GSM网络的鉴权采用的是Comp128-1/2/3算法，又称A3A8算法，而2G的CDMA采用的是CAVE算法，3G网络采用的是MILENAGE算法。因为上面提到的算法并不像DES/RSA那样具有公开性，所以在此就重点介绍一下他们的鉴权过程。
ICCID：8985207170012345678
IMSI：454070012345678
KI：58A3B6D2F623BB858BEA4F0012345678
OPC：BEDBDC5D7B44CB0D74C5F8A12345678
Send TLV Auth Command:008800812210351B71FED9A82648F499647BF59833FC1096A79DA94C8DF24C4E3DECCBD6EB5682
rapdu=6135
auth resp=C0DB08F54A0C993B1A6C3210418ED1B5E5A17DB3445495056F258BFB109D51C2D36ADFCF5CFD79AF912A7A8EBA0865F229F2CA21B7AE9000
发送：
10 -- RAND长度
35 1B 71 FE D9 A8 26 48 F4 99 64 7B F5 98 33 FC -- RAND值
10 -- AUTH长度
96 A7 9D A9 4C 8D F2 4C 4E 3D EC CB D6 EB 56 82 -- AUTH值
接收：
DB -- 成功标志
08 -- RES长度
F5 4A 0C 99 3B 1A 6C 32 -- RES值
10 -- CK长度
41 8E D1 B5 E5 A1 7D B3 44 54 95 05 6F 25 8B FB -- CK值
10 -- IK长度
9D 51 C2 D3 6A DF CF 5C FD 79 AF 91 2A 7A 8E BA -- IK值
08 --KC长度
65 F2 29 F2 CA 21 B7 AE -- KC 值
90 00 -- 状态
| SW1 | SW2 | 错误描述 |
|---|---|---|
| '98' | '62' | 鉴权错误，不正确的MAC |
| '98' | '64' | 鉴权错误，不支持GSM安全语境 |
image
image
image
展讯radio日志
11-08 17:04:16.414 570 578 D RIL-PHS : /dev/stty_lte3 Rev:%RSIMREQ: "MBAU": "D9B60A93715CA9EB162F075CFD47B54E","F46CB9DF6D45F24C0BA570D531D99A60",1
11-08 17:04:16.414 572 598 D use-Rlog/RLOG-AT: [1] Channel3: AT< %RSIMREQ: "MBAU": "D9B60A93715CA9EB162F075CFD47B54E","F46CB9DF6D45F24C0BA570D531D99A60",1
11-08 17:04:16.414 572 598 D use-Rlog/RLOG-RIL: [1] RSIMREQ use s_sim_num = 1 and modem = 49
11-08 17:04:16.414 572 2837 D RIL : vsim write cmd = 1,"MBAU": "D9B60A93715CA9EB162F075CFD47B54E","F46CB9DF6D45F24C0BA570D531D99A60",1
11-08 17:04:16.414 572 2837 D use-Rlog/RLOG-RIL: [1] vsim write cmd len= 82
11-08 17:04:16.414 572 2837 D use-Rlog/RLOG-RIL: [1] vsim write OK
11-08 17:04:16.414 960 2700 D RILC_ATCI: vsim_socket_1: Recv < 1,"MBAU": "D9B60A93715CA9EB162F075CFD47B54E","F46CB9DF6D45F24C0BA570D531D99A60",1
11-08 17:04:16.414 960 2700 D RILC_ATCI: readerThread serviceId: 1
11-08 17:04:16.414 960 2700 D RILC_ATCI: read MBAU
11-08 17:04:16.414 960 2700 D RILC_ATCI: vism wait for unsol response
11-08 17:04:16.414 960 2838 D RILC_ATCI: processMbau
11-08 17:04:16.414 960 2838 E RILC_ATCI: tmp = "MBAU": "D9B60A93715CA9EB162F075CFD47B54E","F46CB9DF6D45F24C0BA570D531D99A60",1
11-08 17:04:16.414 960 2838 E RILC_ATCI: strStartsWith MBAU
11-08 17:04:16.414 960 2838 E RILC_ATCI: rand = D9B60A93715CA9EB162F075CFD47B54E
11-08 17:04:16.414 960 2838 E RILC_ATCI: autn = F46CB9DF6D45F24C0BA570D531D99A60
11-08 17:04:16.414 960 2838 E RILC_ATCI: vsim_auth_cause = 1, phoneId = 1
11-08 17:04:16.414 960 2838 D RILC_ATCI: spfnCommand apdu_req:008800812210D9B60A93715CA9EB162F075CFD47B54E10F46CB9DF6D45F24C0BA570D531D99A60
KI
OPC
AES
https://wenku.baidu.com/view/5683255d915f804d2b16c1b2.html
http://www.elecfans.com/d/723353.html
网友评论