Authenticated Encryption with Additional Data

Description

Authenticated Encryption with Additional Data (AEAD) refers to a class of cryptographic algorithms that simultaneously provide confidentiality, integrity, and authenticity of data. AEAD1, as specified in 3GPP Release 20, denotes a specific set of AEAD algorithms approved for use in 5G networks. These algorithms encrypt plaintext to produce ciphertext and generate an authentication tag that covers both the ciphertext and any additional authenticated data (AAD). This dual protection ensures that the data cannot be read or modified by unauthorized parties, and that the associated data (like headers) is also protected against tampering.

In 5G, AEAD algorithms are used in various protocols, including the Packet Data Convergence Protocol (PDCP) for user plane and signalling radio bearers, and the Non-Access Stratum (NAS) for control plane signalling. The 3GPP has standardized several AEAD algorithms, such as AES-GCM, AES-CCM, and SNOW 3G, which are specified in TS 35.240, 35.243, and 35.246. AEAD1 likely refers to a specific implementation or suite of these algorithms, ensuring interoperability across vendors. The AEAD process takes as input a plaintext, a nonce (number used once), and additional authenticated data (AAD). It outputs a ciphertext and an authentication tag. The receiver uses the same nonce and AAD to verify the tag and decrypt the ciphertext.

The key advantage of AEAD is its efficiency and security. By combining encryption and authentication in a single pass, AEAD algorithms reduce computational overhead compared to separate encryption and MAC operations. They also avoid common pitfalls like the need to manage separate keys for encryption and authentication. In 5G, AEAD is mandatory for certain interfaces, reflecting the increased focus on security in the new radio and core network.

AEAD1 is used in the 5G security architecture to protect both control plane and user plane data. For control plane, NAS messages are protected using AEAD, ensuring that signalling is confidential and integrity-protected. For user plane, PDCP uses AEAD to protect IP packets, providing confidentiality and integrity for user data. The AAD in these contexts includes sequence numbers, bearer identities, and other header fields that must be authenticated but not encrypted. This prevents attacks such as replay, reordering, and modification.

From a deployment perspective, support for AEAD1 is mandatory in 5G UEs and network nodes. The algorithms are implemented in hardware or software, and their use is negotiated during security mode procedures. The 3GPP specifications define the exact parameters and procedures for using AEAD1, ensuring that all compliant devices can interoperate securely. As 5G evolves, AEAD1 will remain a cornerstone of 5G security, with potential extensions to new services and network architectures.

The term AEAD1 is sometimes used to refer to the first set of AEAD algorithms specified for 5G, distinguishing them from later additions. In Release 20, the specifications 35.240, 35.243, and 35.246 detail the AEAD1 algorithms and their usage. These documents are essential for developers and engineers implementing 5G security.

Purpose & Motivation

AEAD1 exists to provide a standardized, efficient, and secure method for protecting data in 5G networks. Before AEAD, many systems used separate encryption and integrity algorithms, which could be cumbersome and sometimes led to security vulnerabilities if not implemented correctly. For example, in 4G LTE, the integrity protection of user plane data was optional in some cases, and the algorithms used were not AEAD. The introduction of AEAD in 5G addresses these issues by combining confidentiality and integrity in a single, well-analyzed cryptographic primitive.

The motivation for AEAD1 comes from the need to secure the diverse and demanding use cases of 5G, including enhanced mobile broadband (eMBB), ultra-reliable low-latency communications (URLLC), and massive machine-type communications (mMTC). These use cases require strong security without compromising performance. AEAD algorithms are designed to be fast and parallelizable, making them suitable for high-throughput applications. They also provide robust security guarantees, as they are resistant to chosen-ciphertext attacks and other cryptanalytic techniques.

Historically, 3GPP has evolved its security algorithms from the early days of GSM and UMTS to LTE and now 5G. Each generation introduced stronger algorithms and more comprehensive protection. AEAD1 in Release 20 represents the latest step, ensuring that 5G networks can protect user data and signalling against modern threats. The specifications 35.240, 35.243, and 35.246 define the algorithms and their usage, providing a clear framework for implementation. As 5G networks are deployed globally, AEAD1 will be critical in maintaining trust and security.