SRES

SRES stands for Signed Response, and it is the numerical result of a cryptographic calculation that a mobile phone performs during GSM network authentication. When your phone connects to a GSM base station, the network sends it a random number called a RAND (random challenge). Your phone's SIM card uses this RAND, combined with a secret key stored only on the SIM itself, to compute the SRES. This computed value is sent back to the network, which performs the same calculation independently and checks whether the responses match. If they do, the phone is authenticated as a legitimate subscriber.

The SRES is typically a 32-bit value, represented as 8 hexadecimal digits. The actual algorithm used to derive the SRES from the RAND and the subscriber key is the A3 algorithm, which varies by operator and SIM issuer but is usually a variant of COMP128. The entire exchange happens within milliseconds as part of the GSM security architecture, before the phone is granted access to network services. Without a correct SRES, the authentication fails and the handset cannot proceed.

Why this matters in practice

The strength of GSM authentication depends entirely on keeping the subscriber key secret and on the robustness of the A3 algorithm. Early implementations of COMP128-1 were reverse-engineered from SIM cards, which allowed researchers to clone SIMs by extracting the key. Modern SIM cards use stronger variants like COMP128-3, but the fundamental principle remains: authentication is a bilateral secret-key operation where the SRES proves possession of the key without ever transmitting it over the air.

SRES is distinct from other GSM security elements. The network also computes a cipher key (Kc) from the same challenge and secret key, using the A8 algorithm, which is then used to encrypt voice and data traffic on the radio link. The SRES itself is not secret; it changes with every authentication challenge. The secret is the key on the SIM, and the fact that an attacker who intercepts the SRES cannot reverse-engineer the key from it (in theory, though in practice old implementations failed this test).

GSM authentication using RAND and SRES has largely been superseded by newer schemes in 3G and 4G networks, which use different challenge-response mechanisms. However, legacy GSM networks and devices still depend on this mechanism, and it remains the foundation of SIM card security architecture that newer standards build upon.