RFC 9048

Q: What does the Introduction section cover in RFC 9048 — EAP-AKA' Updates?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 9048 — EAP-AKA' Updates. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the SUCI Identity Handling section cover in RFC 9048 — EAP-AKA' Updates?

The SUCI Identity Handling section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 9048 — EAP-AKA' Updates. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Bidding-Down Prevention section cover in RFC 9048 — EAP-AKA' Updates?

The Bidding-Down Prevention section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 9048 — EAP-AKA' Updates. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Key Derivation Clarifications section cover in RFC 9048 — EAP-AKA' Updates?

The Key Derivation Clarifications section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 9048 — EAP-AKA' Updates. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the AT_CHECKCODE Enhancement section cover in RFC 9048 — EAP-AKA' Updates?

The AT_CHECKCODE Enhancement section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 9048 — EAP-AKA' Updates. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

Improved Extensible Authentication Protocol Method for 3GPP Mobile Network Authentication and Key Agreement (EAP-AKA')

Standards Track Updates: RFC 5448

October 2021

Abstract: This document is an updated specification of EAP-AKA'. It addresses 5G-specific identity handling with SUCI, strengthens bidding-down prevention, clarifies key derivation, and aligns the protocol with 3GPP TS 33.501 authentication procedures for 5G System.

Canonical source: https://www.rfc-editor.org/rfc/rfc9048 | IETF Datatracker

1. Introduction

▶

RFC 9048 updates RFC 5448 to align EAP-AKA' with 5G System requirements. Key motivations include SUCI-based identity privacy, stronger bidding-down prevention, and clearer integration with the 5G authentication architecture.

2. SUCI Identity Handling

▶

In 5G, the UE's permanent identity (SUPI) is protected by encrypting it into a Subscription Concealed Identifier (SUCI). RFC 9048 specifies how SUCI is used in EAP-AKA' identity exchanges.

SUCI Format: The SUCI is a NAI (Network Access Identifier) containing the encrypted MSIN portion of the SUPI, using the home network's public key (ECIES Profile A or B, per TS 33.501 Annex C).

3. Bidding-Down Prevention

▶

RFC 9048 strengthens the AT_BIDDING mechanism to prevent downgrade from EAP-AKA' to EAP-AKA. The server MUST set the D bit in AT_BIDDING when it supports AKA', and the peer MUST verify this bit.

AT_BIDDING D-bit = 1: Server supports EAP-AKA' (peer must verify)
If peer supports AKA' but receives EAP-AKA Challenge, it MUST reject if AT_BIDDING D-bit was previously seen
Prevents an attacker from forcing the weaker EAP-AKA method to obtain non-network-bound keys

4. Key Derivation Clarifications

▶

RFC 9048 clarifies the key derivation functions and their integration with the 5G key hierarchy, specifically the derivation of K_AUSF from EMSK.

Key	Derivation	Length
CK', IK'	KDF(CK\|\|IK, SN_name, SQN⊕AK)	256 bits total
MK	SHA-256(Identity \|\| IK' \|\| CK')	512+ bits (via PRF)
MSK	PRF(MK)[0..63]	512 bits
EMSK	PRF(MK)[64..127]	512 bits
K_AUSF	EMSK[0..255]	256 bits
K_SEAF	KDF(K_AUSF, SN_name)	256 bits
K_AMF	KDF(K_SEAF, SUPI, ABBA)	256 bits

5. AT_CHECKCODE Enhancement

▶

AT_CHECKCODE is strengthened to use SHA-256 (instead of SHA-1 in EAP-AKA) for computing the hash over exchanged EAP messages. This provides a cryptographic binding of the pre-authentication message exchange.

6. Security Considerations

▶

SUCI privacy: Permanent identity never sent in cleartext over the air interface
Bidding-down: Mandatory AT_BIDDING verification prevents EAP-AKA' → EAP-AKA downgrade
Key binding: CK'/IK' derivation binds to serving network name
5G alignment: Key derivation chain matches TS 33.501 Annex A exactly
ABBA parameter: Anti-Bidding Between Architectures parameter prevents cross-generation downgrade (5G→4G)