SUCI and SUPI: what identity concealment in 5G actually does

The design splits one thing into two. The subscription still has a permanent identifier, allocated by the operator and held on the subscriber module, and it still behaves the way the earlier identity behaved: unique, stable, resolvable to an account. What changed is that this value is no longer what the device puts on the air. Before transmission the device encrypts it with a public key belonging to its home operator, and sends the result.

The encryption is arranged so that the output differs on each computation, even for the same subscription. This matters more than the confidentiality itself. A value that were merely encrypted but constant would be just as good a tracking token as the original, because an observer does not need to know what a number means in order to recognise it again. Freshness is what breaks the linkage, and without it concealment would be cosmetic.

Part of the request stays readable, and by design. The network the device is currently talking to has to know which home operator to forward the exchange to, so the country and operator prefix travels in the clear. An observer therefore still learns which operator the subscription belongs to, and where the subscription is registered, while learning nothing about which subscription it is. That is the trade the specification makes explicitly.

The technique described on the mechanism page depends on asking a handset for its permanent identity and receiving something useful. Under concealment the question can still be asked and the handset still answers, but the answer is a fresh envelope that the asker cannot open and cannot match against anything it collected yesterday. The attack is not blocked; its output is devalued to the point of uselessness.

That distinction is worth holding onto, because it explains the shape of what remains. A device standing in for a cell can still capture attachments, still observe the presence of subscriptions belonging to a given operator, and still see how many devices are in range. What it can no longer do is say which subscriptions those are, or recognise that the subscription in front of it is the one it saw last week.

The protection also has a boundary that is easy to overlook: it applies to the generation that implements it. Earlier generations are still in service, and a handset using one of them is in the position it was always in. Concealment on the fifth generation and a fallback to the second generation are not contradictory statements, and where both are available the weaker one determines the outcome.

Alongside the encryption schemes, the specification defines an option that applies no concealment and transmits the permanent identifier unchanged. It is not an oversight. There are situations where the alternative to sending the identifier is failing to provide service, and a specification that made concealment unconditional would have made those situations unserviceable.

The consequence is that the security property depends on deployment. Whether a given subscription is concealed depends on what its home operator provisioned on the module and what its configuration selects, and a subscriber has no practical way of establishing which is in force. So the accurate statement about concealment in the fifth generation is that the capability is standardised and mandatory to support, while its use in any particular network is a matter of that network’s configuration.

This is the recurring pattern in mobile network security and it is not specific to identity: the specification defines what is possible, the deployment decides what is true, and the gap between them is where the residual risk lives.

The relationship between the two bodies of work is discussed on the specifications page.