# Tuak algorithm — the higher-strength Milenage alternative

> Tuak (sometimes written TUAK) is the 3GPP-specified second-generation authentication algorithm for mobile networks, designed as a future-proof alternative to Milenage. Where Milenage is built on AES-128, Tuak is built on the Keccak permutation (the same primitive behind SHA-3), allowing larger key sizes (up to 256 bits) and a different cryptographic family in case AES-based Milenage ever weakens. Tuak is functionally interchangeable with Milenage at the air-interface level — the network selects which to use.

- Canonical URL: https://www.broadnet.me/answers/tuak-algorithm
- Language: en
- Last reviewed: 2026-05-28
- Publisher: BroadNet (https://www.broadnet.me)

## What it actually does

Same job as Milenage: take Ki/OPc and a network RAND, produce RES, CK, IK, AK. The internal construction is different — Tuak runs the Keccak-f[1600] permutation rather than AES rounds — but the input/output interface to the network is identical. An HSS can issue Tuak authentication vectors instead of Milenage vectors; a SIM/eUICC that supports Tuak handles the challenge transparently. Most modern eUICC OSes support both algorithms and pick based on the profile's configuration.

## Why it matters commercially

Tuak is the operator's hedge. If a cryptanalytic break against AES-128 ever emerged, every Milenage-based authentication would be at risk; Tuak provides a drop-in replacement with no air-interface changes. For high-security verticals — government, defense, banking-grade eSIM — Tuak with 256-bit keys is increasingly the default. For mainstream consumer eSIM, Milenage remains the operator preference. BroadNet's eSIM VSM platform supports both algorithms in profile personalisation; the choice is per-profile at the operator's discretion.

## Latency, scale, and compliance angle

Tuak performance on modern secure elements is comparable to Milenage (within 2x). HSS-side authentication-vector generation has similar throughput. 3GPP TS 35.231 defines the algorithm; ETSI maintains the test vectors. Tuak is fully GSMA-recognised; SAS-SM key-custody audit covers Tuak Ki/OPc with the same rigor as Milenage.

## Privacy and compliance considerations

Same key-protection model as Milenage — Ki/OPc never leaves the secure element or the HSS HSM. The advantage of Tuak over Milenage for compliance purposes is the larger key size (up to 256 bits vs 128), which gives a higher safety margin against future cryptanalytic advances. For deployments with multi-decade lifetime requirements (satellite IoT, industrial M2M with 15-year warranties), Tuak's headroom is a reasonable conservative choice.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [Milenage algorithm — 3GPP authentication explained](https://www.broadnet.me/answers/milenage-algorithm)
- [eUICC — the embedded UICC chip explained](https://www.broadnet.me/answers/what-is-euicc)
- [SM-DP+ — Subscription Manager Data Preparation, explained](https://www.broadnet.me/answers/sm-dp-plus)
- [SAS-SM certification — what it means for SIM and eSIM trust](https://www.broadnet.me/answers/sas-sm-certification)
- [eSIM VSM platform](https://www.broadnet.me/operators/esim-vsm)