From my understanding this is how SIM authentication works:

  • When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network
  • Operator network finds the Ki(128 bit symmetric auth key) of the given IMSI generates RAND(a radnom number) and encrypts the RAND with Ki and that gives the value RAND_1, and also sends RAND to the mobile device which forwards it to the SIM card
  • SIM card receives RAND and encrypt it using Ki and calculates RAND_2 and sends it trough mobile device to operator network
  • Operator network compares RAND_1 and RAND_2 and if they are equal the SIM is succesfully authenticated to the network

So, that's how the SIM authenticates itself to the network. But, how does the network prooves it's identity. Someone could easily set up their own tower and act like the operator network?

1 Answer 1


According to these slides, during the handshake both the operator and the SIM card uses A8, RAND, and Ki to generate a session key (Kc).

After the operator compares RAND_1 and RAND_2, it uses Kc to encrypt a message. The mobile then tries to decrypt the encrypted message with Kc; if this decryption is successful, then the mobile had, in effect, authenticated that the operator of the tower knows Ki as well, because generating Kc requires knowing Ki.

  • Ok. That explains it. However I read something about Stingray phone tracker. How does it work then? Aug 21, 2015 at 15:14
  • @user3362334: according to this article: The Stingray ‘jams’ local 3G and 4G networks, forcing all phones in the area to ‘drop down’ to 2G.
    – Lie Ryan
    Aug 21, 2015 at 15:27
  • @Lie Ryan that's why i configured my phone to refuse to connect to any 2G network. Never again my phone provider downgraded me to 2G without necessity as bonus lol !
    – Freedo
    Aug 22, 2015 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .