A method comprising: in a home network of a communication system, provisioning one or more cryptographic key pairs for utilization by subscribers of the home network to conceal subscriber identifiers provided to one or more access points in the communication system; and managing the one or more cryptographic key pairs utilizing an element or function in the home network of the communication system, wherein managing the one or more cryptographic key pairs comprises: receiving one or more requests for subscriber identifier decryption related to one or more of the cryptographic key pairs, wherein each of the one or more requests comprises an encrypted subscriber identifier and a cryptographic key pair identifier identifying a cryptographic key pair used to encrypt the subscriber identifier; determining a validity of a given cryptographic key pair identified by the cryptographic key pair identifier for each respective request; decrypting the encrypted subscriber identifier based on the determining, wherein the decrypting is performed utilizing a private key associated with the cryptographic key pair identifier for each respective request; and providing a response comprising a decrypted subscriber identifier to each respective request based on the determining and the decrypting, wherein at least one of the responses comprises information related to one or more updates for one or more cryptographic key pairs. in a home network of a communication system, provisioning one or more cryptographic key pairs for utilization by subscribers of the home network to conceal subscriber identifiers provided to one or more access points in the communication system; and managing the one or more cryptographic key pairs utilizing an element or function in the home network of the communication system, wherein managing the one or more cryptographic key pairs comprises: receiving one or more requests for subscriber identifier decryption related to one or more of the cryptographic key pairs, wherein each of the one or more requests comprises an encrypted subscriber identifier and a cryptographic key pair identifier identifying a cryptographic key pair used to encrypt the subscriber identifier; determining a validity of a given cryptographic key pair identified by the cryptographic key pair identifier for each respective request; decrypting the encrypted subscriber identifier based on the determining, wherein the decrypting is performed utilizing a private key associated with the cryptographic key pair identifier for each respective request; and providing a response comprising a decrypted subscriber identifier to each respective request based on the determining and the decrypting, wherein at least one of the responses comprises information related to one or more updates for one or more cryptographic key pairs. receiving one or more requests for subscriber identifier decryption related to one or more of the cryptographic key pairs, wherein each of the one or more requests comprises an encrypted subscriber identifier and a cryptographic key pair identifier identifying a cryptographic key pair used to encrypt the subscriber identifier; determining a validity of a given cryptographic key pair identified by the cryptographic key pair identifier for each respective request; decrypting the encrypted subscriber identifier based on the determining, wherein the decrypting is performed utilizing a private key associated with the cryptographic key pair identifier for each respective request; and providing a response comprising a decrypted subscriber identifier to each respective request based on the determining and the decrypting, wherein at least one of the responses comprises information related to one or more updates for one or more cryptographic key pairs. <EOS>