Cipher Key

Description

A cipher key in 3GPP terminology is a cryptographic value that, when combined with a security algorithm, encodes (encrypts) and decodes (decrypts) user plane and control plane data. It is a fundamental building block of the confidentiality protection mechanisms defined across all 3GPP access technologies, including GSM, UMTS, LTE, and 5G NR. The cipher key is distinct from the integrity key (IK), which is used for authentication and integrity protection rather than confidentiality. Together, the cipher key and integrity key form the key hierarchy that underpins 3GPP security architecture.

In practice, the cipher key is derived during the authentication and key agreement (AKA) procedure. In UMTS and LTE, the Authentication Centre (AuC) and the USIM generate a cipher key (CK) and an integrity key (IK) as outputs of the AKA process. These keys are then transported from the Home Subscriber Server (HSS) or Home Location Register (HLR) to the serving network entity (SGSN, MME, or AMF) so that the radio access network can activate ciphering. In 5G, the key hierarchy is more elaborate: the long-term key K stored on the USIM is used to derive KAUSF, from which KSEAF, KAMF, and eventually the radio-specific keys KRRCenc, KRRCint, KUPenc, and KUPint are derived. Each of these derived keys serves a specific ciphering or integrity purpose on a specific interface.

The cipher key is used by the ciphering algorithm to transform plaintext into ciphertext. 3GPP defines several standardized ciphering algorithms: the GSM-era A5/1, A5/2, and A5/3; the UMTS/LTE-era UEA1 (based on KASUMI) and UEA2 (based on SNOW 3G); the LTE-era 128-EEA1 (SNOW 3G), 128-EEA2 (AES-CTR), and 128-EEA3 (ZUC); and the 5G NR algorithms NEA1 (SNOW 3G), NEA2 (AES-CTR), and NEA3 (ZUC). The cipher key length varies by algorithm and generation: 64 bits in GSM, 128 bits in UMTS, LTE, and 5G. The selection of which algorithm to use is negotiated between the UE and the network through security mode command procedures.

The cipher key lifecycle includes generation, distribution, activation, and deletion. Keys are generated during authentication, distributed to the serving network via the core network interfaces (e.g., S6a, N8, N11), and activated via Security Mode Command (SMC) procedures. Once activated, ciphering applies to all subsequent user and signalling data on the radio interface. Keys are deleted when the security context is released, such as during detach or when the UE moves to a new serving network that performs a fresh AKA. Key freshness is ensured through the use of sequence numbers and the AKA procedure, preventing replay attacks.

From a standards perspective, the cipher key concept is documented in 3GPP TS 21.905 (Vocabulary for 3GPP Specifications) and TS 22.101 (Service aspects; Service principles). The definition has remained remarkably stable across releases from Rel-4 through Rel-19, reflecting the enduring nature of this fundamental security concept. The term appears in numerous other specifications including TS 33.102 (3G security architecture), TS 33.401 (SAE security architecture), and TS 33.501 (5G security architecture), where the detailed key derivation and usage rules are specified.

Purpose & Motivation

The cipher key exists to provide confidentiality protection for user data and signalling information transmitted over the air interface and across network interfaces. Without ciphering, over-the-air transmissions could be intercepted by anyone with a radio receiver, exposing voice calls, text messages, and data sessions to eavesdropping. The cipher key, combined with a standardized ciphering algorithm, ensures that only authorized parties possessing the correct key can decode the transmitted information.

Historically, the need for cipher keys became apparent in the early GSM era when analog cellular systems offered no meaningful protection against eavesdropping. GSM introduced the A5 ciphering algorithms and the concept of a cipher key derived during authentication. However, early GSM ciphering had weaknesses: A5/1 was eventually broken, and A5/2 was intentionally weakened for export purposes. These limitations motivated the development of stronger algorithms in UMTS (UEA1/UEA2) and LTE (128-EEA1/2/3), each requiring more robust cipher keys.

The cipher key concept also addresses the problem of key management in mobile networks. Because mobile subscribers roam across networks and hand over between cells, the cipher key must be distributable to serving network nodes without exposing the long-term subscriber secret. The AKA procedure solves this by deriving temporary cipher keys that are valid only for a specific serving network and session, limiting the damage if a serving network is compromised. This design principle — separating long-term secrets from session keys — remains central to 3GPP security across all generations.