3GPP Milenage Authentication API

import * as crypto from 'crypto';

export class MilenageAlgorithm {
  private readonly c1 = Buffer.from('00000000000000000000000000000000', 'hex');
  private readonly c2 = Buffer.from('00000000000000000000000000000001', 'hex');
  private readonly c3 = Buffer.from('00000000000000000000000000000002', 'hex');
  private readonly c4 = Buffer.from('00000000000000000000000000000004', 'hex');
  private readonly c5 = Buffer.from('00000000000000000000000000000008', 'hex');

  private readonly r1 = 64;
  private readonly r2 = 0;
  private readonly r3 = 32;
  private readonly r4 = 64;
  private readonly r5 = 96;

  /**
   * Generate OPc from OP and K per TS 35.206 Section 4.1
   */
  public generateOPc(op: Buffer, k: Buffer): Buffer {
    const cipher = crypto.createCipheriv('aes-128-ecb', k, null);
    cipher.setAutoPadding(false);
    const encrypted = Buffer.concat([cipher.update(op), cipher.final()]);
    return this.xor(op, encrypted);
  }

  /**
   * Generate authentication vector
   */
  public generateAuthVector(
    k: Buffer,
    opc: Buffer,
    sqn: Buffer,
    amf: Buffer
  ): {
    rand: Buffer;
    xres: Buffer;
    ck: Buffer;
    ik: Buffer;
    autn: Buffer;
  } {
    const rand = crypto.randomBytes(16);
    
    // f1: Compute MAC-A and MAC-S
    const { macA, macS } = this.f1(k, opc, rand, sqn, amf);
    
    // f2: Compute RES
    const xres = this.f2(k, opc, rand);
    
    // f3: Compute CK
    const ck = this.f3(k, opc, rand);
    
    // f4: Compute IK
    const ik = this.f4(k, opc, rand);
    
    // f5: Compute AK
    const ak = this.f5(k, opc, rand);
    
    // Generate AUTN = SQN ⊕ AK || AMF || MAC-A
    const autn = Buffer.concat([
      this.xor(sqn, ak),
      amf,
      macA
    ]);
    
    return { rand, xres, ck, ik, autn };
  }

  private f1(
    k: Buffer,
    opc: Buffer,
    rand: Buffer,
    sqn: Buffer,
    amf: Buffer
  ): { macA: Buffer; macS: Buffer } {
    const temp = this.xor(rand, opc);
    const cipher = crypto.createCipheriv('aes-128-ecb', k, null);
    cipher.setAutoPadding(false);
    const out = Buffer.concat([cipher.update(temp), cipher.final()]);
    
    const input = this.xor(
      this.xor(Buffer.concat([sqn, amf, sqn, amf]), this.c1),
      opc
    );
    const cipher2 = crypto.createCipheriv('aes-128-ecb', k, null);
    cipher2.setAutoPadding(false);
    const result = Buffer.concat([cipher2.update(this.xor(input, out)), cipher2.final()]);
    
    const macA = this.xor(result, opc).slice(0, 8);
    
    // MAC-S uses different constant
    const inputS = this.xor(
      this.xor(Buffer.concat([sqn, amf, sqn, amf]), this.c5),
      opc
    );
    const cipher3 = crypto.createCipheriv('aes-128-ecb', k, null);
    cipher3.setAutoPadding(false);
    const resultS = Buffer.concat([cipher3.update(this.xor(inputS, out)), cipher3.final()]);
    const macS = this.xor(resultS, opc).slice(0, 8);
    
    return { macA, macS };
  }

  private f2(k: Buffer, opc: Buffer, rand: Buffer): Buffer {
    return this.computeFunction(k, opc, rand, this.c2, this.r2).slice(0, 8);
  }

  private f3(k: Buffer, opc: Buffer, rand: Buffer): Buffer {
    return this.computeFunction(k, opc, rand, this.c3, this.r3);
  }

  private f4(k: Buffer, opc: Buffer, rand: Buffer): Buffer {
    return this.computeFunction(k, opc, rand, this.c4, this.r4);
  }

  private f5(k: Buffer, opc: Buffer, rand: Buffer): Buffer {
    return this.computeFunction(k, opc, rand, this.c5, this.r5).slice(0, 6);
  }

  private computeFunction(
    k: Buffer,
    opc: Buffer,
    rand: Buffer,
    constant: Buffer,
    rotation: number
  ): Buffer {
    const temp = this.xor(rand, opc);
    const cipher = crypto.createCipheriv('aes-128-ecb', k, null);
    cipher.setAutoPadding(false);
    const encrypted = Buffer.concat([cipher.update(temp), cipher.final()]);
    
    const input = this.xor(this.rotate(this.xor(encrypted, opc), rotation), constant);
    const cipher2 = crypto.createCipheriv('aes-128-ecb', k, null);
    cipher2.setAutoPadding(false);
    const result = Buffer.concat([cipher2.update(input), cipher2.final()]);
    
    return this.xor(result, opc);
  }

  private xor(a: Buffer, b: Buffer): Buffer {
    const result = Buffer.alloc(Math.max(a.length, b.length));
    for (let i = 0; i < result.length; i++) {
      result[i] = a[i] ^ b[i];
    }
    return result;
  }

  private rotate(buffer: Buffer, bits: number): Buffer {
    const bytes = bits / 8;
    return Buffer.concat([buffer.slice(bytes), buffer.slice(0, bytes)]);
  }
}