Pith. sign in

REVIEW 2 major objections 2 minor 59 references

A Lightweight Post-Quantum Authentication Framework for 5G Base Station Bootstrapping

T0 review · 2 major / 2 minor · reviewed 2026-06-30 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read EMULSION secures 5G base station broadcasts with post-quantum security inside a single packet by anchoring a TESLA-style HMAC chain with one MAYO signature per epoch.

desk verdict EMULSION anchors a TESLA HMAC chain with one MAYO signature per epoch to fit PQ auth into single 5G SIB packets, with solid testbed gains, but the timing security assumptions need verification. read the letter →

arxiv 2606.30542 v1 pith:ZRRXECZS submitted 2026-06-29 cs.CR

Saleh Darzi , Mirza Masfiqur Rahman , Imtiaz Karim , Rouzbeh Behnia , Attila A Yavuz , Elisa Bertino This is my paper · ORCID
classification cs.CR
keywords post-quantumauthentication5GbasestationbootstrappingTESLAchainMAYOsignatureSIBbroadcastsecuritylightweightframeworksymmetric-keyefficiency
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that EMULSION delivers genuine post-quantum authentication for 5G System Information Block broadcasts by combining a TESLA-style HMAC chain with a single compact MAYO signature applied once per epoch. It exploits fixed SIB transmission windows, millisecond-level time synchronization, and eSIM/USIM credentials to keep the entire authentication inside one packet without fragmentation or certificate transmission. A sympathetic reader would care because prior PKI and direct NIST-PQC approaches either exceed packet-size limits or introduce delays up to thousands of milliseconds, leaving networks open to fake base station attacks and spoofed alerts. The framework protects the full SIB family from SIB1 to SIB21 and achieves 33 times lower end-to-end delay and 31 times less overhead than ML-DSA on a real over-the-air testbed. The authors formally prove its security and release an open-source implementation.

What carries the argument

The TESLA-style HMAC chain anchored by one MAYO post-quantum signature per epoch, which enables public verification of broadcast messages using 5G time synchronization without transmitting certificates or fragmenting packets.

What would settle it

An experiment showing that an attacker can forge a valid SIB broadcast by exploiting small timing discrepancies in the 5G synchronization to break the HMAC chain verification before the next MAYO-anchored epoch.

Watch

Extended reading notes

Core claim

EMULSION is the first framework to exploit native 5G architectural features to achieve genuine PQ security at symmetric-key efficiency. It uses a TESLA-style HMAC chain anchored by a compact PQ signature (MAYO) applied once per epoch, fitting authentication within a single packet with no fragmentation and eliminating certificate transmission entirely while protecting the full SIB family.

Load-bearing premise

That the fixed SIB transmission windows and millisecond-level time synchronization in 5G can be used directly to anchor the TESLA chain without introducing new timing or synchronization attacks.

Editorial extensions

If this is right

  • The full SIB1-SIB21 family receives protection instead of only selected messages.
  • End-to-end delay drops by a factor of 33 compared with direct ML-DSA integration.
  • Communication overhead falls by a factor of 31 versus ML-DSA and 5.4 versus FN-DSA.
  • No certificate transmission or packet fragmentation is required.
  • Security is formally proven for the hybrid symmetric-PQ construction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The single-packet design could extend to other broadcast authentication settings that share precise time synchronization and fixed transmission schedules.
  • Open-sourcing the implementation allows independent verification of the timing assumptions on additional 5G hardware and software stacks.
  • The approach may lower the barrier for deploying quantum-resistant protections in existing cellular networks without hardware changes to UEs or base stations.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 2 minor

Summary. The paper proposes EMULSION, a TESLA-style HMAC-chain authentication framework for 5G base-station SIB broadcasts. It anchors the chain with a single compact MAYO post-quantum signature per epoch, exploits fixed SIB transmission windows and millisecond-level UE-BS time synchronization together with eSIM/USIM credentials, fits the entire authenticator inside one unfragmented packet, eliminates certificate transmission, protects the full SIB1–SIB21 family, supplies a formal security proof, reports 33× lower end-to-end delay and 31× lower communication overhead than ML-DSA (and 12×/5.4× versus FN-DSA) on a real over-the-air 5G testbed, and releases open-source code.

Significance. If the security argument is sound, the work would be significant: it is the first scheme to obtain genuine post-quantum security for 5G broadcast authentication at essentially symmetric-key cost by directly using native 5G architectural primitives rather than bolting on heavy PQC primitives. The real testbed measurements, the claim of protecting every SIB, the open-source release, and the formal proof are concrete strengths that raise the bar for future 5G/6G security proposals.

major comments (2)
  1. [§4] §4 (Security Model and Proof): The formal security reduction for the TESLA-style chain assumes that the receiver’s view of the disclosure schedule is strictly determined by the fixed SIB transmission windows and the claimed millisecond-level time synchronization. The model does not include an adversary that can influence base-station clock skew, spoof SIB scheduling, or manipulate the UE’s perception of transmission windows. Because TESLA security rests on the receiver being certain that a disclosed key was unknown at MAC verification time, the absence of this modeling directly undermines the “genuine PQ security at symmetric-key efficiency” claim.
  2. [§5.2] §5.2 (Testbed Evaluation): The reported 33× delay and 31× overhead gains versus ML-DSA are measured under benign channel conditions. No experiments or analysis are provided that inject controlled timing perturbations or SIB-window manipulation to test whether the single-packet fitting and security still hold when the anchoring assumptions are stressed.
minor comments (2)
  1. [Abstract] The abstract states that EMULSION “protects the full SIB family (SIB1-SIB21)”; the manuscript should explicitly list which SIB types are authenticated in each epoch and confirm that the single-packet format accommodates the largest SIB payload.
  2. [§3] Notation for the HMAC-chain indices and epoch boundaries should be introduced once in §3 and used consistently; several later equations reuse the same symbols with slightly different meanings.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the thorough review and constructive comments on our manuscript. We address each of the major comments below and indicate the revisions we will make to strengthen the paper.

read point-by-point responses

  1. Referee: [§4] §4 (Security Model and Proof): The formal security reduction for the TESLA-style chain assumes that the receiver’s view of the disclosure schedule is strictly determined by the fixed SIB transmission windows and the claimed millisecond-level time synchronization. The model does not include an adversary that can influence base-station clock skew, spoof SIB scheduling, or manipulate the UE’s perception of transmission windows. Because TESLA security rests on the receiver being certain that a disclosed key was unknown at MAC verification time, the absence of this modeling directly undermines the “genuine PQ security at symmetric-key efficiency” claim.

    Authors: Our security model is constructed around the native 5G architectural primitives, including the fixed SIB transmission windows and millisecond-level time synchronization enforced by the network and eSIM/USIM credentials. These are treated as trusted components of the 5G system, consistent with how TESLA is typically applied in synchronized broadcast settings. We agree, however, that the proof would benefit from an explicit treatment of adversaries attempting to influence these elements. In the revised manuscript, we will expand §4 to include a discussion of such attacks, explaining that they would require compromising the 5G core network security, which is outside the scope of the broadcast authentication threat model considered. This will reinforce rather than undermine the claim of achieving genuine post-quantum security at symmetric-key efficiency. revision: yes

  2. Referee: [§5.2] §5.2 (Testbed Evaluation): The reported 33× delay and 31× overhead gains versus ML-DSA are measured under benign channel conditions. No experiments or analysis are provided that inject controlled timing perturbations or SIB-window manipulation to test whether the single-packet fitting and security still hold when the anchoring assumptions are stressed.

    Authors: The performance measurements were obtained from a real over-the-air 5G testbed to reflect practical deployment conditions. We recognize the importance of evaluating resilience under stressed conditions. In the revised version, we will add analysis in §5.2, including a theoretical examination of how timing perturbations affect the scheme and additional testbed experiments or simulations that introduce controlled clock skew and scheduling manipulations to verify that the single-packet authenticator and security properties remain intact. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: framework applies established primitives to 5G constraints without self-referential reductions

full rationale

The provided abstract and description contain no equations, parameter fits, or derivation steps that reduce the claimed security or efficiency to inputs by construction. EMULSION is presented as combining a TESLA-style HMAC chain with a single MAYO signature per epoch, leveraging documented 5G features (fixed SIB windows, ms-level sync, eSIM/USIM). Security is stated to be formally proven, and performance numbers come from over-the-air testbed evaluation rather than any fitted or renamed quantity. No self-citations are invoked as load-bearing uniqueness theorems, and no ansatz or renaming of known results appears. The derivation chain is therefore self-contained against external benchmarks.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

The central claim rests on the cryptographic security of HMAC and the MAYO signature scheme plus the domain assumption that 5G's existing time synchronization and fixed transmission windows can be leveraged without new vulnerabilities. No free parameters or new invented entities are introduced.

assumptions (2)
  • standard math Security of the HMAC primitive and the MAYO post-quantum signature scheme
    The TESLA-style chain and single signature per epoch rely on these primitives remaining secure.
  • domain assumption 5G networks provide reliable millisecond-level time synchronization and fixed SIB transmission windows usable for key disclosure timing
    This assumption enables the chain to fit in one packet without fragmentation or extra overhead.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Lightweight Post-Quantum Authentication Framework for 5G Base Station Bootstrapping." pith.science (2026). https://pith.science/paper/ZRRXECZS

@misc{pith2026260630542,
  author       = {Pith},
  title        = {Pith review of: A Lightweight Post-Quantum Authentication Framework for 5G Base Station Bootstrapping},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZRRXECZS}},
  note         = {Machine review of arXiv:2606.30542}
}
abstract

The absence of authenticated bootstrapping between User Equipments (UEs) and Base Stations (BSs) in 5G leaves System Information Block (SIB) broadcasts unprotected, enabling fake BS attacks, man-in-the-middle interception, and spoofed emergency alerts. Prior efforts such as Public Key Infrastructure (PKI)-based certificate chains, token-based schemes, and identity-based signatures either impose overhead exceeding 5G's strict packet-size constraints or lack post-quantum (PQ) security. Direct NIST-PQC integration is infeasible: ML-DSA requires 34 fragmented SIB1 packets and up to 5,282,ms end-to-end delay, and FN-DSA still requires 13 fragments and up to 1,920,ms. We propose $\emulsion$, a symmetric chained publicly verifiable authentication framework for 5G/6G BS broadcast authentication. EMULSION is the first framework to exploit native 5G architectural features: fixed SIB transmission windows, millisecond-level time synchronization, and eSIM/USIM credential management to achieve genuine PQ security at symmetric-key efficiency. It uses a TESLA-style HMAC chain anchored by a compact PQ signature (MAYO) applied once per epoch, fitting authentication within a single packet with no fragmentation and eliminating certificate transmission entirely. Unlike all prior schemes, EMULSION protects the full SIB family (SIB1-SIB21). Evaluated on a real over-the-air 5G testbed, EMULSION achieves 33x lower end-to-end delay and 31x less communication overhead than ML-DSA, and 12x lower delay and 5.4x less overhead than FN-DSA. We formally prove the security of EMULSION and open-source its implementation for public testing and adaptation.

Figures

Figures reproduced from arXiv: 2606.30542 by the authors.

Figure 1
Figure 1. 5G network connection setup and protocol stack. The UE decodes the MIB from the PBCH to obtain the System Frame Number (SFN), which provides the timing reference needed to locate SIB1 on the DL-SCH. SIB1 carries the core cell configuration including PLMN identity, cell barring status, and scheduling for additional SIBs; mandatory fields include Cell Selection Info (signal quality metrics) and Cell Access Related Inf… view at source ↗
Figure 2
Figure 2. Outline of Our Threat Models. MAYO [25] is a leading multivariate scheme based on the Oil￾and-Vinegar (OV) framework, achieving EUF-CMA security under the hardness of the Multivariate Quadratic (MQ) prob￾lem. Its whipping technique yields compact signatures (186 B at NIST Level I) and a manageable public key (4,912 B), well￾suited for bandwidth-constrained 5G broadcasts. MAYO also supports batch verification of k pa… view at source ↗
Figure 3
Figure 3. EMULSION protocol flow. VI. PERFORMANCE EVALUATION This section presents a comprehensive evaluation of EMULSION against NIST-PQC standards and conventional authentication schemes for 5G initial bootstrapping. A. Configuration and Experimental Setup Hardware: We assessed the efficiency of EMULSION protocol on a system equipped with a standard desktop equipped with a 12th Gen Intel Core i7 − 12700H@3.50 GHz, 16 GiB RA… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: SIB1 reception characterization on POWDER testbed. [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Packet loss effect on authentication schemes. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Tradeoff between end-to-end delay and authentication [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 7 canonical work pages

  1. [1]

    Insecure connection bootstrapping in cellular networks: the root of all evil,

    S. R. Hussain, M. Echeverria, A. Singla, O. Chowdhury, and E. Bertino, “Insecure connection bootstrapping in cellular networks: the root of all evil,” inProceedings of the 12th conference on security and privacy in wireless and mobile networks, 2019, pp. 1–11

    2019

  2. [2]

    A survey on security aspects for 3gpp 5g networks,

    J. Cao, M. Ma, H. Li, R. Ma, Y . Sun, P. Yu, and L. Xiong, “A survey on security aspects for 3gpp 5g networks,”IEEE communications surveys & tutorials, vol. 22, no. 1, pp. 170–195, 2019

    2019

  3. [3]

    Imsi- catch me if you can: Imsi-catcher-catchers,

    A. Dabrowski, N. Pianta, T. Klepp, M. Mulazzani, and E. Weippl, “Imsi- catch me if you can: Imsi-catcher-catchers,” inProceedings of the 30th annual computer security applications Conference, 2014, pp. 246–255

    2014

  4. [4]

    NR; Radio Resource Control (RRC) Protocol Specification,

    3GPP, “NR; Radio Resource Control (RRC) Protocol Specification,” 3rd Generation Partnership Project, Tech. Rep. TS 38.331 V18.1.0,

  5. [5]

    Available: https://www.etsi.org/deliver/etsi ts/138300 138399/138331/18.01.00 60/ts 138331v180100p.pdf

    [Online]. Available: https://www.etsi.org/deliver/etsi ts/138300 138399/138331/18.01.00 60/ts 138331v180100p.pdf

  6. [6]

    Touching the untouchables: Dynamic security analysis of the lte control plane,

    H. Kim, J. Lee, E. Lee, and Y . Kim, “Touching the untouchables: Dynamic security analysis of the lte control plane,” in2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1153–1168

    2019

  7. [7]

    Gotta detect ’em all: Fake base station and multi-step attack detection in cellular networks,

    K. S. Mubasshir, I. Karim, and E. Bertino, “Gotta detect ’em all: Fake base station and multi-step attack detection in cellular networks,” 2025

    2025

  8. [8]

    {DoLTEst}: In-depth downlink negative testing framework for{LTE}devices,

    C. Park, S. Bae, B. Oh, J. Lee, E. Lee, I. Yun, and Y . Kim, “{DoLTEst}: In-depth downlink negative testing framework for{LTE}devices,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 1325–1342

    2022

Show all 59 references
  1. [9]

    Fixing insecure cellular system information broadcasts for good,

    A. J. Ross, B. Reaves, Y . Nasser, G. Cukierman, and R. P. Jover, “Fixing insecure cellular system information broadcasts for good,” inProceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses, 2024, pp. 693–708

    2024

  2. [10]

    Base station certificate and multi-factor authentication for cellular radio control communication security,

    S. Wuthier, J. Kim, I. Kim, and S.-Y . Chang, “Base station certificate and multi-factor authentication for cellular radio control communication security,”arXiv preprint arXiv:2504.02133, 2025

    2025

  3. [11]

    Study on 5G Security Enhancements against False Base Stations (FBS): Certificate Based Solution for Protecting System Information Messages with Digital Signature in an NPN,

    3GPP, “Study on 5G Security Enhancements against False Base Stations (FBS): Certificate Based Solution for Protecting System Information Messages with Digital Signature in an NPN,” 3rd Generation Partnership Project, Tech. Rep. TR 33.809, S3-202717,

  4. [12]

    Available: https://www.3gpp.org/ftp/TSG SA/WG3 Security/TSGS3 100Bis-e/Docs/S3-202717.zip

    [Online]. Available: https://www.3gpp.org/ftp/TSG SA/WG3 Security/TSGS3 100Bis-e/Docs/S3-202717.zip

  5. [13]

    Baron: Base-station authentication through core network for mobility management in 5g networks,

    A. Lotto, V . Singh, B. Ramasubramanian, A. Brighente, M. Conti, and R. Poovendran, “Baron: Base-station authentication through core network for mobility management in 5g networks,” inProceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Network...

    2023

  6. [14]

    Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations,

    A. Singla, R. Behnia, S. R. Hussain, A. Yavuz, and E. Bertino, “Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations,” inProceedings of the 2021 ACM Asia Conference on Computer and Communications Security, 2021, pp. 501–515

    2021

  7. [15]

    Protecting unauthenticated messages in lte/5g mobile networks: A two-level hierarchical identity- based signature (hibs) solution,

    C. Yu, S. Chen, Q. Xing, and Z. Wei, “Protecting unauthenticated messages in lte/5g mobile networks: A two-level hierarchical identity- based signature (hibs) solution,”Computer Networks, vol. 254, p. 110814, 2024

    2024

  8. [16]

    Securing 5g bootstrapping: A two-layer ibs authentication protocol,

    Y . Dong, R. Behnia, A. A. Yavuz, and S. R. Hussain, “Securing 5g bootstrapping: A two-layer ibs authentication protocol,”arXiv preprint arXiv:2502.04915, 2025

    2025

  9. [17]

    5g-hcls: An authentication protocol to protect bootstrapping messages in 5g network,

    Z. Sun and C. Peng, “5g-hcls: An authentication protocol to protect bootstrapping messages in 5g network,” in2025 IEEE Wireless Com- munications and Networking Conference (WCNC). IEEE, 2025, pp. 1–6

    2025

  10. [18]

    The impact of quantum computing on real-world security: A 5g case study,

    C. J. Mitchell, “The impact of quantum computing on real-world security: A 5g case study,”Computers & Security, vol. 93, p. 101825, 2020

    2020

  11. [19]

    Future-proofing authentication against insecure bootstrap- ping for 5g networks: Feasibility, resiliency, and accountability,

    S. Darzi, M. M. Rahman, I. Karim, R. Behnia, A. A. Yavuz, and E. Bertino, “Future-proofing authentication against insecure bootstrap- ping for 5g networks: Feasibility, resiliency, and accountability,”arXiv preprint arXiv:2510.23457, 2025

    2025 arXiv

  12. [20]

    Post-Quantum Cryptography Standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA),

    NIST, “Post-Quantum Cryptography Standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA),” National Institute of Stan- dards and Technology, Tech. Rep. FIPS 203/204/205, 2024. [Online]. Available: https://csrc.nist.gov/projects/post-quantum-cryptography

    2024

  13. [21]

    Cyber Security (CYBER); Quantum-Safe Cryptography (QSC); Efficient Quantum-Safe Hybrid Key Exchanges with Hidden Access Policies,

    ETSI, “Cyber Security (CYBER); Quantum-Safe Cryptography (QSC); Efficient Quantum-Safe Hybrid Key Exchanges with Hidden Access Policies,” European Telecommunications Standards Institute, Tech. Rep. TS 104 015 V1.1.1, 2024. [Online]. Available: https://www.etsi.org/deliver/etsi...

    2024

  14. [22]

    Quantum-Readiness: Migration to Post-Quantum Cryptography,

    NSA, CISA, and NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography,” Cybersecurity and In- frastructure Security Agency, Tech. Rep., 2025. [On- line]. Available: https://www.cisa.gov/resources-tools/resources/ quantum-readiness-migration-post-quantum-cryptography

    2025

  15. [23]

    Framework and Overall Objectives of the Future Development of IMT for 2030 and Beyond,

    ITU-R, “Framework and Overall Objectives of the Future Development of IMT for 2030 and Beyond,” International Telecommunication Union, Tech. Rep. Recommendation ITU-R M.2160-0, 2023. [Online]. Available: https://www.itu.int/rec/R-REC-M.2160/en

  16. [24]

    Embedded SIM Remote Provisioning Architecture,

    GSMA, “Embedded SIM Remote Provisioning Architecture,” GSM Association, Tech. Rep. SGP.02 V4.2, 2020. [Online]. Available: https://www.gsma.com/solutions-and-impact/technologies/ esim/wp-content/uploads/2020/07/SGP.02-v4.2.pdf

    2020

  17. [25]

    RSP Technical Specification,

    ——, “RSP Technical Specification,” GSM Associa- tion, Tech. Rep. SGP.22 V3.1, 2023. [Online]. Avail- able: https://www.gsma.com/solutions-and-impact/technologies/esim/ wp-content/uploads/2023/05/SGP.22-v3.1.pdf

    2023

  18. [26]

    Efficient authentication and signing of multicast streams over lossy channels,

    A. Perrig, R. Canetti, J. D. Tygar, and D. Song, “Efficient authentication and signing of multicast streams over lossy channels,” inProceeding 2000 IEEE symposium on security and privacy. S&P 2000. IEEE, 2000, pp. 56–73

    2000

  19. [27]

    Mayo: Practical post-quantum signatures from oiland- vinegar maps,

    W. Beullens, “Mayo: Practical post-quantum signatures from oiland- vinegar maps,” inInternational Conference on Selected Areas in Cryp- tography, pp. 355–376

  20. [28]

    Efficient signature generation by smart cards,

    C.-P. Schnorr, “Efficient signature generation by smart cards,”Journal of cryptology, vol. 4, pp. 161–174, 1991

    1991

  21. [29]

    Falcon: Fast-fourier lattice-based compact signatures over ntru,

    P.-A. Fouque, J. Hoffstein, P. Kirchner, V . Lyubashevsky, T. Pornin, T. Prest, T. Ricosset, G. Seiler, W. Whyte, Z. Zhanget al., “Falcon: Fast-fourier lattice-based compact signatures over ntru,”Submission to the NIST’s post-quantum cryptography standardization process, vol. ...

    2018

  22. [30]

    Module-lattice-based digital signature standard,

    T. Dang, J. Lichtinger, Y .-K. Liu, C. Miller, D. Moody, R. Peralta, R. Perlner, A. Robinsonet al., “Module-lattice-based digital signature standard,”National Institute of Standards and Technology (NIST), Thinh Dang, Jacob, 2024

    2024

  23. [31]

    Comprehensive survey on self-organizing cellular network approaches applied to 5g networks,

    H. Fourati, R. Maaloul, L. Chaari, and M. Jmaiel, “Comprehensive survey on self-organizing cellular network approaches applied to 5g networks,”Computer Networks, vol. 199, p. 108435, 2021. [30]3GPP RRC Specification, 2024, https://www.etsi.org/deliver/etsi ts/ 138300 138399/13...

    2021

  24. [32]

    Keying hash functions for message authentication,

    M. Bellare, R. Canetti, and H. Krawczyk, “Keying hash functions for message authentication,” inAnnual international cryptology conference. Springer, 1996, pp. 1–15. [32]3GPP Specification on Security architecture and procedures for 5G Sys- tem, 2024, https://www.etsi.org/deliv...

    1996

  25. [33]

    Algorithms for quantum computation: discrete logarithms and factoring,

    P. W. Shor, “Algorithms for quantum computation: discrete logarithms and factoring,” in35th annual symp. on found. of CS. Ieee, 1994

    1994

  26. [34]

    Stateless hash-based digital signature standard,

    D. Cooperet al., “Stateless hash-based digital signature standard,” 2024

    2024

  27. [35]

    D. Soni, K. Basu, M. Nabeel, N. Aaraj, M. Manzano, and R. Karri, “Falcon,”Hardware Architectures for Post-Quantum Digital Signature Schemes, pp. 31–41, 2021

    2021

  28. [36]

    Additional Digital Signature Schemes – Round 2 Submissions,

    NIST, “Additional Digital Signature Schemes – Round 2 Submissions,” National Institute of Standards and Technology, Post-Quantum Cryptography Standardization, 2024. [Online]. Available: https://csrc. nist.gov/Projects/pqc-dig-sig/round-2-additional-signatures

    2024

  29. [37]

    Gotta detect’em all: Fake base station and multi-step attack detection in cellular networks,

    K. S. Mubasshir, I. Karim, and E. Bertino, “Gotta detect’em all: Fake base station and multi-step attack detection in cellular networks,” in Proceedings of the 34th USENIX Security Symposium, 2025

    2025

  30. [38]

    Breaking lte on layer two,

    D. Rupprecht, K. Kohls, T. Holz, and C. P ¨opper, “Breaking lte on layer two,” in2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1121–1136

    2019

  31. [39]

    Envisioning the future of cyber security in post-quantum era: A survey on pq standardization, applications, challenges and opportunities,

    S. Darzi, K. Ahmadi, S. Aghapour, A. A. Yavuz, and M. M. Kermani, “Envisioning the future of cyber security in post-quantum era: A survey on pq standardization, applications, challenges and opportunities,”arXiv preprint arXiv:2310.12037, 2023

    2023

  32. [40]

    Enhancing the 5g-aka protocol with post-quantum digital signature method,

    G. Rossi Figlarz and F. Passuelo Hessel, “Enhancing the 5g-aka protocol with post-quantum digital signature method,” inInternational Confer- ence on Advanced Information Networking and Applications. Springer, 2024, pp. 99–110

    2024

  33. [41]

    A beyond-5g authentication and key agreement protocol,

    M. T. Damir, T. Meskanen, S. Ramezanian, and V . Niemi, “A beyond-5g authentication and key agreement protocol,” inInternational Conference on Network and System Security. Springer, 2022, pp. 249–264

    2022

  34. [42]

    A practical transition to post-quantum security in 5g-aka,

    A. Braeken, A. K. Yadav, and J. Munilla, “A practical transition to post-quantum security in 5g-aka,”IEEE Transactions on Information Forensics and Security, vol. 20, pp. 13 071–13 084, 2025

    2025

  35. [43]

    On post-quantum identification in 5g,

    M. T. Damir and V . Niemi, “On post-quantum identification in 5g,” in Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks, ser. WiSec ’22. New York, NY , USA: Association for Computing Machinery, 2022, p. 292–294. [Online]. Available:...

    2022 doi

  36. [44]

    NR; Base Station (BS) Radio Transmission and Reception,

    3GPP, “NR; Base Station (BS) Radio Transmission and Reception,” 3rd Generation Partnership Project, Tech. Rep. TS 38.104 V17.9.0,

  37. [45]

    [Online]. Available: https://www.etsi.org/deliver/etsi ts/138100 138199/138104/17.09.00 60/ts 138104v170900p.pdf [46]Network Signal Guru User Manual, https://m.qtrun.com/docs/NSG Manual Aug 2017.pdf

    2017

  38. [46]

    Status report on the third round of the nist post-quantum cryptography standardization process,

    G. Alagic, D. Apon, D. Cooper, Q. Dang, T. Dang, J. Kelsey, J. Lichtinger, Y .-K. Liu, C. Milleret al., “Status report on the third round of the nist post-quantum cryptography standardization process,” 2022

    2022

  39. [47]

    Short signatures from the weil pairing,

    D. Boneh, B. Lynn, and H. Shacham, “Short signatures from the weil pairing,” inInternational conference on the theory and application of cryptology and information security. Springer, 2001, pp. 514–532

    2001

  40. [48]

    Powder: Platform for open wireless data-driven experimental research,

    J. Breen, A. Buffmire, J. Duerig, K. Dutt, E. Eide, A. Ghosh, M. Hibler, D. Johnson, S. K. Kasera, E. Lewis, D. Maas, C. Martin, A. Orange, N. Patwari, D. Reading, R. Ricci, D. Schurig, L. B. Stoller, A. Todd, J. Van der Merwe, N. Viswanathan, K. Webb, and G. Wong, “Powder: Pl...

    2021

  41. [49]

    An extended certificate-based authentication and security protocol for mobile networks,

    C.-C. Lee, I.-E. Liao, and M.-S. Hwang, “An extended certificate-based authentication and security protocol for mobile networks,”Information Technology and Control, vol. 38, no. 1, 2009

    2009

  42. [50]

    An authentication and security protocol for mobile com- puting,

    Y . Zheng, “An authentication and security protocol for mobile com- puting,” inMobile Communications: Technology, tools, applications, authentication and security IFIP World Conference on Mobile Commu- nications 2–6 September 1996, Canberra, Australia. Springer, 1996, pp. 249–257

    1996

  43. [51]

    On evaluating delegated digital signing of broadcasting messages in 5g,

    H. Gao, Y . Zhang, T. Wan, J. Zhang, and H. Duan, “On evaluating delegated digital signing of broadcasting messages in 5g,” in2021 IEEE global communications conference (GLOBECOM). IEEE, 2021, pp. 1– 7

    2021

  44. [52]

    Fake base station detection and blacklisting,

    S. Wuthier, J. Kim, J. Kim, and S.-Y . Chang, “Fake base station detection and blacklisting,” in2024 33rd International Conference on Computer Communications and Networks (ICCCN). IEEE, 2024, pp. 1–9

    2024

  45. [53]

    Post-quantum lattice-based forward-secure authentication scheme using fog computing in 5g-assisted vehicular networks,

    Z. G. Al-Mekhlafi, M. A. Al-Shareeda, B. A. Mohammed, A. A. Alsadhan, A. Khalil, A. M. Alayba, A. M. S. Saleh, H. A. Al- reshidi, and K. Almekhlafi, “Post-quantum lattice-based forward-secure authentication scheme using fog computing in 5g-assisted vehicular networks,” 2024

    2024

  46. [54]

    Identity-based signature with server-aided verification scheme for 5g mobile systems,

    M. Ramadan, Y . Liao, F. Li, and S. Zhou, “Identity-based signature with server-aided verification scheme for 5g mobile systems,”IEEE Access, vol. 8, pp. 51 810–51 820, 2020

    2020

  47. [55]

    Fast verification of on- line/offline threshold signatures for 5g iot,

    B. Sengupta and A. Lakshminarayanan, “Fast verification of on- line/offline threshold signatures for 5g iot,” in2024 IEEE International Conference on Advanced Networks and Telecommunications Systems (ANTS). IEEE, 2024, pp. 1–6

    2024

  48. [56]

    Post-quantum secure hybrid methods for ue primary authentication in 6g with forward secrecy,

    R. C. Vuppala, D. Kumar, D. Je, N. Sharma, A. Nigam, and D. Kim, “Post-quantum secure hybrid methods for ue primary authentication in 6g with forward secrecy,” inGLOBECOM 2023-2023 IEEE Global Communications Conference. IEEE, 2023, pp. 2590–2595

    2023

  49. [57]

    5g-aka-hpqc: Hybrid post-quantum cryptography protocol for quantum-resilient 5g primary authentication with forward secrecy,

    Y . Ko, I. Pawana, and I. You, “5g-aka-hpqc: Hybrid post-quantum cryptography protocol for quantum-resilient 5g primary authentication with forward secrecy,”arXiv preprint arXiv:2502.02851, 2025

    2025

  50. [58]

    An applied analysis of securing 5g/6g core networks with post-quantum key encapsulation methods,

    P. Scalise, R. Garcia, M. Boeding, M. Hempel, and H. Sharif, “An applied analysis of securing 5g/6g core networks with post-quantum key encapsulation methods,”Electronics, vol. 13, no. 21, p. 4258, 2024

    2024

  51. [59]

    Post-quantum cryptography in the 5g core,

    T. Attema, B. de Kock, S. M. Jayaprakash, D. Schoinianakis, T. Si- jpesteijn, and R. van de Vlasakker, “Post-quantum cryptography in the 5g core,”arXiv preprint arXiv:2512.20243, 2025. APPENDIXA SECURITYPROOFS We present the full proofs of Lemmas 1–3 and Theorem 1. Each lemma ...

    2025

Pith tools

Reviewed June 30, 2026 · model on record in the stance chip above.