3GPP TSG-SA3 Meeting #126	draft_S3-260859-r1

Goa, India, 09 – 13 February 2026 was S3-260696

Source:	China Mobile

Title:	A hybrid scheme for SUPI protection

Document for:	Approval

Agenda item:	5.2.1

Spec:	3GPP TR 33.801-01

Version:	0.3.0

Work Item:	FS_6G_SEC

Comments

This PCR proposes a hybrid scheme for SUPI protection.

* * * First Change * * * *

7.2	Solutions

Editor’s Note: This clause contains solutions to update 3GPP defined security protocols (for example SUCI calculation) to use the appropriate PQC algorithm, if those protocols are not expected to be updated by other SDOs to use PQC algorithms.

7.2.1	Solutions to SUCI calculation

Editor’s Note: If only SUCI calculation is considered, this subclause may be removed. If other protocol, e.g. MIKEY-SAKKE is studied, this subclause is used for each of such protocol identified.

7.2.1.X	Solution #X to SUCI calculation: A hybrid scheme for SUPI protection

7.2.1.X.1	Introduction

A hybrid scheme used to protect SUPI is proposed, which combines ECIES and PQC KEM scheme to calculate SUCI. Consequently, the quantum-computing attacks on the ECIES can be mitigated.

Preassumption: UEs are provisioned with both ECC public key and PQC public key of HN (Home Network ).

7.2.1.X.2	Solution details

The basic idea is to maintain the basic process of ECIES without any modifications except that only one step on the UE side is added, where the ephemeral public key generated by the UE based on ECC is encrypted by using the PQC KEM algorithm (e.g. Crystals-Kyber). The SUCI generated by the UE does not contain the ephemeral public key, but rather the encrypted ephemeral public key. In this way, attackers with quantum computer cannot obtain the ephemeral public key, and consequently cannot obtain the ephemeral shared key that encrypts subscription identifier (e.g. MSIN). The advantage of this scheme is that it has well compatibility with the ECIES scheme, and its security relies not only on the ECC algorithm but also on the PQC algorithm.

7.2.1.X.2.1	Processing on UE side

The UE generates SUCI using a hybrid scheme, whose process is shown in the following figure:

Figure 7.2.1.X.2.1: Encryption at UE

The detailed steps for encryption are as follows:

1. UE generates an ECC ephemeral public/private key pair;

2. Generate an ephemeral shared key by using the ephemeral private key and the provisioned ECC public key of HN;

3. Derive an ephemeral encryption key and an ephemeral MAC key based on the ephemeral shared key;

4. Encrypt the plaintext by using an ephemeral encryption key to generate the ciphertext;

5. Use an ephemeral MAC key to perform integrity protection on the ciphertext and generate a MAC (Message Authentication Code) tag;

6. Based on the PQC-based key encapsulation mechanism, the ephemeral public key is encrypted by using the provisioned PQC public key of HN.

The output of the scheme is: encrypted ephemeral public key || ciphertext || MAC tag

NOTE: Steps 1-5 mentioned above are the encryption steps specified in TS33.501, while Step 6 is newly added.

The SUCI format of this scheme is as follows:

Figure 7.2.1.X.2.2: SUCI Format

7.2.1.X.2.2	Processing on home network side

After receiving SUCI, the home network finds the corresponding ECC private key and PQC private key based on the home network ECC public key identifier and home network PQC public key identifier in SUCI. The home network then uses these two private keys to process SUCI to obtain SUPI. The process is shown in the following figure:

Figure 7.2.1.X.2.3: Decryption at UE

The detailed steps for decryption are as follows:

1. The network uses its PQC private key to decrypt the encrypted ephemeral public key based on the PQC key decapsulation mechanism;

2. Generate the ephemeral shared key by using the ECC private key of HN and ephemeral public key;

3. Derive the ephemeral decryption key and the MAC key based on the ephemeral shared key;

4. Apply the ephemeral decryption key to decrypt the ciphertext to obtain the plaintext;

5. Perform integrity verification on the ciphertext by using the ephemeral MAC key and MAC function;

Note: Steps 2-5 mentioned above are the decryption steps in TS33.501, while Step 1 is newly added

Editor’s note: Evaluation on impact of initial access due to increased length of SUCI is FFS.

Editor’s note: Evaluation on computing overhead of SUCI calculation on both UE and network side is FFS.

Editor’s note: Whether the solution works for case that user does not update USIM card is FFS.

Editor’s note: Whether this solution meets IND-CCA-1 security and IND-CCA-2 security is FFS.

Editor’s note: Whether PQC based KEM scheme could be used for encryption of Eph. public key is FFS.

7.2.1.X.3	Evaluation

Editor’s note: Evaluation is FFS.

* * * End of Changes * * * *