SUCI probing in the wild: cracking 5G's privacy promise across commercial European networks

The identifier that wasn't supposed to leak

For three mobile generations, the IMSI travelled in the clear at every initial registration. Anyone with a software-defined radio and a hundred euros of hardware could stand on a street corner and harvest the unique fingerprint of every phone within range. The IMSI Catcher became one of the best-documented surveillance tools of the past decade, used by states, criminals, and an awkward middle ground of private actors.

5G's answer was the SUCI — the Subscription Concealed Identifier. An encrypted version of the IMSI, derived using elliptic-curve cryptography with the operator's public key and a per-registration ephemeral key. Two layers of defence: the IMSI never travels unencrypted, and each SUCI is unique even for the same subscriber, so you cannot track a device just by watching its identifier change.

On paper, this closes the IMSI Catcher era. In the specification, the cryptography is sound. The encryption scheme (ECIES) is reviewed, well understood, and not what we are about to attack. The vulnerability is somewhere else entirely — in how the SUCI is used by the 5G Authentication and Key Agreement procedure, and in a design choice the specification made for backward compatibility that nobody quite remembered to revisit.

An authentication procedure with three exits

To understand why this works, you need to look at exactly how a USIM card verifies an authentication challenge. When a 5G network wants to authenticate a subscriber, it sends an Authentication Request containing two values: a random number (RAND) and an authentication token (AUTN). The USIM does three checks, in this order, and the order matters more than anything else in this story.

Notice what this gives the attacker. If they replay an old RAND/AUTN pair captured from a known target, the MAC verification will succeed only when the challenge was originally derived for that subscriber's secret key. If it succeeds, the SQN check comes next — and the captured SQN is by now out of range, so the USIM returns Synch_Failure. If the MAC verification fails, the USIM returns MAC_Failure first and never gets to the SQN check at all.

Two different error codes, leaking exactly the information an attacker needs to know.

SUCI-Cracker, in two phases

The attack has a prerequisite worth stating plainly: you need to know the target's IMSI beforehand. Practically, this means catching it with a classic 2G/3G/4G IMSI Catcher — still trivial, still legal-grey, still operational in 2025. The SUCI-Cracker is not the complete surveillance pipeline, it is the missing link that breaks 5G's claim to be a clean break from the past.

Once you have the target IMSI, the attack runs in two phases. Phase 1 happens on a legitimate 4G network — quietly, just observing one authentication. Phase 2 happens later, anywhere, against any SUCI the attacker wants to test.

Three countries, four operators, one Faraday cage

Lab demonstrations are not field results. We chose three European countries with mature commercial 5G Standalone deployments — Spain, Germany, and the United Kingdom — and bought regular consumer SIM cards over the counter in the operators' own stores. No insider access, no privileged credentials, no test SIMs. Just whatever a normal customer would walk out with.

For each SIM, the first step was checking whether the operator had actually activated the SUCI protection. This is done by reading the SIM's elementary files (EF.SUCI_Calc_Info, EF.Routing_Indicator) using the open-source pySim-shell tool. Of the four operators tested, all four had SUCI capability turned on — so all four became valid targets.

Results — Authentication Response scenario

This is the fastest variant: capture, immediate replay, hope the SQN is still fresh. The exact same SIM is used in both phases, with no activity between them. Time is measured from the start of Phase 1 to confirmed correlation.

Results — Synch_Failure scenario

The harder variant: between Phase 1 and Phase 2, the SIM is used normally on the network, advancing the SQN counter until the captured value is stale. Phase 2 still works — the MAC verification succeeds (so the attacker still gets confirmation) but now the USIM returns Synch_Failure instead of Auth Response. Both leak the answer.

The variation matters. Operator D in the UK was the fastest in both scenarios — a window of five and a half minutes is operationally trivial for a determined attacker. Operator C in Germany took nearly seven hours in the harder scenario because of a stricter authentication policy. None of these times are limits in any meaningful sense; they reflect how often the network forces re-authentication, which is a configuration choice, not a defence.

Why this needs a specification change, not a patch

The honest version of the mitigation story: this is a specification-level fix. The 3GPP Authentication Failure message exposes the cause as a plain integer — #20 for MAC failure, #21 for Synch failure, #26 for non-5G authentication. Those integers are the leak. As long as an attacker can tell which check failed, the linkability attack works.

What would actually fix it:

• Encrypt the failure cause inside the Authentication Failure message. The USIM and the network already share keys that could derive a one-shot key for this purpose.
• Verify MAC and SQN before responding at all. Currently the USIM responds quickly with whatever cause it hit first. A constant-time, single-response model would close the side channel.
• Re-evaluate AKA's backward compatibility. The linkability flaw was identified in 3G and 4G research papers more than a decade ago. 5G inherited it for backward compatibility with USIMs. The cost of that compatibility is what this paper documents.

What an individual operator can do today is more limited: monitor for unusual patterns of authentication failures, especially repeated MAC_Failure spikes from a single SUCI range. It is not a fix, it is a detection layer. The fix has to go through 3GPP.

What people ask us about this research