Standalone Algorithm (Integrity-Only or Ciphering-Only)

Description

A standalone algorithm, as defined in 3GPP TS 33.771, is a cryptographic algorithm that performs exactly one of the two core security functions in cellular communications: either integrity protection or ciphering (encryption). This contrasts with combined algorithms, such as the well-known NEA/NIA families (e.g., 128-NEA1/128-NIA1, 128-NEA2/128-NIA2), which are typically specified as paired algorithms providing both confidentiality and integrity using the same underlying cryptographic primitive. The standalone concept allows a network or device to apply only the security function that is needed for a given context, without the overhead or complexity of the other.

In the 3GPP security architecture, integrity algorithms (e.g., NIA0, NIA1, NIA2, NIA3) compute a Message Authentication Code (MAC) over signalling or user data to detect tampering, while ciphering algorithms (e.g., NEA0, NEA1, NEA2, NEA3) encrypt data to prevent eavesdropping. A standalone algorithm is therefore one that is defined and used independently for just one of these purposes. For example, an integrity-only algorithm might be used to protect RRC signalling when confidentiality is not required or is prohibited by regulatory constraints, while a ciphering-only algorithm might be used for user-plane data where integrity protection is not mandated.

The introduction of the standalone algorithm concept in Release 20 reflects the growing flexibility required by 5G-Advanced and future 6G security frameworks. As networks become more diverse — supporting network slicing, non-terrestrial networks, industrial IoT, and reduced-capability devices — the ability to select a single security function independently becomes valuable. It allows operators to tailor security to the threat model and performance constraints of each service. For instance, a low-latency industrial application might prioritize integrity over confidentiality, while a media streaming service might prioritize confidentiality.

Architecturally, standalone algorithms are managed through the same security key hierarchy and algorithm negotiation procedures as combined algorithms. The UE and network (AMF, gNB, or SMF) negotiate the algorithm via NAS and AS security mode command procedures. The algorithm identifier (a 4-bit value in the NAS/AS security mode command) indicates which algorithm is selected. When a standalone algorithm is chosen, only the corresponding function is activated; the other function may be set to a null algorithm (e.g., NEA0 for ciphering or NIA0 for integrity) if not needed.

From a specification perspective, TS 33.771 defines the security requirements and test vectors for these algorithms. The standalone designation ensures that implementers and test houses can validate each function independently, which simplifies certification and interoperability testing. It also enables new algorithm designs that are optimized for a single function, potentially achieving better performance or security margins than combined designs.

Purpose & Motivation

The standalone algorithm concept exists to provide granularity and flexibility in 3GPP security. Historically, 3GPP specified ciphering and integrity algorithms in pairs (e.g., 128-NEA1 and 128-NIA1) because early systems like GSM and UMTS applied both functions to most traffic. However, as networks evolved, it became clear that not all data requires both protection types. For example, some regulatory domains prohibit encryption of certain emergency or lawful-intercept-related signalling, while still requiring integrity. Conversely, some user-plane data may require confidentiality but not integrity due to latency constraints.

By defining standalone algorithms, 3GPP allows operators and vendors to implement and deploy only the security function that is necessary, reducing computational overhead and simplifying key management. This is particularly important for IoT devices with limited processing power, where running both ciphering and integrity on every packet may be prohibitive. It also supports new use cases such as network slicing, where different slices may have different security policies.

The motivation also stems from the need for algorithm agility. As cryptographic primitives age and new threats emerge, 3GPP needs to introduce new algorithms quickly. Standalone algorithms can be added or deprecated independently, without forcing a change to the paired algorithm. This modularity future-proofs the security architecture and aligns with the broader industry trend toward composable security functions.