Integrity only algorithm

Description

An integrity only algorithm is a cryptographic primitive defined within the 3GPP security architecture that delivers message authentication and integrity protection without applying any encryption to the underlying data. In the 5G and beyond security framework, the Network Integrity Algorithms (NIA) family provides integrity protection for signalling and user plane traffic between the UE and the network. While NIA0 through NIA3 have historically been defined with associated ciphering counterparts (NEA), the Rel-20 specification TS 33.771 introduces the concept of algorithms that provide integrity protection alone, explicitly referencing NIA4, NIA5, and NIA6 as defined in TS 35.240, TS 35.243, and TS 35.246 respectively.

The algorithm operates by computing a Message Authentication Code (MAC) over the input data using a secret key shared between the communicating parties. The sender appends this MAC to the transmitted message, and the receiver independently recomputes the MAC over the received data and compares it with the received value. If the values match, the receiver can be confident that the data originated from an entity possessing the shared key and that the data has not been modified in transit. Crucially, unlike ciphering algorithms, the integrity only algorithm does not transform the plaintext into ciphertext, meaning the payload remains readable to any entity that can observe the transmission.

In the 3GPP security architecture, integrity protection is applied at multiple layers. At the Access Stratum (AS) level, integrity protection covers RRC signalling and, in certain configurations, user plane data. At the Non-Access Stratum (NAS) level, integrity protection covers NAS signalling messages between the UE and the AMF. The selection of which integrity algorithm to use is negotiated during the security mode command procedure, where the network and UE agree on a mutually supported algorithm based on their respective security capabilities. The integrity only algorithms NIA4, NIA5, and NIA6 extend this framework by providing additional algorithm choices that offer integrity without the overhead or regulatory constraints associated with ciphering.

The introduction of integrity only algorithms is particularly relevant in scenarios where confidentiality is either not required, not permitted by regulation, or where the computational overhead of encryption must be minimized. For example, in certain machine-type communication scenarios or in deployments where data is already protected at higher layers, integrity protection alone may suffice. Additionally, some jurisdictions impose restrictions on encryption, making integrity only algorithms a practical alternative that still provides essential security guarantees against tampering and spoofing.

From an implementation perspective, integrity only algorithms must be implemented alongside the existing NIA family and must be selectable through the standard security capability negotiation mechanisms. The UE and network each maintain a list of supported integrity algorithms, and the network selects the highest-priority algorithm supported by both parties. The algorithm identifiers for NIA4, NIA5, and NIA6 are defined in the respective specification documents, and their cryptographic properties—such as MAC length, key size, and resistance to forgery attacks—are specified to meet 3GPP's security requirements for 5G-Advanced and beyond.

Purpose & Motivation

The integrity only algorithm concept exists to address scenarios where data authenticity and tamper detection are required but confidentiality is either unnecessary, undesirable, or prohibited. Traditional 3GPP security algorithms typically paired integrity protection with ciphering, meaning that selecting an integrity algorithm implicitly involved encryption. This coupling created challenges in deployments where encryption was restricted by regulation, where the data was already encrypted at the application layer, or where the computational and bandwidth overhead of ciphering was deemed excessive for the use case.

Prior to Rel-20, the 3GPP security framework offered NIA0 (null integrity), NIA1 (SNOW-based), NIA2 (AES-based), and NIA3 (ZUC-based) algorithms, each with corresponding ciphering algorithms. However, there was no standardized mechanism to select integrity protection independently of ciphering in a way that was explicitly recognized and specified. The introduction of integrity only algorithms in TS 33.771 formalizes this capability, providing operators and vendors with a clear specification for deploying integrity-only security configurations.

The motivation also stems from the evolving threat landscape and the diverse requirements of 5G-Advanced and 6G use cases. In industrial IoT, for instance, sensor data may need to be authenticated to prevent injection attacks but may not require encryption because the data is not sensitive. Similarly, in public safety or lawful interception scenarios, integrity protection ensures that data has not been tampered with while allowing authorized entities to inspect content. By defining integrity only algorithms as a first-class concept, 3GPP enables more flexible security policy enforcement and aligns with the principle of applying security proportionate to the risk.