Everything worth knowing, nothing that isn't.
What it actually does
Milenage is built around five AES-128 invocations (f1, f1*, f2, f3, f4, f5) keyed by Ki, with OPc mixed in for per-operator domain separation. The network sends RAND, the SIM/eUICC runs Milenage with its stored Ki/OPc, returns RES plus authentication parameters. The network checks RES against its own computation. If they match, the subscriber is authenticated and the session keys CK/IK are derived. This same flow runs on every cell attach, every paging response, every authentication challenge — billions of times per day globally.
Why it matters commercially
Milenage is the reason operators can trust the device — without it, there is no operator network, no SMS, no voice, no data. For an eSIM Subscription Manager, the act of personalising a profile means writing a unique Ki + OPc pair into a fresh ISD-P. The Ki/OPc generation must be cryptographically strong, archived for HLR/HSS provisioning, and never transmitted in cleartext outside the HSM boundary. BroadNet's eSIM VSM platform (/operators/esim-vsm) generates Milenage Ki/OPc inside a FIPS 140-2 Level 3 HSM environment.
Latency, scale, and compliance angle
Milenage on a modern SIM/eUICC executes in 5-20 ms. On an HSS at scale, batch authentication-vector generation runs at 10K-50K vectors/sec per HSM. Compliance: Milenage is the GSMA-mandated default for 4G; TUAK is an alternative for higher-security profiles (see /answers/tuak-algorithm). All Milenage Ki/OPc material is in scope for SAS-SM key-custody audit.
Privacy and compliance considerations
Compromise of Ki/OPc means the subscriber can be impersonated and their traffic decrypted indefinitely. There is no recovery beyond re-personalising a new profile. This is why Ki never leaves the secure element on the device side, why HSS database backups are encrypted and access-controlled, and why HSM ceremonies for Ki generation are dual-control with split-key custody. The whole SAS-SM regime exists, fundamentally, to protect Milenage key material.