Osmocom Libraries » libosmocore

The UMTS AKA SQN increment is SQN + (1 << ind), but osmo-auc-gen still has assumptions in two places from an earlier erratic code stage, where the increment was simply 1.

libosmocore/utils/osmo-auc-gen.c:

                case 's':
                        if (test_aud.type != OSMO_AUTH_TYPE_UMTS) {
                                fprintf(stderr, "Only UMTS has SQN\n");
                                exit(2);
                        }
                        test_aud.u.umts.sqn = strtoull(optarg, 0, 10);
                        /* Before calculating the UMTS auth vector,
                         * osmo_auth_gen_vec() increments the SQN. SQN-1 here
                         * to end up with the SQN the user requested. */
                        test_aud.u.umts.sqn--;
                        break;

This should subtract something like (1<<ind) instead.

and

        /* After recovering SQN.MS from AUTS, milenage_gen_vec_auts() does
         * aud->u.umts.sqn++, so to show SQN.MS we need to -1 */
        if (auts_is_set)
                printf("AUTS success: SQN.MS = %" PRIu64 "\n",
                       test_aud.u.umts.sqn - 1);

Either drop this output or somehow obtain the actual SQN.MS calculated from AUTS.