND[0]

IN[i] = 0 for 448 ≤ i ≤ 511

IN[512] .. IN[767] = K[255] .. K [0]        if the length of K is 256 bits

IN[512] .. IN[639] = K[127] .. K [0]        if the length of K is 128 bits

IN[i] = 0 for 640 ≤ i ≤ 767                       if the length of K is 128 bits

IN[i] = 1 for 768 ≤ i ≤ 772

IN[i] = 0 for 773 ≤ i ≤ 1086

IN[1087] = 1

IN[i] = 0 for 1088 ≤ i ≤ 1599

OUT = Π(IN)

提取AK：

Output of f5* = AK, where:

AK[0] .. AK[47] = OUT[815] .. OUT[768]

5.具体数据表示

根据规范3GPP TS35.232整理

example--计算TPOC的细节

TOPc:

bd04d9530e87513c5d837ac2ad954623a8e2330c115305a73eb45d1f40cccbff