Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2606.30542

A Lightweight Post-Quantum Authentication Framework for 5G Base Station Bootstrapping

Saleh Darzi, Mirza Masfiqur Rahman, Imtiaz Karim, Rouzbeh Behnia, Attila A. Yavuz, Elisa Bertino

Published Jun 29, 2026• 0 citations
arXivHTMLPDF

Abstract

The absence of authenticated bootstrapping between User Equipments (UEs) and Base Stations (BSs) in 5G leaves System Information Block (SIB) broadcasts unprotected, enabling fake BS attacks, man-in-the-middle interception, and spoofed emergency alerts. Prior efforts such as Public Key Infrastructure (PKI)-based certificate chains, token-based schemes, and identity-based signatures either impose overhead exceeding 5G's strict packet-size constraints or lack post-quantum (PQ) security. Direct NIST-PQC integration is also infeasible; current standards, such as ML-DSA requires 34 fragmented SIB1 packets and up to 5,282\,ms end-to-end delay, and FN-DSA still requires 13 fragments and up to 1,920\,ms. We propose EMULSION, a symmetric chained publicly verifiable authentication framework for 5G/6G BS broadcast authentication. EMULSION is the first framework to exploit native 5G architectural features: fixed SIB transmission windows, millisecond-level time synchronization, and eSIM/USIM credential management to achieve genuine PQ security at symmetric-key efficiency. It uses a timed stream loss-tolerant authentication with HMAC chain anchored by a compact PQ signature~(MAYO) applied once per epoch, fitting authentication within a single packet with no fragmentation and eliminating certificate transmission entirely. Unlike prior schemes, EMULSION extends to the full SIB family (SIB1-SIB21) at no additional per-broadcast cost, demonstrated over the air on SIB1. Evaluated on a real over-the-air 5G testbed, EMULSION achieves 33x lower end-to-end delay and 31x less communication overhead than ML-DSA, and 12x lower delay and 5.4x less overhead than FN-DSA. We formally prove the security of EMULSION and open-source its implementation for public testing and adaptation.

DOI
10.48550/arxiv.2606.30542

Related papers

Poster: From Transitional to Full Post-Quantum Authentication for 5G Base Station Bootstrapping

Mirza Masfiqur Rahman, Saleh Darzi, Imtiaz Karim +3 more

5G transmits System Information Blocks (SIBs) without authentication during bootstrapping, enabling fake base station attacks. Direct NIST-PQC integration is infeasible: ML-DSA requires 34 fragmented packets and up to 5,282 ms delay. We present a two-phase PQ migration framework. Phase I provides transitional security via hierarchical identity-based threshold signatures with a fail-stop mechanism backed by PQ-secure audit logging. This transitional solution requires only 144 B overhead and 2.99 ms end-to-end delay, which is three orders of magnitude faster than ML-DSA. Phase II achieves full PQ authentication via a TESLA-style HMAC chain anchored by a compact post-quantum signature, which is applied once per epoch (160.07 ms delay). Both phases fit within 1-2 SIB1 packets and are validated on a real over-the-air 5G testbed.

ACM Conference on Post-Quantum and Quantum-based Security•Oct 26, 2026•0 citations

Post-Quantum Digital Signature and Authentication for eSIM in 5G Mobile Networking

Qaiser Khan, Sourav Purification, Rono Cheruiyot +3 more

In mobile networking, specifically in 5G networking, embedded SIM (eSIM) does not rely on the hardware chips to deliver the core network’s public key as traditional SIM cards do. Instead, eSIM utilizes remote digital certificates enabled by Public Key Infrastructure (PKI). In this research, we study the post-quantum transition of eSIM-based mobile networking by applying and incorporating the post-quantum ciphers to the digital certificates and authentication. While building on the existing mutual authentication between the user equipment and core network, we build quantum resistance in the digital signatures used for the digital certificate and authentication so that they are secure against quantum-computing attackers. We implement our scheme using the NIST-standardized post-quantum ciphers to evaluate the computing/time and battery/power overheads, which are important for resource-constrained mobile devices. We compare the post-quantum ciphers with the current quantum-vulnerable ciphers and show that the lattice-based schemes have comparable or even better overhead performances.

Silicon Valley Cybersecurity Conference (SVCC)•Jun 23, 2025•4 citations

Post-Quantum Identity-Based TLS for 5G Service-Based Architecture and Cloud-Native Infrastructure

Vipin Kumar Rathi, Lakshya Chopra, Nikhil Kumar Rajput

Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.

arXiv:2602.04238•Feb 4, 2026•0 citations

Lightweight Identity-Based Re-Authentication for Supporting Post-Quantum Security in 5G

Manish Paudel, Maryna Veksler, Kemal Akkaya

The rapid growth of 5G wireless technology has transformed connectivity, offering exceptional bandwidth, ultralow latency, and massive IoT device connectivity.However, as quantum computers are progressing, resistance against attacks from such computers becomes a mandatory requirement for all critical infrastructure, necessitating efficient post-quantum cryptography (PQC) implementations for 5G-based IoT devices with limited resources.For instance, User Equipment (UE) reauthentication due to frequent handovers and mobility events is a daily operation that already comes with some overhead, which is not attractive to be used for IoT UE devices.Incorporating heavier PQ solutions into these re-authentications will lead to even more additional communication and computation overhead that may hinder PQ deployment in next generation networks.As such, this paper introduces a novel, lightweight approach for integrating PQC in 5G IoT authentication by proposing a custom identity-based session resumption mechanism without compromising interoperability with existing protocols.This approach prevents replay attacks and ensures perfect forward secrecy (PFS) by utilizing customized identities that are dynamically generated based on device-specific parameters, combined with intelligent server-side caching of quantum-resistant cryptographic materials that eliminate the need for full PQC computations during subsequent re-authentications.We demonstrate through realistic 5G experimentation that the proposed solution significantly lowers authentication overhead while providing quantumresistant security.

•Jan 1, 2026•0 citations

QUANTUM-SAFE SECURITY FRAMEWORK FOR PRIVACY-PRESERVING 6G COMMUNICATION SYSTEMS

P. T. Kalaivaani, E. Nagarjuna

This research paper presents a framework, referred to as QRAPSF, which is quantum-resilient and adaptive privacy security framework for 6G communication systems. The QRAPSF framework incorporates quantum-resistant key establishment using ML-KEM, authentication using ML-DSA, lightweight privacy preserving identity management, adaptive physical layer security, and threat aware security level selection. The hierarchical security controller determines the appropriate security level based on channel status, device capability, latency requirements, and threat level. The proposed QRAPSF framework obtains attack detection accuracy of 96.24%, authentication success rate of 98.31%, and privacy preservation efficiency of 95.14% under 5% network load and 93.81%, 96.19%, and 92.61%, respectively, under 30% network load. The communication overhead remains between 9.42% and 11.68%, whereas the authentication latency varies between 29.84 ms and 37.42 ms depending on the network load. Under 30% network load, the proposed QRAPSF framework has communication overhead 5.40 percentage points less than that of Lattice-Based Physical Layer Security and authentication latency 7.86 ms less than that of Hybrid PQC Authentication.

ICTACT Journal on Communication Technology•Sep 1, 2026•0 citations

Analysis of Post-Quantum Cryptography in User Equipment in 5G and Beyond

Sanzida Hoque, Abdullah Aydeger, Engin Zeydan +1 more

The advent of quantum computing threatens the security of classical public-key cryptographic systems, prompting the transition to post-quantum cryptography (PQC). While PQC has been analyzed in theory, its performance in practical wireless communication environments remains underexplored. This paper presents a detailed implementation and performance evaluation of NIST-selected PQC algorithms in user equipment (UE) to UE communications over 5G networks. Using a full 5G emulation stack (Open5GS and UERANSIM) and PQC-enabled TLS 1.3 via BoringSSL and liboqs, we examine key encapsulation mechanisms and digital signature schemes across realistic network conditions. We evaluate performance based on handshake latency, CPU and memory usage, bandwidth, and retransmission rates, under varying cryptographic configurations and client loads. Our findings show that ML-KEM with ML-DSA offers the best efficiency for latency-sensitive applications, while SPHINCS+ and HQC combinations incur higher computational and transmission overheads, making them unsuitable for security-critical but time-sensitive 5G scenarios.

arXiv:2507.17074•Conference on Local Computer Networks•Sep 15, 2025•14 citations
The absence of authenticated bootstrapping between User Equipments (UEs) and Base Stations (BSs) in 5G leaves System Information Block (SIB) broadcasts unprotected, enabling fake BS attacks, man-in-the-middle interception, and spoofed emergency alerts. Prior efforts such as Public Key Infrastructure (PKI)-based certificate chains, token-based schemes, and identity-based signatures either impose overhead exceeding 5G's strict packet-size constraints or lack post-quantum (PQ) security. Direct NIST-PQC integration is also infeasible; current standards, such as ML-DSA requires 34 fragmented SIB1 packets and up to 5,282,ms end-to-end delay, and FN-DSA still requires 13 fragments and up to 1,920,ms. We propose EMULSION, a symmetric chained publicly verifiable authentication framework for 5G/6G BS broadcast authentication. EMULSION is the first framework to exploit native 5G architectural features: fixed SIB transmission windows, millisecond-level time synchronization, and eSIM/USIM credential management to achieve genuine PQ security at symmetric-key efficiency. It uses a timed stream loss-tolerant authentication with HMAC chain anchored by a compact PQ signature~(MAYO) applied once per epoch, fitting authentication within a single packet with no fragmentation and eliminating certificate transmission entirely. Unlike prior schemes, EMULSION extends to the full SIB family (SIB1-SIB21) at no additional per-broadcast cost, demonstrated over the air on SIB1. Evaluated on a real over-the-air 5G testbed, EMULSION achieves 33x lower end-to-end delay and 31x less communication overhead than ML-DSA, and 12x lower delay and 5.4x less overhead than FN-DSA. We formally prove the security of EMULSION and open-source its implementation for public testing and adaptation.
5G transmits System Information Blocks (SIBs) without authentication during bootstrapping, enabling fake base station attacks. Direct NIST-PQC integration is infeasible: ML-DSA requires 34 fragmented packets and up to 5,282 ms delay. We present a two-phase PQ migration framework. Phase I provides transitional security via hierarchical identity-based threshold signatures with a fail-stop mechanism backed by PQ-secure audit logging. This transitional solution requires only 144 B overhead and 2.99 ms end-to-end delay, which is three orders of magnitude faster than ML-DSA. Phase II achieves full PQ authentication via a TESLA-style HMAC chain anchored by a compact post-quantum signature, which is applied once per epoch (160.07 ms delay). Both phases fit within 1-2 SIB1 packets and are validated on a real over-the-air 5G testbed.
In mobile networking, specifically in 5G networking, embedded SIM (eSIM) does not rely on the hardware chips to deliver the core network’s public key as traditional SIM cards do. Instead, eSIM utilizes remote digital certificates enabled by Public Key Infrastructure (PKI). In this research, we study the post-quantum transition of eSIM-based mobile networking by applying and incorporating the post-quantum ciphers to the digital certificates and authentication. While building on the existing mutual authentication between the user equipment and core network, we build quantum resistance in the digital signatures used for the digital certificate and authentication so that they are secure against quantum-computing attackers. We implement our scheme using the NIST-standardized post-quantum ciphers to evaluate the computing/time and battery/power overheads, which are important for resource-constrained mobile devices. We compare the post-quantum ciphers with the current quantum-vulnerable ciphers and show that the lattice-based schemes have comparable or even better overhead performances.
Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.
The rapid growth of 5G wireless technology has transformed connectivity, offering exceptional bandwidth, ultralow latency, and massive IoT device connectivity.However, as quantum computers are progressing, resistance against attacks from such computers becomes a mandatory requirement for all critical infrastructure, necessitating efficient post-quantum cryptography (PQC) implementations for 5G-based IoT devices with limited resources.For instance, User Equipment (UE) reauthentication due to frequent handovers and mobility events is a daily operation that already comes with some overhead, which is not attractive to be used for IoT UE devices.Incorporating heavier PQ solutions into these re-authentications will lead to even more additional communication and computation overhead that may hinder PQ deployment in next generation networks.As such, this paper introduces a novel, lightweight approach for integrating PQC in 5G IoT authentication by proposing a custom identity-based session resumption mechanism without compromising interoperability with existing protocols.This approach prevents replay attacks and ensures perfect forward secrecy (PFS) by utilizing customized identities that are dynamically generated based on device-specific parameters, combined with intelligent server-side caching of quantum-resistant cryptographic materials that eliminate the need for full PQC computations during subsequent re-authentications.We demonstrate through realistic 5G experimentation that the proposed solution significantly lowers authentication overhead while providing quantumresistant security.
This research paper presents a framework, referred to as QRAPSF, which is quantum-resilient and adaptive privacy security framework for 6G communication systems. The QRAPSF framework incorporates quantum-resistant key establishment using ML-KEM, authentication using ML-DSA, lightweight privacy preserving identity management, adaptive physical layer security, and threat aware security level selection. The hierarchical security controller determines the appropriate security level based on channel status, device capability, latency requirements, and threat level. The proposed QRAPSF framework obtains attack detection accuracy of 96.24%, authentication success rate of 98.31%, and privacy preservation efficiency of 95.14% under 5% network load and 93.81%, 96.19%, and 92.61%, respectively, under 30% network load. The communication overhead remains between 9.42% and 11.68%, whereas the authentication latency varies between 29.84 ms and 37.42 ms depending on the network load. Under 30% network load, the proposed QRAPSF framework has communication overhead 5.40 percentage points less than that of Lattice-Based Physical Layer Security and authentication latency 7.86 ms less than that of Hybrid PQC Authentication.
The advent of quantum computing threatens the security of classical public-key cryptographic systems, prompting the transition to post-quantum cryptography (PQC). While PQC has been analyzed in theory, its performance in practical wireless communication environments remains underexplored. This paper presents a detailed implementation and performance evaluation of NIST-selected PQC algorithms in user equipment (UE) to UE communications over 5G networks. Using a full 5G emulation stack (Open5GS and UERANSIM) and PQC-enabled TLS 1.3 via BoringSSL and liboqs, we examine key encapsulation mechanisms and digital signature schemes across realistic network conditions. We evaluate performance based on handshake latency, CPU and memory usage, bandwidth, and retransmission rates, under varying cryptographic configurations and client loads. Our findings show that ML-KEM with ML-DSA offers the best efficiency for latency-sensitive applications, while SPHINCS+ and HQC combinations incur higher computational and transmission overheads, making them unsuitable for security-critical but time-sensitive 5G scenarios.