It‘s a very cool approach, I think where it falls short is that each UE will get the same key.
Much of the infrastructure around LTE & 5G is based on the assumption that noone but the operator has this key. However, since everyone has this key, it must now be considered public (since every SIM card can be used decode and encode any connection from any user).
This means that:
- The full connection plaintext will be leaked (yes, you should do TLS, but Metadata)
- The IMEI (unique and persistent identifier of a phone) can be requested at will from an attacker (and is often requested by the operator at the beginning), thus allowing you to be tracked not only by the operator, but by any entity sniffing the wireless channel
- Measurement Reports containing the exact GPS coordinates can be sniffed or requested by anyone
Comments
It‘s a very cool approach, I think where it falls short is that each UE will get the same key.
Much of the infrastructure around LTE & 5G is based on the assumption that noone but the operator has this key. However, since everyone has this key, it must now be considered public (since every SIM card can be used decode and encode any connection from any user).
This means that:
- The full connection plaintext will be leaked (yes, you should do TLS, but Metadata) - The IMEI (unique and persistent identifier of a phone) can be requested at will from an attacker (and is often requested by the operator at the beginning), thus allowing you to be tracked not only by the operator, but by any entity sniffing the wireless channel - Measurement Reports containing the exact GPS coordinates can be sniffed or requested by anyone
Still, it could be something for 6G for sure.