# Post-Quantum Key Exchange and Subscriber Identity Encryption in 5G Using ML-KEM (Kyber) 1
## 2 Motivation and Background  
### Motivation: PQC Transition  
Public-key ciphers are vulnerable to quantum computers due to the challenges posed by prime factorization and discrete logarithms. In 1994, [PERSON] introduced quantum algorithms for prime factorization [4], while [PERSON]'s algorithm [8] significantly accelerates key searches. The combined impact of [PERSON]'s and [PERSON]'s algorithms compromises the security of current cryptographic systems, as demonstrated in Table 1.  
In October 2023, IBM announced the development of the latest quantum computer, with a processor containing over 1000 qubits [9]. [PERSON] et al. [10] have shown that calculating the elliptic curve discrete logarithm on a quantum computer requires a considerably smaller number of quantum bits (qubits) compared to addressing the integer factorization problem. While breaking RSA-2048 would necessitate millions of qubits, which is still years away, the urgency for considering quantum attacks arises from several factors: the compatibility of PQC with classical computers, the uncertainty surrounding the development of quantum computers globally, the security of PQC ciphers against both quantum and classical attacks, and government agencies taking early steps to use PQC for better security.  
The National Institute of Standards and Technology (NIST) introduced post-quantum cryptographic algorithms in 2016 to address quantum resistance issues; the timeline of PQC is shown in Figure 1. In late 2017, 82 candidate ciphers were submitted for review, and in December of the same year, 69 algorithms were selected in the first round based on meeting the minimum suitability criteria. By January 2019, NIST advanced 26 ciphers to the second round, based on internal analysis, theoretical security assessments, and public feedback. By July 2020, 15 ciphers were chosen for round 3 and categorized into finalized and alternative groups based on factors such as performance, computational cost, data transfer cost, and implementation feasibility.  
After a comprehensive evaluation across multiple rounds, NIST identified four candidate ciphers for potential standardization in July 2022. These include one PKE/KEM, namely CRYSTALS-Kyber, and three digital signatures (DSs), namely CRYSTALS-Dilithium, FALCON, and SPHINCS+, all originating from the third round. PKE/KEM is employed to ensure message confidentiality, while DSs are used to ensure message integrity.  
NIST conducted a thorough analysis of the security strengths of post-quantum ciphers and compared the brute-force difficulty with pre-quantum ciphers. Table 1 outlines the pre-quantum security levels of symmetric (AES) and public-key ciphers, including RSA and elliptic curve (EC) algorithms, in 128-bit, 192-bit, and 256-bit security contexts. It contrasts these with the Kyber family of post-quantum cryptographic schemes, specifically  
Figure 1: NIST PQC standardization process: from call to standards. The blue-colored processes represent the rounds for announcing the candidate PQC algorithms, and the black-colored processes represent other events, such as calls for candidates, calls for feedback, conferences, and standardization.  
Kyber-512, Kyber-768, and Kyber-1024. The table demonstrates that Kyber-512 offers 128-bit security equivalent to EC-256 (including algorithms like X25519 and secp256r1). Furthermore, it highlights the vulnerability of traditional public-key algorithms to quantum attacks, notably [PERSON]'s algorithm, whereas Kyber-512 remains secure against quantum threats due to its reliance on different mathematical hard problems.  
We utilize NIST security-level analyses to ensure fairness in our comparison study, selecting ciphers of the same security levels for comparison purposes.