Authentication, Encryption, and Selection

Question 1

That are the “triplets”?

Answer 1

The RAND, SRES, and Kc (K sub C)

Question 2

Which algorithm is used to calculate the SRES?

Answer 2

A3 Algorithm

Question 3

Which algorithm is used to calculate the Kc?

Answer 3

A8 Algorithm

Question 4

Where are the Ki codes stored?

Answer 4

The SIM and the AUC

Question 5

Once the AUC has generated the triplets, how is the authentication and encryption completed?

Answer 5

Once the AuC has generated the Triplets, they are forwarded to the serving MSC. The MSC forwards the RAND on the downlink to the MS. The MS uses the RAND to create the same Triplets that the network did. The MS then sends the SRES back to the MSC.
If the received SRES matches the SRES generated by the network, the handset is authenticated, and receives a TMSI and a Location Update Accept message (LUA).

Question 6

What is the A5 algorithm?

Answer 6

The A5 algorithm is used to combine the Kc and the user traffic to create a ciphered bit stream.

Question 7

What is A5/0 level of encryption?

Answer 7

A5/0 refers to an unencrypted network.

Question 8

What is A5/1 level of encryption?

Answer 8

A5/1 is a 64-bit cipher that was used by most GSM networks until it was successfully reverse engineered in 1999.

Question 9

What is A5/2 level of encryption?

Answer 9

A5/2 is a far weaker encryption scheme than A5/1 and was banned from use on GSM networks.

Question 10

What is A5/3 level of encryption?

Answer 10

A5/3 Is the most common standard found today; a 128-bit cipher.

Question 11

What is A5/4 level of encryption?

Answer 11

A5/4 is the most complex encryption scheme but is not fielded by GSM networks at the time of this guide’s writing.

Question 12

Which multiple access schemes are used in GSM?

Answer 12

FDMA and TDMA

Question 13

What is FDMA?

Answer 13

In FDMA, users are on separate frequencies.
To increase users, a network must increase the amount of frequency it owns.
The primary multiple access scheme used in 1G technologies.
Very inefficient .
In GSM, each frequency is 200 kHz in bandwidth.

Question 14

What is TDMA?

Answer 14

In TDMA, several users use the same frequency, but at different times.
The “timeslots” switch so fast that it is indistinguishable to the human ear.
In GSM there are 8 timeslots per frequency that are 577 microseconds long.
In high density areas, GSM networks can use Half-Rate.

Question 15

How long are GSM frames and time slots?

Answer 15

One frame is 4.615 milliseconds

One time slot is 577 microseconds

Question 16

What is timing advance?

Answer 16

Signals transmitted from phones far away from the tower take great times to arrive at the tower.
This can cause the signal to arrive late for its assigned timeslot.
To counter this, phones are associated a “Timing Advance” according to how far they are from the tower.
This causes the phone to send its signal earlier, so it arrives in its proper timeslot.

Question 17

What are the timing advance message ranges?

Answer 17

The timing advance message ranges between 0-63. The first timing advance ring is approximately 350 meters, and each subsequent ring is 550 meters.

Question 18

What is duplexing?

Answer 18

A Duplex method is the method by which radios distinguish transmission paths.
In GSM, the transmission path from the tower to the MS is called the “Downlink”.
The transmission path from the MS to the tower is called the “Uplink”.
GSM separates the uplink and downlink by using separate frequencies. This is called Frequency Division Duplexing (FDD).
The frequency separation between Downlink and Uplink is called an “offset”.
GSM radios can only listen to one frequency at a time, so it is Half-Duplex, meaning communication goes both ways, non-simultaneously.

Question 19

What is an ARFCN?

Answer 19

A GSM channel is called an “Absolute Radio Frequency Channel Number” or ARFCN.
An ARFCN refers to both the uplink and downlink frequencies that make up a radio channel, it is a pair of frequencies.

Question 20

What is idle mode?

Answer 20

Once a handset is authenticated and allowed onto a network, it goes into idle mode in which it “camps” on a selected ARFCN.
Camping means that the handset is passively monitoring Paging Channels in case it has incoming traffic and periodically monitoring the BCCH.
A handset will monitor all 32 neighbors on its BA list, however it will monitor the top six neighbors, the Neighbor List, much more frequently.

Question 21

What is reselection?

Answer 21

While in idle mode, the mobile handset constantly looks for the best ARFCN. If an ARFCN is stronger than its current serving ARFCN, the handset will “reselect” to that new ARFCN and camp there. Reselection is done by the handset alone and requires no network assistance.
The rules governing reselection are dictated by the “C2” equation.
The handset calculate C2 values for the ARFCNs on its neighbor list and will reselect if a neighbor ARFCN has a higher C2 value for more than five seconds.

Question 22

What is the C2 equation?

Answer 22

C2 = C1 + CRO - (Temporary Offset*H)

H is the Penalty Timer rangers from 0-31 (in increments of 20 seconds) that dictates how long the Temporary Offset applies.

Question 23

What is CRO?

Answer 23

Cell Reselection Offset (CRO) is an artificial value that ranges from 0-7 (in increments of 10 dB with 7 being infinitely high) that makes an ARFCN appear less attractive than its actual RSSI.

Question 24

What is CRH?

Answer 24

Cell Reselection Hysteresis (CRH)
An artificial value applied to the serving cell from 0-14 (in increments of 2db).
Used on LAC boundaries to prevent “ping ponging” from LAC to LAC, causing frequent network traffic

Question 25

What is the T3212 timer?

Answer 25

A timer (0-255 in increments of 6 minutes) that causes the handset to register periodically to ensure the handset is still in the LAC.

Question 26

That is the T3122 timer?

Answer 26

A timer that sets the minimum time for a device to issue a RACH after an immediate reject message.

Question 27

What is a hand over and what are the two types?

Answer 27

A Handover occurs when a call is handed off from one tower to another because a handset is moving.

For handovers between towers controlled by the same BSC (intra-BSC) the BSC handles signaling required.
For handovers between towers controlled by different BSCs (inter-BSC) the serving MSC must coordinate the handover.