Algorithm 6 The Challenge–Response Step 2.3 [UE]

Inputs:  $(RAND,AUTN)$       UE computes a Diffie-Hellman key $DHK\leftarrow ep{k}_{UE}^{-1}·RAND$       Parse $AUTN$ as $(CONC,AMF,MAC)$       Compute $AK\leftarrow f_5(k,RAND\oplus DHK)$       De-conceal $SQ{N}_{HN}\leftarrow AK\oplus CONC$       Check if $f_1(k,SQ{N}_{HN},AMF,RAND\oplus DHK)$       If this check does not pass, the UE returns ⊥ and sends a failure message Mac_Failure to SN (case i). Otherwise, proceed to the next step.       Check $SQ{N}_{UE}<SQ{N}_{HN}<SQ{N}_{UE}+\Delta$ If this check does not pass, the SIM card computes $MA{C}^{*}\leftarrow f_1^{*}(k,SQ{N}_{UE},AMF,RAND\oplus DHK)$ $A{K}^{*}\leftarrow f_5^{*}(k,RAND\oplus DHK)$ $AUTS\leftarrow (A{K}^{*}\oplus SQ{N}_{UE},AMF,MA{C}^{*})$ After the SIM card computes $AUTS$, then UE re-synchronizes with HN by sending a failure message Sync_Failure and $AUTS$ to $SN$ (case ii) Otherwise, proceed to the next step.       Update $SQ{N}_{UE}\leftarrow SQ{N}_{HN}$       Compute $CK\leftarrow f_3(k,RAND\oplus DHK)$ and $IK\leftarrow f_4(k,RAND\oplus DHK)$       Compute $RES\leftarrow f_2(k,RAND\oplus DHK)$       SIM return $RES,CK$ and $IK$ to $ME$       The ME compute $RE{S}^{*}\leftarrow KDF(CK\parallel IK,I{D}_{SN}\parallel RAND\parallel RES)$       Derive $K_{AUSF}\leftarrow KDF(CK\parallel IK,I{D}_{SN}\parallel CONC\parallel DHK)$       Derive $K_{SEAF}\leftarrow KDF(K_{AUSF},I{D}_{SN})$       The UE returns $(K_{SEAF},RE{S}^{*})$    Outputs. The UE stores $K_{SEAF}$ and sends $RE{S}^{*}$ to SN (case iii)