5G transmits System Information Blocks (SIBs) without authentication during bootstrapping, enabling fake base station attacks. Direct NIST-PQC integration is infeasible: ML-DSA requires 34 fragmented packets and up to 5,282 ms delay. We present a two-phase PQ migration framework. Phase I provides transitional security via hierarchical identity-based threshold signatures with a fail-stop mechanism backed by PQ-secure audit logging. This transitional solution requires only 144 B overhead and 2.99 ms end-to-end delay, which is three orders of magnitude faster than ML-DSA. Phase II achieves full PQ authentication via a TESLA-style HMAC chain anchored by a compact post-quantum signature, which is applied once per epoch (160.07 ms delay). Both phases fit within 1-2 SIB1 packets and are validated on a real over-the-air 5G testbed.
5G transmits System Information Blocks (SIBs) without authentication during bootstrapping, enabling fake base station attacks. Direct NIST-PQC integration is infeasible: ML-DSA requires 34 fragmented packets and up to 5,282 ms delay. We present a two-phase PQ migration framework. Phase I provides transitional security via hierarchical identity-based threshold signatures with a fail-stop mechanism backed by PQ-secure audit logging. This transitional solution requires only 144 B overhead and 2.99 ms end-to-end delay, which is three orders of magnitude faster than ML-DSA. Phase II achieves full PQ authentication via a TESLA-style HMAC chain anchored by a compact post-quantum signature, which is applied once per epoch (160.07 ms delay). Both phases fit within 1-2 SIB1 packets and are validated on a real over-the-air 5G testbed.
The absence of authenticated bootstrapping between User Equipments (UEs) and Base Stations (BSs) in 5G leaves System Information Block (SIB) broadcasts unprotected, enabling fake BS attacks, man-in-the-middle interception, and spoofed emergency alerts. Prior efforts such as Public Key Infrastructure (PKI)-based certificate chains, token-based schemes, and identity-based signatures either impose overhead exceeding 5G's strict packet-size constraints or lack post-quantum (PQ) security. Direct NIST-PQC integration is also infeasible; current standards, such as ML-DSA requires 34 fragmented SIB1 packets and up to 5,282\,ms end-to-end delay, and FN-DSA still requires 13 fragments and up to 1,920\,ms. We propose EMULSION, a symmetric chained publicly verifiable authentication framework for 5G/6G BS broadcast authentication. EMULSION is the first framework to exploit native 5G architectural features: fixed SIB transmission windows, millisecond-level time synchronization, and eSIM/USIM credential management to achieve genuine PQ security at symmetric-key efficiency. It uses a timed stream loss-tolerant authentication with HMAC chain anchored by a compact PQ signature~(MAYO) applied once per epoch, fitting authentication within a single packet with no fragmentation and eliminating certificate transmission entirely. Unlike prior schemes, EMULSION extends to the full SIB family (SIB1-SIB21) at no additional per-broadcast cost, demonstrated over the air on SIB1. Evaluated on a real over-the-air 5G testbed, EMULSION achieves 33x lower end-to-end delay and 31x less communication overhead than ML-DSA, and 12x lower delay and 5.4x less overhead than FN-DSA. We formally prove the security of EMULSION and open-source its implementation for public testing and adaptation.
The transition to a cloud-native 5G Service-Based Architecture (SBA) improves scalability but exposes control-plane signaling to emerging quantum threats, including Harvest-Now, Decrypt-Later (HNDL) attacks. While NIST has standardized post-quantum cryptography (PQC), practical, deployable integration in operational 5G cores remains underexplored. This work experimentally integrates NIST-standardized ML-KEM-768 and ML-DSA into an open-source 5G core (free5GC) using a sidecar proxy pattern that preserves unmodified network functions (NFs). Implemented on free5GC, we compare three deployments: (i) native HTTPS/TLS, (ii) TLS sidecar, and (iii) PQC-enabled sidecar. Measurements at the HTTP/2 request-response boundary over repeated independent runs show that PQC increases end-to-end Service-Based Interface (SBI) latency to approximately 54 ms, adding a deterministic 48-49 ms overhead relative to the classical baseline, while maintaining tightly bounded variance (IQR <= 0.2 ms, CV < 0.4%). We also quantify the impact of Certification Authority (CA) security levels, identifying certificate validation as a tunable contributor to overall delay. Overall, the results demonstrate that sidecar-based PQC insertion enables a non-disruptive and operationally predictable migration path for quantum-resilient 5G signaling.
Quantum computing is reshaping the security landscape of modern telecommunications. The cryptographic foundations that secure todays 5G systems, including RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman (DH), are all susceptible to attacks enabled by Shors algorithm. Protecting 5G networks against future quantum adversaries has therefore become an urgent engineering and research priority. In this paper we introduce QORE, a quantum-secure 5G and Beyond 5G (B5G) Core framework that provides a clear pathway for transitioning both the 5G Core Network Functions and User Equipment (UE) to Post-Quantum Cryptography (PQC). The framework uses the NIST-standardized lattice-based algorithms Module-Lattice Key Encapsulation Mechanism (ML-KEM) and Module-Lattice Digital Signature Algorithm (ML-DSA) and applies them across the 5G Service-Based Architecture (SBA). A Hybrid PQC (HPQC) configuration is also proposed, combining classical and quantum-safe primitives to maintain interoperability during migration. Experimental validation shows that ML-KEM achieves quantum security with minor performance overhead, meeting the low-latency and high-throughput requirements of carrier-grade 5G systems. The proposed roadmap aligns with ongoing 3GPP SA3 and SA5 study activities on the security and management of post-quantum networks as well as with NIST PQC standardization efforts, providing practical guidance for mitigating quantum-era risks while safeguarding long-term confidentiality and integrity of network data.
The rapid growth of 5G wireless technology has transformed connectivity, offering exceptional bandwidth, ultralow latency, and massive IoT device connectivity.However, as quantum computers are progressing, resistance against attacks from such computers becomes a mandatory requirement for all critical infrastructure, necessitating efficient post-quantum cryptography (PQC) implementations for 5G-based IoT devices with limited resources.For instance, User Equipment (UE) reauthentication due to frequent handovers and mobility events is a daily operation that already comes with some overhead, which is not attractive to be used for IoT UE devices.Incorporating heavier PQ solutions into these re-authentications will lead to even more additional communication and computation overhead that may hinder PQ deployment in next generation networks.As such, this paper introduces a novel, lightweight approach for integrating PQC in 5G IoT authentication by proposing a custom identity-based session resumption mechanism without compromising interoperability with existing protocols.This approach prevents replay attacks and ensures perfect forward secrecy (PFS) by utilizing customized identities that are dynamically generated based on device-specific parameters, combined with intelligent server-side caching of quantum-resistant cryptographic materials that eliminate the need for full PQC computations during subsequent re-authentications.We demonstrate through realistic 5G experimentation that the proposed solution significantly lowers authentication overhead while providing quantumresistant security.
The security of 5G networks relies heavily on cryptography, particularly public-key algorithms that are vulnerable to quantum computer attacks. With NIST now standardizing post-quantum cryptographic (PQC) algorithms, we investigate the practical challenges of PQC migration on a physical 5G testbed. Our testbed, built on OpenAirInterface, integrates essential 5G network components, including User Equipment (UE), Next Generation Node B (gNB) - the base stations for 5G - and core network with multiple functions.
5G Core networks are entering a decisive phase of post-quantum (PQ) migration: operators and vendors are beginning to advertise PQ-TLS 1.3, PQ-IPsec, and hybrid KEM support across the Service-Based Interface (SBI) and N2, N3, N4 reference points, in line with 3GPP TS 33.501, emerging IETF drafts, and NIST FIPS 203, 204, 205. Yet deploying PQ primitives does not guarantee PQ security. A Network Function may advertise ML-KEM-768 and silently fall back to X25519; negotiate a hybrid KEM but authenticate with ECDSA-P256; present an ML-DSA leaf on a classical chain; or skip mutual TLS altogether. These failures are silent on the wire, and today scanners (testssl.sh, sslyze, Qualys) together with 5G-specific fuzzers are PQ-unaware and telecom-blind. We present PQC Validator, a layered PQC assurance framework purpose-built for the cloud-native 5G Core, comprising a PQ Crypto Engine (L1), a PQ Conformance Prober (L2), a PQ Robustness Tester (L3), a PQ Overhead Meter (L4), and an eBPF Attestation Plane for wire-level ground truth. Its scope spans the full control-plane cryptographic surface: an independent PQ-TLS 1.3 client and server, a strongSwan-driven PQ-IPsec harness for N2/N3/N4, an eBPF/XDP/TC monitoring plane that extracts wire-level ground truth on negotiated groups and signatures, and a Kubernetes-native UI that auto-discovers NFs and emits structured PQ evidence classifying every endpoint as classical, hybrid-pq, or full-pq. A compliance suite spans TLS, PQC, 3GPP SBI, NRF OpenAPI, and security hardening, while a protocol fuzzer exercises CVE-class regressions and downgrade paths.