At its September 2026 plenary (TSG SA#113), 3GPP approved changes to TR 33.703, its study on transitioning to post-quantum cryptography. The changes record that two IETF drafts the study relied on are now published standards: RFC 9954 on hybrid key exchange in TLS 1.3, and RFC 9964 on ML-DSA signatures for JOSE and COSE.
The update is small, but it marks a change of phase. TR 33.703 was approved in June 2026 at SA#112 as version 20.0.0 and is now under change control. The study had started in June 2025 at SA#108 in Prague and was drafted over six SA3 meetings. Its rapporteurs were Zhongding Lei of Huawei and Virendra Kumar of Qualcomm. A follow-up normative work item, PQCMigration_Ph1-SEC (SP-260663), now targets TS 33.210 and TS 33.310. TS 33.210 holds 3GPP's cryptographic profiles for TLS, IKEv2 and IPsec. TS 33.310 governs certificates and PKI between network elements.
The problem is well defined. Every protocol in 5G that uses traditional public-key cryptography (RSA, Diffie-Hellman, elliptic curves) could be broken by a cryptographically relevant quantum computer. The groundwork was TR 33.938, a cryptographic inventory of 5G Standalone. It lists where asymmetric cryptography appears: TLS and DTLS on service-based interfaces, IKEv2 and IPsec on N2, N3, Xn, F1 and E1, JWE and JWS in OAuth 2.0, the certificate infrastructure, ECIES in subscriber identity concealment, and MIKEY-SAKKE in mission-critical services. TR 33.703 takes that list and asks what each entry needs.
For most of these protocols, 3GPP does not own the fix. TLS, IKEv2, JOSE and COSE are IETF protocols, and 3GPP's job is to update its profiles once the IETF has finished its work. The study therefore tracks IETF documents by maturity level (individual draft, working group draft, RFC) and gives priority to mature ones. That explains the September changes: two items the study had listed as drafts are now RFCs.
TLS 1.3 is the most advanced case. It has been mandatory for core network nodes since Release 15 and for all nodes since Release 16. The study notes that the IETF generally recommends hybrid key exchange. The hybrid X25519MLKEM768 combines classical X25519 with the post-quantum ML-KEM and is already the default in OpenSSL. The study cites an external report that more than 40 percent of HTTPS client requests already use it. The study is blunt about TLS 1.2. Since Release 16, any TLS 1.2 session in a 3GPP network implies that at least one node is non-compliant, so the study expects TLS 1.2 to have been phased out of 5G already. It does not plan a post-quantum path for it.
The harder cases are protocols 3GPP defines itself or that no one else is likely to update. The WID names two explicitly: SUCI calculation and MIKEY-SAKKE. SUCI (Subscription Concealed Identifier) is how a phone hides its permanent subscriber identity when it attaches to a network. The phone uses ECIES to encrypt the identity to the home network's public key. Current profiles use X25519 or secp256r1, where the ephemeral public key is 32 or 33 bytes. The study collects 23 candidate solutions in six groups: standalone schemes that replace ECDH with a post-quantum KEM such as ML-KEM; hybrid schemes that combine ML-KEM and ECDH through a KEM combiner; nested schemes that encrypt twice, once with each method; schemes that avoid asymmetric cryptography through pre-shared symmetric keys; two solutions based on quantum channels; and one profile-selection mechanism.
Size is the constraint that runs through all of this. An ML-KEM-768 ciphertext is 1,088 bytes and its public key is 1,184 bytes, where the elliptic-curve values used today take 32 bytes. For SUCI this affects what the USIM can store and whether the calculation runs on the USIM or in the handset. It also affects how the larger identifier fits into registration messages, and how old and new devices coexist while the network supports both. Post-quantum signatures bring a similar problem to certificates and IKEv2 authentication. That is why the study separately assesses lattice-based and hash-based signature classes, and why it maps 3GPP procedures to NIST security levels I to V.
The study's general assumptions allow for cases with no suitable post-quantum option. Where that happens, 3GPP must choose and justify another route: deprecation, mitigation or re-architecting the procedure. The first normative phase covers the IETF-derived profiles in TS 33.210 and TS 33.310. Choosing among the SUCI candidates and deciding what happens to MIKEY-SAKKE are still open questions.
3GPP has been working towards this point for a while. TR 33.841, a Release 16 study, examined the quantum threat to 5G and concluded that no approved quantum-safe replacements for its asymmetric algorithms existed at the time. It recommended keeping protocols extensible, so that a post-quantum KEM could later be added as a new SUPI encryption profile without redesigning the mechanism. That work also led to the 256-bit symmetric algorithms that 3GPP has since specified. Those algorithms answer the smaller threat quantum computing poses to symmetric keys.
The study was backed by 29 organisations. They include equipment vendors (Nokia, Ericsson, Huawei, Cisco, Thales), operators (Deutsche Telekom, AT&T, Orange, Telefonica, KDDI), chip and device makers (Qualcomm, Intel, Apple, Samsung) and government bodies: Germany's BSI and economy ministry, the US NIST and the UK's DSIT. National agencies in the list are a reminder that government migration deadlines are driving the timetable. The UK's NCSC, cited in the WID, sets 2035 as the target for completing migration.