# 5G-AKA-FS: A 5G Authentication and Key Agreement Protocol for Forward Secrecy
## 2 Related Works  
3 GPP has defined two AKA protocols, namely 5G-AKA and Extensible Authentication Protocol (EAP)-AKA\({}^{\prime}\), for primary authentication in 5G networks. The purpose of the AKA protocols is to establish mutual authentication between the UE and the HN. In 2G to 4G networks, UE's identifier IMSI is publicly exposed, thus resulting in privacy issues. However, in 5G-AKA, the subscriber identity information, known as SUPI, is encrypted into SUCI, which is then used for authentication while solving the privacy problem. **5G-AKA** enhances authentication and key exchange in addition to introducing subscriber identity protection (e.g., SUCI) for privacy. However, as it is developed based on EPS-AKA, it inherits existing security vulnerabilities. Ref. [15] conducted a formal verification and analysis of the 5G-AKA protocol using the Mixed Strand Space model, revealing vulnerabilities within the protocol. Their study also presented 21 attack scenarios specific to 5G-AKA and highlighted security features not supported by 5G-AKA. Furthermore, ref. [17] identified shortcomings, such as the lack of support for forward secrecy through an analysis of 5G-AKA. In this regard, improved protocols, including [3; 16; 17; 20; 21], have been proposed to address such vulnerabilities in 5G-AKA. **SUCI-AKA**, proposed by [20], aims to achieve forward secrecy for the anchor key \(K_{SEAF}\). For this goal, when generating the master session key \(K_{AUSF}\), the protocol reuses the shared key \(k_{HN}\), which is exchanged through ECIES to encrypt SUPI. In more details, the sequence number \(SQN\) is replaced with \(k_{HN}\) during the generation of \(K_{AUSF}\). Such an approach enhances the security of the anchor and sub-session keys derived from \(K_{AUSF}\) while still allowing the UE to verify if the received messages and their message authentication code (MAC) are fresh. However, SUCI-AKA can not support forward secrecy because the anchor key \(K_{SEAF}\) is compromised when the long-term key \(k\), shared between the UE and the HN, and the HN's private key \(sk_{HN}\) are leaked. **5G-IPAKA**, proposed by [17], aims to provide mutual authentication between the UE and the SN, enhanced security for the anchor key and authentication vector (AV), and key confirmation. This protocol tries to provide forward secrecy by applying the ECIES secret \(k_{HN}\) to generate the anchor key \(K_{SEAF}\), from which sub-sessions keys are then derived. Moreover, it lets the HN send \(K_{SEAF}\) to the SN before the UE authentication. In this way, 5G-IPAKA enables the UE to authenticate the SN by verifying the SN's message authentication code computed with \(K_{SEAF}\) in addition to the HN. Similar to this, the UE is authenticated to the SN through its message authentication code. As a result, 5G-IPAKA achieves mutual authentication between the SN and the UE and between the HN and the UE while supporting key confirmation. However, if \(k\) and \(sk_{HN}\) are leaked, an attacker can reconstruct the anchor key \(K_{SEAF}\) for malicious purposes while breaking forward secrecy. Furthermore, active attacks by malicious SNs are also possible since the HN delivers \(K_{SEAF}\) to the SN without authenticating the UE. Finally, this protocol leads to compatibility issues with Subscriber Identity Modules (SIMs) by proposing a structure that deviates from the existing standard specification. **5 GAKA-LCCO**, proposed by [21], aims to improve high communication and computation overheads as well as address SUCI replay attacks present in 5G-IPAKA. In this protocol, the SN first creates the random number and timestamp \(RAND_{SN}\) and \(T_{SN}\), and sends to the UE these values, which are then applied to generate the key block with the long-term shared key \(k\) and the ECIES secret \(k_{HN}\). Note that the generated key block is not only used to compute the UE's SUCI but also to authenticate the UE to the HN.