Telecom PQC Overview
Mobile networks combine extreme longevity, billions of subscribers, and long-lived credentials carrying data with decades-long secrecy requirements. That makes telecom one of the highest-priority sectors for post-quantum migration & one of the most exposed to "harvest now, decrypt later" attacks.
Why telecom is a high-priority, high-HNDL sector
Few industries match the cryptographic risk profile of mobile networks:
- Very long lifecycles. Generations of mobile technology coexist for decades. Equipment, SIM/credential provisioning, and roaming agreements are designed to outlast any single hardware refresh, so cryptographic choices made today persist far into the era of a cryptographically relevant quantum computer (CRQC).
- Huge subscriber bases. A single operator can serve hundreds of millions of subscribers, each with long-lived identity and credential keys provisioned into SIM/USIM modules that are costly to rotate.
- Long secrecy lifetime of traffic. Signalling, location, and subscriber-identity data retain value for years. An adversary can record encrypted traffic today and decrypt it once a CRQC exists — the classic HNDL threat.
Operators must therefore inventory and migrate cryptography across the entire network: the radio access network (RAN), the core, transport/backhaul, and roaming/interconnect links.
What is quantum-vulnerable vs not in mobile
Not every algorithm in a mobile network is equally at risk. Symmetric primitives are only weakened by Grover's algorithm and are largely mitigated by adequate key sizes. Asymmetric primitives are broken by Shor's algorithm and are the urgent migration targets.
| Network layer / function | Crypto used | Type | Quantum risk |
|---|---|---|---|
| Authentication (AKA) | MILENAGE / TUAK | Symmetric | Grover only — mitigated by key size (keys are currently 128-bit; 256-bit is a discussed future goal). 3GPP still discusses the 256-bit transition only as a study item, so it should not be read as already mandated in live networks. |
| Air-interface ciphering & integrity | 128-NEA/128-NIA (SNOW 3G, AES, ZUC-based 128-NEA3/128-NIA3) | Symmetric | Grover only — mitigated by key size |
| Subscriber identity concealment (SUCI) | ECIES (Profile A = Curve25519, Profile B = NIST P-256) | Asymmetric | Shor-vulnerable — if a future CRQC breaks the ECC used in SUCI/ECIES, recorded SUCIs may be de-concealed, exposing the corresponding SUPI/IMSI |
| Transport / backhaul | TLS, IPsec | Asymmetric (key exchange & certs) | Shor-vulnerable — HNDL exposure |
| Roaming / interconnect (N32, SEPP) | TLS, application-layer security | Asymmetric | Shor-vulnerable |
| Service-based architecture (SBA) interfaces | TLS, OAuth, certificates | Asymmetric | Shor-vulnerable |
| PKI / certificates | RSA, ECDSA | Asymmetric | Shor-vulnerable |
The headline near-term asymmetric target is SUCI: 5G conceals the long-term subscriber identity SUPI/IMSI using ECIES, an ECC-based scheme. Because ECIES is Shor-vulnerable, if a future CRQC can break the ECC used by ECIES in SUCI, an attacker could de-conceal the SUCIs it recorded, exposing the corresponding SUPI/IMSI — making SUCI one of the clearest HNDL privacy targets in mobile networks. The transport and PKI layers are equally pressing.
The bodies involved
| Body | Role in telecom PQC |
|---|---|
| 3GPP | Defines 5G/mobile standards; security work in the SA3 group. Has study items on PQC impact and on protecting SUCI & 256-bit algorithms, targeting later Releases and 6G. Normative PQC is still early-phase. |
| GSMA | Industry coordination via the Post-Quantum Telco Network (PQTN) taskforce — impact assessment, inventory and migration guidance. Aligns operators with NIST algorithms and IETF protocols. |
| ITU-T | Telecommunication standardization, including network security recommendations relevant to quantum-safe transport. |
| ETSI | Quantum-safe cryptography work and migration guidance feeding the wider telecom ecosystem. |
The standards landscape
No body has yet mandated PQC for mobile networks; the current picture is study items and guidance:
- 3GPP SA3 — study items only: TR 33.841 (256-bit symmetric algorithms, Rel-16), TR 33.700-41 (256-bit algorithm transition study, Rel-19), TR 33.938 (cryptographic inventory of 3GPP security protocols, Rel-19), and a follow-on PQC study item targeting Rel-20 / 6G. SUCI/ECIES is defined normatively in TS 33.501.
- GSMA PQTN — operator guidance: PQ.01 (impact assessment), PQ.02 (quantum risk management, 22 Sep 2023), PQ.03 (telecom use-case guidelines, v2.0, 4 Oct 2024).
- ITU-T X.1811 (Apr 2021) — security guidelines for applying quantum-safe algorithms in 5G systems.
Standards & references
- 3GPP TS 33.501 — 5G security architecture (SUCI/ECIES); TR 33.841 & TR 33.938 study items.
- GSMA Post-Quantum Cryptography documents — PQTN PQ.01 / PQ.02 / PQ.03.
- ITU-T X.1811 — quantum-safe algorithms in 5G (Apr 2021).
Related
电信行业后量子迁移总览
移动网络兼具超长生命周期、数十亿用户规模，以及承载长期保密数据的长效凭证密钥，这使电信成为后量子迁移优先级最高的行业之一，同时也是最易遭受先收集、后解密（Harvest Now, Decrypt Later, HNDL）攻击的领域。
为何电信是高优先级且高 HNDL 风险的行业
很少有行业的密码风险画像能与移动网络相提并论：
- 极长的生命周期。多代移动技术会并存数十年，设备、SIM 与凭证开通以及漫游协议的设计寿命都远超单次硬件更新，因此今天做出的密码选择会一直延续到具备密码学意义的量子计算机（CRQC）出现的时代。
- 庞大的用户规模。单一运营商可服务数亿用户，每个用户都有写入 SIM/USIM 模块的长效身份与凭证，密钥轮换成本极高。
- 流量的长期保密价值。信令、位置以及用户身份数据可在多年内保持价值，攻击者今天即可记录加密流量，待 CRQC 出现后再行解密——这正是典型的HNDL威胁。
因此，运营商必须对全网密码进行盘点与迁移，涵盖无线接入网（RAN）、核心网、传输与回传，以及漫游与互联链路。
移动网络中哪些易受量子攻击哪些不易
并非网络中所有算法的风险都相同：对称原语仅被 Grover 算法削弱，通过足够的密钥长度即可缓解；非对称原语会被 Shor 算法攻破，是最紧迫的迁移目标。
| 网络层 / 功能 | 所用密码 | 类型 | 量子风险 |
|---|---|---|---|
| 认证（AKA） | MILENAGE / TUAK | 对称 | 仅 Grover，由密钥长度缓解；当前为 128 位，256 位是业界讨论中的未来目标。3GPP 目前仍以研究项目形式讨论 256-bit 过渡，不应理解为现网已强制采用。 |
| 空口加密与完整性 | 128-NEA/128-NIA，基于 SNOW 3G、AES、ZUC 的 128-NEA3/128-NIA3 | 对称 | 仅 Grover，由密钥长度缓解 |
| 用户身份隐藏（SUCI） | ECIES，Profile A = Curve25519，Profile B = NIST P-256 | 非对称 | 易受 Shor 攻击，CRQC 可解隐 SUPI/IMSI，破坏用户隐私 |
| 传输 / 回传 | TLS、IPsec | 非对称密钥交换与证书 | 易受 Shor 攻击，存在 HNDL 暴露 |
| 漫游 / 互联（N32、SEPP） | TLS 与应用层安全 | 非对称 | 易受 Shor 攻击 |
| 基于服务的架构（SBA）接口 | TLS、OAuth、证书 | 非对称 | 易受 Shor 攻击 |
| PKI / 证书 | RSA、ECDSA | 非对称 | 易受 Shor 攻击 |
近期最关键的非对称目标是 SUCI：5G 使用 ECIES（一种基于 ECC 的方案）隐藏长期用户身份 SUPI/IMSI，而 ECIES 易受 Shor 攻击，若未来 CRQC 能攻破 SUCI 中 ECIES 所用 ECC，攻击者可能解隐其记录的 SUCI，暴露对应 SUPI/IMSI，因此 SUCI 是移动网络中最清晰的 HNDL 隐私目标之一；传输层与 PKI 层同样紧迫。
相关标准组织
| 组织 | 在电信 PQC 中的角色 |
|---|---|
| 3GPP | 制定 5G 与移动标准，安全工作由 SA3 组承担；已设立关于 PQC 影响以及保护 SUCI 与 256 位算法的研究项目，面向后续 Release 与 6G，规范化 PQC 仍处早期。 |
| GSMA | 通过后量子电信网络（PQTN）工作组协调产业，输出影响评估、盘点与迁移指南，推动运营商对齐 NIST 算法与 IETF 协议。 |
| ITU-T | 负责电信标准化，包括与抗量子传输相关的网络安全建议。 |
| ETSI | 开展抗量子密码工作并提供迁移指南，反哺更广的电信生态。 |
标准格局
目前尚无任何组织对移动网络强制要求 PQC，现阶段以研究项目与指南为主：
- 3GPP SA3：目前仅为研究项目——TR 33.841（256 位对称算法，Rel-16）、TR 33.700-41（256 比特算法过渡研究，Rel-19）、TR 33.938（3GPP 安全协议密码资产清单，Rel-19），以及一项面向 Rel-20 / 6G 的后续 PQC 研究项目；SUCI/ECIES 由 TS 33.501 规范化定义。
- GSMA PQTN：运营商指南——PQ.01（影响评估）、PQ.02（量子风险管理，2023 年 9 月 22 日）、PQ.03（电信用例指南 v2.0，2024 年 10 月 4 日）。
- ITU-T X.1811（2021 年 4 月）：在 5G 系统中应用抗量子算法的安全指南。
标准与参考
- 3GPP TS 33.501——5G 安全架构，SUCI/ECIES；TR 33.841 与 TR 33.938 研究项目。
- GSMA 后量子密码文档——PQTN PQ.01 / PQ.02 / PQ.03。
- ITU-T X.1811——5G 中的抗量子算法，2021 年 4 月。