Why 5G Authentication Is Different

Authentication in 5G represents a fundamental architectural shift from 4G LTE. In LTE, the MME directly communicates with the HSS to fetch authentication vectors, and the entire process is based on EPS-AKA -- a single method. 5G introduces a unified authentication framework defined in TS 33.501 (Security architecture and procedures for 5G System) that supports two primary methods: 5G-AKA and EAP-AKA' (EAP-AKA Prime). Both methods derive from the same root key K stored in the USIM but differ in their confirmation mechanisms and extensibility.

The key innovation is the introduction of the AUSF (Authentication Server Function) and SIDF (Subscription Identifier De-concealing Function) as dedicated network functions, separating authentication logic from mobility management. This separation enables home-network-controlled authentication even when the UE is roaming -- a critical security improvement over 4G where the visited network's MME had significant control.

Network Functions in 5G Authentication

The ARPF (Authentication credential Repository and Processing Function) is co-located with the UDM and has access to the subscriber's permanent key K and the sequence number SQN. The SIDF uses the home network's private key to decrypt the SUCI and recover the SUPI -- ensuring that the permanent identity is never exposed over the air interface.

SUPI vs SUCI: Identity Privacy

In 4G, the IMSI is transmitted in cleartext during initial attach, enabling IMSI-catcher attacks. 5G solves this with SUCI (Subscription Concealed Identifier):

The SUCI is generated by the USIM or ME using ECIES Profile A (Curve25519) or Profile B (secp256r1) as defined in TS 33.501 Annex C. The encryption uses the home network's public key, which is provisioned in the USIM.

Worked Example 1 -- SUCI Construction

Given:

• SUPI (IMSI): 310260123456789
• MCC: 310, MNC: 260, MSIN: 123456789
• Home Network Public Key ID: 1
• Protection Scheme: ECIES Profile A (X25519 + AES-128-CTR + HMAC-SHA-256)

The SUCI construction process:

1. USIM generates ephemeral X25519 key pair: (eSK, ePK)
2. Compute shared secret: SS = X25519(eSK, HN_PK) where HN_PK is the home network public key
3. Derive encryption key and MAC key from SS using ANSI-X9.63-KDF
4. Encrypt MSIN: EncMSIN = AES-128-CTR(K_enc, "123456789")
5. Compute MAC: MAC = HMAC-SHA-256(K_mac, EncMSIN)
6. SUCI = {SUPI Type=IMSI, MCC=310, MNC=260, RoutingIndicator=0xff, ProtectionSchemeId=1, HN_PubKey_ID=1, ePK || EncMSIN || MAC}

The resulting SUCI is approximately 50--70 bytes depending on the scheme. Only the home PLMN's SIDF can decrypt it because it holds the corresponding private key.

NTT DOCOMO confirmed in their 2024 security implementation report that 100% of 5G SA registrations on their network use SUCI with ECIES Profile A, with decryption at the SIDF adding less than 2 ms to the authentication procedure.

5G-AKA Procedure -- Step by Step

5G-AKA is the primary authentication method for 3GPP access. The full procedure involves the following steps:

Message Flow

The critical difference from 4G EPS-AKA is the dual confirmation: the AMF performs a preliminary check using HXRES/HRES (a hash of the response), while the AUSF performs the definitive check using XRES/RES. This ensures the home network always has the final say on authentication success.

EAP-AKA' Procedure

EAP-AKA' (defined in RFC 9048 and referenced in TS 33.501 clause 6.1.3.1) wraps the AKA challenge inside EAP messages. It is mandatory for non-3GPP access (e.g., Wi-Fi) and optional for 3GPP access.

Both methods ultimately derive the same K-AUSF from the transformed keys CK' and IK'. The subsequent key hierarchy is identical regardless of which method was used.

5G Key Hierarchy

The 5G key hierarchy derives all session keys from the permanent key K stored in the USIM. Each derivation uses a Key Derivation Function (KDF) based on HMAC-SHA-256, as specified in TS 33.220 Annex B.

Worked Example 2 -- Key Derivation Chain Timing

During an authentication on Vodafone Germany's 5G SA network (Ericsson core), the following timing was measured for each key derivation step:

The cryptographic operations themselves take under 3 ms -- the majority of the 45--80 ms total authentication time is consumed by network transport between AMF, AUSF, and UDM over the SBI interfaces.

SQN Synchronization

The Sequence Number (SQN) prevents replay attacks. The USIM maintains a SQN counter that must be within an acceptable range of the network's SQN. If the USIM detects a SQN out of range (indicating a potential replay or de-synchronization), it sends an Authentication Failure with cause SYNCH_FAILURE and includes an AUTS parameter to resynchronize.

The AUTS (Authentication Re-synchronization Token) allows the UDM to recover the USIM's current SQN value without exposing it. The UDM then generates a new AV with a corrected SQN and re-initiates authentication.

T-Mobile US reported a SQN synchronization failure rate of 0.02% across their subscriber base, primarily occurring after long periods of USIM inactivity (devices stored without power for months) or after USIM swap operations.

Authentication in Roaming Scenarios

In roaming, the visited PLMN's AMF communicates with the home PLMN's AUSF via the SEPP (Security Edge Protection Proxy). The SN-name (Serving Network Name) parameter binds the authentication to the visited network, preventing a compromised visited network from reusing authentication vectors on a different network.

The SN-name is constructed as "5G:mnc.mcc.3gppnetwork.org" as defined in TS 24.501 clause 9.12.1. This ensures that K-SEAF derived in one visited network cannot be reused by another visited network.

Deutsche Telekom reported that cross-border 5G SA roaming authentication latency averages 120 ms due to the additional SEPP-to-SEPP hop between PLMNs, compared to 45 ms for home-network authentication. Their SEPP deployment uses TLS 1.3 with mutual certificate authentication.

Comparison with 4G EPS-AKA

Operator Deployment Statistics

All major operators have deployed 5G-AKA as the primary method for 3GPP access, with EAP-AKA' reserved for non-3GPP (Wi-Fi offload) scenarios. SK Telecom achieves the lowest latency due to co-located AUSF and UDM deployment within the same data center.

Key Takeaway: 5G authentication through 5G-AKA and EAP-AKA' provides three critical improvements over 4G: permanent identity concealment via SUCI, home-network-controlled authentication confirmation at the AUSF, and a deeper key hierarchy with strong serving-network binding. The entire cryptographic chain from K to application keys takes under 3 ms -- network transport dominates the total authentication time. Understanding the key hierarchy, SUCI construction, and the dual-confirmation mechanism is essential for 5G security certification.