# 5G-Compliant Authentication Protocol for RFID
## 2 Security Architecture and Procedures for 5G and Threat Model
### The 5G Authentication and Key Agreement Protocol, 5G-AKA  
A primary authentication is compulsory for all the devices, regardless of the service or network access these require (agnostic access network). The purpose of this primary authentication and key agreement procedure is to enable mutual authentication between the UE and the network and provide keying material (\(K_{SEAF}\)) that can be used between UE and SN. A secondary authentication is also possible in 5G, but is optional. This is intended for authenticated access to services provided over 5G; e.g., access to corporate data, and is beyond the scope of this paper (for more information consult [2]). Moreover, 3 GPP proposes two AKA protocols in the standard to be used for primary authentication: EAP-AKA and 5G-AKA. This paper focuses on the most recent one: 5G-AKA. EAP is  
Figure 1: Here: 5G architecture and the main elements involved in the security procedures. very similar but uses slightly different flows and key derivation. For more details, we refer the reader to [3] and Subclause 6.1.3.1 of [2]. Before describing the specific messages exchanged in 5G-AKA, we discuss its main aspects:  
* Shared cryptographic material. HN and UE (USIM) share a long-term symmetric key \(K\). All the UEs belonging to that HN also store the public key \(pk_{HN}\) of HN, while HN stores the corresponding secret key \(sk_{HN}\). * Sequence numbers. UE and HN share a loosely-synchronized sequence number \(SQ\): UE stores \(SQ_{UE}\), while HN stores \(SQ_{HN}\). These are checked during the authentication procedure to prevent replay attacks. * Cryptographic functions. The 3 GPP architecture defines a key derivation function \(KDF\), and seven cryptographic functions, \(f1\), \(f1^{*}\), \(f2\), \(f3\), \(f4\), \(f5\) and \(f5^{*}\)[4]: the first three are message authentication functions, while the last four are key derivation functions. These are one-way keyed functions that should be practically indistinguishable from independent random functions. In particular: (i) knowledge of the values of one function on a fairly large number of given inputs should not enable its values to be predicted on other inputs; (ii) outputs from any one function should not be predictable from those of the other functions (on the same or other inputs); (iii) it should be infeasible to determine any part of the secret key, by manipulation of the inputs and examination of the outputs of the algorithm. These requirements are broadly captured by pseudo-random functions (PRF) and pairwise independence (Section 19.3.2.2, p. 19 [5]), and in particular jointly PRFs [6]. Informally, the PRFs \(hi:\{0,1\}^{n}\times\{0,1\}^{s_{1}}\rightarrow\{0,1\}^{t_{i}}\), \(i=1,\ldots,m\), are jointly PRFs if for any key \(k\in\{0,1\}^{n}\), the output of \((h1(k,\cdot),\ldots,hm(k,\cdot))\) is practically indistinguishable from the output of \((g_{1}(\cdot),\ldots,g_{m}(\cdot))\), on the same input, where \(g_{i}:\{0,1\}^{s_{i}}\rightarrow\{0,1\}^{t_{i}}\), \(i=1,\ldots,m\), are functions drawn uniformly from the set of all functions from \(\{0,1\}^{s_{i}}\) to \(\{0,1\}^{t_{i}}\). Finally, the KDF is used to derive the keys for secure communication. It is specified in [7], as a keyed hash function based on SHA256 [8]. * The MILENAGE algorithms [5]. Although the implementation of \(f1\)-\(f5\) and \(f1^{*}\), \(f5^{*}\) is proprietary and not standardized, the 3 GPP security working group has developed an example algorithm set for these authentication and key generation functions. This uses a 128-bit blockcipher (AES-128) as a kernel function. The seven functions \(f1\)-\(f5\) and \(f1^{*}\),-\(f5^{*}\) are constructed by invoking the kernel function and using circular shifts \(r_{1},\ldots,r_{5}\) and xor-ing constants \(c_{1},\ldots,c_{5}\), selected appropriately to ensure separation (independence). Furthermore, \(f1\) and \(f1^{*}\) use a CBC MAC structure, while the others use double encryption in counter mode. * Identifiers.