关于EAP-AKA认证中AT_MAC参数生成算法的技术求助

我现在卡在EAP-AKA认证流程里的AT_MAC参数计算上了——目前已经明确AT_RAND和AT_AUTN的生成逻辑，但严格按照RFC 4187的规范实现后，算出来的AT_MAC结果和实际运行的系统完全不一致，实在找不到问题出在哪，想求助各位大佬帮忙看看！

我的输入参数包括：

• 3GPP-SIP-Authorization
• Confidentiality-Key (CK)
• Integrity-Key (IK)
• Identity
• 3GPP-SIP-Authenticate

我参考的RFC 4187相关规范如下：

10.15. AT_MAC #

The AT_MAC attribute is used for EAP-AKA message authentication.
Section 9 specifies in which messages AT_MAC MUST be included.

The value field of the AT_MAC attribute contains two reserved bytes
followed by a keyed message authentication code (MAC). The MAC is
calculated over the whole EAP packet and concatenated with optional
message-specific data, with the exception that the value field of the
MAC attribute is set to zero when calculating the MAC. The EAP
packet includes the EAP header that begins with the Code field, the
EAP-AKA header that begins with the Subtype field, and all the
attributes, as specified in Section 8.1. The reserved bytes in
AT_MAC are set to zero when sending and ignored on reception. The
contents of the message-specific data that may be included in the MAC
calculation are specified separately for each EAP-AKA message in
Section 9.

The MAC algorithm is HMAC-SHA1-128 [RFC2104] keyed hash value. (The
HMAC-SHA1-128 value is obtained from the 20-byte HMAC-SHA1 value by
truncating the output to 16 bytes. Hence, the length of the MAC is
16 bytes.) The derivation of the authentication key (K_aut) used in
the calculation of the MAC is specified in Section 7.

7. Key Generation #

This section specifies how keying material is generated.

On EAP-AKA full authentication, a Master Key (MK) is derived from the
underlying AKA values (CK and IK keys), and the identity, as follows.

MK = SHA1(Identity|IK|CK)

In the formula above, the "|" character denotes concatenation.
Identity denotes the peer identity string without any terminating
null characters. It is the identity from the last AT_IDENTITY
attribute sent by the peer in this exchange, or, if AT_IDENTITY was

下面是我自己写的Python实现脚本，以及对应的输出结果：

import hmac
import hashlib

#input parameters
identity = b"0999011027538363@nai.epc.mnc001.mcc999.3gppnetwork.org"
ck = bytes.fromhex("86a2d3c129a5d184b4a9fd3c5ac47739")
ik = bytes.fromhex("c2d815eeee312ca4c82d1308fea1bbe7")
rand = bytes.fromhex("0000fae5fb79279e2ea292f6366820e02a13")
autn = bytes.fromhex("0000ff4b031189580000224dd374c08abba9")
mac0 = bytes.fromhex("000000000000000000000000000000000000")

# k_aut calculation (Section 7 RFC 4187)
concatenated_k_aut = identity + ik + ck
concatenated_k_aut_hash = hashlib.sha1(concatenated_k_aut).hexdigest()
k_aut = bytes.fromhex(concatenated_k_aut_hash)[:16] # Truncate to 128 bits
print("k_aut:", k_aut.hex())

# Construct eap_aka_message
eap_header = bytes.fromhex("01 02 00 44 17")  # EAP Header
eap_aka_header = bytes.fromhex("01 00 00")  # EAP-AKA Header
at_rand = bytes.fromhex("01 05") + rand    # AT_RAND
at_autn = bytes.fromhex("02 05") + autn    # AT_AUTN
at_mac = bytes.fromhex("0b 05") + mac0    # EMPTY MAC value
eap_aka_message = eap_header + eap_aka_header + at_rand + at_autn + at_mac
print("eap_aka_message:", eap_aka_message.hex())

# Calculate AT_MAC
hmac_sha11 = hmac.new(k_aut, eap_aka_message, hashlib.sha1).digest()
at_mac = hmac_sha11[:16]
print("AT_MAC:", at_mac.hex())

脚本输出结果：

k_aut: d3585fc249bf60bcb528842aa27eb3e5
eap_aka_message: 010200441701000001050000fae5fb79279e2ea292f6366820e02a1302050000ff4b031189580000224dd374c08abba90b05000000000000000000000000000000000000
AT_MAC: a06b277a5f7f626c62c8cd58c3b469e7

有没有大佬能帮我排查下问题所在？或者分享一个经过验证能正常运行的AT_MAC计算脚本（Python或者其他语言都行），真的非常感谢！

备注：内容来源于stack exchange，提问作者Dzmitriy Buinovskiy