# Milenage algorithm — 3GPP authentication explained

> Milenage is the 3GPP-standardised authentication and key-generation algorithm that every GSM/UMTS/LTE network uses to verify a subscriber and derive session keys. It runs inside the SIM/eUICC and inside the operator's HLR/HSS, taking the subscriber's Ki (long-term key), OPc (operator-customised constant), and a network random challenge (RAND), and producing the response (RES), the ciphering key (CK), the integrity key (IK), and an anonymity key (AK). It is the cryptographic foundation of mobile authentication.

- Canonical URL: https://www.broadnet.me/answers/milenage-algorithm
- Language: en
- Last reviewed: 2026-09-29
- Publisher: BroadNet (https://www.broadnet.me)

## What it actually does

Milenage is built around five AES-128 invocations (f1, f1*, f2, f3, f4, f5) keyed by Ki, with OPc mixed in for per-operator domain separation. The network sends RAND, the SIM/eUICC runs Milenage with its stored Ki/OPc, returns RES plus authentication parameters. The network checks RES against its own computation. If they match, the subscriber is authenticated and the session keys CK/IK are derived. This same flow runs on every cell attach, every paging response, every authentication challenge — billions of times per day globally.

## Why it matters commercially

Milenage is the reason operators can trust the device — without it, there is no operator network, no SMS, no voice, no data. For an eSIM Subscription Manager, the act of personalising a profile means writing a unique Ki + OPc pair into a fresh ISD-P. The Ki/OPc generation must be cryptographically strong, archived for HLR/HSS provisioning, and never transmitted in cleartext outside the HSM boundary. BroadNet's eSIM VSM platform (/operators/esim-vsm) generates Milenage Ki/OPc inside a FIPS 140-2 Level 3 HSM environment.

## Latency, scale, and compliance angle

Milenage on a modern SIM/eUICC executes in 5-20 ms. On an HSS at scale, batch authentication-vector generation runs at 10K-50K vectors/sec per HSM. Compliance: Milenage is the GSMA-mandated default for 4G; TUAK is an alternative for higher-security profiles (see /answers/tuak-algorithm). All Milenage Ki/OPc material is in scope for SAS-SM key-custody audit.

## Privacy and compliance considerations

Compromise of Ki/OPc means the subscriber can be impersonated and their traffic decrypted indefinitely. There is no recovery beyond re-personalising a new profile. This is why Ki never leaves the secure element on the device side, why HSS database backups are encrypted and access-controlled, and why HSM ceremonies for Ki generation are dual-control with split-key custody. The whole SAS-SM regime exists, fundamentally, to protect Milenage key material.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [Tuak algorithm — the higher-strength Milenage alternative](https://www.broadnet.me/answers/tuak-algorithm)
- [eUICC — the embedded UICC chip explained](https://www.broadnet.me/answers/what-is-euicc)
- [SM-DP+ — Subscription Manager Data Preparation, explained](https://www.broadnet.me/answers/sm-dp-plus)
- [SAS-SM certification — what it means for SIM and eSIM trust](https://www.broadnet.me/answers/sas-sm-certification)
- [eSIM VSM platform](https://www.broadnet.me/operators/esim-vsm)