anchor.diff:  %% @private
   vector(timeout, #statedata{session_id = SessionID} = StateData)->
   	{stop, {shutdown, SessionID}, StateData};
  -vector({Rand, Autn, Xres},
  -		#statedata{eap_id = EapID, session_id = SessionID} = StateData) ->
  -	{next_state, vector, StateData}.
  +vector({Rand, CK, IK, Autn}, #statedata{eap_id = EapID,
  +		session_id = SessionID, identity = Identity} = StateData) ->
  +	NextEapID = (EapID rem 255) + 1,
  +	EapData1 = ocs_eap_codec:eap_aka(#eap_aka_challenge{mac = <<0:128>>,
  +			rand = Rand, autn = Autn}),
  +	MK = crypto:hash(sha1, <<Identity/binary, IK/binary, CK/binary>>),
  +	Kaut = <<0:16>>,
  +	Kencr = <<0:16>>,
  +	Mac = crypto:hmac(sha1, Kaut, EapData1, 16),
  +	EapData2 = ocs_eap_codec:eap_aka(EapData1#eap_aka_challenge{mac = Mac}),
  +	NewStateData = StateData#statedata{eap_id = NextEapID,
  +			res = Rand, ck = CK, ik = IK, ak = Autn,
  +			mk = MK, k_aut = Kaut, k_encr = Kencr},
  +	EapPacket = #eap_packet{code = request, type = ?AKA,
  +			identifier = NextEapID, data = EapData2},
  +	send_radius_response(EapPacket, ?AccessChallenge, [], RadiusID,
  +			RequestAuthenticator, RequestAttributes, NewStateData),
  +	{next_state, vector, NewStateData}.
   
   -spec handle_event(Event, StateName, StateData) -> Result
   	when
  
positive.code: 						{next_state, vector, NextStateData, ?TIMEOUT};
  					#eap_packet{code = response, type = ?Identity,
  							identifier = StartEapID,
  							data = <<?FAST_TAG:6, _/bits>>}
  							when Trusted == true ->
  						% @todo handle fast re-authentication
  						NextEapID = (StartEapID rem 255) + 1,
  						EapData = ocs_eap_codec:eap_aka(#eap_aka_identity{fullauth_id_req = true}),
  						NextStateData = NewStateData#statedata{eap_id = NextEapID, id_req = full},
  						EapPacket = #eap_packet{code = request,
  								type = ?AKA, identifier = NextEapID, data = EapData},
  						send_radius_response(EapPacket, ?AccessChallenge, [], RadiusID,
  
negative.code: 		case ocs_eap_codec:eap_packet(EapMessage) of
  			#eap_packet{code = response, type = ?Identity,
  					identifier = StartEapID,
  					data = <<?PERM_TAG, PermanentID/binary>> = Identity}
  					when Trusted == true ->
  				NextStateData = NewStateData#statedata{eap_id = StartEapID,
  						identity = Identity},
  				[IMSI | _] = binary:split(PermanentID, <<$@>>, []),
  				% @todo handle DIAMETER ANID AVP
  				gen_fsm:send_event(AucFsm, {self(), IMSI, "WLAN"}),
  				{next_state, vector, NextStateData, ?TIMEOUT};
  			#eap_packet{code = response, type = ?Identity,
  					identifier = StartEapID,
  					data = <<?TEMP_TAG:6, _/bits>> = Identity}
  					when Trusted == true ->
  				NextStateData = NewStateData#statedata{eap_id = StartEapID,
  						identity = Identity},
  				Pseudonym = binary:split(Identity, <<$@>>, []),
  				CompressedIMSI = decrypt_imsi(Pseudonym, Keys),
  				IMSI = compressed_imsi(CompressedIMSI),
  				% @todo handle DIAMETER ANID AVP
  				gen_fsm:send_event(AucFsm, {self(), IMSI, "WLAN"}),
  				{next_state, vector, NextStateData, ?TIMEOUT};
  			#eap_packet{code = response, type = ?Identity,
  					identifier = StartEapID,
  					data = <<?FAST_TAG:6, _/bits>> = Identity}
  					when Trusted == true ->
  				% @todo handle fast re-authentication
  				NextEapID = (StartEapID rem 255) + 1,
  				EapData = ocs_eap_codec:eap_aka(#eap_aka_identity{fullauth_id_req = true}),
  				NextStateData = NewStateData#statedata{eap_id = NextEapID,
  						id_req = full, identity = Identity},
  				EapPacket = #eap_packet{code = request,
  						type = ?AKA, identifier = NextEapID, data = EapData},
  				send_diameter_response(SessionId, AuthReqType,
  