Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TR 33.841 Word version: 16.1.0

0… 5…

5 Assessment of quantum computing impact timelines p. 11

5.1 Predicted timescales and resources for quantum computing p. 11

5.2 Timelines for transitioning asymmetric algorithms p. 12

5.3 Timelines for transitioning symmetric algorithms p. 12

5.4 Considerations for assessing timelines p. 12

6 Impacted NextGen areas p. 12

6.1 Impacted use of asymmetric cryptography p. 12

6.1.1 Introduction p. 12

6.1.2 TLS for service based interfaces p. 12

6.1.3 NDS/IP for non-service based interfaces p. 13

6.1.4 SUPI protection p. 13

6.1.5 OAuth in SBA p. 13

6.1.6 N32 Application Layer Security p. 13

6.1.7 Network product software package integrity p. 13

6.1.8 EAP TLS p. 13

6.1.9 Ephemeral key agreement in primary authentication p. 13

6.2 Impacted use of symmetric cryptography p. 14

6.2.1 Introduction p. 14

6.2.2 Ciphering algorithms p. 14

6.2.3 Integrity algorithms p. 14

6.2.4 OTA mechanism p. 14

6.3 Impacted use of hash functions p. 15

6.3.1 Introduction p. 15

6.3.2 Key derivation function p. 15

6.3.3 Authentication and key agreement p. 15

7 Study of full entropy 256-bit keys in the 5G key hierarchy p. 15

7.1 Risks and mitigations for quasi-random IVs in counter mode p. 15

7.1.1 The attacks and their cost p. 15

7.1.2 Applicability to 3GPP use of counter mode p. 16

7.1.3 Mitigations p. 16

8 Assessment of the requirement for and impact of a longer MAC p. 17

8.1 Introduction p. 17

8.2 Integrity protection for control and user planes p. 17

8.3 MAC tag length impact on security p. 18

8.4 Impact of a longer MAC tag on network p. 18

8.5 Minimal level of integrity protection p. 18

9 Study of coexistence of different size keys and key size negotiation. p. 18

9.1 Ensuring system parameters support variable length keys p. 19

9.2 Ensuring system parameters support variable length MACs, AKA messages etc. p. 19

9.3 Ensuring key derivation functions support variable length keys p. 19

9.4 Using 256-bit keys in New RAN with legacy core p. 19

9.5 Co-existence between 128-bit and 256-bit key lengths p. 20

9.6 Co-existence between multiple or variable lengths MAC tags p. 20

9.7 Reduced complexity of key derivation function negotiation p. 20

10 Study of desired number of 256-bit algorithms p. 20

10.1 Overview of existing GSMA/3GPP symmetric algorithms p. 20

10.1.1 Algorithms for authentication and AKA key generation p. 20

10.1.2 Algorithms for encryption and integrity p. 21

11 Study the desired performance aspects for the new 256-bit algorithms p. 21

11.1 Peak data rates p. 21

11.2 Latency p. 21

12 Study of key management p. 22

13 Study of individual algorithm details p. 22

13.1 Radio interface encryption and integrity algorithms p. 22

13.1.1 AES p. 22

13.1.2 SNOW 3G p. 22

13.1.3 ZUC p. 22

13.2 AKA algorithms p. 22

13.2.1 MILENAGE p. 22

13.2.2 TUAK p. 22

13.3 Key derivation algorithms p. 23

13.3.1 HMAC-SHA-256 p. 23

14 Potential requirements p. 23

14.1 Potential requirements for adoption of post-quantum algorithms p. 23

14.2 Potential requirements for longer MAC p. 23

15 Conclusions p. 23

$ Change History p. 25