diff --git a/.checkpatch.conf b/.checkpatch.conf
new file mode 100644
index 0000000..46bf0eb
--- /dev/null
+++ b/.checkpatch.conf
@@ -0,0 +1 @@
+--exclude ^src/gsm/tuak/KeccakP-1600-3gpp\.(c|h)$
diff --git a/TODO-RELEASE b/TODO-RELEASE
index b239efa..acd1a61 100644
--- a/TODO-RELEASE
+++ b/TODO-RELEASE
@@ -16,3 +16,4 @@
 libosmogsm	ADD	new osmo_sub_auth_data2 / osmo_auth_gen_vec2 / osmo_auth_gen_vec_auts2
 libosmogsm	MODIFY	osmo_auth_impl callback function signature change. No known external users
 libosmogsm	ADD	osmo_auth_c2
+libosmogsm	ADD	OSMO_AUTH_ALG_TUAK
diff --git a/include/osmocom/crypt/auth.h b/include/osmocom/crypt/auth.h
index 0e9b502..f73a48b 100644
--- a/include/osmocom/crypt/auth.h
+++ b/include/osmocom/crypt/auth.h
@@ -33,6 +33,7 @@
 	OSMO_AUTH_ALG_XOR_3G,
 	OSMO_AUTH_ALG_MILENAGE,
 	OSMO_AUTH_ALG_XOR_2G,
+	OSMO_AUTH_ALG_TUAK,
 	_OSMO_AUTH_ALG_NUM,
 };
 /* Backwards-compatibility. We used to call XOR-3G just "XOR" which became ambiguous when
diff --git a/src/gsm/Makefile.am b/src/gsm/Makefile.am
index ca850d2..cbbdcc0 100644
--- a/src/gsm/Makefile.am
+++ b/src/gsm/Makefile.am
@@ -15,6 +15,8 @@
 		 milenage/common.h milenage/crypto.h milenage/includes.h \
 		 milenage/milenage.h
 
+noinst_HEADERS += tuak/KeccakP-1600-3gpp.h tuak/tuak.h
+
 noinst_LTLIBRARIES = libgsmint.la
 lib_LTLIBRARIES = libosmogsm.la
 
@@ -30,6 +32,7 @@
 			auth_milenage.c milenage/aes-encblock.c gea.c \
 			milenage/aes-internal.c milenage/aes-internal-enc.c \
 			milenage/milenage.c gan.c ipa.c gsm0341.c apn.c \
+			tuak/KeccakP-1600-3gpp.c tuak/tuak.c auth_tuak.c \
 			gsup.c gsup_sms.c gprs_gea.c gsm0503_conv.c oap.c gsm0808_utils.c \
 			gsm23003.c gsm23236.c mncc.c bts_features.c oap_client.c \
 			gsm29118.c gsm48_rest_octets.c cbsp.c gsm48049.c \
diff --git a/src/gsm/auth_core.c b/src/gsm/auth_core.c
index ad5967d..6972cb7 100644
--- a/src/gsm/auth_core.c
+++ b/src/gsm/auth_core.c
@@ -328,6 +328,7 @@
 	{ OSMO_AUTH_ALG_XOR_3G, "XOR-3G" },
 	{ OSMO_AUTH_ALG_MILENAGE, "MILENAGE" },
 	{ OSMO_AUTH_ALG_XOR_2G, "XOR-2G" },
+	{ OSMO_AUTH_ALG_TUAK, "TUAK" },
 	{ 0, NULL }
 };
 
diff --git a/src/gsm/auth_tuak.c b/src/gsm/auth_tuak.c
new file mode 100644
index 0000000..05fbf69
--- /dev/null
+++ b/src/gsm/auth_tuak.c
@@ -0,0 +1,207 @@
+/*! \file auth_tuak.c
+ * GSM/GPRS/3G authentication core infrastructure */
+/*
+ * (C) 2023 by Harald Welte <laforge@osmocom.org>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+/* NOTE: TUAK offers a lot of size variability in terms of size of length of MAC_A, MAC_S,
+ * but this is not used within 3GPP.  The different sizes of Kc and RES are handled via
+ * osmo_sub_auth_data2. */
+
+#include <errno.h>
+#include <osmocom/crypt/auth.h>
+#include <osmocom/core/bits.h>
+#include "tuak/tuak.h"
+
+/*! \addtogroup auth
+ *  @{
+ */
+
+static const uint8_t *gen_opc_if_needed(const struct osmo_sub_auth_data2 *aud, uint8_t *gen_opc)
+{
+	int rc;
+
+	/* Check if we only know OP and compute OPC if required */
+	if (aud->type == OSMO_AUTH_TYPE_UMTS && aud->u.umts.opc_is_op) {
+		rc = tuak_opc_gen(gen_opc, aud->u.umts.k, aud->u.umts.k_len, aud->u.umts.opc);
+		if (rc < 0)
+			return NULL;
+		return gen_opc;
+	}
+
+	return aud->u.umts.opc;
+}
+
+static int tuak_gen_vec(struct osmo_auth_vector *vec,
+			struct osmo_sub_auth_data2 *aud,
+			const uint8_t *_rand)
+{
+	size_t res_len = vec->res_len;
+	uint64_t next_sqn;
+	uint8_t gen_opc[32];
+	const uint8_t *opc;
+	uint8_t sqn[6];
+	uint64_t ind_mask;
+	uint64_t seq_1;
+
+	switch (vec->res_len) {
+	case 4:
+	case 8:
+	case 16:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	OSMO_ASSERT(aud->algo == OSMO_AUTH_ALG_TUAK);
+
+	if (aud->u.umts.k_len != 16 && aud->u.umts.k_len != 32)
+		return -EINVAL;
+	if (aud->u.umts.opc_len != 32)
+		return -EINVAL;
+
+	opc = gen_opc_if_needed(aud, gen_opc);
+	if (!opc)
+		return -1;
+
+	/* Determine next SQN, according to 3GPP TS 33.102:
+	 * SQN consists of SEQ and a lower significant part of IND bits:
+	 *
+	 * |----------SEQ------------|
+	 * |------------------------SQN-----------|
+	 *                           |-----IND----|
+	 *
+	 * The IND part is used as "slots": e.g. a given HLR client will always
+	 * get the same IND part, called ind here, with incrementing SEQ. In
+	 * the USIM, each IND slot enforces that its SEQ are used in ascending
+	 * order -- as long as that constraint is satisfied, the SQN may jump
+	 * forwards and backwards. For example, for ind_bitlen == 5, asking the
+	 * USIM for SQN = 32, 64, 33 is allowed, because 32 and 64 are
+	 * SEQ || (ind == 0), and though 33 is below 64, it is ind == 1 and
+	 * allowed.  Not allowed would be 32, 96, 64, because 64 would go
+	 * backwards after 96, both being ind == 0.
+	 *
+	 * From the last used SQN, we want to increment SEQ + 1, and then pick
+	 * the matching IND part.
+	 *
+	 * IND size is suggested in TS 33.102 as 5 bits. SQN is 48 bits long.
+	 * If ind_bitlen is passed too large here, the algorithms will break
+	 * down. But at which point should we return an error? A sane limit
+	 * seems to be ind_bitlen == 10, but to protect against failure,
+	 * limiting ind_bitlen to 28 is enough, 28 being the number of bits
+	 * suggested for the delta in 33.102, which is discussed to still
+	 * require 2^15 > 32000 authentications to wrap the SQN back to the
+	 * start.
+	 *
+	 * Note that if a caller with ind == 1 generates N vectors, the SQN
+	 * stored after this will reflect SEQ + N. If then another caller with
+	 * ind == 2 generates another N vectors, this will then use SEQ + N
+	 * onwards and end up with SEQ + N + N. In other words, most of each
+	 * SEQ's IND slots will remain unused. When looking at SQN being 48
+	 * bits wide, after dropping ind_bitlen (say 5) from it, we will still
+	 * have a sequence range of 2^43 = 8.8e12, eight trillion sequences,
+	 * which is large enough to not bother further. With the maximum
+	 * ind_bitlen of 28 enforced below, we still get more than 1 million
+	 * sequences, which is also sufficiently large.
+	 *
+	 * An ind_bitlen of zero may be passed from legacy callers that are not
+	 * aware of the IND extension. For these, below algorithm works out as
+	 * before, simply incrementing SQN by 1.
+	 *
+	 * This is also a mechanism for tools like the osmo-auc-gen to directly
+	 * request a given SQN to be used. With ind_bitlen == 0 the caller can
+	 * be sure that this code will increment SQN by exactly one before
+	 * generating a tuple, thus a caller would simply pass
+	 * { .ind_bitlen = 0, .ind = 0, .sqn = (desired_sqn - 1) }
+	 */
+
+	if (aud->u.umts.ind_bitlen > OSMO_MILENAGE_IND_BITLEN_MAX)
+		return -2;
+
+	seq_1 = 1LL << aud->u.umts.ind_bitlen;
+	ind_mask = ~(seq_1 - 1);
+
+	/* the ind index must not affect the SEQ part */
+	if (aud->u.umts.ind >= seq_1)
+		return -3;
+
+	/* keep the incremented SQN local until gsm_milenage() succeeded. */
+	next_sqn = ((aud->u.umts.sqn + seq_1) & ind_mask) + aud->u.umts.ind;
+
+	osmo_store64be_ext(next_sqn, sqn, 6);
+
+	tuak_generate(opc, aud->u.umts.amf, aud->u.umts.k, aud->u.umts.k_len,
+		      sqn, _rand, vec->autn, vec->ik, vec->ck, vec->res, &res_len);
+
+	/* generate the GSM Kc + SRES values using C2 + C3 functions */
+	osmo_auth_c3(vec->kc, vec->ck, vec->ik);
+	osmo_auth_c2(vec->sres, vec->res, vec->res_len, 1);
+
+	vec->auth_types = OSMO_AUTH_TYPE_UMTS | OSMO_AUTH_TYPE_GSM;
+
+	/* for storage in the caller's AUC database */
+	aud->u.umts.sqn = next_sqn;
+
+	return 0;
+}
+
+static int tuak_gen_vec_auts(struct osmo_auth_vector *vec,
+			     struct osmo_sub_auth_data2 *aud,
+			     const uint8_t *auts, const uint8_t *rand_auts,
+			     const uint8_t *_rand)
+{
+	uint8_t sqn_out[6];
+	uint8_t gen_opc[32];
+	const uint8_t *opc;
+	int rc;
+
+	OSMO_ASSERT(aud->algo == OSMO_AUTH_ALG_TUAK);
+
+	if (aud->u.umts.k_len != 16 && aud->u.umts.k_len != 32)
+		return -EINVAL;
+	if (aud->u.umts.opc_len != 32)
+		return -EINVAL;
+
+	opc = gen_opc_if_needed(aud, gen_opc);
+
+	rc = tuak_auts(opc, aud->u.umts.k, sizeof(aud->u.umts.k), rand_auts, auts, sqn_out);
+	if (rc < 0)
+		return rc;
+
+	aud->u.umts.sqn_ms = osmo_load64be_ext(sqn_out, 6) >> 16;
+	/* Update our "largest used SQN" from the USIM -- milenage_gen_vec()
+	 * below will increment SQN. */
+	aud->u.umts.sqn = aud->u.umts.sqn_ms;
+
+	return tuak_gen_vec(vec, aud, _rand);
+}
+
+static struct osmo_auth_impl tuak_alg = {
+	.algo = OSMO_AUTH_ALG_TUAK,
+	.name = "TUAK (libosmogsm built-in)",
+	.priority = 1000,
+	.gen_vec = &tuak_gen_vec,
+	.gen_vec_auts = &tuak_gen_vec_auts,
+};
+
+static __attribute__((constructor)) void on_dso_load_tuak(void)
+{
+	osmo_auth_register(&tuak_alg);
+}
+
+/*! @} */
diff --git a/src/gsm/tuak/KeccakP-1600-3gpp.c b/src/gsm/tuak/KeccakP-1600-3gpp.c
new file mode 100644
index 0000000..3f5e2ad
--- /dev/null
+++ b/src/gsm/tuak/KeccakP-1600-3gpp.c
@@ -0,0 +1,176 @@
+/* -----------------------------------------------------------------------
+ * code extracted from 3GPP TS 35.231, annex E for Keccak core functions
+ * https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2402
+ *-----------------------------------------------------------------------*/
+
+/* This code may be freely used or adapted.
+*/
+
+#include "KeccakP-1600-3gpp.h"
+
+
+const uint8_t Rho[25]		= {0,1,62,28,27,36,44,6,55,20,3,10,43,25,39,41,45,
+   15,21,8,18,2,61,56,14};
+
+const uint8_t Pi[25]		= {0,6,12,18,24,3,9,10,16,22,1,7,13,19,20,4,5,11,17,
+   23,2,8,14,15,21};
+
+const uint8_t Iota[24]	= {1,146,218,112,155,33,241,89,138,136,57,42,187,203,
+   217,83,82,192,26,106,241,208,33,120};
+
+#define ROTATE64(value, n)	\
+((((uint64_t)(value))<<(n)) | (((uint64_t)(value))>>(64-(n))))
+
+/* ---------------------------------------------------------------------
+   64-bit version of Keccak_f(1600)
+   ---------------------------------------------------------------------
+*/
+void Keccak_f_64(uint64_t s[25])
+{	uint64_t t[5];
+	uint8_t i, j, round;
+
+	for(round=0; round<24; ++round)
+	{	/* Theta function */
+		for(i=0; i<5; ++i)
+			t[i] = s[i] ^ s[5+i] ^ s[10+i] ^ s[15+i] ^ s[20+i];
+		for(i=0; i<5; ++i, s+=5)
+		{	s[0] ^= t[4] ^ ROTATE64(t[1], 1);
+			s[1] ^= t[0] ^ ROTATE64(t[2], 1);
+			s[2] ^= t[1] ^ ROTATE64(t[3], 1);
+			s[3] ^= t[2] ^ ROTATE64(t[4], 1);
+			s[4] ^= t[3] ^ ROTATE64(t[0], 1);
+		}
+		s -= 25;
+
+		/* Rho function */
+		for(i=1; i<25; ++i)
+			s[i] = ROTATE64(s[i], Rho[i]);
+
+		/* Pi function */
+		for(t[1] = s[i=1]; (j=Pi[i]) > 1; s[i]=s[j], i=j);
+		s[i] = t[1];
+
+		/* Chi function */
+		for(i=0; i<5; ++i, s += 5)
+		{	t[0] = (~s[1]) & s[2];
+			t[1] = (~s[2]) & s[3];
+			t[2] = (~s[3]) & s[4];
+			t[3] = (~s[4]) & s[0];
+			t[4] = (~s[0]) & s[1];
+			for(j=0; j<5; ++j) s[j] ^= t[j];
+		}
+		s -= 25;
+
+		/* Iota function */
+		t[0] = Iota[round];
+		*s ^= (t[0] | (t[0]<<11) | (t[0]<<26) | (t[0]<<57)) 
+              & 0x800000008000808BULL; /* set & mask bits 0,1,3,7,15,31,63 */
+	}
+}
+
+
+/* ---------------------------------------------------------------------
+   8-bit version of Keccak_f(1600)
+   ---------------------------------------------------------------------
+*/
+void Keccak_f_8(uint8_t s[200])
+{	uint8_t t[40], i, j, k, round;
+
+	for(round=0; round<24; ++round)
+	{	/* Theta function */
+		for(i=0; i<40; ++i)
+			t[i]=s[i]^s[40+i]^s[80+i]^s[120+i]^s[160+i];
+		for(i=0; i<200; i+=8)
+			for(j = (i+32)%40, k=0; k<8; ++k)
+				s[i+k] ^= t[j+k];
+		for(i=0; i<40; t[i] = (t[i]<<1)|j, i+=8)
+			for(j = t[i+7]>>7, k=7; k; --k)
+				t[i+k] = (t[i+k]<<1)|(t[i+k-1]>>7);
+		for(i=0; i<200; i+=8)
+			for(j = (i+8)%40, k=0; k<8; ++k)
+				s[i+k] ^= t[j+k];
+
+		/* Rho function */
+		for(i=8; i<200; i+=8)
+		{	for(j = Rho[i>>3]>>3, k=0; k<8; ++k) 	/* j:=bytes to shift, s->t 		*/
+				t[(k+j)&7] = s[i+k];
+			for(j = Rho[i>>3]&7, k=7; k; --k) 	   /* j:=bits  to shift, t->s 	*/
+				s[i+k] = (t[k]<<j) | (t[k-1]>>(8-j));
+			s[i] = (t[0]<<j) | (t[7]>>(8-j));
+		}
+
+		/* Pi function */
+		for(k=8; k<16; ++k) t[k] = s[k];		/* =memcpy(t+8, s+8, 8) 				 	*/
+		for(i=1; (j=Pi[i])>1; i=j)
+			for(k=0; k<8; ++k)						/* =memcpy(s+(i<<3), s+(j<<3), 8)	*/
+				s[(i<<3)|k] = s[(j<<3)|k];
+		for(k=0; k<8; ++k)							/* =memcpy(s+(i<<3), t+8, 8) 		 	*/
+			s[(i<<3)|k] = t[k+8];
+
+		/* Chi function */
+		for(i=0; i<200; i+=40)
+		{	for(j=0; j<40; ++j)
+				t[j]=(~s[i+(j+8)%40]) & s[i+(j+16)%40];
+			for(j=0; j<40; ++j)	s[i+j]^=t[j];
+		}
+
+		/* Iota function */
+		k = Iota[round];
+		s[0] ^= k & 0x8B;			/* bits 0, 1, 3, 7 */
+		s[1] ^= (k<<3)&0x80;		/* bit 15 */
+		s[3] ^= (k<<2)&0x80;		/* bit 31 */
+		s[7] ^= (k<<1)&0x80;		/* bit 63 */
+
+	}
+}
+
+/* ---------------------------------------------------------------------
+   32-bit version of Keccak_f(1600)
+   ---------------------------------------------------------------------
+*/
+void Keccak_f_32(uint32_t s[50])
+{	uint32_t t[10];
+	uint8_t i, j, round, k;
+
+	for(round=0; round<24; ++round)
+	{	/* Theta function */
+		for(i=0; i<10; ++i)
+			t[i] = s[i] ^ s[10+i] ^ s[20+i] ^ s[30+i] ^ s[40+i];
+		for(i=0; i<5; ++i)
+			for(j=8, k=2; ; j%=10, k=(k+2)%10)
+			{	*s++ ^= t[j++] ^ ((t[k]<<1)|(t[k+1]>>31));
+				*s++ ^= t[j++] ^ ((t[k+1]<<1)|(t[k]>>31));
+				if(j==8) break;
+			}
+		s -= 50;
+
+		/* Rho function */
+		for(i=2; i<50; i+=2)
+		{	k = Rho[i>>1] & 0x1f;
+			t[0] = (s[i+1] << k) | (s[i] >> (32-k));
+			t[1] = (s[i] << k) | (s[i+1] >> (32-k));
+			k = Rho[i>>1] >> 5;
+			s[i] = t[1-k], s[i+1] = t[k];
+		}
+
+		/* Pi function */
+		for(i=2, t[0]=s[2], t[1]=s[3]; (j=(Pi[i>>1]<<1))>2; i=j)
+			s[i]=s[j], s[i+1]=s[j+1];
+		s[i]=t[0], s[i+1]=t[1];
+
+		/* Chi function */
+		for(i=0; i<5; ++i, s+=10)
+		{	for(j=0; j<10; ++j)
+				t[j] = (~s[(j+2)%10]) & s[(j+4)%10];
+			for(j=0; j<10; ++j)
+				s[j] ^= t[j];
+		}
+		s -= 50;
+
+		/* Iota function */
+		t[0] = Iota[round];
+		s[0] ^= (t[0] | (t[0]<<11) | (t[0]<<26)) & 0x8000808B;
+		s[1] ^= (t[0]<<25) & 0x80000000;
+	}
+}
+
diff --git a/src/gsm/tuak/KeccakP-1600-3gpp.h b/src/gsm/tuak/KeccakP-1600-3gpp.h
new file mode 100644
index 0000000..a23cc46
--- /dev/null
+++ b/src/gsm/tuak/KeccakP-1600-3gpp.h
@@ -0,0 +1,25 @@
+/* -----------------------------------------------------------------------
+ * code extracted from 3GPP TS 35.231, annex E for Keccak core functions
+ * https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2402
+ *-----------------------------------------------------------------------*/
+
+/* this is the trick to make the code cross-platform
+ * at least, Win32 / Linux */
+
+#if defined(_WIN32) || defined(__WIN32__)
+#	include <windows.h>
+#	define EXPORTIT __declspec(dllexport)
+#else
+#	define EXPORTIT
+#endif
+
+#include <stdint.h>
+
+/*------------------------------------------------------------------------
+ * KeccakP-1600-3gpp.h
+ *------------------------------------------------------------------------*/
+
+EXPORTIT void Keccak_f_8 (uint8_t s[200]);
+EXPORTIT void Keccak_f_32(uint32_t s[50]);
+EXPORTIT void Keccak_f_64(uint64_t s[25]);
+
diff --git a/src/gsm/tuak/tuak.c b/src/gsm/tuak/tuak.c
new file mode 100644
index 0000000..c044a37
--- /dev/null
+++ b/src/gsm/tuak/tuak.c
@@ -0,0 +1,372 @@
+/* (C) 2023 by Harald Welte <laforge@osmocom.org>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <string.h>
+#include <errno.h>
+
+#include <osmocom/core/utils.h>
+
+#include "KeccakP-1600-3gpp.h"
+
+/* TUAK authentication algorithm
+ * as proposed by 3GPP as an alternative to Milenage
+ * algorithm based on SHA-3 (more exactly its KeccakP-1600 permutation)
+ * see 3GPP TS 35.231, 232 and 233 */
+
+static unsigned int g_keccak_iterations = 1;
+static const char algoname[] = "TUAK1.0";
+const uint8_t zero16[16] = { 0, };
+
+void tuak_set_keccak_iterations(unsigned int i)
+{
+	g_keccak_iterations = i;
+}
+
+/* append data from 'input' to 'buf' at 'idx', reversing byte order */
+#define PUSH_DATA(buf, idx, input, nbytes)	\
+	for (int i = nbytes-1; i >= 0; i--) {	\
+		buf[idx++] = input[i];		\
+	}
+
+/* like memcpy(), but reversing they order of bytes */
+void memcpy_reverse(uint8_t *dst, const uint8_t *src, size_t len)
+{
+	for (size_t i = 0; i < len; i++)
+		dst[i] = src[len-i-1];
+}
+
+static void tuak_core(uint8_t buf[200], const uint8_t *opc, uint8_t instance, const uint8_t *_rand,
+		      const uint8_t *amf, const uint8_t *sqn, const uint8_t *k, uint8_t k_len_bytes,
+		      unsigned int keccac_iterations)
+{
+	unsigned int idx = 0;
+
+	PUSH_DATA(buf, idx, opc, 32);
+	buf[idx++] = instance;
+	PUSH_DATA(buf, idx, algoname, strlen(algoname)); /* without trailing NUL */
+	PUSH_DATA(buf, idx, _rand, 16);
+	PUSH_DATA(buf, idx, amf, 2);
+	PUSH_DATA(buf, idx, sqn, 6);
+	PUSH_DATA(buf, idx, k, k_len_bytes);
+	memset(buf+idx, 0, 32-k_len_bytes); idx += 32-k_len_bytes;
+	buf[idx++] = 0x1f;
+	memset(buf+idx, 0, 38); idx += 38;
+	buf[idx++] = 0x80;
+	memset(buf+idx, 0, 64); idx += 64;
+	OSMO_ASSERT(idx == 200);
+
+	for (unsigned int i = 0; i < keccac_iterations; i++)
+		Keccak_f_64((uint64_t *) buf);
+}
+
+/**
+ * tuak_f1 - TUAK f1 algorithm
+ * @opc: OPc = 256-bit value derived from OP and K
+ * @k: K = 128-bit or 256-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @sqn: SQN = 48-bit sequence number
+ * @amf: AMF = 16-bit authentication management field
+ * @mac_a: Buffer for MAC-A = 64/128/256-bit network authentication code
+ * Returns: 0 on success, -1 on failure
+ */
+int tuak_f1(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes, const uint8_t *_rand,
+	    const uint8_t *sqn, const uint8_t *amf, uint8_t *mac_a, uint8_t mac_a_len_bytes,
+	    unsigned int keccac_iterations)
+{
+	uint8_t buf[200];
+	uint8_t instance = 0x00;
+
+	switch (mac_a_len_bytes) {
+	case 8:
+		instance |= 0x08;
+		break;
+	case 16:
+		instance |= 0x10;
+		break;
+	case 32:
+		instance |= 0x20;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	switch (k_len_bytes) {
+	case 16:
+		break;
+	case 32:
+		instance |= 0x01;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	tuak_core(buf, opc, instance, _rand, amf, sqn, k, k_len_bytes, keccac_iterations);
+
+	memcpy_reverse(mac_a, buf, mac_a_len_bytes);
+
+	return 0;
+}
+
+/**
+ * tuak_f1star - TUAK f1* algorithm
+ * @opc: OPc = 256-bit value derived from OP and K
+ * @k: K = 128-bit or 256-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @sqn: SQN = 48-bit sequence number
+ * @amf: AMF = 16-bit authentication management field
+ * @mac_s: Buffer for MAC-S = 64/128/256-bit resync authentication code
+ * Returns: 0 on success, -1 on failure
+ */
+int tuak_f1star(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes, const uint8_t *_rand,
+		const uint8_t *sqn, const uint8_t *amf, uint8_t *mac_s, uint8_t mac_s_len_bytes,
+		unsigned int keccac_iterations)
+{
+	uint8_t buf[200];
+	uint8_t instance = 0x80;
+
+	switch (mac_s_len_bytes) {
+	case 8:
+		instance |= 0x08;
+		break;
+	case 16:
+		instance |= 0x10;
+		break;
+	case 32:
+		instance |= 0x20;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	switch (k_len_bytes) {
+	case 16:
+		break;
+	case 32:
+		instance |= 0x01;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	tuak_core(buf, opc, instance, _rand, amf, sqn, k, k_len_bytes, keccac_iterations);
+
+	memcpy_reverse(mac_s, buf, mac_s_len_bytes);
+
+	return 0;
+}
+
+/**
+ * tuak_f2345 - TUAK f2, f3, f4, f5, algorithms
+ * @opc: OPc = 256-bit value derived from OP and K
+ * @k: K = 128/256-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @res: Buffer for RES = 32/64/128/256-bit signed response (f2), or %NULL
+ * @ck: Buffer for CK = 128/256-bit confidentiality key (f3), or %NULL
+ * @ik: Buffer for IK = 128/256-bit integrity key (f4), or %NULL
+ * @ak: Buffer for AK = 48-bit anonymity key (f5), or %NULL
+ * Returns: 0 on success, -1 on failure
+ */
+int tuak_f2345(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes,
+	       const uint8_t *_rand, uint8_t *res, uint8_t res_len_bytes,
+	       uint8_t *ck, uint8_t ck_len_bytes,
+	       uint8_t *ik, uint8_t ik_len_bytes, uint8_t *ak, unsigned int keccac_iterations)
+{
+	uint8_t buf[200];
+	uint8_t instance = 0x40;
+
+	switch (res_len_bytes) {
+	case 4:
+		break;
+	case 8:
+		instance |= 0x08;
+		break;
+	case 16:
+		instance |= 0x10;
+		break;
+	case 32:
+		instance |= 0x20;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	switch (ck_len_bytes) {
+	case 16:
+		break;
+	case 32:
+		instance |= 0x04;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	switch (ik_len_bytes) {
+	case 16:
+		break;
+	case 32:
+		instance |= 0x02;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	switch (k_len_bytes) {
+	case 16:
+		break;
+	case 32:
+		instance |= 0x01;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	tuak_core(buf, opc, instance, _rand, zero16, zero16, k, k_len_bytes, keccac_iterations);
+
+	if (res)
+		memcpy_reverse(res, buf, res_len_bytes);
+
+	if (ck)
+		memcpy_reverse(ck, buf + 32, ck_len_bytes);
+
+	if (ik)
+		memcpy_reverse(ik, buf + 64, ik_len_bytes);
+
+	if (ak)
+		memcpy_reverse(ak, buf + 96, 6);
+
+	return 0;
+}
+
+/**
+ * tuak_f5star - TUAK f5* algorithm
+ * @opc: OPc = 256-bit value derived from OP and K
+ * @k: K = 128/256-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @ak: Buffer for AK = 48-bit anonymity key (f5)
+ * Returns: 0 on success, -1 on failure
+ */
+int tuak_f5star(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes,
+		const uint8_t *_rand, uint8_t *ak, unsigned int keccac_iterations)
+{
+	uint8_t buf[200];
+	uint8_t instance = 0xc0;
+
+	switch (k_len_bytes) {
+	case 16:
+		break;
+	case 32:
+		instance += 1;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	tuak_core(buf, opc, instance, _rand, zero16, zero16, k, k_len_bytes, keccac_iterations);
+
+	memcpy_reverse(ak, buf + 96, 6);
+
+	return 0;
+}
+
+/**
+ * tuak_generate - Generate AKA AUTN,IK,CK,RES
+ * @opc: OPc = 256-bit operator variant algorithm configuration field (encr.)
+ * @amf: AMF = 16-bit authentication management field
+ * @k: K = 128/256-bit subscriber key
+ * @sqn: SQN = 48-bit sequence number
+ * @_rand: RAND = 128-bit random challenge
+ * @autn: Buffer for AUTN = 128-bit authentication token
+ * @ik: Buffer for IK = 128/256-bit integrity key (f4), or %NULL
+ * @ck: Buffer for CK = 128/256-bit confidentiality key (f3), or %NULL
+ * @res: Buffer for RES = 32/64/128-bit signed response (f2), or %NULL
+ * @res_len: Max length for res; set to used length or 0 on failure
+ */
+void tuak_generate(const uint8_t *opc, const uint8_t *amf, const uint8_t *k, uint8_t k_len_bytes,
+		   const uint8_t *sqn, const uint8_t *_rand, uint8_t *autn, uint8_t *ik,
+		   uint8_t *ck, uint8_t *res, size_t *res_len)
+{
+	int i;
+	uint8_t mac_a[8], ak[6];
+
+	if (*res_len < 4) {
+		*res_len = 0;
+		return;
+	}
+	if (tuak_f1(opc, k, k_len_bytes, _rand, sqn, amf, mac_a, sizeof(mac_a), g_keccak_iterations) ||
+	    tuak_f2345(opc, k, k_len_bytes, _rand, res, *res_len, ck, 16, ik, 16, ak, g_keccak_iterations)) {
+		*res_len = 0;
+		return;
+	}
+
+	/* AUTN = (SQN ^ AK) || AMF || MAC */
+	for (i = 0; i < 6; i++)
+		autn[i] = sqn[i] ^ ak[i];
+	memcpy(autn + 6, amf, 2);
+	memcpy(autn + 8, mac_a, 8);
+}
+
+
+/**
+ * tuak_auts - Milenage AUTS validation
+ * @opc: OPc = 256-bit operator variant algorithm configuration field (encr.)
+ * @k: K = 128/256-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @auts: AUTS = 112-bit authentication token from client
+ * @sqn: Buffer for SQN = 48-bit sequence number
+ * Returns: 0 = success (sqn filled), -1 on failure
+ */
+int tuak_auts(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes,
+	      const uint8_t *_rand, const uint8_t *auts, uint8_t *sqn)
+{
+	uint8_t amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */
+	uint8_t ak[6], mac_s[8];
+	int i;
+
+	if (tuak_f5star(opc, k, k_len_bytes, _rand, ak, g_keccak_iterations))
+		return -1;
+	for (i = 0; i < 6; i++)
+		sqn[i] = auts[i] ^ ak[i];
+	if (tuak_f1star(opc, k, k_len_bytes, _rand, sqn, amf, mac_s, 8, g_keccak_iterations) ||
+	    memcmp(mac_s, auts + 6, 8) != 0)
+		return -1;
+	return 0;
+}
+
+int tuak_opc_gen(uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes, const uint8_t *op)
+{
+	uint8_t buf[200];
+	uint8_t instance;
+
+	switch (k_len_bytes) {
+	case 16:
+		instance = 0x00;
+		break;
+	case 32:
+		instance = 0x01;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	tuak_core(buf, op, instance, zero16, zero16, zero16, k, k_len_bytes, g_keccak_iterations);
+
+	memcpy_reverse(opc, buf, 32);
+
+	return 0;
+}
diff --git a/src/gsm/tuak/tuak.h b/src/gsm/tuak/tuak.h
new file mode 100644
index 0000000..1a80822
--- /dev/null
+++ b/src/gsm/tuak/tuak.h
@@ -0,0 +1,33 @@
+#pragma once
+#include <stdint.h>
+
+/* low-level functions */
+
+int tuak_f1(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes, const uint8_t *_rand,
+	    const uint8_t *sqn, const uint8_t *amf, uint8_t *mac_a, uint8_t mac_a_len_bytes,
+	    unsigned int keccac_iterations);
+
+int tuak_f1star(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes, const uint8_t *_rand,
+		const uint8_t *sqn, const uint8_t *amf, uint8_t *mac_s, uint8_t mac_s_len_bytes,
+		unsigned int keccac_iterations);
+
+int tuak_f2345(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes,
+	       const uint8_t *_rand, uint8_t *res, uint8_t res_len_bytes,
+	       uint8_t *ck, uint8_t ck_len_bytes,
+	       uint8_t *ik, uint8_t ik_len_bytes, uint8_t *ak, unsigned int keccac_iterations);
+
+int tuak_f5star(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes,
+		const uint8_t *_rand, uint8_t *ak, unsigned int keccac_iterations);
+
+/* high-level API */
+
+void tuak_set_keccak_iterations(unsigned int i);
+
+void tuak_generate(const uint8_t *opc, const uint8_t *amf, const uint8_t *k, uint8_t k_len_bytes,
+		   const uint8_t *sqn, const uint8_t *_rand, uint8_t *autn, uint8_t *ik,
+		   uint8_t *ck, uint8_t *res, size_t *res_len);
+
+int tuak_auts(const uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes,
+	      const uint8_t *_rand, const uint8_t *auts, uint8_t *sqn);
+
+int tuak_opc_gen(uint8_t *opc, const uint8_t *k, uint8_t k_len_bytes, const uint8_t *op);
diff --git a/tests/Makefile.am b/tests/Makefile.am
index c6027a9..8df9d56 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -10,7 +10,8 @@
 
 check_PROGRAMS = timer/timer_test sms/sms_test ussd/ussd_test		\
                  bits/bitrev_test a5/a5_test		                \
-                 conv/conv_test auth/milenage_test lapd/lapd_test	\
+                 conv/conv_test auth/milenage_test auth/tuak_test	\
+		 lapd/lapd_test						\
                  gsm0808/gsm0808_test gsm0408/gsm0408_test		\
 		 gprs/gprs_test	kasumi/kasumi_test gea/gea_test		\
 		 logging/logging_test codec/codec_test			\
@@ -115,6 +116,10 @@
 auth_milenage_test_SOURCES = auth/milenage_test.c
 auth_milenage_test_LDADD = $(top_builddir)/src/gsm/libosmogsm.la $(LDADD)
 
+auth_tuak_test_SOURCES = auth/tuak_test.c
+auth_tuak_test_LDADD = $(top_builddir)/src/gsm/libgsmint.la $(LDADD)
+auth_tuak_test_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/src
+
 auth_xor2g_test_SOURCES = auth/xor2g_test.c
 auth_xor2g_test_LDADD = $(top_builddir)/src/gsm/libosmogsm.la $(LDADD)
 
@@ -393,6 +398,7 @@
              timer/timer_test.ok sms/sms_test.ok ussd/ussd_test.ok	\
              bits/bitrev_test.ok a5/a5_test.ok				\
              conv/conv_test.ok auth/milenage_test.ok ctrl/ctrl_test.ok	\
+	     auth/tuak_test.ok					\
              auth/xor2g_test.ok						\
              lapd/lapd_test.ok						\
              gsm0408/gsm0408_test.ok gsm0408/gsm0408_test.err		\
@@ -535,6 +541,8 @@
 		>$(srcdir)/ussd/ussd_test.ok
 	auth/milenage_test \
 		>$(srcdir)/auth/milenage_test.ok
+	auth/tuak_test \
+		>$(srcdir)/auth/tuak_test.ok
 	comp128/comp128_test \
 		>$(srcdir)/comp128/comp128_test.ok
 	lapd/lapd_test \
diff --git a/tests/auth/tuak_test.c b/tests/auth/tuak_test.c
new file mode 100644
index 0000000..a00ab2c
--- /dev/null
+++ b/tests/auth/tuak_test.c
@@ -0,0 +1,309 @@
+
+#include <stdint.h>
+#include <osmocom/core/utils.h>
+#include "gsm/tuak/tuak.h"
+
+/* user-friendly test specification, uses hex-strings for all parameters for
+ * copy+pasting from the spec. */
+struct tuak_testspec {
+	const char *name;
+	struct {
+		const char *k;
+		const char *rand;
+		const char *sqn;
+		const char *amf;
+		const char *top;
+		unsigned int keccak_iterations;
+	} in;
+	struct {
+		const char *topc;
+		const char *f1;
+		const char *f1star;
+		const char *f2;
+		const char *f3;
+		const char *f4;
+		const char *f5;
+		const char *f5star;
+	} out;
+};
+
+static const struct tuak_testspec testspecs[] = {
+	{
+		.name = "TS 35.233 Section 6.3 Test Set 1",
+		.in = {
+			.k = "abababababababababababababababab",
+			.rand = "42424242424242424242424242424242",
+			.sqn = "111111111111",
+			.amf = "ffff",
+			.top = "5555555555555555555555555555555555555555555555555555555555555555",
+			.keccak_iterations = 1,
+		},
+		.out = {
+			.topc = "bd04d9530e87513c5d837ac2ad954623a8e2330c115305a73eb45d1f40cccbff",
+			.f1 = "f9a54e6aeaa8618d",
+			.f1star = "e94b4dc6c7297df3",
+			.f2 = "657acd64",
+			.f3 = "d71a1e5c6caffe986a26f783e5c78be1",
+			.f4 = "be849fa2564f869aecee6f62d4337e72",
+			.f5 = "719f1e9b9054",
+			.f5star = "e7af6b3d0e38",
+		},
+	}, {
+		.name = "TS 35.233 Section 6.4 Test Set 2",
+		.in = {
+			.k = "fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0efeeedecebeae9e8e7e6e5e4e3e2e1e0",
+			.rand = "0123456789abcdef0123456789abcdef",
+			.sqn = "0123456789ab",
+			.amf = "abcd",
+			.top = "808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f",
+			.keccak_iterations = 1,
+		},
+		.out = {
+			.topc = "305425427e18c503c8a4b294ea72c95d0c36c6c6b29d0c65de5974d5977f8524",
+			.f1 = "c0b8c2d4148ec7aa5f1d78a97e4d1d58",
+			.f1star = "ef81af7290f7842c6ceafa537fa0745b",
+			.f2 = "e9d749dc4eea0035",
+			.f3 = "a4cb6f6529ab17f8337f27baa8234d47",
+			.f4 = "2274155ccf4199d5e2abcbf621907f90",
+			.f5 = "480a9345cc1e",
+			.f5star = "f84eb338848c",
+		},
+	}, {
+		.name = "TS 35.233 Section 6.5 Test Set 3",
+		.in = {
+			.k = "fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0efeeedecebeae9e8e7e6e5e4e3e2e1e0",
+			.rand = "0123456789abcdef0123456789abcdef",
+			.sqn = "0123456789ab",
+			.amf = "abcd",
+			.top = "808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f",
+			.keccak_iterations = 1,
+		},
+		.out = {
+			.topc = "305425427e18c503c8a4b294ea72c95d0c36c6c6b29d0c65de5974d5977f8524",
+			.f1 = "d97b75a1776065271b1e212bc3b1bf173f438b21e6c64a55a96c372e085e5cc5",
+			.f1star = "427bbf07c6e3a86c54f8c5216499f3909a6fd4a164c9fe235b1550258111b821",
+			.f2 = "07021c73e7635c7d",
+			.f3 = "4d59ac796834eb85d11fa148a5058c3c",
+			.f4 = "126d47500136fdc5ddfd14f19ebf16749ce4b6435323fbb5715a3a796a6082bd",
+			.f5 = "1d6622c4e59a",
+			.f5star = "f84eb338848c",
+		},
+	}, {
+		.name = "TS 35.233 Section 6.6 Test Set 4",
+		.in = {
+			.k = "b8da837a50652d6ac7c97da14f6acc61",
+			.rand = "6887e55425a966bd86c9661a5fa72be8",
+			.sqn = "0dea2ee2c5af",
+			.amf = "df1e",
+			.top = "0952be13556c32ebc58195d9dd930493e12a9003669988ffde5fa1f0fe35cc01",
+			.keccak_iterations = 1,
+		},
+		.out = {
+			.topc = "2bc16eb657a68e1f446f08f57c0efb1d493527a2e652ce281eb6ca0e4487760a",
+			.f1 = "749214087958dd8f58bfcdf869d8ae3f",
+			.f1star = "619e865afe80e382aee13063f9dfb56d",
+			.f2 = "4041ce438e3e38e8aa96562eed83ac43",
+			.f3 = "3e3bc01bea0cd914c4c2c83ce2d92757",
+			.f4 = "666a8e6f577b1aa77b7fd53cebb8a3d6",
+			.f5 = "1f880d005119",
+			.f5star = "45e617d77fe5",
+		},
+	}, {
+		.name = "TS 35.233 Section 6.7 Test Set 5",
+		.in = {
+			.k = "1574ca56881d05c189c82880f789c9cd4244955f4426aa2b69c29f15770e5aa5",
+			.rand = "c570aac68cde651fb1e3088322498bef",
+			.sqn = "c89bb71f3a41",
+			.amf = "297d",
+			.top = "e59f6eb10ea406813f4991b0b9e02f181edf4c7e17b480f66d34da35ee88c95e",
+			.keccak_iterations = 1,
+		},
+		.out = {
+			.topc = "3c6052e41532a28a47aa3cbb89f223e8f3aaa976aecd48bc3e7d6165a55eff62",
+			.f1 = "d7340dad02b4cb01",
+			.f1star = "c6021e2e66accb15",
+			.f2 = "84d89b41db1867ffd4c7ba1d82163f4d526a20fbae5418fbb526940b1eeb905c",
+			.f3 = "d419676afe5ab58c1d8bee0d43523a4d2f52ef0b31a4676a0c334427a988fe65",
+			.f4 = "205533e505661b61d05cc0eac87818f4",
+			.f5 = "d7b3d2d4980a",
+			.f5star = "ca9655264986",
+		},
+	}, {
+		.name = "TS 35.233 Section 6.8 Test Set 6",
+		.in = {
+			.k = "1574ca56881d05c189c82880f789c9cd4244955f4426aa2b69c29f15770e5aa5",
+			.rand = "c570aac68cde651fb1e3088322498bef",
+			.sqn = "c89bb71f3a41",
+			.amf = "297d",
+			.top = "e59f6eb10ea406813f4991b0b9e02f181edf4c7e17b480f66d34da35ee88c95e",
+			.keccak_iterations = 2,
+		},
+		.out = {
+			.topc = "b04a66f26c62fcd6c82de22a179ab65506ecf47f56245cd149966cfa9cec7a51",
+			.f1 = "90d2289ed1ca1c3dbc2247bb480d431ac71d2e4a7677f6e997cfddb0cbad88b7",
+			.f1star = "427355dbac30e825063aba61b556e87583abac638e3ab01c4c884ad9d458dc2f",
+			.f2 = "d67e6e64590d22eecba7324afa4af4460c93f01b24506d6e12047d789a94c867",
+			.f3 = "ede57edfc57cdffe1aae75066a1b7479bbc3837438e88d37a801cccc9f972b89",
+			.f4 = "48ed9299126e5057402fe01f9201cf25249f9c5c0ed2afcf084755daff1d3999",
+			.f5 = "6aae8d18c448",
+			.f5star = "8c5f33b61f4e",
+		},
+	},
+};
+
+
+struct tuak_testset {
+	const char *name;
+	struct {
+		uint8_t k[32];
+		uint8_t k_len_bytes;
+		uint8_t rand[16];
+		uint8_t sqn[6];
+		uint8_t amf[2];
+		uint8_t top[32];
+		unsigned int keccak_iterations;
+	} in;
+	struct {
+		uint8_t topc[32];
+		uint8_t mac_a[32];
+		uint8_t mac_s[32];
+		uint8_t mac_len_bytes;
+
+		uint8_t res[32];
+		uint8_t res_len_bytes;
+
+		uint8_t ck[32];
+		uint8_t ck_len_bytes;
+		uint8_t ik[32];
+		uint8_t ik_len_bytes;
+		uint8_t ak[6];
+		uint8_t f5star[6];
+	} out;
+};
+
+static void expect_equal(const char *name, const uint8_t *actual, const uint8_t *expected, size_t len)
+{
+	if (!memcmp(actual, expected, len)) {
+		printf("\t%s: %s\r\n", name, osmo_hexdump_nospc(actual, len));
+	} else {
+		char buf[len*2+1];
+		printf("\t%s: %s != %s\r\n", name, osmo_hexdump_nospc(actual, len),
+			osmo_hexdump_buf(buf, sizeof(buf), expected, len, "", true));
+	}
+}
+
+static void execute_testset(const struct tuak_testset *tset)
+{
+	uint8_t topc[32];
+
+	printf("==> %s\n", tset->name);
+
+	tuak_set_keccak_iterations(tset->in.keccak_iterations);
+	tuak_opc_gen(topc, tset->in.k, tset->in.k_len_bytes, tset->in.top);
+	expect_equal("TOPc", topc, tset->out.topc, sizeof(topc));
+
+	if (tset->out.mac_len_bytes) {
+		uint8_t mac_a[32];
+		uint8_t mac_s[32];
+
+		tuak_f1(topc, tset->in.k, tset->in.k_len_bytes, tset->in.rand, tset->in.sqn, tset->in.amf,
+			mac_a, tset->out.mac_len_bytes, tset->in.keccak_iterations);
+		expect_equal("MAC_A", mac_a, tset->out.mac_a, tset->out.mac_len_bytes);
+
+		tuak_f1star(topc, tset->in.k, tset->in.k_len_bytes, tset->in.rand, tset->in.sqn, tset->in.amf,
+			    mac_s, tset->out.mac_len_bytes, tset->in.keccak_iterations);
+		expect_equal("MAC_S", mac_s, tset->out.mac_s, tset->out.mac_len_bytes);
+	}
+
+	if (tset->out.ck_len_bytes || tset->out.ik_len_bytes || tset->out.res_len_bytes) {
+		uint8_t res[32];
+		uint8_t ck[32];
+		uint8_t ik[32];
+		uint8_t ak[6];
+
+		tuak_f2345(topc, tset->in.k, tset->in.k_len_bytes, tset->in.rand,
+			   tset->out.res_len_bytes ? res : NULL, tset->out.res_len_bytes,
+			   tset->out.ck_len_bytes ? ck : NULL, tset->out.ck_len_bytes,
+			   tset->out.ik_len_bytes ? ik : NULL, tset->out.ik_len_bytes,
+			   ak, tset->in.keccak_iterations);
+
+		if (tset->out.res_len_bytes)
+			expect_equal("RES", res, tset->out.res, tset->out.res_len_bytes);
+
+		if (tset->out.ck_len_bytes)
+			expect_equal("CK", ck, tset->out.ck, tset->out.ck_len_bytes);
+
+		if (tset->out.ik_len_bytes)
+			expect_equal("IK", ik, tset->out.ik, tset->out.ik_len_bytes);
+
+		expect_equal("AK", ak, tset->out.ak, 6);
+	}
+}
+
+/* convert string-testspec to binary-testset and execute it */
+static void execute_testspec(const struct tuak_testspec *tcase)
+{
+	struct tuak_testset _tset, *tset = &_tset;
+
+	tset->name = tcase->name;
+	tset->in.keccak_iterations = tcase->in.keccak_iterations;
+
+	osmo_hexparse(tcase->in.k, tset->in.k, sizeof(tset->in.k));
+	tset->in.k_len_bytes = strlen(tcase->in.k)/2;
+	OSMO_ASSERT(tset->in.k_len_bytes == 16 || tset->in.k_len_bytes == 32);
+
+	osmo_hexparse(tcase->in.rand, tset->in.rand, sizeof(tset->in.rand));
+	OSMO_ASSERT(strlen(tcase->in.rand)/2 == 16);
+
+	osmo_hexparse(tcase->in.sqn, tset->in.sqn, sizeof(tset->in.sqn));
+	OSMO_ASSERT(strlen(tcase->in.sqn)/2 == 6);
+
+	osmo_hexparse(tcase->in.amf, tset->in.amf, sizeof(tset->in.amf));
+	OSMO_ASSERT(strlen(tcase->in.amf)/2 == 2);
+
+	osmo_hexparse(tcase->in.top, tset->in.top, sizeof(tset->in.top));
+	OSMO_ASSERT(strlen(tcase->in.top)/2 == 32);
+
+	osmo_hexparse(tcase->out.topc, tset->out.topc, sizeof(tset->out.topc));
+	OSMO_ASSERT(strlen(tcase->out.topc)/2 == 32);
+
+	osmo_hexparse(tcase->out.f1, tset->out.mac_a, sizeof(tset->out.mac_a));
+	osmo_hexparse(tcase->out.f1star, tset->out.mac_s, sizeof(tset->out.mac_s));
+	OSMO_ASSERT(strlen(tcase->out.f1) == strlen(tcase->out.f1star));
+	tset->out.mac_len_bytes = strlen(tcase->out.f1)/2;
+	OSMO_ASSERT(tset->out.mac_len_bytes == 8 || tset->out.mac_len_bytes == 16 ||
+		    tset->out.mac_len_bytes == 32);
+
+	osmo_hexparse(tcase->out.f2, tset->out.res, sizeof(tset->out.res));
+	tset->out.res_len_bytes = strlen(tcase->out.f2)/2;
+	OSMO_ASSERT(tset->out.res_len_bytes == 4 || tset->out.res_len_bytes == 8 ||
+		    tset->out.res_len_bytes == 16 || tset->out.res_len_bytes == 32);
+
+	osmo_hexparse(tcase->out.f3, tset->out.ck, sizeof(tset->out.ck));
+	tset->out.ck_len_bytes = strlen(tcase->out.f3)/2;
+	OSMO_ASSERT(tset->out.ck_len_bytes == 16 || tset->out.ck_len_bytes == 32);
+
+	osmo_hexparse(tcase->out.f4, tset->out.ik, sizeof(tset->out.ik));
+	tset->out.ik_len_bytes = strlen(tcase->out.f4)/2;
+	OSMO_ASSERT(tset->out.ik_len_bytes == 16 || tset->out.ik_len_bytes == 32);
+
+	osmo_hexparse(tcase->out.f5, tset->out.ak, sizeof(tset->out.ak));
+	OSMO_ASSERT(strlen(tcase->out.f5)/2 == 6);
+
+	osmo_hexparse(tcase->out.f5star, tset->out.f5star, sizeof(tset->out.f5star));
+	OSMO_ASSERT(strlen(tcase->out.f5star)/2 == 6);
+
+	execute_testset(tset);
+}
+
+int main(int argc, char **argv)
+{
+#if 0
+	for (unsigned int i = 0; i < ARRAY_SIZE(testsets); i++)
+		execute_testset(&testsets[i]);
+#endif
+
+	for (unsigned int i = 0; i < ARRAY_SIZE(testspecs); i++)
+		execute_testspec(&testspecs[i]);
+
+}
diff --git a/tests/auth/tuak_test.ok b/tests/auth/tuak_test.ok
new file mode 100644
index 0000000..976fb59
--- /dev/null
+++ b/tests/auth/tuak_test.ok
@@ -0,0 +1,48 @@
+==> TS 35.233 Section 6.3 Test Set 1
+	TOPc: bd04d9530e87513c5d837ac2ad954623a8e2330c115305a73eb45d1f40cccbff
+	MAC_A: f9a54e6aeaa8618d
+	MAC_S: e94b4dc6c7297df3
+	RES: 657acd64
+	CK: d71a1e5c6caffe986a26f783e5c78be1
+	IK: be849fa2564f869aecee6f62d4337e72
+	AK: 719f1e9b9054
+==> TS 35.233 Section 6.4 Test Set 2
+	TOPc: 305425427e18c503c8a4b294ea72c95d0c36c6c6b29d0c65de5974d5977f8524
+	MAC_A: c0b8c2d4148ec7aa5f1d78a97e4d1d58
+	MAC_S: ef81af7290f7842c6ceafa537fa0745b
+	RES: e9d749dc4eea0035
+	CK: a4cb6f6529ab17f8337f27baa8234d47
+	IK: 2274155ccf4199d5e2abcbf621907f90
+	AK: 480a9345cc1e
+==> TS 35.233 Section 6.5 Test Set 3
+	TOPc: 305425427e18c503c8a4b294ea72c95d0c36c6c6b29d0c65de5974d5977f8524
+	MAC_A: d97b75a1776065271b1e212bc3b1bf173f438b21e6c64a55a96c372e085e5cc5
+	MAC_S: 427bbf07c6e3a86c54f8c5216499f3909a6fd4a164c9fe235b1550258111b821
+	RES: 07021c73e7635c7d
+	CK: 4d59ac796834eb85d11fa148a5058c3c
+	IK: 126d47500136fdc5ddfd14f19ebf16749ce4b6435323fbb5715a3a796a6082bd
+	AK: 1d6622c4e59a
+==> TS 35.233 Section 6.6 Test Set 4
+	TOPc: 2bc16eb657a68e1f446f08f57c0efb1d493527a2e652ce281eb6ca0e4487760a
+	MAC_A: 749214087958dd8f58bfcdf869d8ae3f
+	MAC_S: 619e865afe80e382aee13063f9dfb56d
+	RES: 4041ce438e3e38e8aa96562eed83ac43
+	CK: 3e3bc01bea0cd914c4c2c83ce2d92757
+	IK: 666a8e6f577b1aa77b7fd53cebb8a3d6
+	AK: 1f880d005119
+==> TS 35.233 Section 6.7 Test Set 5
+	TOPc: 3c6052e41532a28a47aa3cbb89f223e8f3aaa976aecd48bc3e7d6165a55eff62
+	MAC_A: d7340dad02b4cb01
+	MAC_S: c6021e2e66accb15
+	RES: 84d89b41db1867ffd4c7ba1d82163f4d526a20fbae5418fbb526940b1eeb905c
+	CK: d419676afe5ab58c1d8bee0d43523a4d2f52ef0b31a4676a0c334427a988fe65
+	IK: 205533e505661b61d05cc0eac87818f4
+	AK: d7b3d2d4980a
+==> TS 35.233 Section 6.8 Test Set 6
+	TOPc: b04a66f26c62fcd6c82de22a179ab65506ecf47f56245cd149966cfa9cec7a51
+	MAC_A: 90d2289ed1ca1c3dbc2247bb480d431ac71d2e4a7677f6e997cfddb0cbad88b7
+	MAC_S: 427355dbac30e825063aba61b556e87583abac638e3ab01c4c884ad9d458dc2f
+	RES: d67e6e64590d22eecba7324afa4af4460c93f01b24506d6e12047d789a94c867
+	CK: ede57edfc57cdffe1aae75066a1b7479bbc3837438e88d37a801cccc9f972b89
+	IK: 48ed9299126e5057402fe01f9201cf25249f9c5c0ed2afcf084755daff1d3999
+	AK: 6aae8d18c448