Subject: [hrpc] Some follow up from the 5G presentation today

From: John Mattsson <[email-masked]>
Date: Wed, 23 Mar 2022 12:35:17 +0000

Hi,

Some requested follow up from the 5G presentation today.

- 3GPP TSG SA WG3 (SA3) is responsible for defining the requirements and specifying the architectures and protocols for security and privacy in 3GPP systems. SA3-LI is formally a subworking group of SA3 but functions as a separate working group with different participants.

https://www.3gpp.org/specifications-groups/sa-plenary/sa3-security

Here you can find specifications, work items, and meeting documents. Meeting document contains all contributions (also not approved) and meeting reports ordered by meeting.

- If you are looking for the companies that objected to introduce forward secrecy in 5G-AKA, that can be found here under "New KI: Existing authentication procedure lacking the PFS property".
https://www.3gpp.org/ftp/tsg_sa/WG3_Security/TSGS3_97_Reno/Report/MeetingReport__SA3_97.docx

I find the lack of forward secrecy in 5G-AKA unacceptable from both a security and privacy perspective. The more this topic is highlighted and discussed, the better.

- Mail achieves for all 3GPP email lists can be found here:
https://list.etsi.org/scripts/wa.exe?INDEX
https://list.etsi.org/scripts/wa.exe?A0=3GPP_TSG_SA_WG3

- There is unfortunately no easy way to find out which mechanisms are actually used in different mobile network. If someone want to do the work, a good start would be to check and document the use of IMSI encryption in 5G in networks around the world. (SUCI can optionally use the NULL encryption algorithm).

- Regarding IETF, I think IETF needs to be better at marking everything not following best practice as "NOT RECOMMENDED" even if used by certain industries. I think there are many candidates for this is almost all areas and groups of the IETF.

- As I said feel free to contact me for any discussion on mobile network security and privacy, or the use of Diffie-Hellman in general.

Cheers,
John