Message Authentication Code

Description

In 3GPP security, the Message Authentication Code (MAC) is a critical element generated during the Authentication and Key Agreement (AKA) procedure. Specifically, it refers to the MAC included within the Authentication Token (AUTN) that the network sends to the User Equipment (UE) for mutual authentication. The MAC is computed by the network's Authentication Centre (AuC) using the cryptographic algorithm f1 (or its variant f1* for 5G AKA) with a secret key K (shared with the UE's USIM), a random challenge RAND, a sequence number SQN, and an Authentication Management Field (AMF) as inputs. The formula is MAC = f1_K(SQN || RAND || AMF).

The architecture involves the Home Subscriber Server (HSS)/AuC in the core network generating the authentication vector, which contains RAND, AUTN (which includes MAC and other fields), XRES, and session keys. The AUTN is sent to the serving network (e.g., MME in 4G, AMF in 5G), which forwards RAND and AUTN to the UE. Upon receipt, the UE's USIM independently computes an expected MAC (XMAC) using the same f1 algorithm, its shared key K, and the received RAND, SQN, and AMF. The USIM then compares the computed XMAC with the MAC value extracted from the received AUTN. If they match, it proves to the UE that the authentication vector was generated by an entity possessing the correct secret key K, thereby authenticating the network. A mismatch indicates a potential security threat, and authentication fails.

How it works is deeply tied to the AKA protocol's mutual authentication goal. The MAC's inclusion in AUTN allows the UE to verify the network's legitimacy before proceeding. It protects against forgery attacks; an attacker cannot construct a valid AUTN without knowledge of K. The MAC computation is one-way and cryptographically strong, ensuring that even if RAND and AUTN are intercepted, the secret key cannot be derived. Its role is foundational for establishing a trusted session, as successful MAC validation is a prerequisite for the UE to compute the session keys (CK, IK) and the network's expected response (RES), completing the mutual authentication handshake. This mechanism is used across 3G (UMTS), 4G (EPS-AKA), and 5G (5G AKA, EAP-AKA').

Purpose & Motivation

The Message Authentication Code within AKA was created to provide explicit network authentication to the user equipment, addressing a security weakness in the earlier 2G (GSM) system. In GSM, only the network authenticated the mobile station (one-way authentication), leaving it vulnerable to false base station attacks ("IMSI catchers") where a rogue network could impersonate a legitimate one. The introduction of mutual authentication in 3GPP UMTS was a fundamental security enhancement, and the MAC is the mechanism that enables the UE to verify the network.

The problem it solves is proving the network's authenticity to the UE in a shared secret key context. Without the MAC, a UE could not distinguish between a legitimate network and an attacker broadcasting a captured RAND. The MAC, derived from the shared secret K and other freshness parameters (SQN, RAND), provides this proof. Its creation was motivated by the need for stronger security as mobile networks evolved to carry sensitive data and transactions. It addresses the limitation of one-way authentication by ensuring that both parties in the communication are verified, forming the basis for secure key derivation and protecting against man-in-the-middle and replay attacks. This established the trusted foundation for all subsequent 3GPP security architectures.

Key Features

• Generated using the f1 (or f1*) cryptographic algorithm with the shared secret key K
• Embedded within the Authentication Token (AUTN) sent from network to UE
• Enables UE-side verification of network authenticity during AKA
• Uses inputs including sequence number (SQN), random challenge (RAND), and AMF for freshness
• Critical for achieving mutual authentication in 3G, 4G, and 5G systems
• Failure of MAC comparison leads to authentication rejection and possible synchronization failure procedure

Evolution Across Releases

Defining Specifications