It doesn‘t need any keys, since the protocol itself is vulnerable to this. The Identity Request message that is sent is unauthenticated, but the phone replies with the IMSI nonetheless.

Note that this is just one part of the attack, the attack also includes fully passive localization of phones.