Pseudo-Random Function defined by key K

Description

PRFK is a notation used in 3GPP security specifications to denote a Pseudo-Random Function (PRF) that is instantiated with a specific secret key K. The subscript K indicates that the function is keyed with K, meaning that the output depends on both the input message and the secret key K. This notation is common in cryptographic literature and is adopted in 3GPP TS 35.234 and TS 35.236 to precisely describe how keys are derived and authentication values are computed. PRFK is not a separate algorithm but a way of referring to a PRF when the key is fixed, which is essential for defining key derivation functions and message authentication codes.

In 3GPP security procedures, PRFK is used to derive cryptographic keys from a root key. For example, during 5G-AKA, the Authentication Server Function (AUSF) and the UE both possess a shared secret key K. They use PRFK with different input strings to derive keys such as KAUSF, KSEAF, and KAMF. The notation PRFK(input) makes it explicit that the derivation uses the key K. Similarly, PRFK is used to compute the authentication response (RES) and the expected response (XRES) in authentication procedures, ensuring that both parties compute the same value without revealing K.

The security of PRFK relies on the properties of the underlying PRF: given K, the output is deterministic and indistinguishable from random to an adversary without K. The key K must be kept secret and is typically stored in the UE's UICC and in the UDM/AUSF in the network. The PRFK is designed to resist cryptanalysis, including known-plaintext and chosen-plaintext attacks, as long as the underlying PRF (e.g., HMAC-SHA-256) is secure.

Architecturally, PRFK is implemented in the same network functions that implement the PRF: the UE, AUSF, UDM, and AMF. The notation is used in specifications to define the exact inputs and outputs of key derivation procedures. For instance, TS 35.234 may define a key derivation function as KDF(K, input) = PRFK(input), where KDF is the key derivation function. This abstraction allows 3GPP to specify security procedures in a modular way, separating the definition of the PRF from the specific inputs used in each procedure.

The introduction of PRFK in Release 19 alongside PRF reflects the need for precise, standardized notation in 3GPP security specifications. While the concept of a keyed PRF has been used implicitly in earlier algorithms like MILENAGE and TUAK, the explicit notation PRFK provides clarity for implementers and ensures that key derivation and authentication procedures are unambiguously defined. PRFK is thus a critical component of the 3GPP security framework, enabling secure and interoperable authentication and key agreement in 5G and beyond.

Purpose & Motivation

PRFK exists to provide a precise notation for a Pseudo-Random Function that is keyed with a specific secret key K. In cryptographic protocols, it is often necessary to distinguish between the general PRF and its instantiation with a particular key. The notation PRFK makes it explicit that the function's output depends on the secret key K, which is essential for defining key derivation and authentication procedures in 3GPP specifications.

Before the explicit introduction of PRFK in Release 19, 3GPP specifications described keyed pseudo-random functions in prose or through algorithm-specific notations. This could lead to ambiguity, especially when multiple keys are involved in a procedure. The PRFK notation, specified in TS 35.234 and TS 35.236, addresses this by providing a standardized way to denote a keyed PRF. It allows specifications to define key derivation functions as PRFK(input), making it clear that the derivation uses the key K and that both the UE and the network must possess K to compute the same output.

The motivation for PRFK is rooted in the need for clarity and interoperability in 5G security. As 5G networks support diverse services and access types, the number of keys and key derivation steps has increased. PRFK provides a consistent notation that can be used across different procedures, reducing the risk of implementation errors and ensuring that vendors interpret the specifications correctly. It also facilitates security analysis, as the properties of PRFK can be studied independently of the specific inputs used in each procedure. PRFK is therefore a foundational element of 3GPP's security architecture, enabling secure and reliable authentication and key agreement.