3GPP · 5G & Mobile
3GPP defines the standards behind 4G/5G and future 6G networks. Its security group, SA3, is studying how post-quantum cryptography affects mobile networks — with the ECC-based SUCI mechanism as the headline asymmetric target. Normative PQC in 3GPP is still in the study/roadmap phase.
SA3: the security working group
Within 3GPP, security architecture and protocols are owned by SA3 (Security and Privacy). SA3 defines mobile authentication, air-interface protection, identity privacy, transport security, and the certificate/PKI framework. It is also where 3GPP's quantum-safe work is being driven through study items.
What is symmetric vs Shor-vulnerable in 5G
A clear-eyed migration plan starts by separating the two risk classes. Symmetric primitives are only weakened by Grover's algorithm and are mitigated by adequate key sizes; asymmetric primitives are broken by Shor's algorithm and need replacement.
Symmetric — Grover only, mitigated by key size
- Authentication and Key Agreement (AKA). 5G-AKA relies on the
MILENAGEorTUAKalgorithm sets, which are symmetric constructions keyed by the long-term subscriber key. These are not Shor-vulnerable. - 256-bit study. SA3 has studied 256-bit transition topics, notably the Rel-19 TR 33.700-41 ("Study on enabling a cryptographic algorithm transition to 256 bits"); earlier 256-bit work (e.g. TR 33.841, Rel-16) should be checked against the current 3GPP 33-series list before citation.
- Air-interface ciphering & integrity. The 5G
128-NEA/128-NIAalgorithm families are built onSNOW 3G(NEA1/NIA1),AES(NEA2/NIA2), andZUC(NEA3/NIA3). All symmetric.
Current air-interface keys are 128-bit. A move toward 256-bit air-interface security is a discussed future goal to give symmetric algorithms a comfortable Grover margin, and is part of the SA3 study landscape.
Asymmetric — Shor-vulnerable, urgent
- SUCI / ECIES (the headline target). To stop IMSI catchers, 5G never sends the permanent subscriber identity in the clear. The long-term identity
SUPI/IMSIis concealed as the SUCI (Subscription Concealed Identifier) usingECIES, an ECC-based scheme defined normatively in TS 33.501: Profile A uses Curve25519/X25519, Profile B uses NIST P-256 (secp256r1); both wrap the result with AES-128-CTR plus HMAC-SHA-256. ECIES is Shor-vulnerable, so a future attacker who recorded SUCIs could de-conceal subscriber identities — a privacy break and a clear HNDL target. Academic and draft work already proposes hybrid replacements for SUCI/ECIES (e.g. X25519 + ML-KEM-768), but these are not yet a normative configuration in 3GPP TS 33.501. - Transport (TLS / IPsec). Backhaul and inter-node links rely on TLS and IPsec, whose key exchange and certificates are asymmetric.
- Service-Based Architecture (SBA) & roaming. The 5G core's SBA interfaces use TLS and certificates; roaming/interconnect runs over the
N32interface secured by the SEPP (Security Edge Protection Proxy). All asymmetric and Shor-vulnerable. - PKI / certificates. The certificate framework underpinning all of the above uses RSA/ECDSA today.
PQC study items and the Release / 6G timeline
3GPP SA3's PQC-related work is still in the study phase, carried out as Technical Reports (TRs) rather than as shipped normative features. the Rel-19 TR 33.700-41 studies enabling a transition to 256-bit algorithms (earlier 256-bit work such as TR 33.841 should be checked against the current 33-series list); TR 33.938 (Rel-19) takes a cryptographic inventory of 5G/6G and explores how NIST PQC algorithms might replace existing ones, and is non-normative. A dedicated SA3 follow-on PQC study item (referenced by some sources as TR 33.703; the final number is per 3GPP's official publication) targets the Rel-20 / 6G design horizon. Treat current activity as roadmap and feasibility study work, not as shipped mandatory PQC features.
Where the quantum risk actually sits in 5G
| Component | Current crypto | Quantum exposure | Migration focus |
|---|---|---|---|
| AKA / MILENAGE / TUAK | Symmetric | Not a direct Shor target; Grover gives only quadratic speedup | Key length and long-term security margin |
| SUCI / ECIES | ECC | Vulnerable to Shor | PQC or hybrid SUCI |
| SBA TLS | TLS | Follows IETF TLS PQC migration | Hybrid KEX now, PQ or hybrid certificates later |
| Roaming / SEPP / N32 | PKI / TLS | Certificate chains and trust anchors become critical | Interoperability, certificate migration, cross-operator governance |
What operators should track
- Inventory where ECIES (SUCI), TLS, IPsec, and certificates appear across RAN, core, and roaming.
- Plan for crypto-agility so a PQC/hybrid ECIES profile and PQC certificates can be adopted when standardized.
- Follow SA3 study outputs and coordinate with GSMA and IETF protocol work.
Standards & references
- 3GPP TS 33.501 — Security architecture and procedures for 5G (normative; defines SUCI/ECIES Profile A & B).
- 3GPP TR 33.841 — Study on the support of 256-bit algorithms for 5G (Rel-16; symmetric-key focus).
- 3GPP TR 33.938 — Cryptographic inventory of 3GPP-defined security protocols (Rel-19; non-normative).
- 3GPP TR 33.700-41 — Study on enabling a cryptographic algorithm transition to 256 bits (Rel-19).
- 3GPP specifications portal — SA3 specifications & study items.
Related
3GPP 5G 与移动网络
3GPP 制定 4G/5G 及未来 6G 网络的标准，其安全工作组 SA3 正在研究后量子密码对移动网络的影响，其中基于 ECC 的 SUCI 机制是最核心的非对称迁移目标。3GPP 的规范化 PQC 仍处于研究与路线规划阶段。
SA3 安全工作组
在 3GPP 内部，安全架构与协议由 SA3（安全与隐私）负责。SA3 定义移动认证、空口保护、身份隐私、传输安全以及证书与 PKI 框架，3GPP 的抗量子工作也通过 SA3 的研究项目推进。
5G 中哪些是对称的哪些易受 Shor 攻击
清晰的迁移规划首先要区分两类风险：对称原语仅被 Grover 算法削弱，通过足够的密钥长度即可缓解；非对称原语会被 Shor 算法攻破，必须替换。
对称 仅 Grover 由密钥长度缓解
- 认证与密钥协商（AKA）：5G-AKA 依赖
MILENAGE或TUAK算法集，它们是以长期用户密钥为密钥的对称构造，不易受 Shor 攻击。 - 256 位研究：SA3 已就 256 位过渡课题开展研究，其中 Rel-19 的 TR 33.700-41（启用 256 比特密码算法过渡研究）聚焦这一对称密钥方向；更早的 256 位工作（如 TR 33.841，Rel-16）引用前应对照 3GPP 当前 33 系列清单核实。
- 空口加密与完整性：5G 的
128-NEA/128-NIA算法族基于SNOW 3G（NEA1/NIA1）、AES（NEA2/NIA2）与ZUC（NEA3/NIA3），均为对称算法。
当前空口密钥为 128 位，向 256 位空口安全演进是业界讨论中的未来目标，以便为对称算法预留充裕的 Grover 余量，这也是 SA3 研究图景的一部分。
非对称 易受 Shor 攻击且紧迫
- SUCI / ECIES（核心目标）：为阻止 IMSI 抓取器，5G 从不明文发送永久用户身份。长期身份
SUPI/IMSI通过基于 ECC 的ECIES方案隐藏为 SUCI（订阅隐藏标识符），TS 33.501 对其作出规范化定义：Profile A 使用 Curve25519/X25519，Profile B 使用 NIST P-256（secp256r1），两者均以 AES-128-CTR 加 HMAC-SHA-256 封装结果。ECIES 易受 Shor 攻击，记录下 SUCI 的未来攻击者可还原出用户身份，既是隐私泄露也是明确的 HNDL 目标。学术与草案工作中已有以 X25519 + ML-KEM-768 等混合方式替代 SUCI/ECIES 的提案，但尚未成为 3GPP TS 33.501 中的规范化配置。 - 传输（TLS / IPsec）：回传与节点间链路依赖 TLS 与 IPsec，其密钥交换与证书均为非对称。
- 基于服务的架构（SBA）与漫游：5G 核心网的 SBA 接口使用 TLS 与证书，漫游与互联经由
N32接口、由 SEPP（安全边缘保护代理）保护，均为非对称且易受 Shor 攻击。 - PKI / 证书：支撑上述一切的证书框架目前使用 RSA/ECDSA。
PQC 研究项目与 Release / 6G 时间线
3GPP SA3 的 PQC 相关工作仍处于研究阶段（以技术报告 TR 的形式开展，而非已落地的规范化功能）。Rel-19 的 TR 33.700-41 研究向 256 比特算法的过渡（更早的 256 位工作如 TR 33.841 应对照当前 33 系列清单核实）；TR 33.938（Rel-19）对 5G/6G 的密码资产进行盘点并探讨 NIST PQC 算法可能的替换方式，属非规范性文件；SA3 一项专门的后量子研究项目（部分资料记为 TR 33.703，最终编号以 3GPP 正式发布为准）面向 Rel-20 / 6G 设计周期。因此当前活动应视为路线与可行性研究，而非已落地的强制 PQC 功能。
5G 中量子风险的实际分布
| 组件 | 当前密码机制 | 量子暴露 | 迁移重点 |
|---|---|---|---|
| AKA / MILENAGE / TUAK | 对称密码 | 非 Shor 直接目标；Grover 仅提供平方级加速 | 密钥长度与长期安全裕量 |
| SUCI / ECIES | ECC | 受 Shor 算法威胁 | PQC 或混合 SUCI |
| SBA TLS | TLS | 跟随 IETF TLS PQC 迁移 | 当前混合 KEX，后续 PQ 或混合证书 |
| Roaming / SEPP / N32 | PKI / TLS | 证书链与信任锚成为重点 | 互操作、证书迁移、跨运营商治理 |
运营商应关注什么
- 盘点 ECIES/SUCI、TLS、IPsec 及证书在 RAN、核心网与漫游中的分布。
- 规划密码敏捷性，以便在标准化后能采用 PQC/混合 ECIES 配置与 PQC 证书。
- 跟踪 SA3 研究产出，并与 GSMA 及 IETF 协议工作协同。
标准与参考
- 3GPP TS 33.501 5G 安全架构与流程，规范性定义 SUCI/ECIES Profile A 与 B。
- 3GPP TR 33.841 面向 5G 的 256 位算法支持研究（Rel-16），聚焦对称密钥。
- 3GPP TR 33.938 3GPP 安全协议密码资产清单（Rel-19），非规范性。
- 3GPP TR 33.700-41 启用 256 比特密码算法过渡研究（Rel-19）。
- 3GPP 标准门户 SA3 规范与研究项目。