anchor.diff:  identity({#radius{id = RadiusID, authenticator = RequestAuthenticator,
   		attributes = RequestAttributes}, RadiusFsm},
   		#statedata{eap_id = EapID, session_id = SessionID,
  -		auc_fsm = AucFsm} = StateData) ->
  +		auc_fsm = AucFsm, keys = Keys, id_req = IdReq} = StateData) ->
   	NewStateData = StateData#statedata{radius_fsm = RadiusFsm},
   	try
   		EapMessage = radius_attributes:fetch(?EAPMessage, RequestAttributes),
   		case ocs_eap_codec:eap_packet(EapMessage) of
  -			#eap_packet{code = response, type = ?AKA,
  -					identifier = EapID, data = Data} ->
  -				NewEapID = (EapID rem 255) + 1,
  -				NewStateData = StateData#statedata{eap_id = NewEapID},
  -				#eap_aka_identity{identity = Identity} = ocs_eap_codec:eap_aka(Data),
  +			#eap_aka_identity{identity = <<?PERM_TAG, PermanentID/binary>>}
  +					when IdReq == full ->
  +				[IMSI | _] = binary:split(PermanentID, <<$@>>, []),
   				% @todo handle RADIUS attribute for ANID
  -				gen_fsm:send_event(AucFsm, {Identity, "WLAN"}),
  -				{next_state, vector, NewStateData, ?TIMEOUT};
  -			#eap_packet{code = response, type = ?LegacyNak, identifier = EapID} ->
  -				{stop, {shutdown, SessionID}, NewStateData}
  +				gen_fsm:send_event(AucFsm, {self(), IMSI, "WLAN"}),
  +				{next_state, vector, StateData, ?TIMEOUT};
  +			#eap_aka_identity{identity = <<?TEMP_TAG:6, _/bits>> = TemporaryID}
  +					when IdReq == full ->
  +				Pseudonym = binary:split(TemporaryID, <<$@>>, []),
  +				CompressedIMSI = decrypt_imsi(Pseudonym, Keys),
  +				IMSI = compressed_imsi(CompressedIMSI),
  +				% @todo handle RADIUS attribute for ANID
  +				gen_fsm:send_event(AucFsm, {self(), IMSI, "WLAN"}),
  +				{next_state, vector, StateData, ?TIMEOUT}
   		end
   	catch
   		_:_Reason ->
  
positive.code: 							when Trusted == true ->
  						% @todo handle fast re-authentication
  						NextEapID = (StartEapID rem 255) + 1,
  						NextStateData = NewStateData#statedata{eap_id = NextEapID},
  						EapData = ocs_eap_codec:eap_aka(#eap_aka_identity{fullauth_id_req = true}),
  						EapPacket = #eap_packet{code = request,
  								type = ?AKA, identifier = NextEapID, data = EapData},
  						send_radius_response(EapPacket, ?AccessChallenge, [], RadiusID,
  
negative.code: 			end;
  		{error, not_found} ->
  			EapData = ocs_eap_codec:eap_aka(#eap_aka_identity{fullauth_id_req = true}),
  			NextStateData = NewStateData#statedata{id_req = full},
  			EapPacket = #eap_packet{code = request,
  					type = ?AKA, identifier = EapID, data = EapData},
  			send_radius_response(EapPacket, ?AccessChallenge, [], RadiusID,
  					RequestAuthenticator, RequestAttributes, NewStateData),
  			{next_state, identity, NextStateData, ?TIMEOUT}
  	end.
  
  -spec identity(Event, StateData) -> Result
  