Specification of the MILENAGE-256 algorithm set; An example set of 256-bit 3GPP authentication and key generation functions f1, f1*, f2, f3, f4, f5, f5* and f5**; Document 2: algorithm specification
This document contains a detailed specification of the general framework for the MILENAGE-256 algorithm set, together with specification for the cryptographic kernel used to instantiate the algorithm set.
The main new requirement for the MILENAGE-256 algorithm set, compared to previous 3GPP authentication and key generation functions, is to provide a 256-bit target security level, mainly motivated by future proofing 3GPP networks in case larger scale quantum computers become practical in the future. While this level of security can already be provided by the previously defined TUAK algorithm set [10], having another algorithm set, based on a different cryptographic kernel, provides a fallback, in case of future advances in conventional (non-quantum-computing based) cryptanalysis of the hash-function Keccak, the kernel used in TUAK.
The framework for MILENAGE-256 largely mirrors that of the previously defined MILENAGE algorithm set [9], but with a few important differences as discussed later in the present document.
In terms of the cryptographic kernel, MILENAGE-256 requires the use of a kernel mapping 256-bit inputs to 256-bit outputs, under the control of a 256-bit secret key. The present document provides kernel based on direct use of the Rijndael-256-256 block cipher with 256-bit block and key size.
The reader may recall that Rijndael was the candidate algorithm selected by NIST as the Advanced Encryption Standard, though the option to use a 256-bit block size was not adopted as part of the NIST AES requirements [5].
The algorithm set is named MILENAGE-256 since the intention is to provide full 256-bit security, which requires the use of 256-bit keys. Nonetheless MILENAGE-256 supports both 128-bit and 256-bit keys, to facilitate the transition to 256-bit security. If MILENAGE-256 is employed in a context containing components that do not yet support 256-bit keys, 128-bit keys can initially be employed, though it is recommended that the implementation supports a mechanism for transitioning to 256-bit keys in the future.
Associated test data for the MILENAGE-256 example algorithm set appears in a partner document comprising detailed test data, covering modes and the example kernel, and general design conformance test data [3].
Provisions are further made so that operators who so desire can customise the algorithm set to different degrees, providing some level of separation/isolation between implementations used by different operators.