Everything worth knowing, nothing that isn't.
What it actually does
Same job as Milenage: take Ki/OPc and a network RAND, produce RES, CK, IK, AK. The internal construction is different — Tuak runs the Keccak-f[1600] permutation rather than AES rounds — but the input/output interface to the network is identical. An HSS can issue Tuak authentication vectors instead of Milenage vectors; a SIM/eUICC that supports Tuak handles the challenge transparently. Most modern eUICC OSes support both algorithms and pick based on the profile's configuration.
Why it matters commercially
Tuak is the operator's hedge. If a cryptanalytic break against AES-128 ever emerged, every Milenage-based authentication would be at risk; Tuak provides a drop-in replacement with no air-interface changes. For high-security verticals — government, defense, banking-grade eSIM — Tuak with 256-bit keys is increasingly the default. For mainstream consumer eSIM, Milenage remains the operator preference. BroadNet's eSIM VSM platform supports both algorithms in profile personalisation; the choice is per-profile at the operator's discretion.
Latency, scale, and compliance angle
Tuak performance on modern secure elements is comparable to Milenage (within 2x). HSS-side authentication-vector generation has similar throughput. 3GPP TS 35.231 defines the algorithm; ETSI maintains the test vectors. Tuak is fully GSMA-recognised; SAS-SM key-custody audit covers Tuak Ki/OPc with the same rigor as Milenage.
Privacy and compliance considerations
Same key-protection model as Milenage — Ki/OPc never leaves the secure element or the HSS HSM. The advantage of Tuak over Milenage for compliance purposes is the larger key size (up to 256 bits vs 128), which gives a higher safety margin against future cryptanalytic advances. For deployments with multi-decade lifetime requirements (satellite IoT, industrial M2M with 15-year warranties), Tuak's headroom is a reasonable conservative choice.