Quantum computers render 5G insecure

As should be clear from the above descriptions, for pragmatic backwards compatibility reasons, the foundation of 5G security is exactly as it was in UMTS and LTE (3G and 4G) systems. A 128-bit key K, shared by the USIM and the issuing network, is used as the foundation of all 5G security functions (with the exception of mobile identity confidentiality, which relies on asymmetric cryptography). Clearly this means that if the USIM-resident key K is ever discovered, then the entire basis of 5G security is undermined, despite the fact that 256-bit keys are used in the key derivation hierarchy More specifically, to support the AKA protocol, K is used to help create a 5-value authentication vector, exactly as used in UMTS, including RAND, MAC and two 128-bit keys CK and IK. These values are then used to generate further values, as follows

The value XRES* is computed as a function of XRES, RAND, CK, IK and an identifier from the serving network. In turn HXRES* is then derived from XRES* and RAND. That is, HXRES* is a function solely of RAND, K and the serving network name. The keys CK and IK are then input to a further key derivation function (along with the encrypted SQN) to generate the 256-bit key KAUSF. Next, the 256-bit key KSEAF is derived from a combination of KAUSF and the serving network identifier, and the 256-bit key KAMF is, in turn, derived from KSEAF. Finally, the 128-bit keys actually used for encrypting and integrity-protecting tra c are derived from KAMF (possibly as a multi-step process), initially as 256-bit keys which are then truncated before use. It should thus be clear that the operational keys are a function solely of RAND, K, the serving network name (and certain other public parameters). It should immediately be apparent that there is a major security issue in the PQ era. That is, security is based on a 128-bit secret key, and thus Grovers algorithm (see 2.1) could reduce the effective level of security to that provided by a 64-bit key. Searches of size 264, whilst not trivial, are well within the bounds of what is possible today. Detailed implications for the AKA protocol and operational protection are discussed below. It could be argued that parts of the functions used to generate the values XRES*, HXRES* and the operational keys are issuing-network-proprietary (namely f1 f5). However, this gives very little additional security for two reasons. Firstly `default values for these functions are standardized and are, presumably, in use in some networks. Secondly, all such functions are necessarily built into every USIM, and so a determined adversary could reverse engineer the USIM to learn these functions.

Finally, and perhaps rather ironically, all current implementations will immediately become non-compliant with the underlying standards. As noted above, the normative requirements for the functions f1 f5 are specified in 5.1.6 of 3GPP TS 33.105 [4] these requirements are necessary since the functions can be chosen by the USIM issuer. For example, in 5.1.6.3 it is stated that `f3 should be a key derivation function. In particular, it shall be computationally infeasible to derive K from knowledge of RAND and CK. However, since f3 takes two 128-bit inputs (RAND and K) and gives the 128-bit value CK as output, Grovers algorithm will mean that in the PQ era this requirement will be false by definition regardless of the choice of f3

To consider in greater detail the degree of vulnerability of a 5G system in the PQ era, suppose a malicious party has intercepted a matching pair of AKA Authentication Request and Authentication Response messages. The first message will contain a 128-bit RAND value, and the second will contain the 128-bit response RES*. Now RES* is a function solely of RAND and K, and hence Grovers algorithm means that of the order of 264 work will be required to deduce K.

That is, in the PQ era, interception of a single (successful) AKA challenge response pair will provide sufficient information to determine the USIM key.