3GPP is currently considering the introduction of the 256-bit variant of symmetric-key cryptographic algorithms for beyond 5G Advanced systems, in addition to the 128-bit algorithms to attain higher security strength. In the recent years, a new security scheme called, Authenticated Encryption with Associated Data (AEAD) has been gaining popularity, and claims to be fast enough to provide confidentiality and integrity protection together with reduced instruction cycles. It is of interest, to consider such efficient algorithms for user plane protection in 5G and beyond, to maintain stringent performance metrics without compromising on security in a post quantum era. In this paper, we provide state-of-the-art performance evaluation on a test bed and propose the usage of AEAD scheme implemented using AES-GCM (AES-Galois Counter Mode) operation in 5G Systems for achieving higher security strength of quantum-resistant communications. We further extended our exploration to assess the performance impact of integrating AEAD with the quantum resistant variants of protocols PQ-TLS, IKEv2 with PPKs for an end-to-end user plane security. We performed a comparative analysis of the 256-bit variant of AES-GCM mode of operation with traditional AES modes of operation in 128-bit and 256-bit variants, by considering performance metrics such as throughput, energy consumption, CPU utilization and latency. We have observed that, AES-256 GCM provides an increase in throughput by 9.4% when both ciphering and integrity protection are applied. Similarly, we observed a reduction of 200% in latency for AES-256 GCM than that of AES-128 modes of operations. We also ran experiments on energy utilization and CPU utilization and observed that AES-256 GCM consumes 16% more energy and CPU cycles utilization is more than AES-256 CTR. From the evaluation results, we observed that the transition to 256-bit crypto algorithms is needed not only for realizing a quantum secure system, but also to increase the system performance.
3GPP is currently considering the introduction of the 256-bit variant of symmetric-key cryptographic algorithms for beyond 5G Advanced systems, in addition to the 128-bit algorithms to attain higher security strength. In the recent years, a new security scheme called, Authenticated Encryption with Associated Data (AEAD) has been gaining popularity, and claims to be fast enough to provide confidentiality and integrity protection together with reduced instruction cycles. It is of interest, to consider such efficient algorithms for user plane protection in 5G and beyond, to maintain stringent performance metrics without compromising on security in a post quantum era. In this paper, we provide state-of-the-art performance evaluation on a test bed and propose the usage of AEAD scheme implemented using AES-GCM (AES-Galois Counter Mode) operation in 5G Systems for achieving higher security strength of quantum-resistant communications. We further extended our exploration to assess the performance impact of integrating AEAD with the quantum resistant variants of protocols PQ-TLS, IKEv2 with PPKs for an end-to-end user plane security. We performed a comparative analysis of the 256-bit variant of AES-GCM mode of operation with traditional AES modes of operation in 128-bit and 256-bit variants, by considering performance metrics such as throughput, energy consumption, CPU utilization and latency. We have observed that, AES-256 GCM provides an increase in throughput by 9.4% when both ciphering and integrity protection are applied. Similarly, we observed a reduction of 200% in latency for AES-256 GCM than that of AES-128 modes of operations. We also ran experiments on energy utilization and CPU utilization and observed that AES-256 GCM consumes 16% more energy and CPU cycles utilization is more than AES-256 CTR. From the evaluation results, we observed that the transition to 256-bit crypto algorithms is needed not only for realizing a quantum secure system, but also to increase the system performance.
Significant performance improvements in bandwidth and latency make 5G a suitable candidate for a wide range of applications, particularly those requiring real-time communication, such as Industrial Control Systems (ICS) and autonomous vehicles. However, today’s security, including modern cryptographic systems, is prone to different attacks caused by the high computational power of quantum computing, highlighting the need for integrating quantum-resistant security measures. To accommodate attacks targeted at 5G networks, there are efforts to move towards TLS-based security, which is the widely accepted standard across networks. However, integrating post-quantum algorithms must also be considered in such a transition. Thus, this paper is the first to perform the integration of Post-quantum TLS (PQ-TLS) protocols into 5G networks and offer a realistic performance evaluation. Our approach focuses on integrating PQ-TLS into the 5G control plane (CP) without requiring a major overhaul, thus ensuring communications’ interoperability even with legacy components of 5G, which may not support TLS. Specifically, we have updated the registration and authentication protocols for both core network functions and user equipment (UE) by implementing a TLS tunneling approach through virtualization. We then evaluate the performance and feasibility of PQ-TLS in enhancing the security of 5G communications on an actual testbed. Our results demonstrate that while PQ algorithms introduce some overhead, they remain viable for 5G applications, particularly for protocols that can run on the core network.
The fifth generation of mobile networks (5G) is among the critical infrastructures whose security and privacy requirements are paramount. Compared to previous generations, 5G leverages a service-based architecture where many Network Functions (NF), i.e., the set of microservices on which is based the architecture, need secure communication means. NFs can communicate using HTTP2, and despite not being required by the standard, they can use Transport Layer Protocol (TLS) to ensure data integrity and authentication across the network. However, with the expected arrival of quantum computers in the near future, traditional cryptographic algorithms are under significant threat. With the recent run for post-quantum standardization, the NIST selected possible candidate algorithms. However, no study evaluates whether such algorithms would be applicable in the 5G core without significant performance degradation. In this paper, we perform the first assessment of the feasibility of using post-quantum secure Key Encapsulation Mechanism (KEM) for the 5G core network. To this aim, we implemented and compared the performances of five algorithms among those selected during the NIST standardization process. We adapted those algorithms to implement them in a standalone 5G core implemented via Open5GS, and tested their performance when performing user registration. Our results show that the KY-BER768 achieves comparable performance to TLS in terms of UE registration time and CPU utilization, thus being a candidate solution to improve the security posture of the 5G core.
Recent advances in quantum computing have prompted urgent consideration for the migration of classical cryptographic systems to post-quantum alternatives. However, it is impossible to fully understand the impact that migrating to current Post-Quantum Cryptography (PQC) algorithms will have on various applications without actual implementation of quantum-resistant cryptography. On the other hand, PQC algorithms come with complexity and long processing times, which may impact the Quality of Service (QoS) of many applications. Therefore, PQC-based protocols with practical implementation across various applications are essential. This paper introduces a new framework for PQC standalone and PQC-AES (Advanced Encryption Standard) hybrid Public Key Encryption (PKE) protocols. Building on prior results, we focus on securing applications such as file transfer, video streaming, and chat-based communication using enhanced PQC-based protocols. The extended PQC-based protocols use a sequence number-based mechanism to effectively counter replay and man-in-the-middle attacks and mitigate standard cybersecurity attack vectors. Experimental evaluations examined encryption/decryption speeds, throughput, and processing overhead for these standalone PQC and PQC-AES hybrid schemes, benchmarking them against traditional AES-256 in an existing client-server environment. The results demonstrate that the new approaches achieve a significant balance between security and system performance compared to conventional deployments. Furthermore, the comprehensive security analysis confirms the robustness and effectiveness of the proposed PQC-based protocols across diverse attack scenarios. Notably, the PQC-AES hybrid protocol demonstrates greater efficiency for applications handling larger data volumes (e.g., 10–100 KB) with reduced latency, underscoring the practical necessity of carefully balancing security and operational efficiency in the post-quantum migration process.
The need for secure communication in the advent of fully developed quantum computers is underscored by the ongoing standardization of Post-Quantum Cryptography algorithms (PQC). However, due to the complexity and long processing time of PQC algorithms, it is impractical to use them directly in most applications. Therefore, a practical implementation, especially in applications that may be vulnerable to quantum attacks, is essential. This paper proposes PQC-based and PQC-AES (Advanced Encryption Standard) hybrid Public Key Encryption (PKE) protocols to secure the communication of application data transmitted between two parties. The parties securely exchange their PQC keys using a PQC Key Encapsulation Mechanism (KEM) scheme. In the PQC-based PKE, the exchanged PQC public keys (asymmetric key cryptography) are used to encrypt data for network transmission. To decrypt the encrypted data, each party uses their private PQC secret key, known only to them, enabling secure end-to-end communication. In the PQC-AES hybrid PKE, a two-way shared secret key is used to generate a symmetric key (symmetric key cryptography) for encryption and decryption. The performance of the proposed protocols is evaluated through experiments with PQC algorithms in a client-server file transfer application. The evaluation results highlight the necessity of considering security, latency, and other metrics when implementing PQC algorithms in various applications. It is confirmed that KYBER1024 and BIKE-L1 achieved similar throughput in comparison to using the conventional AES-256 key encryption algorithm without extensive overheads in the wireless network for a smaller load (e.g., 1 KB size), while the PQC-AES hybrid cryptography protocol may be suitable for applications where the data size is larger,
Advancements in 5G are largely driven by its adoption across a variety of applications, including smart homes, smart healthcare, autonomous vehicles, transportation, and Industry 5.0. However, this widespread usage raises significant security and privacy concerns, particularly regarding authentication. To secure 5G communications, 3GPP has standardised the 5G-Authentication and Key Agreement (5G-AKA) protocol. Despite this, state-of-the-art research has revealed that 5G-AKA suffers from several vulnerabilities. In response, numerous alternative authentication schemes have been proposed. Nevertheless, many of these protocols continue to be susceptible to classical security threats, such as malicious serving network (SN) attacks, ephemeral secret leakage, traceability, anonymity violations, and, most critically, a lack of Perfect Forward Secrecy (PFS). Additionally, recent advancements in quantum computing pose a substantial risk to the security of 5G-AKA and its variants, rendering them insecure in the post-quantum era. Although a few post-quantum cryptography-based protocols have been introduced, studies show that they are either computationally expensive or still vulnerable to quantum attacks. In order to tackle these challenges, we propose two versions of a novel authentication protocol that not only provide comprehensive security guarantees but are also computationally efficient. Version 1 utilises a hybrid cryptographic approach (AES + KEM) and achieves the lowest computational cost—even lower than Version 2, which relies solely on KEM. Both versions offer the same level of security, but Version 1 is significantly more efficient in terms of resource usage. We have validated our proposed protocols using the Real-Or-Random (ROR) model and the Scyther tool. Furthermore, we evaluated their performance against existing protocols under both known and unknown attack scenarios. The results show that our protocols incur lower computational, communication, and energy overhead, as well as strong resilience against unknown attacks, outperforming several existing authentication schemes. Furthermore, we implement a testbed to demonstrate the real-time applicability of both proposed versions.
The advent of quantum computing threatens the security of classical public-key cryptographic systems, prompting the transition to post-quantum cryptography (PQC). While PQC has been analyzed in theory, its performance in practical wireless communication environments remains underexplored. This paper presents a detailed implementation and performance evaluation of NIST-selected PQC algorithms in user equipment (UE) to UE communications over 5G networks. Using a full 5G emulation stack (Open5GS and UERANSIM) and PQC-enabled TLS 1.3 via BoringSSL and liboqs, we examine key encapsulation mechanisms and digital signature schemes across realistic network conditions. We evaluate performance based on handshake latency, CPU and memory usage, bandwidth, and retransmission rates, under varying cryptographic configurations and client loads. Our findings show that ML-KEM with ML-DSA offers the best efficiency for latency-sensitive applications, while SPHINCS+ and HQC combinations incur higher computational and transmission overheads, making them unsuitable for security-critical but time-sensitive 5G scenarios.