Pseudo-Random Function

Description

A Pseudo-Random Function (PRF) is a fundamental cryptographic primitive that takes a secret key and an input string and produces an output that is computationally indistinguishable from a truly random function to any adversary who does not know the key. In 3GPP specifications, PRFs are used extensively in security procedures to derive cryptographic keys, generate authentication vectors, and compute message authentication codes. The PRF is deterministic: given the same key and input, it always produces the same output, which is essential for both endpoints of a communication to independently derive identical keys or verify integrity.

In the context of 3GPP Release 19, PRF is specified in TS 35.234 and TS 35.236, which are part of the 3GPP security algorithms specifications. TS 35.234 defines the cryptographic algorithms for the 5G System, including the PRF used in the 5G Authentication and Key Agreement (5G-AKA) and the Extensible Authentication Protocol (EAP-AKA'). TS 35.236 specifies the security algorithms for the 5G System's non-3GPP access and related procedures. The PRF is used within these specifications to derive keys such as KSEAF, KAUSF, and KAMF, and to compute authentication responses and message authentication codes.

The PRF operates by taking a key K and an input message M and producing an output PRF(K, M). The security of the PRF relies on the secrecy of K and the computational difficulty of distinguishing its output from random. In 3GPP, PRFs are typically instantiated using standardized algorithms such as HMAC-SHA-256 or AES-based constructions. For example, the key derivation functions (KDFs) specified in 3GPP TS 33.220 and TS 33.501 use HMAC-SHA-256 as the underlying PRF. The PRF ensures that even if an attacker observes the input and output, they cannot recover the key or predict future outputs without knowing the key.

Architecturally, the PRF is not a network node but a cryptographic building block embedded in security algorithms. It is implemented in the UE's Universal Integrated Circuit Card (UICC), the Authentication Server Function (AUSF), the Unified Data Management (UDM), and the Access and Mobility Management Function (AMF) in the 5G core. During the authentication procedure, the AUSF and UE both compute the PRF using the same key and input to derive the same authentication response and keys. The PRF is also used in the derivation of the 5G security context, ensuring that each network function has the correct keys for encryption and integrity protection.

The introduction of PRF in Release 19 reflects the ongoing need for robust, standardized cryptographic primitives as 3GPP networks evolve toward 5G-Advanced and beyond. While PRFs have been used implicitly in earlier releases through algorithms like MILENAGE and TUAK, the explicit specification in TS 35.234 and TS 35.236 provides a clear, standardized definition for implementers and ensures interoperability across vendors. The PRF is critical for maintaining the security and trustworthiness of 3GPP networks, protecting user data, and enabling secure authentication and key agreement.

Purpose & Motivation

The Pseudo-Random Function (PRF) exists to provide a standardized, cryptographically secure method for deriving keys and computing authentication values in 3GPP networks. In security protocols, both the network and the UE must independently compute identical keys and authentication responses without transmitting the secret key over the air. A PRF enables this by allowing both parties to use the same secret key and input to produce the same output, while ensuring that an eavesdropper cannot predict the output or recover the key.

Before the explicit specification of PRF in Release 19, 3GPP security algorithms relied on similar constructs such as MILENAGE and TUAK, which are based on AES and Keccak respectively. These algorithms include pseudo-random functions internally, but the PRF as a distinct, standardized primitive was not separately defined for all 5G procedures. The introduction of PRF in TS 35.234 and TS 35.236 addresses the need for a clear, modular definition that can be used across different security contexts, including 5G-AKA, EAP-AKA', and non-3GPP access.

The PRF solves the problem of secure key derivation and authentication in a multi-vendor, multi-operator environment. By standardizing the PRF, 3GPP ensures that UEs and network functions from different vendors can interoperate securely. It also provides a foundation for future security enhancements, allowing new algorithms to be plugged in without redesigning the entire security architecture. The PRF is thus a cornerstone of 3GPP security, enabling trust and confidentiality in mobile networks.