SUCI / SUPI Privacy — Tracing Subscriber Privacy in 5G

You are reviewing the security posture of a 5G standalone network. A researcher claims that the subscriber's permanent identity (SUPI) is now protected from IMSI catchers. You have captured, on N2 and the SBI, a UE's initial registration where a SUCI built with ECIES Profile B is used instead of a plain IMSI. Analyze the trace: find where the SUPI is revealed (inside the core), confirm that the NAS message the UE sent over the air carries only a SUCI with its MSIN sealed, and identify the network function where the SIDF (Subscription Identifier De-concealing Function) de-conceals it. Keep the claim's scope in view: it holds on standalone access with a protection scheme that is not the null scheme. References worth having open: TS 33.501 §6.12.2 (SUCI) and §6.12.5 (SIDF), TS 33.501 Annex C (Protection Schemes — Null, ECIES Profile A, ECIES Profile B), TS 33.501 §6.1.3.2 (5G AKA), TS 24.501 §9.11.3.4 (5GS mobile identity), TS 29.503 (Nudm_UEAuthentication), TS 29.509 (Nausf_UEAuthentication).