# 5G-AKA-FS: A 5G Authentication and Key Agreement Protocol for Forward Secrecy
## 2 Related Works
### Elliptic Curve Integrated Encryption Scheme  
The Elliptic Curve Integrated Encryption Scheme (ECIES) [24; 25] is a well-known hybrid encryption scheme consisting of a Key Encapsulation Mechanism (KEM) and a Data Encapsulation Mechanism (DEM) where messages of arbitrary length can be encrypted. This scheme is a key component of 5G-AKA.  
The ECIES-KEM has the following three algorithms:  
\begin{table}
\begin{tabular}{l c} \hline \hline \multicolumn{2}{c}{**Meanings**} \\ \hline HN & Home Network \\ UE (ME, SIM) & User Equipment (Mobile Equipment, Subscriber Identity Modules) \\ SN & Serving Network \\ SUPI & SUDiscriber Permanent Identifier \\ SUCI & SUDiscriber Concealed Identifier \\ KEM & Key Encapsulation Mechanism \\ DEM & Data Encapsulation Mechanism \\ AMF & Access Management Function \\ AUSF & Authentication Server Function \\ SEAF & SEurity Anchor Function \\ \(k\) & A permanent key shared between UE and HN \\ \(K_{AUSF}\) & A master session key derived from 5G-AKA-FS \\ \(K_{SEAF}\) & An anchor key derived from 5G-AKA-FS \\ \(k_{UE}\) & UE’s shared key established by ECIES-KEM \\ \(k_{HN}\) & HN’s shared key established by ECIES-KEM \\ \((PK_{HN},sk_{HN})\) & HN’s ECIES public-private key pair where \(PK_{HN}=sk_{HN}\cdot G\) \\ \(1D_{SN}\) & Unique identifier of SN \\ \(ID_{HN}\) & Unique identifier of HN \\ \(SQN_{UE}\) & UE’s sequence number \\ \(SQN_{HN}\) & HN’s sequence number \\ \(RAND\) & HN’s challenge message \\ AUTH & Mutual AUTHentiation \\ SKE & Secure Key Exchange \\ LUCS & Legacy USIM Compatibility Support \\ LBA & LinkaBility Attack \\ AMS & Active attack by Malicious SN \\ FS & Forward Secrecy \\ \hline \hline \end{tabular}
\end{table}
Table 1: Abbreviations and notations.  
* \(\mathbf{KeyGen}(pp)\): On input of a public parameter \(pp\), the algorithm outputs a public-private key pair \((PK,sk)\) such that \(PK=sk\cdot G\), where \(pp\) is an elliptic curve parameter standardized in secp256r1[26], and \(G\in pp\) is a base point.
* \(\mathbf{Encap}(PK)\): On input of a public key \(PK\), the algorithm generates an ephemeral public-private key pair \((R,r)\) such that \(R=r\cdot G\), and then outputs a ciphertext \(C_{0}=R\) and a shared key \(k_{s}=\mathsf{KDF}(r\cdot PK)\), where \(\mathsf{KDF}\) is a key derivation function.
* \(\mathbf{Decap}(sk,C_{0})\): On input of a ciphertext \(C_{0}\) and a private key \(sk\), the algorithm outputs the shared key \(k_{s}=\mathsf{KDF}(sk\cdot C_{0})\). The ECIES-DEM has the following two algorithms:
* \(\mathbf{SEnc}(k_{s},M)\): On input of a key \(k_{s}\) and a message \(M\), the algorithm first parses \(k_{s}\) as \(k_{1}||k_{2}\), computes \(C_{1}=\mathsf{ENC}(k_{1},M)\) and \(C_{2}=\mathsf{MAC}(k_{2},C_{1})\), and then outputs \((C_{1},C_{2})\), where \(\mathsf{ENC}\) is an encryption part of a symmetric encryption scheme and \(\mathsf{MAC}\) is a message authentication code.
* \(\mathbf{SDec}(k_{s},(C_{1},C_{2}))\): On input of a ciphertext \((C_{1},C_{2})\) and a key \(k_{s}\), the algorithm first parses \(k_{s}\) as \(k_{1}||k_{2}\). If \(C_{2}\
eq\mathsf{MAC}(k_{2},C_{1})\), it outputs \(\bot\). Otherwise, the algorithm outputs \(M=\mathsf{DEC}(k_{1},C_{1})\), where \(\mathsf{DEC}\) is a decryption part of a symmetric encryption scheme.