5G-AKA Authentication & SUCI/SUPI Privacy in 5G NR

Introduction

5G primary authentication is the procedure that answers two questions at once before any traffic is trusted: is this really the subscriber it claims to be, and is this really the subscriber's genuine network. It runs early in the connection lifecycle — immediately after the UE sends its Registration Request and before the NAS Security Mode Command activates ciphering — so that every key used afterwards descends from a freshly proven root. It is specified in TS 33.501 (security architecture) with the NAS message carriage in TS 24.501.

Two independent problems are solved together on this page. The first is identity privacy: the permanent identifier (SUPI) must never appear in the clear on the radio interface, so the UE transmits a concealed form (SUCI) instead. The second is mutual authentication and key agreement: 5G-AKA (or its peer method EAP-AKA′) proves both sides and mints the anchor key K_SEAF that seeds the entire NAS and AS key tree.

Because the flow spans four network functions — UE/USIM, SEAF/AMF, AUSF, and UDM/ARPF/SIDF — each learning deliberately less than the one below it, understanding which function holds what secret is the key to reasoning about where trust is anchored and why a visited network can serve you without ever holding your keys.

Why concealment and mutual authentication are needed

Concretely, two distinct threats are being defeated. First, a passive eavesdropper or an active IMSI-catcher must not be able to tie a radio transmission to a real person; LTE left the IMSI exposed during initial attach and some identity requests, so 5G conceals the permanent identity structurally rather than optionally. Second, a rogue base station must not be able to impersonate a real network to a UE, and a cloned or invalid USIM must not be able to impersonate a real subscriber to the network — so authentication is mutual: the AUTN token proves the network to the UE, and the RES* response proves the UE to the network. Neither direction is optional, and both must pass before the anchor key K_SEAF is released.

The Identity-Privacy Problem SUCI Solves

The permanent subscriber identity in 5G is the SUPI (Subscription Permanent Identifier). It is either an IMSI-based value (the familiar MCC + MNC + MSIN) or, for non-3GPP and private deployments, a network-specific identifier in NAI form (username@realm). The SUPI is treated as a long-lived secret: it identifies a paying subscriber uniquely and forever, so if it ever crosses the air in the clear, a passive listener can pin a transmission to a specific person, and an active IMSI-catcher can lure UEs into revealing it. LTE never fully fixed this — the IMSI was sent in cleartext during initial attach and in some identity requests.

Concealment covers only the subscriber-specific part — the MSIN of an IMSI, or the username of an NAI. The routing part — the MCC/MNC (Home Network Identifier), or the realm — stays in the clear on purpose, because the serving network needs it to route the authentication request to the correct home network. Crucially, the UE picks a fresh ephemeral key for every concealment, so two SUCI values computed for the same subscriber look completely unrelated on the air: there is no linkability, and repeated observation buys an attacker nothing.

De-concealment happens in exactly one place: the SIDF (Subscription Identifier De-concealing Function), a service offered by the UDM (Unified Data Management) in the home network. The SIDF is the only entity that holds the private key matching the public key provisioned in USIMs, and 3GPP mandates that the private key never leaves it. This is what severs the link between a radio eavesdropper and the permanent identity — the classic IMSI-catcher defence, now structural rather than optional.

Inside a SUCI: ECIES and its Components

A SUCI is not just a blob of ciphertext — it is a self-describing structure so the home network knows exactly how to reverse it. Every SUCI carries, in the clear, the metadata needed to route and decrypt, and only the sensitive part is protected. The concealment algorithm is ECIES (Elliptic Curve Integrated Encryption Scheme), profiled in TS 33.501 Annex C as Profile A (Curve25519 / X25519) and Profile B (secp256r1).

Reading the structure top to bottom, the first five fields are metadata the serving network and SIDF need in the clear; only the last, the Scheme Output, hides the identity. The Home Network Public Key ID deserves emphasis: because it names the exact key used, operators can provision several public keys and retire old ones gracefully — a UE with a stale key still names it, and the network still holds the matching private key long enough to de-conceal. The null-scheme (Protection Scheme ID = 0) exists only for narrow cases: unauthenticated emergency registration where no home network can be reached, or test/development USIMs. In normal operation a real ECIES profile is always used.

The Scheme Output for both profiles concatenates three parts: the UE's ephemeral public key (33 octets compressed for the secp256r1 Profile B, 32 octets for the Curve25519 Profile A), the ciphertext of the MSIN/username, and an ICB/MAC tag that lets the SIDF detect tampering before it trusts the recovered identity. The symmetric leg uses AES-128 in CTR mode for encryption and HMAC-SHA-256 (truncated) for the tag, with the encryption key, ICB and MAC key all derived from the ECDH shared secret through the ANSI-X9.63 KDF.

5G-AKA: The Primary Authentication Flow

SUCI protects the identity; 5G-AKA proves it. It is the default method for primary authentication in 5G — the mutual challenge–response that convinces the network the subscriber is genuine and convinces the UE the network is genuine, all before any traffic key is trusted. Four functions cooperate, and each is deliberately limited in what it learns.

The SEAF (Security Anchor Function), co-located with the AMF in the serving network, drives the procedure but delegates the cryptography home. It calls the AUSF (Authentication Server Function) in the home network over the N12 service interface (Nausf_UEAuthentication). The AUSF in turn calls the UDM/ARPF (the Authentication credential Repository and Processing Function inside the UDM) over Nudm_UEAuthentication_Get. The UDM's SIDF de-conceals the SUCI to a SUPI, and the ARPF generates the authentication vector from the subscriber's long-term key K.

The vector is produced in two stages. The UDM/ARPF builds a 5G Home Environment Authentication Vector (5G HE AV) containing RAND, AUTN, XRES* and K_AUSF, and returns it to the AUSF. The AUSF then derives HXRES* (a hash of XRES*) and K_SEAF, and passes the serving network a reduced 5G Serving Environment Authentication Vector (5G SE AV) containing only RAND, AUTN and HXRES* — deliberately not XRES*, K_AUSF, or K_SEAF yet. The serving network gets just enough to challenge the UE and do a first-pass check, nothing more.

The AKA primitives themselves are the same milenage/TUAK functions LTE used, run inside the USIM from K and RAND: f1 produces the network MAC that fills AUTN, f2 produces the base response RES, f3/f4 produce CK/IK, and f5 produces the anonymity key AK that masks the sequence number as SQN⊕AK. The 5G-specific twist is RES* and XRES*: they are derived from RES/XRES by a KDF that also binds in the serving-network name (SN name), so a response captured in one network cannot be replayed to authenticate the subscriber in another.

The serving side now challenges the UE. The AMF sends a NAS Authentication Request carrying RAND, AUTN, ngKSI and ABBA. The USIM verifies AUTN first — it recomputes the MAC and checks that the SQN (sequence number) is fresh and in range. This step is what authenticates the network to the UE: only the real home network, holding K, could have produced a valid AUTN. If the MAC is wrong the USIM rejects with a MAC failure; if the SQN is out of range it triggers a re-synchronisation. Only when AUTN checks out does the USIM compute the response RES* and the key material, and the UE returns RES* in a NAS Authentication Response.

Verification of the UE happens in two stages, by design. The SEAF/AMF computes HRES* from the received RES* and compares it against the HXRES* it holds — a fast local check that rejects an obviously wrong answer immediately. But this is not the binding decision: on a match the SEAF forwards RES* to the AUSF (Nausf_UEAuthentication confirm), and the AUSF makes the authoritative comparison against the XRES* it kept. Only that comparison authenticates the UE to the network. When it succeeds, the AUSF releases K_SEAF and the real SUPI to the SEAF/AMF. The serving network learns who the subscriber actually is only now, from the home network, never from the air.

Key Output: K_AUSF → K_SEAF → K_AMF

Authentication is not only about proving identities — it mints the top of the key hierarchy. Every successful 5G-AKA run produces, at both the UE and the network, the same anchored chain of keys, each derived from the one above by the 3GPP KDF (HMAC-SHA256). The chain seeded here is the reason all later NAS and AS keys can be regenerated without re-authenticating.

The USIM (holding K) and the UDM/ARPF both compute CK/IK from K and RAND, and from those derive K_AUSF, bound to the serving-network name. K_AUSF stays in the home network at the AUSF — it is never handed to a visited network, and it later anchors features such as Steering-of-Roaming and K_AKMA. From K_AUSF the AUSF derives the anchor key K_SEAF, again bound to the serving-network name, and this is the single key delivered to the serving network. The AMF then derives K_AMF from K_SEAF, mixing in the SUPI and the ABBA parameter, and from K_AMF grows the two branches — NAS keys and the RAN key K_gNB.

Two parameters carried in the Authentication Request deserve a note. The ngKSI (Key Set Identifier in 5G) is a small value that names the resulting security context, so that after an idle period the UE and AMF can reactivate the context by reference — without transmitting any key — instead of re-running authentication. The ABBA parameter (Anti-Bidding-down Between Architectures) is fed into the K_AMF derivation to bind the key to the set of security features the network actually supports, so an attacker cannot force a downgrade to a weaker feature set. Both are set by the AMF and echoed to the UE at challenge time.

The Alternative: EAP-AKA′

5G-AKA is the common method, but TS 33.501 defines a second primary-authentication method that produces the same anchor: EAP-AKA′. It uses exactly the same USIM primitives — the same K, RAND, AUTN, SQN, and the same CK/IK outputs — but wraps them in the IETF EAP (Extensible Authentication Protocol) framework rather than the bespoke 5G-AKA signalling. The AUSF plays the EAP server, the SEAF is a pass-through authenticator, and the exchange runs a full EAP request/response round (EAP-Request/AKA′-Challenge → EAP-Response/AKA′-Challenge → EAP-Success).

The cryptographic difference is that EAP-AKA′ first transforms CK/IK into CK′/IK′, bound to the serving-network name, and derives K_AUSF from the EAP master session key. The end result is identical: an K_AUSF at the AUSF, an K_SEAF anchor delivered to the SEAF, and the same hierarchy below. Where the two differ is in framing, in message count, and in where the response is verified.

Both methods are equal partners in the standard: the UDM decides which one to run for a given subscriber, and the SEAF supports both. From the key hierarchy's point of view, the choice is invisible below K_SEAF — the anchor, and everything derived from it, is the same shape either way. The SUCI concealment described above is likewise independent of the method: the UE conceals its identity, the SIDF de-conceals it, and only then does either 5G-AKA or EAP-AKA′ run.

Summary

Two mechanisms carry all of 5G's front-door security. SUCI concealment keeps the permanent identity (SUPI) off the air by ECIES-encrypting only the MSIN/username with the home network public key, leaving routing fields in the clear; the home SIDF alone can reverse it. 5G-AKA (or EAP-AKA′) then runs a mutual challenge–response: AUTN proves the network to the UE, RES* proves the UE to the network, and the check is anchored at the home AUSF so a visited network can never fake it.

The practical way to reason about it is to follow who holds what: the USIM holds K; the UDM/ARPF builds the 5G HE AV and de-conceals the SUCI; the AUSF keeps K_AUSF and XRES* and makes the binding decision; the SEAF/AMF gets only the reduced 5G SE AV and, on success, the anchor K_SEAF. From K_SEAF the AMF grows K_AMF and the whole NAS/AS tree — without ever re-running authentication until the context expires.

When something breaks, the first question is which check failed: a MAC failure points at a spoofed or wrong network, a synchronisation failure at SQN drift, a de-concealment failure at the home network public key or Routing Indicator, and a RES*/XRES* mismatch at an invalid or cloned USIM. Each maps to a distinct, testable cause.

Quick Q&A

Quick LTE 4G / 5G NR Interview Questions