Authentication between user equipment and network using a hybrid key exchange

Abstract

There is provided an apparatus comprising: means for initiating a registration with a serving network in order to establish a session between the apparatus and the serving network, means for receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism, means for performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation, means for deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key, means for providing, to the network entity, the ciphertext associated with the encapsulation, and means for deriving a master key for the session based on the hybrid shared key, Ks.

Description

[0001] AUTHENTICATION BETWEEN USER EQUIPMENT AND NETWORK USING A HYBRID KEY EXCHANGE

[0002] Technical Field

[0003] Various examples of this disclosure relate to methods, apparatuses, and computer programs for authentication between a user equipment and a network using a hybrid key exchange. In particular, a hybrid key exchange associated with an extensible authentication protocol (EAP) authentication and key agreement prime (AKA’) process.

[0004] Background

[0005] A communication network can be seen as a facility that enables communications between two or more communication devices, or provides communication devices access to a data network. A mobile or wireless communication network is one example of a communication network. A communication device may be provided with a service by an application server.

[0006] Such communication networks operate in accordance with standards such as those provided by 3GPP (Third Generation Partnership Project) or ETSI (European Telecommunications Standards Institute). Examples of standards are the so-called 5G (5th Generation) standards provided by 3GPP.

[0007] Summary

[0008] Some examples of this disclosure will be described with respect to certain aspects. These aspects are not intended to indicate key or essential features of the embodiments of this disclosure, nor are they intended to be used to limit the scope of thereof. Other features, aspects, and elements will be readily apparent to a person skilled in the art in view of this disclosure. For example, it should be appreciated that further aspects may be provided by the combination of any two or more of the various aspects described below.

[0009] According to an aspect, there is provided an apparatus comprising: means for initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; means for receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; means for performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; means for deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; means for providing, to the network entity, the ciphertext associated with the encapsulation; and means for deriving a master key for the session based on the hybrid shared key, Ks.

[0010] In some examples, the apparatus comprises: means for generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and means for providing, to the network entity, a message comprising the second public key of the second key material.

[0011] In some examples, the encapsulation is a cryptography key encapsulation.

[0012] In some examples, the message is an authentication response message.

[0013] In some examples, the network entity is a RAN node. In some examples, the RAN node is a RAN node of a serving network.

[0014] In some examples, the apparatus comprises: means for receiving, from the network entity, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and means for deriving the further shared secret key based on the second private key and the third public key.

[0015] In some examples, the third public key of third key material is received in an authentication request message. In some examples, the authentication request message comprises the third key material and at least one parameter associated with forward secrecy.

[0016] In some examples, the receiving of the second public key of second key material is associated with an authentication for the session.

[0017] In some examples, the means for deriving the hybrid shared secret key, Ks, comprises: means for combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks.

[0018] In some examples, the means for deriving the hybrid shared secret key, Ks, comprises: means for performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0019] In some examples, the encapsulation comprises a key encapsulation mechanism, KEM.

[0020] In some examples, the apparatus further comprises: means for deriving, based on the master key, at least one of the following: a re- authentication key, a master session key, or an extended master session key.

[0021] In some examples, the apparatus is one of: a mobile equipment, a user equipment, a communication device, or a terminal. According to an aspect, there is provided an apparatus for a first network function, the apparatus comprising means for the first network function to perform: receiving, from a second network function, first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks.

[0022] In some examples, the means are for the first network function to perform: receiving a second public key of second key material that is associated with the user equipment, wherein the second key material is ephemeral key material.

[0023] In some examples, the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks.

[0024] In some examples, the deriving the hybrid shared secret key, Ks, comprises: means for performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0025] In some examples, the de-encapsulation comprises a key encapsulation mechanism, KEM, de-encapsulation.

[0026] In some examples, the means are for the first network function to perform: means for deriving, based on the master key, at least one of the following: a re-authentication key, a master session key, or an extended master session key.

[0027] In some examples, the first network function is an authentication server function.

[0028] According to an aspect, there is provided an apparatus for a second network function, the apparatus comprising means for the second network function to perform: generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a postquantum cryptography key encapsulation mechanism; and providing, to a first network function, the first key material comprising the first public key and the first private key.

[0029] In some examples, the means are for the second network function to perform: generating third key material comprising a third public key and a third private key, wherein the third key material that is associated with the home network, wherein the third key material is ephemeral key material; and providing, to the first network function, the third key material.

[0030] In some examples, the second network function is a unified data management function.

[0031] According to an aspect, there is provided a subscriber identity module comprising: means for receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; means for performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; means for deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; means for providing, to the apparatus, the ciphertext associated with the encapsulation; and means for deriving a master key based on the hybrid shared key, Ks.

[0032] In some examples, the subscriber identity module comprises: means for generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and means for providing, to a mobile equipment, the second key material.

[0033] In some examples, the encapsulation is a cryptography key encapsulation.

[0034] In some examples, the message is an authentication response message.

[0035] In some examples, the subscriber identity module comprises: means for receiving, from the mobile equipment, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and means for deriving the further shared secret key based on the second private key and the third public key.

[0036] In some examples, the means for deriving the hybrid shared secret key, Ks, comprises: means for combining the shared secret key, SS, and a further shared secret key to form the hybrid shared secret key, Ks.

[0037] In some examples, the means for deriving the hybrid shared secret key, Ks, comprises: means for performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0038] In some examples, wherein the encapsulation comprises a key encapsulation mechanism, KEM.

[0039] In some examples, the subscriber identity module further comprises: means for deriving, based on the master key, at least one of the following: a re-authentication key, a master session key, or an extended master session key. According to an aspect, there is provided a method comprising: initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the network entity, the ciphertext associated with the encapsulation; and deriving a master key for the session based on the hybrid shared key, Ks.

[0040] In some examples, the method comprises: generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and providing, to the network entity, a message comprising the second public key of the second key material.

[0041] In some examples, the encapsulation is a cryptography key encapsulation.

[0042] In some examples, the message is an authentication response message.

[0043] In some examples, the network entity is a RAN node. In some examples, the RAN node is a RAN node of a serving network.

[0044] In some examples, the method comprises: receiving, from the network entity, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and deriving the further shared secret key based on the second private key and the third public key.

[0045] In some examples, the third public key of third key material is received in an authentication request message. In some examples, the authentication request message comprises the third key material and at least one parameter associated with forward secrecy.

[0046] In some examples, the receiving of the second public key of second key material is associated with an authentication for the session.

[0047] In some examples, the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks.

[0048] In some examples, the deriving the hybrid shared secret key, Ks, comprises: performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0049] In some examples, the encapsulation comprises a key encapsulation mechanism, KEM. In some examples, the method comprises: deriving, based on the master key, at least one of the following: a re-authentication key, a master session key, or an extended master session key.

[0050] In some examples, the method is performed by one of: a mobile equipment, a user equipment, a communication device, or a terminal.

[0051] According to an aspect, there is provided an apparatus comprising: at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform: initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the network entity, the ciphertext associated with the encapsulation; and deriving a master key for the session based on the hybrid shared key, Ks.

[0052] In some examples, the apparatus is caused to perform: generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and providing, to the network entity, a message comprising the second public key of the second key material.

[0053] In some examples, the encapsulation is a cryptography key encapsulation.

[0054] In some examples, the message is an authentication response message.

[0055] In some examples, the network entity is a RAN node. In some examples, the RAN node is a RAN node of a serving network.

[0056] In some examples, the apparatus is caused to perform: receiving, from the network entity, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and deriving the further shared secret key based on the second private key and the third public key.

[0057] In some examples, the third public key of third key material is received in an authentication request message. In some examples, the authentication request message comprises the third key material and at least one parameter associated with forward secrecy.

[0058] In some examples, the receiving of the second public key of second key material is associated with an authentication for the session. In some examples, the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks.

[0059] In some examples, the deriving the hybrid shared secret key, Ks, comprises: performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0060] In some examples, the encapsulation comprises a key encapsulation mechanism, KEM.

[0061] In some examples, the apparatus is caused to perform: deriving, based on the master key, at least one of the following: a re- authentication key, a master session key, or an extended master session key.

[0062] In some examples, the apparatus is one of: a mobile equipment, a user equipment, a communication device, or a terminal.

[0063] An apparatus comprising: circuitry configured to perform: initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; circuitry configured to perform: performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; circuitry configured to perform: deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; circuitry configured to perform: providing, to the network entity, the ciphertext associated with the encapsulation; and circuitry configured to perform: deriving a master key for the session based on the hybrid shared key, Ks.

[0064] According to an aspect, there is provided a method comprising: receiving, from a first network function, first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks. In some examples, the method comprises: receiving a second public key of second key material that is associated with the user equipment, wherein the second key material is ephemeral key material.

[0065] In some examples, the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks.

[0066] In some examples, the deriving the hybrid shared secret key, Ks, comprises: performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0067] In some examples, the de-encapsulation comprises a key encapsulation mechanism, KEM, de-encapsulation.

[0068] In some examples, the method comprises: deriving, based on the master key, at least one of the following: a re-authentication key, a master session key, or an extended master session key.

[0069] In some examples, the method is performed by a first network function.

[0070] In some examples, the first network function is an authentication server function.

[0071] According to an aspect, there is provided an apparatus comprising: at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform: receiving, from a first network function, first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a postquantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks.

[0072] In some examples, the apparatus is caused to perform: receiving a second public key of second key material that is associated with the user equipment, wherein the second key material is ephemeral key material.

[0073] In some examples, the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks. In some examples, the deriving the hybrid shared secret key, Ks, comprises: performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0074] In some examples, the de-encapsulation comprises a key encapsulation mechanism, KEM, de-encapsulation.

[0075] In some examples, the apparatus is caused to perform: deriving, based on the master key, at least one of the following: a re- authentication key, a master session key, or an extended master session key.

[0076] In some examples, the apparatus is for a first network function.

[0077] In some examples, the first network function is an authentication server function.

[0078] An apparatus comprising: circuitry configured to perform: receiving, from a first network function, first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; circuitry configured to perform: receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; circuitry configured to perform: performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS; circuitry configured to perform: deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks.

[0079] According to an aspect, there is provided a method comprising: generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a postquantum cryptography key encapsulation mechanism; and providing, to a first network function, the first key material comprising the first public key and the first private key.

[0080] In some examples, the method comprises: generating third key material comprising a third public key and a third private key, wherein the third key material that is associated with the home network, wherein the third key material is ephemeral key material; and providing, to the first network function, the third key material.

[0081] In some examples, the method is performed by a second network function.

[0082] In some examples, the second network function is a unified data management function.

[0083] According to an aspect, there is provided an apparatus comprising: at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform: generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; and providing, to a first network function, the first key material comprising the first public key and the first private key.

[0084] In some examples, the apparatus is caused to perform: generating third key material comprising a third public key and a third private key, wherein the third key material that is associated with the home network, wherein the third key material is ephemeral key material; and providing, to the first network function, the third key material.

[0085] In some examples, the apparatus is for a second network function.

[0086] In some examples, the second network function is a unified data management function.

[0087] An apparatus comprising: circuitry configured to perform: generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; and circuitry configured to perform: providing, to a first network function, the first key material comprising the first public key and the first private key.

[0088] According to an aspect, there is provided a method comprising: receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the apparatus, the ciphertext associated with the encapsulation; and deriving a master key based on the hybrid shared key, Ks.

[0089] In some examples, the method comprises: generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and providing, to a mobile equipment, the second key material.

[0090] In some examples, the encapsulation is a cryptography key encapsulation.

[0091] In some examples, the message is an authentication response message.

[0092] In some examples, the method comprises: receiving, from the mobile equipment, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and deriving the further shared secret key based on the second private key and the third public key. In some examples, the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and a further shared secret key to form the hybrid shared secret key, Ks.

[0093] In some examples, the deriving the hybrid shared secret key, Ks, comprises: performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0094] In some examples, wherein the encapsulation comprises a key encapsulation mechanism, KEM.

[0095] In some examples, the method comprises: deriving, based on the master key, at least one of the following: a re-authentication key, a master session key, or an extended master session key.

[0096] In some examples, the method is performed by a SIM, or USIM.

[0097] According to an aspect, there is provided an apparatus comprising: at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform: receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the apparatus, the ciphertext associated with the encapsulation; and deriving a master key based on the hybrid shared key, Ks.

[0098] In some examples, the apparatus is caused to perform: generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and providing, to a mobile equipment, the second key material.

[0099] In some examples, the encapsulation is a cryptography key encapsulation.

[0100] In some examples, the message is an authentication response message.

[0101] In some examples, the apparatus is caused to perform: receiving, from the mobile equipment, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and deriving the further shared secret key based on the second private key and the third public key.

[0102] In some examples, the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and a further shared secret key to form the hybrid shared secret key, Ks. In some examples, the deriving the hybrid shared secret key, Ks, comprises: performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

[0103] In some examples, wherein the encapsulation comprises a key encapsulation mechanism, KEM.

[0104] In some examples, the apparatus is caused to perform: deriving, based on the master key, at least one of the following: a re- authentication key, a master session key, or an extended master session key.

[0105] In some examples, the apparatus is a SIM, or USIM.

[0106] An apparatus comprising: circuitry configured to perform: receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; circuitry configured to perform: performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; circuitry configured to perform: deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; circuitry configured to perform: providing, to the apparatus, the ciphertext associated with the encapsulation; and circuitry configured to perform: deriving a master key based on the hybrid shared key, Ks.

[0107] According to an aspect, there is provided a computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the network entity, the ciphertext associated with the encapsulation; and deriving a master key for the session based on the hybrid shared key, Ks.

[0108] According to an aspect, there is provided a computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: receiving, from a first network function, first key material comprising a first public key and a first private key , wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks.

[0109] According to an aspect, there is provided a computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; and providing, to a first network function, the first key material comprising the first public key and the first private key.

[0110] According to an aspect, there is provided a computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the apparatus, the ciphertext associated with the encapsulation; and deriving a master key based on the hybrid shared key, Ks. A computer product stored on a medium may cause an apparatus to perform the methods as described herein.

[0111] A non-transitory computer readable medium comprising program instructions, that, when executed by an apparatus, cause the apparatus to perform the methods as described herein.

[0112] An electronic device may comprise apparatus as described herein.

[0113] Various other aspects and further embodiments are also described in the following detailed description and in the attached claims.

[0114] According to some aspects, there is provided the subject matter of the independent claims. Some further aspects are defined in the dependent claims. The embodiments that do not fall under the scope of the claims are to be interpreted as examples useful for understanding the disclosure.

[0115] List of Abbreviations:

[0116] AV: Authentication Vector AUSF: Authentication Server Function

[0117] AF: Application Function

[0118] AMF: Access and Mobility Management Function

[0119] AN: Access Network

[0120] BS: Base Station

[0121] CN: Core Network

[0122] DL: Downlink

[0123] EAP: Extensible Authentication Protocol

[0124] ECDH: Elliptic-curve Diffie-Hellman eNB : eNodeB

[0125] FS: Forward Secrecy gNB : gNodeB

[0126] HN: Home Network

[0127] IIoT : Industrial Internet of Things

[0128] KEM: Key Encapsulation Mechanism

[0129] LTE: Long Term Evolution

[0130] NEF: Network Exposure Function

[0131] NG-RAN: Next Generation Radio Access Network

[0132] NF: Network Function

[0133] NR: New Radio

[0134] NRF: Network Repository Function

[0135] NW: Network

[0136] MS: Mobile Station

[0137] MK: Master Key

[0138] ME: Mobile Equipment

[0139] PCF Policy Control Function

[0140] PLMN: Public Land Mobile Network

[0141] PQC: Post-Quantum Cryptography

[0142] RAN: Radio Access Network

[0143] RF: Radio Frequency

[0144] SMF: Session Management Function

[0145] UE: User Equipment

[0146] UDR: Unified Data Repository

[0147] UDM: Unified Data Management UL: Uplink

[0148] USIM: Universal Subscriber Identity Module

[0149] UPF: User Plane Function

[0150] 3GPP: 3rdGeneration Partnership Project

[0151] 5G: 5thGeneration

[0152] 5GC: 5G Core network

[0153] 5G-AN: 5G Radio Access Network

[0154] 5GS: 5G System

[0155] Brief Description of Drawings

[0156] Some examples will now be described, by way of illustrative and non-limiting example only, with reference to the accompanying drawings in which:

[0157] FIG. 1 shows a schematic representation of a 5G communication system;

[0158] FIG. 2 shows a schematic representation of an apparatus for the 5G communication system of FIG. 1 ;

[0159] FIG. 3 shows a schematic representation of a communication device;

[0160] FIGS. 4a to 4d show a signalling and operations diagram for implementing forward secrecy in an extensible authentication protocol authentication and key agreement process;

[0161] FIGS. 5a to 5d show an example signalling and operations diagram for implementing forward secrecy in an extensible authentication protocol authentication and key agreement process using a hybrid key;

[0162] FIG. 6 shows an example method flow diagram performed by an apparatus;

[0163] FIG. 7 shows another example method flow diagram performed by an apparatus;

[0164] FIG. 8 shows another example method flow diagram performed by an apparatus;

[0165] FIG. 9 shows another example method flow diagram performed by an apparatus; and

[0166] FIG. 10 shows a schematic representation of a non-volatile memory medium storing instructions which when executed by a processor allow a processor to perform one or more of the steps of the method of FIGS. 6 to 9.

[0167] Detailed Description

[0168] Cryptography is the practice of techniques for secure communication in the presence of adversarial behaviour. In general, cryptography is about constructing and analysing protocols that prevent third parties or the public from reading private messages. Many cryptographic techniques are implemented in wireless communication systems, such as in 4G, 5G systems and beyond, in order to ensure that transmitted messages between entities may only be read by the desired party or parties.

[0169] A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file. A key, when processed through a cryptographic algorithm, may be used to encode or decode cryptographic data. Based on the used method, the key can be different sizes and varieties, wherein the strength of the encryption relies on the security of the key being maintained. A key's security strength may be dependent on its algorithm, the size of the key, the generation of the key, and the process of key exchange.

[0170] A key-agreement protocol is a protocol whereby two or more parties may agree on a cryptographic key in such a way that both influence the outcome. If properly done, this precludes undesired third parties from forcing a key choice on the agreeing parties. Protocols that are useful in practice also do not reveal to any eavesdropping party what key has been agreed upon. Many key exchange systems have one party generate the key, and send that key to the other party, such that the other party has no influence on the key. Protocols where both parties influence the final derived key are a way to implement forward secrecy (FS). FS (also known as perfect forward secrecy (PFS)) is a feature of specific key-agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised. FS protects past sessions against future compromises of keys or passwords. By generating a unique session key for each session a user initiates, the compromise of a single session key will not affect any data other than that exchanged in the specific session protected by that particular key. This by itself may not be sufficient for FS which additionally requires that a long-term secret compromise does not affect the security of past session keys.

[0171] Extensible Authentication Protocol (EAP) is an authentication framework which supports multiple authentication methods. EAP authentication and key agreement (EAP- AKA) is an EAP method for authentication and session key distribution that uses the AKA mechanism. Authentication and Key Agreement (AKA) is based on challenge-response mechanisms and symmetric cryptography. For example, AKA may run in a universal mobile telecommunications service (UMTS) subscriber identity module (USIM). Based on EAP- AKA, EAP AKA prime (EAP-AKA') is an EAP method that binds derived keys to the name of the access network. EAP methods such as EAP-AKA and EAP-AKA’ are often used / implemented in 5G systems.

[0172] The AKA procedure is used authenticating a user to the network and vice versa. This is possible due to the long term (pre shared but secret key) ‘K’ which is stored in an authentication Centre (AuC) and in a UMTS Subscriber Identity Module (USIM). Other parameters may be derived from the ‘K’ key. During an AKA procedure, messages with parameters to be confirmed by a UE may be delivered from the AuC. These parameters are utilised together in an authentication vector (AV). The AV is delivered to one or more core network entities, which distribute at least part of the AV through the RAN to the UE. The UE performs one or more determinations to match this challenge performed in the network. The result of the UE is sent back to the network and compared to the original AV. If there is a match, then the authentication is successful, and vice versa.

[0173] A subscription permanent identifier (SUPI) is a globally unique identifier that is assigned to each subscriber in the 5G system. A SUPI in 5G may be in two formats, one is the (legacy) format international mobile subscriber identity (IMSI) or the format adopted in 5G network access identifier (NAI). SUPIs in the NAI format allow the use of 3GPP 5G technology in the context of private networks and wireless-wireline convergence. Subscriber Concealed Identifier (SUCI) is a privacy-preserving identifier containing a concealed SUPI. A UE generates a SUCI using a protection scheme with a public key of the home network that was securely provisioned to the USIM during the USIM registration process.

[0174] USIMs are able to store long term keys (e.g., long term key, K). Security in 3GPP (2G- 5G) relies on the long-term key securely stored in the USIM cards. This long-term key enables, for example AKA-based authentication, and is a root key for the derivation of session keys. There are also other long-term keys used for the secure management of USIM cards, called over the air (OTA) keys, which are also securely stored in the SIM cards. If these long-term keys leak due to any reason (e.g., an accidental exposure or factory compromise), the impact on security would be devastating.

[0175] There have been reported attacks that involve a compromising of the smart card supply chain, such as attacking USIM card manufacturers and operators. These attacks are performed in an effort to compromise long-term keys (such as key K) stored on these USIM cards. Resourceful attackers and / or hackers are always a cause for concern for network provides. In this manner, it may be assumed that there is always a breach, such as a long-term key compromise, with procedures being planned and implemented in order to minimise the impact of breaches. Thes assumptions are important for zero trust principles. Attacks on long-term keys are not specific to EAP-AKA or EAP-AKA', and if key material is stolen, security solutions may fail. Even in the face of such attacks, it would be desirable to maintain some level of protection. FIGS. 4a to 4d show a signalling and operations diagram for implementing forward secrecy in an extensible authentication protocol authentication and key agreement process (e.g., EAP-AKA’). The features described alongside FIG. 4 have been proposed in order to protect against some specific attacks, but there are a number of associated problems with this approach which will be discussed below.

[0176] The signalling and operations of FIG. 4 are associated with a document related to an update for RFC 9048, i.e., an improved Extensible Authentication Protocol Method for 3GPP Mobile Network Authentication and Key Agreement (EAP-AKA'), with an optional extension providing ephemeral key exchange. The extension EAP-AKA' Forward Secrecy (EAP-AKA' FS), when negotiated, provides forward secrecy for session keys generated as a part of the authentication run in EAP-AKA'. This prevents an attacker who has gained access to a longterm key from obtaining session keys established in the past, assuming these have been properly deleted. EAP-AKA' FS may mitigate some passive attacks (e.g., large scale pervasive monitoring) against future sessions.

[0177] As shown in FIG. 4a, a UE performs a SUPI to SUCI concealment (see S401 of FIG. 4a), and provides the SUCI or 5G-GUTI to an access and mobility management function (AMF) of a serving network (see S402). The AMF provides the SUCI or SUPI to an authentication server function (AUSF) of a home network in an authentication request message (see S403). The AUSF provides the SUCI or SUPI and a name of the serving network (SN- name) to a unified data management (UDM) function of the home network. The UDM thus has an EAP identity of a UE (see step S404). The UDM runs an AKA algorithm to generate a random number (RAND), authentication token (AUTN), expected response (XRES), cipher key (CK) and integrity key (IK) (see steps S405 and S406). Furthermore, the UDM also derives CK’ and IK’ keys, using at least one cryptographic function followed by a key derivation function (KDF), which are tied to a serving network name (see S406 of FIG. 4a and FIG. 4b). The UDM generates (see S405 of FIG. 4a) an ephemeral key pair, and sends (see steps S407 to S408c of FIG. 4a) a public key of that ephemeral key pair together with the first EAP method message, to a UE. The AUSF stores a private key of the ephemeral key pair (see S408a). The EAP message sent to the UE comprises: AT_PUB_ECDHE (which carries the public key) and AT_KDF_FS (which carries other FS related parameters), wherein ECDH is Elliptic-curve Diffie-Hellman (ECDH) and ECDHE is ECDH ephemeral. Both AT_PUB_ECDHE and AT_KDF_FS may be ignored by the UE if the UE does not support the FS.

[0178] The UE checks (see step S409) if the UE wants to have a FS extension in EAP AKA’. If yes, then the UE will respond to the network with a AT_PUB_ECDHE (associated with the UE) and message authentication code (MAC). If no, the UE will ignore the AT_PUB_ECDHE received from the network.

[0179] If UE wants to participate in FS extension, the UE will (see step S409): i) generate an Elliptic Curve Diffie-Hellman Key Exchange (ECDH) key pair, ii) calculate a shared key, Ks, based on a private key of the UE (of the ECDH key pair) and the public key of the UDM (carried in AT_PUB_ECDHE).

[0180] The UE also derives CK’ and IK’ keys (see S409 of FIG. 4c), using at least one cryptographic function followed by a KDF, which are tied to a serving network name. A result (RES) of the AKA challenge is also determined by the UE (see S409 of FIG. 4c).

[0181] The UE provides, to the AUSF, the public key of the UE (see S410a of FIG. 4a).

[0182] Following this, the AUSF will receive (see steps S410a and S410b) the result (RES) and AT_PUB_ECDHE comprising the public key of the UE, from the UE. As discussed above, the shared key ‘Ks’ is generated at the UE (based on the UE private key and the HN public key) (see step S409). Furthermore, the HN (e.g., AUSF) also generates a shared key ‘Ks’ (see step S41 la of FIG. 4a) using the RES and AT_PUB_ECDHE (public key of UE) from the UE.

[0183] In this manner, ephemeral key pairs are exchanged between the UE and the HN, to allow a master key (MK) to be generated (see step S411b). The MK is generated by both the UE (see S414c of FIG. 4a) and the HN (see S411b) separately, wherein the MK is generated based on the shared key, Ks. The MK is generated using the following equation:

[0184] MK_ECDHE = PRF'(IK'\CK'\SHARED_SECREF, "EAP-AKA' FS"\ Identity) wherein PRF is a pseudo random function, ‘shared secret’ is the shared key (Ks), IK’ is an integrity key and CK’ is a cipher key.

[0185] Further keys are then generated by the HN and the SN (see S413a, S414a). Further keys are then generated at the UE (see S414c of FIG. 4a and 4d Once authentication for the UE has been completed, the UDM will store a result of the authentication (see S413c).

[0186] As described above for FIGS. 4a to 4d, FS for the EAP-AKA' updates the EAP-AKA' specified in RFC 9048, with an extension providing ephemeral key exchange. This prevents an attacker who has gained access to the long-term key (K) from obtaining session keys established in the past, assuming these have been properly deleted. EAP-AKA' FS may mitigate some passive attacks (e.g., large scale pervasive monitoring) against future sessions.

[0187] However, a problem is that EAP-AKA' FS uses traditional algorithms, (i.e., public-key algorithms (e.g., ECDH)) which will fall to quantum cryptanalysis. Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key.

[0188] The presence of a cryptographically relevant quantum computer (CRQC) would render such ‘traditional’ public-key algorithms obsolete and insecure, since the assumptions about the intractability of the mathematical problems for these algorithms that offer high confidence levels of security would no longer apply in the presence of a CRQC.

[0189] The migration to post-quantum cryptography (PQC) is unique in the history of modern digital cryptography in that neither the traditional algorithms nor the post-quantum algorithms are fully trusted to protect data for the required data lifetimes. The post-quantum algorithms face uncertainty about the underlying mathematics, compliance issues, unknown vulnerabilities, hardware and software implementations that have not had sufficient maturing time to rule out classical cryptanalytic attacks and implementation bugs. During the transition from traditional algorithms to post-quantum algorithms, there is a need for protocols to use both types of algorithm.

[0190] One or more of the following examples aim to address one or more of the problems identified above.

[0191] In examples, there is a method (e.g., performed by a UE) that comprises initiating a registration with a serving network in order to establish a session between the apparatus and the serving network, and receiving, from a network entity (e.g., a RAN node), a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism. The method also comprises performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation, and deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key. The method also comprises providing, to the network entity, the ciphertext associated with the encapsulation, and deriving a master key for the session based on the hybrid shared key, Ks.

[0192] In this manner, in some examples, there is a ‘hybrid’ key exchange in EAP-AKA' FS. The hybrid key exchange comprises using multiple key exchange algorithms simultaneously and combining the result. This has the advantage of providing security even if all but one of the component algorithms is broken (e.g., hacked by an attacker). This is of particular use with the transition to post-quantum cryptography (PQC).

[0193] These examples will be described in more detail below, alongside FIGS. 4 to 6.

[0194] Before explaining the examples above in greater detail, an example communication device (e.g., a user equipment) (as shown in FIG. 3) that is capable of registering and authenticating with a serving network is described. The communication device is part of a communication system (as shown in FIG. 1). The communication device is able to communicate with one or more of the entities of the communication system (as shown in FIG. 1) via an apparatus (as shown in FIG. 2), which may be part of / comprised in a base station (e.g., a gNodeB). As described above, a communication device (e.g., a UE) may take part in an authentication process (e.g., EAP AKA’) with a communication system (e.g., a 5G network) in order to establish a communication session.

[0195] Certain general aspects of the communication system and the communication device are briefly explained with reference to FIGS. 1 to 3 to assist in understanding the technology underlying the described examples.

[0196] FIG. 1 shows a schematic representation of a 5G communication system 100. The wireless communication system 100 comprises one more communication devices 102 such as user equipments (UEs), or terminals. The wireless communication system 100 comprises a 5G system (5GS). The 5GS comprises a 5G radio access network (5G-RAN) 106, a 5G core network (5GC) 104 comprising one or more network functions (NF), one or more application functions (AFs) 108, and one or more data networks (DNs) 110.

[0197] The 5G-RAN 106 may comprise one or more gNodeB (gNB) distributed unit (DU) functions connected to one or more gNodeB (gNB) centralized unit (CU) functions.

[0198] The 5GC 104 comprises an access and mobility management function (AMF) 112, a session management function (SMF) 114, an authentication server function (AUSF) 116, a user data management (UDM) 118, a user plane function (UPF) 120, a network exposure function (NEF) 122 and / or other NFs. Some of the examples as shown below may be applicable to 3GPP 5G standards. However, some examples may also be applicable to 5G-advanced, 4G, 3G and other 3GPP standards.

[0199] In a wireless communication system 100, such as that shown in FIG. 1, communication devices 102, such as for example, terminals, user apparatuses, user equipments (UE), and / or machine-type communication devices are provided with wireless access via at least one base station or similar wireless transmitting and / or receiving node or point. The communication device 102 is provided with an appropriate signal receiving and transmitting apparatus for enabling communications, for example enabling access to a communication network or communications directly with other devices. The communication device 102 may access a carrier provided by a base station or access point, and transmit and / or receive communications on the carrier. FIG. 2 illustrates an example of an apparatus 200. The apparatus 200 may be for the 5G communication system of FIG. 1. The apparatus 200 may be for controlling a function of one or more network entities and / or network functions, such as the entities of the 5G-RAN or the 5GC as illustrated on FIG. 1. The apparatus 200 comprises at least one random access memory (RAM) 21 la, at least one read only memory (ROM) 211b, at least one processor 212, 213 and an input / output interface 214. The at least one processor 212, 213 is coupled to the RAM 211a and the ROM 211b. The at least one processor 212, 213 may be configured to execute an appropriate software code 215. The software code 215 may for example allow to perform one or more steps to perform one or more of the present aspects or examples. The software code 215 may be stored in the ROM 211b. The apparatus 200 may be interconnected with another apparatus 200 controlling another entity / function of the 5G-AN or the 5GC. . In some examples, apparatus 200 may be configured to provide one or more functions of the 5G-AN or the 5GC. For example, apparatus 200 may be configured to perform at least some functionality of a particular function of the 5G-AN or the 5GC. For example, apparatus 200 may be configured to operate as a particular function of the 5G-AN or the 5GC. In alternative examples, apparatus 200 may be configured to perform at least some functionality of two or more functions of the 5G-AN and / or the 5GC. For example, apparatus 200 may be configured to operate as two or more functions of the 5G-AN and / or the 5GC. The apparatus 200 may comprise one or more circuits, or circuitry (not shown) which may be configured to perform one or more of the present aspects or examples.

[0200] FIG. 3 illustrates an example of a communication device 300. The communication device 300 may be similar to the communication device 102 illustrated in FIG. 1. The communication device 300 may be provided by any device capable of sending and receiving radio signals. Non-limiting examples of a communication device 300 are a user equipment, a terminal, a mobile station (MS) or mobile device such as a mobile phone or what is known as a ’smart phone’, a computer provided with a wireless interface card or other wireless interface facility (e.g., USB dongle), a personal data assistant (PDA) or a tablet provided with wireless communication capabilities, a machine-type communications (MTC) device, a Cellular Internet of things (CIoT) device, or a terrestrial / maritime / aerial vehicle such as a car, a truck, a boat, an air plane, or a drone, or any combinations of these or the like. The communication device 300 may provide, for example, communication of data for carrying communications. The communications may be one or more of voice, electronic mail (email), text message, multimedia, data, machine data and so on. The communication device 300 may receive signals over an air or radio interface 307 via appropriate apparatus for receiving and may transmit signals via appropriate apparatus for transmitting radio signals. In FIG. 3, a transceiver apparatus is designated schematically by block 306. The transceiver apparatus 306 may be provided for example by means of a radio part and associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device.

[0201] The communication device 300 may be provided with at least one processor 301, at least one memory ROM 302a, at least one RAM 302b and other possible components 303 for use in software and hardware aided execution of tasks it is designed to perform, including control of access to and communications with access systems and other communication devices. The at least one processor 301 is coupled to the RAM 302b and the ROM 302a. The at least one processor 301 may be configured to execute an appropriate software code 308. The software code 308 may for example allow to perform one or more of the present aspects. The software code 308 may be stored in the ROM 302a. The communication device 300 may comprise one or more circuits, or circuitry (not shown) which may be configured to perform one or more of the present aspects or examples.

[0202] The processor, storage and other relevant control apparatus may be provided on an appropriate circuit board and / or in chipsets. This feature is denoted by reference 304. The communication device may optionally have a user interface such as keypad 305, touch sensitive screen or pad, combinations thereof or the like. Optionally one or more of a display, a speaker and a microphone may be provided depending on the type of the device.

[0203] FIGS. 5a to 5d show an example signalling and operations diagram for implementing forward secrecy in an extensible authentication protocol authentication and key agreement process using a hybrid key.

[0204] The signalling and operations of FIGS. 5a to 5d involve a UE, network nodes of a serving network (SN), and network nodes of a home network (HN). The UE may comprise mobile equipment (ME) and a subscriber identity module (SIM) (e.g., a universal SIM (USIM)). The network nodes of the SN comprise: an AMF, and a security anchor function (SEAF). The network nodes of the HN comprise: an AUSF, a UDM, an authentication credential repository and processing function (ARPF), and a subscriber identity de-concealing function (SIDF).

[0205] At S501 of FIG. 5a, the UE performs a SUPI to SUCI concealment for initial registration. In some examples, the USIM performs the SUPI to SUCI concealment and sends the SUCI to the ME. A 5G Globally Unique Temporary Identity (5G-GUTI) may be used by the ME (instead of the SUCI / SUPI) if the UE is already registered (with the AMF).

[0206] At S502, the UE (e.g., the ME) transmits a registration request to the SN (e.g., towards the AMF) via a RAN node. The registration request comprises the SUCI, or the 5G-GUTI.

[0207] At S503, an authenticate request message comprising: the SUCI or 5G GUTI, and a name of the SN (SN-name) is provided to the HN. For example, the RAN node will forward the content to the AUSF and UDM of HN.

[0208] At S504, the AUSF provides an authentication get request comprising the SUCI or 5G GUTI and the SN-name to the UDM.

[0209] At S505, the HN (e.g., at least one of: UDM, ARPF, SIDE) performs a de-concealment of the SUCI (or 5G GUTI) and selects the authentication method for the UE. In this example, EAP AKA’ is chosen as the authentication method. The de-concealing / decrypting may be performed by the SIDF. The SIDE is a functional element of the UDM that is responsible for decrypting a SUCI to reveal a UE’s SUPI.

[0210] The HN (e.g., the UDM) generates first key material that comprises a first public key and a first private key. The first key material is associated with the HN (e.g., as the first key material is generated by the HN). Herein, the first public key is referred to as the first HN public key, and the first private key is referred to as the first HN private key. The first key material is associated with a PQC key encapsulation mechanism (KEM). The first HN public key is referred to as ‘HN_pk’, and the first HN private key is referred to as ‘HN_sk’. In some examples, a KEM key generator function will output HN_pk and HN_sk (kemKeyGen() -> (HN _pk, HN_sk)).

[0211] The HN (e.g., the UDM) generates second key material that comprises a second public key and a second private key. The second key material is associated with the HN. Herein, the second public key is referred to as the second HN public key, and the second private key is referred to as the second HN private key. The second key material is an ephemeral key pair. The ephemeral key pair may use Elliptic-curve Diffie-Hellman (ECDH). ECDH is a key agreement protocol that allows two parties, each having an elliptic-curve public-private key pair, to establish a shared secret over an insecure channel. ECDH using ephemeral keys is referred to as ECDHE. In some examples, the UDM generates the second key material when / if the UDM supports forward secrecy.

[0212] In S506, the UDM performs an authentication (or authentication procedure) associated with the UE. The UDM generates an AKA challenge and sends an (EAP AKA’) authentication vector (AV) to the AUSF. A detailed depiction of S506 is shown in FIG. 5b. The UDM generates the authentication vector (AV) based on a long-term key (K) associated with the UE / USIM, and the SN-name. The AV is associated with the home network, and is herein referred to as the home AV. Alternatively, the home AV may be referred to as EAP-AKA’ AV.

[0213] The long-term key, K, is subscriber key which will be stored in a secured environment. All session keys after each authentication are a derivative of the long-term key, wherein the key provisioning occurs in USIM and UDM once. Once derived in the USIM / UDM, it is likely that K will not change for a subscriber. In this manner, a long-term key may be considered to be associated with a SIM or USIM.

[0214] As shown in FIG. 5b, the generation of the home AV utilizes at least one cryptographic function and a key derivation function (KDF).

[0215] The home AV may comprise at least one of the following: a random number (RAND), authentication token (AUTN), an expected response (XRES), a cipher key (prime) (CK’), or an integrity key (prime) (IK’).

[0216] At least part of the authentication may be performed by the ARPF of the home network. The ARPF is a functional element of the UDM that may be responsible for generating 5G home environment authentication vectors (home AV). ARPFs and USIMs store the permanent secrets (i.e., long-term key K) that are the base for short term keys.

[0217] At S507, the UDM sends an authentication get response message comprising the home AV, the SUPI, an authentication and key management for applications (AKMA) indication, the first HN private key (HN_sk) and the first HN public key (HN_pk) to the AUSF.

[0218] The UDM sends the second HN public key to the AUSF. The second HN public key may be comprised in the authentication get response message.

[0219] At S508a, the AUSF stores the XRES (which is comprised in the home AV). The AUSF stores and the first HN private key (HN_sk).

[0220] At S508b, the AUSF forwards the first HN public key (HN_pk) to the AMF. The AUSF also forwards the second HN public key to the AMF. An EAP request and the AKA’ challenge may also be provided to the AMF. The EAP request and / or AKA’ challenge may comprise (or indicate) the home AV.

[0221] In S508c, the AMF transmits, to the UE (e.g., the ME), the first HN public key (HN_pk). The AMF transmits the second HN public key to the UE (e.g., the ME). The first and second HN public keys may be provided in an authentication request message. The authentication request message may comprise at least one of the following: the EAP request, the AKA’ challenge, a unique identifier for the UE (ngKSI), or an Anti-Bidding-down Between Architectures (ABBA) parameter.

[0222] At S509, the UE (e.g., the USIM) validates the AKA’ challenge, and verifies a MAC. The UE may verify that the message authentication code (MAC) (generated by the HN) matches an expected MAC (generated by the UE). If there is not a match, then the authentication may be stopped / failed. The UE may also verify that a sequence number (SQN) is in the correct range. If out of range, then the authentication may be stopped / failed. After the validation and verification is successful (and the UE support forward secrecy), the UE invoke an encapsulation using the first HN private key (HN_pk).

[0223] A detailed depiction of S509 is shown in FIG. 5c.

[0224] The UE (e.g., the USIM) performs an encapsulation for the first public key to derive: a shared secret key (ss) and ciphertext associated with the encapsulation (UE_ct). The encapsulation may be a key encapsulation mechanism (e.g., kemEncaps (HN_pk) -> UE_ct, ss.). UE_ct is the ciphertext representing the encapsulated key and ss is shared secret.

[0225] The UE (e.g., the USIM) derives a hybrid shared key (Ks) based on the shared secret key (ss) and a further shared secret key. The further shared secret key may be referred to as a ‘traditional’ shared secret key.

[0226] The further (or traditional) shared secret key is based on a third private key. The UE (e.g., the USIM) generates third key material comprising a third public key and the third private key.The third key material is associated with UE. The third key material may be an ephemeral key pair (e.g., associated with ECDHE). The UE (e.g., the USIM) derives the further shared secret key based on the third private key (of the UE) and the second HN public key.

[0227] In some examples, the hybrid shared key Ks is generated using a combining function (e.g., a KEM combiner, detailed in https: / / datatracker.ietf.org / doc / draft-ounsworth-cfrg-kem- combiners / ) with input parameters of ss (e.g., the shared secret generated from the KemEncaps function) and the further shared secret (e.g., the secret key generated from the ECDHE keys of the UE and HN).

[0228] In some examples, instead of utilising a combining function, the ss and the further shared secret key are hashed, and then the hashed keys are concatenated together to form the hybrid shared secret (Ks). This may be referred to as a hash and concatenation based approach to derive the hybrid shared secret (Ks).

[0229] In this context, the term ‘hybrid’ is used to indicate that a combination of keys is used to derive Ks. The UE (e.g., the USIM) performs an authentication (or authentication procedure) based on the authentication request (of S508c).

[0230] The UE (e.g., the USIM) generates key material. The key material may comprise an AV. The AV is associated with the UE, and so is herein referred to as the UE AV.

[0231] The generation of key material may utilize at least one cryptographic function and a key derivation function (KDF). The RAND and the AUTN of the home AV are used as an input in order to generate the key material. The long-term key, K, associated with the USIM is also used as an input in order to generate the key material. The SN-name and SQN are also used as an input in order to generate the key material.

[0232] The (generated) key material comprises CK’, IK’, RES, and XMAC.

[0233] At S510a, the UE (e.g., the ME) transmits to the SN (e.g., AMF) an authentication response message comprising the RES and the UE_ct. The authentication response may also comprise an EAP response and an AKA’ challenge (response).

[0234] The third public key (associated with the UE) is also transmitted to the SN. The third public key may be comprised in the authentication response message.

[0235] At S510b, the SN (e.g., AMF) provides, the HN (e.g., AUSF), an authenticate request message comprising the RES and the UE_ct. The authentication request may also comprise the EAP response and the AKA’ challenge (response).

[0236] The third public key (associated with the UE) is also provided to the HN. The third public key may be comprised in the authenticate request message.

[0237] At S511a, the AUSF verifies the RES with XRES (XRES is determined in S506). The AUSF uses the UE_ct and first HN private key (HN_sk) to generate a shared secret key (ss). The AUSF may use a de-encapsulation function using the UE_ct and the first HN private key (HN_sk) in order to generate the ss. The de-encapsulation function may be a KEM deencapsulation function (KEMdecaps). The AUSF generates a further (also referred to as ‘traditional’) shared secret key. The further shared secret key is generated (or derived) based on the second HN private key and the third public key (of the UE).

[0238] The AUSF then generates a hybrid shared key (Ks) based on the shared secret key (ss) and the further shared secret key (generated by the AUSF). The AUSF may generate the hybrid shared key (Ks) using a combining function. For example, the combining function may be a KEM combining function. In this manner, the generated ss from KEMdecaps along with traditional shared secret of ECHDE may be used as an input to a KEM combiner to generate the hybrid shared key Ks. In some examples, instead of utilising a combining function, the ss and the further shared secret key are hashed, and then the hashed keys are concatenated together to form the hybrid shared secret (Ks). This may be referred to as a hash and concatenation based approach to derive the hybrid shared secret (Ks).

[0239] At S511b, the AUSF derives a key for the AUSF (KAUSF) and a key for the SEAF (KSEAF). A detailed depiction of S51 lb is shown in FIG. 5d.

[0240] A (hybrid) master key (MK_HYBRID) is generated in the AUSF based on the hybrid shared key Ks (wherein Ks is referred to as ‘HYBRID_SHARED_SECRET’ in the equation below). The AUSF also derives accompanying keys based on the MK_HYBRID. For example, the AUSF derives an extended master session key (EMSK) based on the MK_HYBRID.

[0241] The AUSF uses CK’ and IK’ in order to derive the KAUSF and the KSEAF. CK’ and IK’ have been generated by the UDM. The UDM provides the CK’ and IK’ to the AUSF for KAUSF / KSEAF generation. The extended master session key (EMSK) is used in order to derive the KAUSF. EMSK is derived from the MK_HYBRID. In some examples, the AUSF derives EMSK based on CK’ and IK’ according to RFC5448 (as seen in FIG. 5d, RFC5448 is used as an input to a KDF to derive the KAUSF.

[0242] The AUSF then derives KSEAF from KAUSF.SN-name is additionally used to derive the KSEAF.

[0243] In this manner, the accompanying keys (e.g., KAUSF, KSEAF, KAMF) are derived by the AUSF based on the hybrid master key (MK_HYBRID).

[0244] The UE also generates a (hybrid) master key, separately to the AUSF. For example, the UE may generate the (hybrid) master key at S514c.

[0245] The hybrid master key (MK_HYBRID) and accompanying keys may be derived as follows, wherein the UE and AUSF first derive the MK_HYBRID and subsequently derive MSK, EMSK as shown below:

[0246] MK_HYBRID = PRF’(IK’\CK’\ HYBRID_SHARED_SECRET,"EAP-AKA’ FS"\

[0247] Identity)

[0248] K_encr = MK[0..127]

[0249] K_aut = MK[128..383]

[0250] K_re = MK_HYBRID [0..255]

[0251] MSK = MK_HYBRID [256..767]

[0252] EMSK = MK_HYBRID [768..1279] where MK_HYBRID = hybrid master key, K_encr = encryption key, K_aut = authentication key, K_re = re-authentication key, MSK = master session key, EMSK = extended master session key. In this manner, the K_re is derived based on the MK_HYBRID. MSK is derived based on the MK_HYBRID. EMSK is derived based on the MK_HYBRID.

[0253] At S512, there is an exchange of further EAP messages between the HN and the UE.

[0254] At S513a, the AUSF provides an authenticate response message comprising an indication of EAP success, the SUPI of the UE, and KSEAF.

[0255] At S513b, the AUSF provides an authentication result confirmation request to the UDM.

[0256] At S513c, the UDM stores the authentication result of the UE. In this example, it is assumed that the UE has been successfully authenticated for the SN.

[0257] At S513d, the UDM provides an authentication result confirmation response message to the AUSF.

[0258] At S514a, the SN (e.g., the SEAF) generates a key for the AMF (KAMF). The SEAF may provide KAMF and the ngKSI to the AMF. A detailed depiction of S514a is shown in FIG. 5d.

[0259] As shown in FIG. 5d, the KSEAF, the SUPI of the UE, and the ABBA may be used as inputs to a KDF to derive KAMF.

[0260] At S514b, the AMF provides (via the RAN node) to the UE, an authentication result or non-access stratum (NAS) security mode command (SMC), comprising the indication of EAP success the ngKSI and the ABBA.

[0261] At S514c, the UE (e.g., the USIM) generates a KAUSF, a KSEAF and a KAMF. The UE (e.g., USIM) also generates a hybrid master key (MK_HYBRID). In this manner, the UE and the AUSF separately generate a hybrid master key. The hybrid master key is generated in the UE based on the hybrid shared key Ks.

[0262] The UE (e.g., the USIM) may derive the hybrid master key and the accompanying keys using the same equations as shown above in S511b.

[0263] A detailed depiction of S514c is shown in FIG. 5d.

[0264] The UE uses CK’ and IK’ in order to derive the Kausf. CK’ and IK’ have been generated by the UE in S509. The UE also derives accompanying keys based on the MK_HYBRID. For example, the UE derives an extended master session key (EMSK) based on the MK_HYBRID. The EMSK is also used in order to derive the KAUSF. KAUSF and the SN-name are used to derive KSEAF. KSEAF, the SUPI and the ABBA are used to derive KAMF. In this manner, the accompanying keys (e.g., KAUSF, KSEAF, KAMF) are derived by the UE based on the hybrid master key (MK_HYBRID).

[0265] It should be understood that, in some examples, one or more of the features of FIGS. 5a to 5d may not be performed, or may be performed in a different order.

[0266] In some examples, at least one attribute (or parameter) is defined for the PQC KEM public key of the HN (HN_pk) to be stored and transmitted in (e.g., for S507, or S508a-c). In some examples, at least one attribute (or parameter) is defined for the ciphertext (UE_ct) to be stored and transmitted in (e.g., for S510a, S510b).

[0267] In some examples, an attribute (e.g., AT_KDF_FS) indicates a key derivation function (KDF) used to derive the hybrid master key (MK_HYBRID). The KDF to be used for the hybrid master key is provided in (e.g., AT_KDF_FS) to both the UE and the AUSF (in FIG. 5a).

[0268] In some examples, a plurality of attributes (e.g., AT_KDF_FS attributes) are included to handle an EAP peer (e.g., a UE) that does not support PQC. The plurality of attributes therefore allow flexibility to interoperate with devices that do not support PQC.

[0269] In some examples, the KDF used to derive the hybrid shared key indicates a higher priority than a KDF used to derive the ‘traditional’ shared key (e.g., a traditional shared key derived using an ephemeral key pair).

[0270] One or more of the examples above have the advantage that the security of an authentication procedure for a UE is improved. In examples, for an EAP AKA’ procedure, two different shared keys are used in order to derive a ‘hybrid’ shared key. The security will be maintained even if all but one of the component algorithms is broken (or stolen, hacked, etc.).

[0271] FIG. 6 shows an example method flow performed by an apparatus. For example, the apparatus may be a user equipment, a mobile equipment, or other communication device.

[0272] In S 601, the method comprises initiating a registration with a serving network in order to establish a session between the apparatus and the serving network.

[0273] In S603, the method comprises receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism.

[0274] In S605, the method comprises performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation.

[0275] In S607, the method comprises deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key. In S609, the method comprises providing, to the network entity, the ciphertext associated with the encapsulation.

[0276] In S611, the method comprises deriving a master key for the session based on the hybrid shared key, Ks.

[0277] FIG. 7 shows an example method flow performed by an apparatus. The apparatus may comprise means for a first network function to perform the features of FIG. 7. The apparatus may comprise at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform the features of FIG. 7. The first network function may be an AUSF. The first network function may be associated with a home network.

[0278] In S701, the method comprises receiving, from a second network function, first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a postquantum cryptography key encapsulation mechanism.

[0279] In S703, the method comprises providing, to a user equipment, the first public key of the first key material.

[0280] In S705, the method comprises receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key.

[0281] In S707, the method comprises performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS.

[0282] In S709, the method comprises deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key.

[0283] In S711 , the method comprises deriving a master key based on the hybrid shared key, Ks.

[0284] FIG. 8 shows an example method flow performed by an apparatus. The apparatus may comprise means for a second network function to perform the features of FIG. 8. The apparatus may comprise at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform the features of FIG. 8. The second network function may be an UDM. The second network function may be associated with a home network.

[0285] In S 801, the method comprises generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism. In S803, the method comprises providing, to a first network function, the first key material comprising the first public key and the first private key.

[0286] FIG. 9 shows an example method flow performed by an apparatus. For example, the apparatus may be a SIM, or a USIM.

[0287] In S901, the method comprises receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism.

[0288] In S903, the method comprises performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation.

[0289] In S905, the method comprises deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key.

[0290] In S907, the method comprises providing, to the apparatus, the ciphertext associated with the encapsulation.

[0291] In S909, the method comprises deriving a master key based on the hybrid shared key, Ks.

[0292] FIG. 10 shows a schematic representation of non-volatile memory media 1000a (e.g. Blu-ray disc (BD), computer disc (CD) or digital versatile disc (DVD)) and 1000b (e.g. solid state memory, flash memory, universal serial bus (USB) memory stick) storing instructions and / or parameters 1002 which when executed by a processor allow the processor to perform one or more of the steps of the methods of FIGS. 6 to 9.

[0293] It is noted that while the above describes example embodiments, there are several variations and modifications which may be made to the disclosed solution without departing from the scope of the present invention.

[0294] The examples may thus vary within the scope of the attached claims. In general, some embodiments may be implemented in hardware or special purpose circuits, software, logic or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although embodiments are not limited thereto. While various embodiments may be illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein may be implemented in, as nonlimiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof. The examples may be implemented by computer software stored in a memory and executable by at least one data processor of the involved entities or by hardware, or by a combination of software and hardware. Further in this regard it should be noted that any procedures may represent program steps, or interconnected logic circuits, blocks and functions, or a combination of program steps and logic circuits, blocks and functions. The software may be stored on such physical media as memory chips, or memory blocks implemented within the processor, magnetic media such as hard disk or floppy disks, and optical media such as for example DVD and the data variants thereof, CD.

[0295] The term “non-transitory”, as used herein, is a limitation of the medium itself (i.e. tangible, not a signal) as opposed to a limitation on data storage persistency (e.g. RAM vs ROM). As used herein, “at least one of the following:” and “at least one of: ” and similar wording, where the list of two or more elements are joined by “and”, or “or”, mean at least any one of the elements, or at least any two or more of the elements, or at least all of the elements.

[0296] The memory may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The data processors may be of any type suitable to the local technical environment, and may include one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASIC), gate level circuits and processors based on multi core processor architecture, as non-limiting examples.

[0297] As used herein, the terms “means for”, “means for performing operations including”, “means configured to perform operations including”, or “means configured to perform” (or similar) may be any means that are suitable for performing the feature(s). The “means” may be configured to perform one or more of the functions and / or method steps previously described. For example, the “means” may include one or more of: at least one processor, at least one memory, transceiver circuitry, antenna circuitry, etc. It should be understood that these are provided as non-limiting examples.

[0298] Alternatively, or additionally some examples may be implemented using circuitry. The circuitry may be configured to perform one or more of the functions and / or method steps previously described. That circuitry may be provided in the base station and / or in the communications device. As used in this application, the term “circuitry” may refer to one or more or all of the following: (a) hardware-only circuit implementations (such as implementations in only analogue and / or digital circuitry); (b) combinations of hardware circuits and software, such as: (i) a combination of analogue and / or digital hardware circuit(s) with software / firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as the communications device or base station to perform the various functions previously described; and (c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.

[0299] This definition of circuitry applies to uses of the term “means” in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example integrated device. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, a cellular network device, or other computing or network device.

[0300] The foregoing description has provided by way of exemplary and non-limiting examples a full and informative description of some embodiments. However, various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing description, when read in conjunction with the accompanying drawings and the appended claims. However, all such and similar modifications of the teachings will still fall within the scope as defined in the appended claims.

Claims

Claims:

1. An apparatus comprising: means for initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; means for receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a postquantum cryptography key encapsulation mechanism; means for performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; means for deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; means for providing, to the network entity, the ciphertext associated with the encapsulation; and means for deriving a master key for the session based on the hybrid shared key, Ks.

2. The apparatus according to claim 1, wherein the apparatus comprises: means for generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and means for providing, to the network entity, a message comprising the second public key of the second key material.

3. The apparatus according to claim 1 or claim 2, wherein the apparatus comprises: means for receiving, from the network entity, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and means for deriving the further shared secret key based on the second private key and the third public key.

4. The apparatus according to any of claims claim 1 to claims 3, wherein the receiving of the second public key of second key material is associated with an authentication for the session.

5. The apparatus according to any of claims 1 to 4, wherein the means for deriving the hybrid shared secret key, Ks, comprises: means for combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks.

6. The apparatus according to any of claims 1 to 4, wherein the means for deriving the hybrid shared secret key, Ks, comprises: means for performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

7. The apparatus according to any of claims 1 to 6, wherein the encapsulation comprises a key encapsulation mechanism, KEM.

8. The apparatus according to any of claims 1 to 7, wherein the apparatus further comprises: means for deriving, based on the master key, at least one of the following: a reauthentication key, a master session key, or an extended master session key.

9. The apparatus according to any of claims 1 to 8, wherein the apparatus is one of: a mobile equipment, a user equipment, a communication device, or a terminal.

10. An apparatus for a first network function, the apparatus comprising means for the first network function to perform: receiving, from a second network function, first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS;deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks.

11. The apparatus according to 10, wherein the means are for the first network function to perform: receiving a second public key of second key material that is associated with the user equipment, wherein the second key material is ephemeral key material.

12. The apparatus according to claim 10 or claim 11 , wherein the deriving the hybrid shared secret key, Ks, comprises: combining the shared secret key, SS, and the further shared secret key to form the hybrid shared secret key, Ks.

13. The apparatus according to claim 10 or claim 11 , wherein the deriving the hybrid shared secret key, Ks, comprises: performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

14. The apparatus according to any of claims 10 to 13, wherein the de-encapsulation comprises a key encapsulation mechanism, KEM, de-encapsulation.

15. The apparatus according to any of claims 10 to 14, wherein the means are for the first network function to perform: deriving, based on the master key, at least one of the following: a re-authentication key, a master session key, or an extended master session key.

16. The apparatus according to any of claims 10 to 15, wherein the first network function is an authentication server function.

17. An apparatus for a second network function, the apparatus comprising means for the second network function to perform:generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; and providing, to a first network function, the first key material comprising the first public key and the first private key.

18. The apparatus according to claim 17, wherein the means are for the second network function to perform: generating third key material comprising a third public key and a third private key, wherein the third key material that is associated with the home network, wherein the third key material is ephemeral key material; and providing, to the first network function, the third key material.

19. The apparatus according to claim 17 or claim 18, wherein the second network function is a unified data management function.

20. A subscriber identity module comprising: means for receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; means for performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; means for deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; means for providing, to the apparatus, the ciphertext associated with the encapsulation; and means for deriving a master key based on the hybrid shared key, Ks.

21. The subscriber identity module according to claim 20, wherein the subscriber identity module comprises: means for generating second key material comprising a second public key and a second private key, wherein the second key material is associated with the apparatus, wherein the second key material is ephemeral key material; and means for providing, to a mobile equipment, the second key material.

22. The subscriber identity module according to claim 20 or claim 21, wherein the subscriber identity module comprises: means for receiving, from the mobile equipment, a third public key of third key material that is associated with the home network, wherein the third key material is ephemeral key material; and means for deriving the further shared secret key based on the second private key and the third public key.

23. The subscriber identity module according to any of claims 20 to 22, wherein the means for deriving the hybrid shared secret key, Ks, comprises: means for combining the shared secret key, SS, and a further shared secret key to form the hybrid shared secret key, Ks.

24. The subscriber identity module according to any of claims 20 to 23, wherein the means for deriving the hybrid shared secret key, Ks, comprises: means for performing, using the shared secret key, SS, and a further shared secret key, a hash operation followed by a concatenation operation to form the hybrid shared secret key, Ks.

25. The subscriber identity module according to any of claims 20 to 24, wherein the encapsulation comprises a key encapsulation mechanism, KEM.

26. The subscriber identity module according to any of claims 20 to 25, wherein the subscriber identity module further comprises: means for deriving, based on the master key, at least one of the following: a reauthentication key, a master session key, or an extended master session key.

27. A method comprising: initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism;performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the network entity, the ciphertext associated with the encapsulation; and deriving a master key for the session based on the hybrid shared key, Ks.

28. A method comprising: receiving, from a first network function, first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks.

29. A method comprising: generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; and providing, to a first network function, the first key material comprising the first public key and the first private key.

30. A method comprising: receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation;deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the apparatus, the ciphertext associated with the encapsulation; and deriving a master key based on the hybrid shared key, Ks.

31. A computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: initiating a registration with a serving network in order to establish a session between the apparatus and the serving network; receiving, from a network entity, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the network entity, the ciphertext associated with the encapsulation; and deriving a master key for the session based on the hybrid shared key, Ks.

32. A computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: receiving, from a first network function, first key material comprising a first public key and a first private key , wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; providing, to a user equipment, the first public key of the first key material; receiving, from the user equipment, ciphertext that is associated with an encapsulation of the first public key; performing a de-encapsulation of the ciphertext and the first private key to derive a shared secret key, SS; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; and deriving a master key based on the hybrid shared key, Ks.

33. A computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: generating first key material comprising a first public key and a first private key, wherein the first key material is associated with a home network, wherein the first key material is associated with a post-quantum cryptography key encapsulation mechanism; and providing, to a first network function, the first key material comprising the first public key and the first private key.

34. A computer program comprising instructions, which when executed by an apparatus, cause the apparatus to perform at least the following: receiving, from an apparatus, a first public key of first key material that is associated with a home network, wherein the first public key is associated with a post-quantum cryptography key encapsulation mechanism; performing an encapsulation for the first public key to derive: a shared secret key, SS, and ciphertext associated with the encapsulation; deriving a hybrid shared key, Ks, based on the shared secret key, SS, and a further shared secret key; providing, to the apparatus, the ciphertext associated with the encapsulation; and deriving a master key based on the hybrid shared key, Ks.

Images