update it

src/mme/emm_handler.c

@@ -231,6 +231,7 @@ void emm_handle_authentication_response(
             ue->kasme, ue->knas_int);
     mme_kdf_nas(MME_KDF_NAS_ENC_ALG, mme_self()->selected_enc_algorithm,
             ue->kasme, ue->knas_enc);
+    mme_kdf_enb(ue->kasme, ue->ul_count.i32, ue->kenb);
 
     rv = nas_security_encode(&emmbuf, ue, &message);
     d_assert(rv == CORE_OK && emmbuf, return, "emm build error");

src/mme/mme_context.h

@@ -124,6 +124,7 @@ typedef struct _mme_ue_t {
     c_uint8_t       autn[AUTN_LEN];
     c_uint8_t       knas_int[SHA256_DIGEST_SIZE/2]; 
     c_uint8_t       knas_enc[SHA256_DIGEST_SIZE/2];
+    c_uint8_t       kenb[SHA256_DIGEST_SIZE];
     c_uint32_t      dl_count;
     union {
         struct {

src/mme/mme_kdf.c

@@ -2,16 +2,13 @@
 
 #include "core_sha2_hmac.h"
 
-#define FC_VALUE 0x15
-#include "core_debug.h"
-
 void mme_kdf_nas(c_uint8_t algorithm_type_distinguishers,
     c_uint8_t algorithm_identity, c_uint8_t *kasme, c_uint8_t *knas)
 {
     c_uint8_t s[7];
     c_uint8_t out[32];
 
-    s[0] = FC_VALUE;
+    s[0] = 0x15; /* FC Value */
 
     s[1] = algorithm_type_distinguishers;
     s[2] = 0x00;
@@ -24,3 +21,18 @@ void mme_kdf_nas(c_uint8_t algorithm_type_distinguishers,
     hmac_sha256(kasme, 32, s, 7, out, 32);
     memcpy(knas, out+16, 16);
 }
+
+void mme_kdf_enb(c_uint8_t *kasme, c_uint32_t ul_count, c_uint8_t *kenb)
+{
+    c_uint8_t s[7];
+
+    s[0] = 0x11; /* FC Value */
+
+    ul_count = ntohl(ul_count);
+    memcpy(s+1, &ul_count, 4);
+
+    s[5] = 0x00;
+    s[6] = 0x04;
+
+    hmac_sha256(kasme, 32, s, 7, kenb, 32);
+}

src/mme/mme_kdf.h

@@ -19,4 +19,7 @@
 CORE_DECLARE(void) mme_kdf_nas(c_uint8_t algorithm_type_distinguishers,
     c_uint8_t algorithm_identity, c_uint8_t *kasme, c_uint8_t *knas);
 
+CORE_DECLARE(void) mme_kdf_enb(c_uint8_t *kasme, c_uint32_t ul_count, 
+        c_uint8_t *kenb);
+
 #endif /* __MME_KDF_H__ */

src/mme/s1ap_build.c

@@ -4,6 +4,7 @@
 
 #include "mme_context.h"
 
+#include "mme_kdf.h"
 #include "s1ap_build.h"
 #include "s1ap_conv.h"
 
@@ -208,9 +209,10 @@ status_t s1ap_build_initial_context_setup_request(
 
     ASN_SEQUENCE_ADD(&ies->e_RABToBeSetupListCtxtSUReq, e_rab);
 
-    ies->securityKey.size = 32;
+    ies->securityKey.size = SHA256_DIGEST_SIZE;
     ies->securityKey.buf = 
         core_calloc(ies->securityKey.size, sizeof(c_uint8_t));
+    memcpy(ies->securityKey.buf, ue->kenb, ies->securityKey.size);
 
     message.procedureCode = S1ap_ProcedureCode_id_InitialContextSetup;
     message.direction = S1AP_PDU_PR_initiatingMessage;