SeongHan SHIN

Secure and covert key establishment is increasingly important in tactical and intermittently connected military 5G environments, where authentication traffic may be observable and captured traffic may remain valuable after transmission. However, the standard 3rd Generation Partnership Project (3GPP) 5G Authentication and Key Agreement (5G-AKA) protocol provides neither covert key establishment nor forward secrecy beyond its conventional key hierarchy. To address this limitation, this paper proposes Stealth-5G-AKA, a compact enhancement that embeds a fragmented stealth Elliptic-Curve Diffie–Hellman (ECDH) exchange into standard 5G-AKA challenge–response signaling without modifying the visible message flow or the 5G core authentication architecture. The Home Network splits a 256-bit ephemeral ECDH public value into two 128-bit fragments and conceals them across successive random challenges. After receiving both fragments, the User Equipment reconstructs the hidden public value, derives a covert shared secret, and generates a stealth anchor key K′_SEAF alongside the conventional K_SEAF. Formal verification in ProVerif under the Dolev–Yao adversarial model shows that Stealth-5G-AKA preserves secrecy and mutual authentication, achieves indistinguishability of stealth executions, and provides forward secrecy for K′_SEAF even if long-term subscriber credentials are compromised after protocol completion. Experimental results show that the stealth embedding introduces no additional messages or signaling fields and adds less than 10% computational overhead over the nearest forward-secrecy baseline while additionally achieving covert activation, indicating that Stealth-5G-AKA is a practical approach to secure and covert key establishment for next-generation military 5G deployments.

5G serves as a catalyst for transformative digital innovation by enabling convergence with various services in our daily lives. The success of this paradigm shift undeniably hinges on robust security measures, with primary authentication—securing access to the 5G network—being paramount. Two protocols, 5G authentication and key agreement (5G-AKA) and the extensible authentication protocol for authentication and key-agreement prime (EAP-AKA’), have been standardized for this purpose, with the former designed for third generation partnership project (3GPP) devices and the latter for non-3GPP devices. However, recent studies have exposed vulnerabilities in the 5G-AKA protocol, rendering it susceptible to security breaches, including linkability attacks. Furthermore, the advent of quantum computing poses significant quantum threats, underscoring the urgent need for the adoption of quantum-resistant cryptographic mechanisms. Although postquantum cryptography (PQC) is being standardized, the lack of real-world deployment limits its proven robustness. In contrast, conventional cryptographic schemes have demonstrated reliability over decades of practical application. To address this gap, the Internet Engineering Task Force (IETF) has initiated the standardization of hybrid PQC algorithms (HPQC), combining classical and quantum-resistant techniques. Consequently, ensuring forward secrecy and resilience to quantum threats in the 5G-AKA protocol is critical. To address these security challenges, we propose the 5G-AKA-HPQC protocol. Our protocol is designed to maintain compatibility with existing standards while enhancing security by combining keys negotiated via the Elliptic Curve Integrated Encryption Scheme (ECIES) with those derived from a PQC-Key encapsulation mechanism (KEM). To rigorously and comprehensively validate the security of 5G-AKA-HPQC, we employ formal verification tools such as SVO Logic and ProVerif. The results confirm the protocol’s security and correctness. Furthermore, performance evaluations highlight the computational and communication overheads inherent to 5G-AKA-HPQC. With an average of 56.5 ms (+112.32%) on a total authentication time, the proposed protocol provides its advantages. Also, on a environment of multiple UE registration, compared to single UE registration, the difference in the increased rate of average authentication time is only 0.01%. The negligible difference of 0.01% indicates that the addition of PQC does not lead to increased overhead in multi-UE registration environments, demonstrating its scalability and practical feasibility. In conclusion, our research provides significant insights into the design of secure, quantum-safe authentication protocols and lays the groundwork for the future standardization of secure authentication and key-agreement protocols for mobile telecommunications.

5G acts as a highway enabling innovative digital transformation and the Fourth Industrial Revolution in our lives. It is undeniable that the success of such a paradigm shift hinges on robust security measures. Foremost among these is primary authentication, the initial step in securing access to 5G network environments. For the 5G primary authentication, two protocols, namely 5G Authentication and Key Agreement (5G-AKA) and Improved Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA′), were proposed and standardized, where the former is for 3GPP devices, and the latter is for non-3GPP devices. Recent scrutiny has unveiled vulnerabilities in the 5G-AKA protocol, exposing it to security breaches, including linkability attacks. Moreover, mobile communication technologies are dramatically evolving while 3GPP has standardized Authentication and Key Management for Applications (AKMA) to reuse the credentials, generated during primary authentication, for 5G network applications. That makes it so significant for 5G-AKA to be improved to support forward secrecy as well as address security attacks. In response, several protocols have been proposed to mitigate these security challenges. In particular, they tried to strengthen security by reusing secret keys negotiated through the Elliptic Curve Integrated Encryption Scheme (ECIES) and countering linkability attacks. However, they still have encountered limitations in completing forward secrecy. Motivated by this, we propose an augmentation to 5G-AKA to achieve forward security and thwart linkability attacks (called 5G-AKA-FS). In 5G-AKA-FS, the home network (HN), instead of using its static ECIES key pair, generates a new ephemeral key pair to facilitate robust session key negotiation, truly realizing forward security. In order to thoroughly and precisely prove that 5G-AKA-FS is secure, formal security verification is performed by applying both BAN Logic and ProVerif. As a result, it is demonstrated that 5G-AKA-FS is valid. Besides, our performance comparison highlights that the communication and computation overheads are intrinsic to 5G-AKA-FS. This comprehensive analysis showcases how the protocol effectively balances between security and efficiency.

In [2], Choi et al. proposed an identity-based password-authenticated key exchange (iPAKE) protocol using the Boneh-Franklin IBE scheme, and its generic construction (UKAM-PiE) that was standardized in ISO/IEC 11770-4/AMD 1. In this paper, we show that the iPAKE and UKAM-PiE protocols are insecure against passive/active attacks by a malicious PKG (Private Key Generator) where the malicious PKG can find out all clients' passwords by just eavesdropping on the communications, and the PKG can share a session key with any client by impersonating the server. Then, we propose a strengthened PAKE (for short, SPAIBE) protocol with IBE, which prevents such a malicious PKG's passive/active attacks. Also, we formally prove the security of the SPAIBE protocol in the random oracle model and compare relevant PAKE protocols in terms of efficiency, number of passes, and security against a malicious PKG.

PSA (Platform Security Architecture) Certified is a security certification scheme for IoT hardware, software, and devices. The scheme is composed of security certification (PSA Certified Level 1/2/3) and functional API certification (PSA Certified Functional API). Up to now, this scheme has been adopted by many chip manufacturers, system/software developers, and OEMs (Original Equipment Manufacturers). In this paper, we investigate the PSA security certification and PSA functional API (Cryptography API, Storage API, and Attestation API) with its reference implementation. Also, we analyze the source code of the reference implementation by using Polyspace Bug Finder. Specifically, we found 1,385 coding defects in the PSA functional API reference implementation where high, medium, and low impact defects take up 44, 90, and 1,251, respectively. Then, we compare the PSA functional API and its reference implementation in several aspects. Throughout this paper, we explain the obtained analysis results and our findings in detail.

AONT (All-or-Nothing Transform) is a kind of (n, n)-threshold secret sharing scheme that distributes a message m into a set of n shares such that the message m can be reconstructed if and only if n shares are collected. At CRYPTO 2000, Desai proposed a simple and faster AONT based on the CTR mode of encryption (called CTRT) and proved its security in the ideal cipher model. Though AES-128, whose key length k = 128 and block length l = 128, can be used in CTRT as a block cipher, AES-256 and AES-192 cannot be used due to its intrinsic restriction of k ≤ l. In this paper, we propose an extended CTRT (for short, XCTRT) suitable for AES-256. By thoroughly evaluating all the tricky cases, we prove that XCTRT is secure in the ideal cipher model under the same CTRT security definition. Also, we discuss the security result of XCTRT in concrete parameter settings. For more flexibility of key length, we propose a variant of XCTRT dealing with l < k ≤ 2l by slightly modifying the construction of the last block. After showing implementation details and performance evaluation of CTRT, XCTRT, and the variant, we can say that our XCTRT and its variant have high-speed encoding and decoding performance and are quite practical enough to be deployed in real-world applications.

In [31], Shin et al. proposed a Leakage-Resilient and Proactive Authenticated Key Exchange (LRP-AKE) protocol for credential services which provides not only a higher level of security against leakage of stored secrets but also secrecy of private key with respect to the involving server. In this paper, we discuss a problem in the security proof of the LRP-AKE protocol, and then propose a modified LRP-AKE protocol that has a simple and effective measure to the problem. Also, we formally prove its AKE security and mutual authentication for the entire modified LRP-AKE protocol. In addition, we describe several extensions of the (modified) LRP-AKE protocol including 1) synchronization issue between the client and server's stored secrets; 2) randomized ID for the provision of client's privacy; and 3) a solution to preventing server compromise-impersonation attacks. Finally, we evaluate the performance overhead of the LRP-AKE protocol and show its test vectors. From the performance evaluation, we can confirm that the LRP-AKE protocol has almost the same efficiency as the (plain) Diffie-Hellman protocol that does not provide authentication at all.