Null-Scheme Encryption & SUCI De-anonymization Privacy Weaknesses

The Promise of Identity Protection: SUCI

In all previous generations of cellular networks (2G, 3G, 4G), one of the most significant privacy risks was the transmission of the International Mobile Subscriber Identity (IMSI) in cleartext over the air. This permanent identifier could be intercepted by an attacker with an "IMSI Catcher" to track a specific user's location and presence.

5G Standalone (SA) was designed to solve this problem by introducing the Subscription Permanent Identifier (SUPI) and the Subscription Concealed Identifier (SUCI). The concept is straightforward: never transmit the permanent SUPI over the air. Instead, the device encrypts the SUPI to create a temporary SUCI for use during the initial network registration.

This process relies on asymmetric cryptography, a concept you'll be familiar with from your work in web security (e.g., TLS). The device uses a public key provided by the home network to encrypt its identifier. Only the home network, with its corresponding private key, can decrypt the SUCI to reveal the true SUPI.

The following article from Mpirical provides an excellent overview of this intended protection.

Weakness 1: "Null-Scheme" Encryption

The SUCI mechanism seems robust, but its effectiveness depends entirely on its implementation. The 3GPP standards, which define how cellular networks operate, include a critical loophole: the encryption can be turned off.

The SUCI data structure contains a field called the "Protection Scheme ID," which tells the network which encryption algorithm was used. While this can specify a strong scheme like ECIES (Elliptic Curve Integrated Encryption Scheme), the standard also permits a value of '0', which signifies the Null Scheme—in other words, no encryption at all.

When the null scheme is used, the "encrypted" part of the SUCI is simply the plaintext Mobile Subscriber Identification Number (MSIN). An attacker monitoring the radio interface can read it just as easily as they could read an IMSI in a 4G network.

To understand how this fits into the broader 5G security framework, the following video explains that much of 5G's security is, in fact, optional.

This "null-scheme" is a form of policy-based bidding down. The network operator decides whether to enforce real encryption. If they don't, any device connecting to their network, regardless of its capabilities, will send its permanent identifier in the clear.

Weakness 2: SUCI De-anonymization

Even when a strong encryption scheme is used and the null scheme is avoided, the SUCI does not provide complete anonymity. An attacker can still perform de-anonymization to learn crucial information about the subscriber.

This is possible because, for the SUCI to be routed to the correct home network for decryption, it must contain some unencrypted information. Specifically, the Mobile Country Code (MCC) and Mobile Network Code (MNC) are sent in cleartext.

The Black Hat presentation "5G IMSI Catchers Mirage" provides a concise analysis of this weakness.

So, while SUCI may prevent an attacker from identifying an individual subscriber (Alice or Bob), it does not prevent them from identifying a subscriber's affiliation (a customer of Operator X from Country Y). This is valuable intelligence for targeted surveillance.

An Important Caveat: 5G NSA vs. SA

A critical point to remember is that all these SUCI-related protections and their associated weaknesses apply only to 5G Standalone (SA) networks, which have a 5G core.

The vast majority of early "5G" deployments were Non-Standalone (NSA), which use a 5G radio but connect to a 4G Evolved Packet Core (EPC). In the 5G NSA architecture, the core network is still 4G, so there is no SUCI. The device identifies itself using its IMSI, just as it would on a 4G network.

The same Black Hat presentation makes this clear.

This means that for a long time, users with "5G" phones were still fully exposed to traditional IMSI catching attacks. As networks transition to 5G SA, SUCI becomes relevant, but as we've discussed, it's far from a perfect solution.

Conclusion

In this lesson, we moved beyond the loud downgrade attacks to examine the more subtle privacy weaknesses within the 5G framework itself. We saw that while 5G SA introduces a powerful privacy concept with SUCI, its real-world effectiveness is compromised by policy choices and protocol design.

Key Takeaways:

• SUCI's Purpose: The Subscription Concealed Identifier (SUCI) is designed to protect a user's permanent identity (SUPI) by encrypting it during initial network registration.
• Null-Scheme Weakness: The 3GPP standards allow for a "null encryption" scheme, where the SUPI is sent in cleartext within the SUCI structure. This is a policy decision by the network operator that completely negates the privacy benefits.
• SUCI De-anonymization: Even with proper encryption, the Mobile Country Code (MCC) and Mobile Network Code (MNC) are sent in the clear. This allows an attacker to identify a user's home country and network operator, enabling targeted intelligence gathering.
• NSA vs. SA: SUCI is a feature of 5G Standalone (SA) only. In the more common Non-Standalone (NSA) mode, the network relies on a 4G core, and the user's permanent identifier (IMSI) is exposed just as it is in 4G.

Preview of the Next Lesson:

The vulnerabilities we discussed today relate to the first Non-Access Stratum (NAS) message sent from the device to the core network. But what happens even before that? In our next lesson, we will explore vulnerabilities in the 5G NR initial connection setup before security is activated. We'll see how information exchanged during the very first Radio Resource Control (RRC) messages can be used for tracking.