Traditionally, the authentication protocols for cellular phone networks have been designed for device authentication rather than user authentication, which brings certain limitations and restrictions on the functionality of the system. In this paper we propose a user authentication protocol for the Global Standards for Mobile (GSM) which permits the use of weak secrets (e.g. passwords or PINs) for authentication, providing new flexibilities for the GSM users. © 2005 IEEE.