Post-quantum cryptography in 5G and telecom networks

Short answer: The 3GPP security group says the quantum threat to symmetric keys can be mitigated with safe key sizes, such as 128 bits or more, while the threat to private keys requires post-quantum cryptography (PQC). 3GPP documents which protocols in 5G use cryptography, and the GSMA publishes migration guidelines for telecom operators. These are industry studies and guidelines, not a completed migration.

How do quantum computers threaten current 5G security?

According to the 3GPP SA3 page, the threat to symmetric keys can be mitigated by using safe key sizes, such as 128 bits or more. However, the threat to private keys requires the adoption of Post-Quantum Cryptography (PQC) algorithms. Asymmetric cryptographic algorithms are vulnerable in the presence of large-scale classical or quantum computers (CRQCs). While symmetric algorithms are not "broken" by Grover’s algorithm, their effective security strength is reduced. To address this reduction, 3GPP SA3 has decided to introduce 256-bit algorithm specifications in TS 35.240 through TS 35.248 as part of 3GPP Release 20. 3GPP says this aims to enhance long-term security resilience.

What is the scope of 3GPP’s PQC study?

3GPP SA3 has studied the cryptography defined in 3GPP specifications, with results documented in TR 33.938. This technical report provides a list of all security protocols that use cryptography in 3GPP specifications for 5G systems, limited to the standalone mode. It differentiates between symmetric and asymmetric cryptographic algorithms. Additionally, 3GPP SA3 started a study documented in TR 33.703 for analyzing the transition to PQC-enablement. This study is G-agnostic, meaning it is independent of any specific generation of mobile networks. The primary triggers for this work were the GSMA PQ.03 guidelines and ETSI TC CYBER migration strategies. Both documents outline approaches for the transition into the PQC era, sharing a common starting point: the establishment of a comprehensive cryptographic inventory.

How are telecom operators planning migration?

The GSMA PQ.03 document provides best practice guidelines to support the journey to quantum-safe cryptography in the telecom ecosystem. It presents a phased approach to migration, allowing prioritization of the actions required. This facilitates forward planning of transformation programmes with key stakeholder groups, such as network operators. The document highlights known technical challenges and areas of uncertainty to raise awareness with stakeholders. Within each use case, there is a detailed analysis of aspects such as standards, functional architecture, and performance implications. The GSMA describes its objective as a practical, telco-focused perspective based on experience and best practice.

What practical implementations have been shared?

The GSMA Post-Quantum Telco Network Task-Force (PQTN) encourages the community to share real-world experience with PQC in telecoms. One shared document details a vendor’s hybrid key exchange mechanism and its implementation. Hybrid systems are one option for migrating security connections in telecom networks, such as IPsec. The objective is to provide telecommunications-specific insights to vendors, operators, and researchers. Results from demonstrations provide information for future networks to address quantum attacks, such as hoarding attacks, and to progress quantum readiness in telecom. This specific concern involves the threat that quantum attacks pose to the connection between network base stations (e.g., gNBs and ng-eNBs) and the security gateways that provide access to network functions in the core network.

FAQ

Is the use of Security Gateways mandated by 3GPP?

No. The use of Security Gateways between the RAN and core network is not mandated by 3GPP standards. However, it is commonly adopted by operators to enhance security. The connections typically involve multiple components using public key cryptography, which may be vulnerable to quantum attacks.

What specific algorithms are being introduced for symmetric keys?

3GPP SA3 has decided to introduce 256-bit algorithm specifications in TS 35.240 through TS 35.248. This decision is part of 3GPP Release 20. The aim is to enhance long-term security resilience by addressing the reduced effective security strength of symmetric algorithms under quantum threats.

Does the PQC study apply to all network generations?

According to 3GPP, yes. The study documented in TR 33.703 for analyzing the transition to PQC-enablement is G-agnostic. This means it is independent of any specific generation of mobile networks. It focuses on the general transition to PQC rather than limiting scope to a particular release.

What role does GSMA PQ.03 play in migration?

GSMA PQ.03 provides best practice guidelines to support the journey to quantum-safe cryptography. It presents a phased approach to migration, allowing prioritization of required actions. It highlights technical challenges and areas of uncertainty to raise awareness with stakeholders like network operators.

Are hybrid key exchanges a required solution?

No. Hybrid systems are described as one option for migrating security connections in telecom networks. They are not mandated as the sole solution. The sharing of implementation details aims to provide insights and information for future networks to address quantum attacks like hoarding attacks.