# A Formal Analysis of 5G Authentication

arXiv: https://arxiv.org/abs/1806.10360 · HTML: https://mlsanity.com/paper/1806.10360/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Jun 2018.

## Built on by (most cited first, 7 of 7)

- [SPEC5G: A Dataset for 5G Cellular Network Protocol Analysis](https://mlsanity.com/paper/2301.09201/) (2023)
- [Hermes: Unlocking Security Analysis of Cellular Network Protocols by Synthesizing Finite State Machines from Natural Language Specifications](https://mlsanity.com/paper/2310.04381/) (2023)
- [Machine Learning Assisted Security Analysis of 5G-Network-Connected Systems](https://mlsanity.com/paper/2108.03514/) (2021)
- [From Ambiguity to Explicitness: NLP-Assisted 5G Specification Abstraction for Formal Analysis](https://mlsanity.com/paper/2308.03277/) (2023)
- [Hierarchical Network Data Analytics Framework for B5G Network Automation: Design and Implementation](https://mlsanity.com/paper/2309.16269/) (2023)
- [A Security Verification Framework of Cryptographic Protocols Using Machine Learning](https://mlsanity.com/paper/2304.13249/) (2023)
- [A Formal Analysis of Agent Payment Protocols](https://mlsanity.com/paper/2609.00060/) (2026)

## Abstract (arXiv)

Mobile communication networks connect much of the world's population. The security of users' calls, SMSs, and mobile data depends on the guarantees provided by the Authenticated Key Exchange protocols used. For the next-generation network (5G), the 3GPP group has standardized the 5G AKA protocol for this purpose. We provide the first comprehensive formal model of a protocol from the AKA family: 5G AKA. We also extract precise requirements from the 3GPP standards defining 5G and we identify missing security goals. Using the security protocol verification tool Tamarin, we conduct a full, systematic, security evaluation of the model with respect to the 5G security goals. Our automated analysis identifies the minimal security assumptions required for each security goal and we find that some critical security goals are not met, except under additional assumptions missing from the standard. Finally, we make explicit recommendations with provably secure fixes for the attacks and weaknesses we found.