Additional Authentication Data

Description

Additional Authentication Data (AAD) is a fundamental concept in authenticated encryption with associated data (AEAD) schemes, which are used extensively in 5G security protocols. AAD refers to data that is not encrypted but is authenticated along with the ciphertext to ensure its integrity and authenticity. In 3GPP specifications, AAD is used in various security contexts, such as in the protection of signalling messages, user plane data, and non-access stratum (NAS) messages. The AAD is input to the AEAD algorithm along with the plaintext and a nonce, and the resulting authentication tag covers both the ciphertext and the AAD. This ensures that any tampering with the AAD is detected during decryption.

In 5G, AAD is employed in protocols like the Packet Data Convergence Protocol (PDCP) for user plane integrity protection, and in NAS for control plane security. For example, when encrypting a NAS message, the AAD might include the message header, sequence number, and other fields that must remain in plaintext for routing but must be protected against modification. The AEAD algorithm (e.g., AES-GCM or SNOW 3G) computes an authentication tag over the ciphertext and AAD. The receiver, possessing the same AAD, can verify the tag and detect any tampering. This is particularly important in 5G because the network must ensure that critical control information is not altered by attackers.

The AAD concept is also used in the security of network slicing, where slice-specific identifiers and other metadata are authenticated to prevent unauthorized access or misrouting. Additionally, AAD is used in the protection of the UE's identity and other sensitive information during initial access. The 3GPP specifications 33.703, 33.771, 35.240, 35.243, and 35.246 define the use of AAD in various security protocols and algorithms.

Key components of AAD include its generation, transmission, and verification. The sender constructs the AAD from fields that need integrity protection but not confidentiality. The receiver uses the same fields to reconstruct the AAD. If the AAD is not correctly reconstructed, the authentication tag verification will fail, and the message will be rejected. This mechanism provides strong integrity protection without the overhead of encrypting all data. In 5G, AAD is used in conjunction with nonces to prevent replay attacks; the nonce ensures that each encryption operation is unique, while the AAD ensures that the context is bound to the ciphertext.

From an implementation perspective, AAD must be carefully defined in standards to ensure interoperability. Different protocols specify different AAD formats. For instance, in PDCP, the AAD includes the COUNT value (which comprises the hyper frame number and sequence number) and the bearer identity (RB ID). This binds the ciphertext to a specific radio bearer and sequence number, preventing replay and reordering attacks. In NAS, the AAD includes the NAS message type and other header fields. The use of AAD is thus integral to the overall security architecture of 5G, providing a balance between confidentiality and integrity.

As 5G evolves, the use of AAD is expected to expand to new areas such as edge computing and network exposure, where data from third parties must be authenticated. The 3GPP continues to refine the specifications to ensure that AAD is used consistently and securely across all network functions.

Purpose & Motivation

The concept of Additional Authentication Data (AAD) exists to address a fundamental challenge in secure communications: how to protect the integrity and authenticity of data that cannot be encrypted. In many protocols, certain fields must remain in plaintext for routing, processing, or interoperability reasons, yet they are still vulnerable to tampering. Traditional methods like separate message authentication codes (MACs) over the entire message could provide integrity, but they required additional computation and bandwidth. AEAD schemes with AAD solve this by allowing the authentication tag to cover both the encrypted data and the unencrypted associated data in a single cryptographic operation, improving efficiency.

In the context of 5G, AAD is essential for securing the control plane and user plane without hindering functionality. For example, in NAS, the message header includes information like the security header type and protocol discriminator, which are needed by intermediate nodes to route the message correctly. If these were encrypted, the network would not be able to process the message. However, if they were left completely unprotected, an attacker could modify them to disrupt communication or redirect messages. AAD allows these fields to be authenticated, ensuring that any modification is detected. This is a significant improvement over previous generations, where integrity protection was either not applied to certain fields or was applied using less efficient methods.

Historically, 3GPP security in 4G (LTE) used similar concepts but with limitations. For instance, in LTE, the integrity protection of NAS messages did not include the entire message header in the MAC calculation, leaving some fields unprotected. The introduction of AAD in 5G provides a more comprehensive and standardized approach. The specifications 33.703, 33.771, and 35.240-35.246 detail the exact usage of AAD in various algorithms and protocols. As 5G advances to Release 20 and beyond, the role of AAD will continue to grow, especially with the advent of new services like ultra-reliable low-latency communications (URLLC) and massive machine-type communications (mMTC), where integrity and authenticity are paramount.