5G was supposed to end IMSI catching for good. Every prior generation — 2G, 3G, 4G — transmitted the subscriber's permanent identity in cleartext at some point during attach or registration, and every commercial cell-site simulator on the market was built to exploit exactly that moment. The Subscription Concealed Identifier (SUCI), introduced in 3GPP TS 33.501, was the first genuine architectural fix: the permanent identity never has to leave the device unencrypted, even during initial network contact.
It didn't work out that way in practice. 3GPP also standardized a fallback — the "Null Protection Scheme" — for emergency calling and lab use, and that fallback has shown up in production deployments where it was never supposed to exist. When an AMF accepts Null Scheme outside an emergency context, or a rogue gNB forces a UE into a registration path that uses it, the permanent 5G subscriber identity goes out over the air exactly as plaintext as a 2010-era IMSI. This is the direct 5G-era descendant of the classic IMSI catcher — same rogue-cell mechanics, same physical-proximity requirement, same outcome, just wearing a different protocol.
This research covers the SUCI/SUPI concealment architecture 3GPP designed to replace plaintext IMSI transmission, the Null Scheme fallback and the configuration gap that reopens it, the rogue gNB kill chain used to force Null-Scheme exposure, the CVE-2022-43677 real-world finding, and the AMF/USIM-level controls that close the gap permanently.
I. SUCI: What 5G Was Supposed to Fix
Under 2G/3G/4G, the IMSI is transmitted in the clear during the initial Attach or Location Update procedure — that single window is what every commercial IMSI catcher is built around. 5G's SUCI removes that window by encrypting the subscriber-specific portion of the identity before it ever reaches the air interface.
SUCI structure (3GPP TS 23.003):
SUCI = [ SUPI Type | MCC | MNC | Routing Indicator | Protection Scheme ID |
Home Network Public Key ID | Scheme Output ]
The Scheme Output field is where the actual protection happens. Under the normal schemes, it's an ECIES (Elliptic Curve Integrated Encryption Scheme) ciphertext of the MSIN — the subscriber-specific digits of the IMSI:
Protection Scheme 1 (ECIES-P256) or 2 (ECIES-P384):
Scheme Output = ECIES_encrypt(MSIN, HPLMN_public_key)
→ Only the Home PLMN's UDM holds the private key to decrypt it
→ SUPI is never visible on the radio interface or the N1 (NAS) interface
Every device on a properly configured 5G network derives its Home Network Public Key from USIM provisioning (EF_SUCI_Calc_Info, TS 31.102 §5.3.48), so the concealment is enforced at the SIM level — not something the network can simply turn off on its end for a single subscriber.
II. The Null Scheme: A Standardized Gap
3GPP also defines Protection Scheme ID = 0 — the Null Scheme — where the Scheme Output field contains the MSIN in plaintext, unencrypted:
Protection Scheme ID: 0 ← Null Scheme
Scheme Output (MSIN): 1234567890 ← SUPI visible on the air interface
This isn't a bug in the spec. It exists for two narrow, legitimate purposes:
- Emergency registration (
urn:service:sos) on networks or devices that cannot resolve a Home Network Public Key — public safety takes priority over identity concealment - Controlled lab/test environments without ECIES key infrastructure
The problem is deployment drift. Several real-world conditions push Null Scheme outside those two boundaries:
III. Kill Chain: Forcing Null-Scheme SUPI Exposure
The exploitation path mirrors classic rogue base station deployment almost exactly — the mechanics of attracting a UE to a rogue cell haven't changed since 2G. What's different is what the attacker is fishing for once the UE connects.
Step 1 — Deploy a Rogue NR Cell on the Target ARFCN
An SDR broadcasts a 5G NR cell matching the target operator's PLMN (MCC/MNC) at higher signal power than the legitimate cell, triggering standard 3GPP TS 38.304 idle-mode cell reselection:
<CodeBlock language="bash" is-terminal code=" # srsRAN gNB configuration (authorized lab use only) gnb: gnb_id: 0x19B ran_node_name: 'TelcoSec-TestgNB' plmn: '26207' # Target operator MCC+MNC tac: 1
Cell broadcasts higher RSRP than legitimate cell
-> UE performs cell reselection (3GPP TS 38.304)"
The rogue cell doesn't need to complete authentication — the SUCI is transmitted in the very first Registration Request, before any mutual authentication has occurred.
Step 2 — Capture the Registration Request and Inspect Protection Scheme ID
The 5GS Registration Request carries the SUCI as a Mobile Identity IE. A rogue cell configured to only advertise Null Scheme support (or one where the UE has no valid Home Network Public Key for any offered scheme) forces the UE toward Protection Scheme ID 0:
<CodeBlock language="bash" is-terminal code="5GS Registration Request: 5GS Registration Type: Initial Registration 5GS Mobile Identity: Identity Type: SUCI SUCI: SUPI Format: IMSI MCC: 262, MNC: 07 Routing Indicator: 0000 Protection Scheme ID: 0 # Null Scheme - SUPI in plaintext Home Network Public Key ID: 0 Scheme Output (MSIN): 1234567890 # SUPI visible"
Step 3 — Bidding-Down NSA UEs Through the LTE Anchor
For 5G NSA devices — 5G NR for data, LTE/EPC for control — forcing a fallback to the LTE anchor sidesteps SUCI entirely, since the anchor never implements it:
1. Suppress NR carrier signals in range (targeted RF interference on n78/n77)
2. UE falls back to LTE (E-UTRAN) registration
3. UE sends LTE ATTACH REQUEST with IMSI in plaintext
-> No SUCI protection exists on the 4G control plane
This is functionally identical to the downgrade attacks documented against 4G/5G devices — the SUCI improvement on the 5G side becomes irrelevant the moment the device is pushed back to an anchor technology that predates it.
Step 4 — Harvest SUPI for Downstream Correlation
Once recovered, the SUPI (IMSI-equivalent under 5G) enables the same follow-on tradecraft as a legacy IMSI harvest — location profiling, targeted signaling attacks, and cross-referencing against other intercepted identifiers to build a subscriber profile.
IV. Real-World Impact
IMPACT OF 5G SUCI NULL-SCHEME EXPOSURE
✗ SUPI exposed in plaintext - the exact identity leak 5G was designed to close
✗ Defeats the primary subscriber-privacy improvement 5G holds over 4G
✗ UE has no notification mechanism - the exposure is invisible to the user
✗ Enables the same follow-on tracking as legacy IMSI catcher harvests
✗ NSA UEs remain exposed to full plaintext IMSI via LTE anchor fallback
MITRE FiGHT Mapping
| TTP ID | Name | Maps To |
|---|---|---|
| FGT5040 | SUCI Null Scheme Exploitation | Rogue gNB triggering Null-Scheme SUCI registration |
| FGT5040.001 | Protocol Bidding-Down for IMSI Exposure | NSA LTE anchor fallback exposing plaintext IMSI |
V. Closing the Gap
amf:
security:
suci:
null_scheme_allowed: false
null_scheme_emergency_only: true
protection_schemes:
- id: 1 # ECIES-P256 (mandatory)
- id: 2 # ECIES-P384 (optional)
on_null_scheme_non_emergency:
action: reject
cause: "5GMM Cause #11 - PLMN not allowed"
log: true
USIM-side enforcement closes the gap even against a hostile network: provisioning EF_SUCI_Calc_Info (TS 31.102 §5.3.48) with a mandatory ECIES scheme and the Home Network Public Key means the UE itself refuses to generate a Null-Scheme SUCI, regardless of what a rogue or misconfigured cell requests.
Network-side detection should treat unexpected neighbour-cell reports, Null-Scheme registration attempts of any kind, and unexplained NR-to-LTE fallback bursts as correlated rogue-cell indicators (GSMA FS.37 §5.1) — the same monitoring discipline covered in our rogue base station detection research.
For the broader RAN threat model this attack sits inside — jamming, bidding-down, O-RAN interface exposure — see Vulnerabilities of the RAN Air Interface. For the 5G core architecture that the AMF and UDM operate within, see 5G Network Security Architecture.
VI. Frequently Asked Questions
That was the design intent, and it works when a network correctly enforces ECIES and rejects Null Scheme outside emergency registration. The problem documented here isn't a flaw in SUCI itself — it's that 3GPP's necessary emergency-services exception (Null Scheme) has leaked into general production use through misconfiguration, particularly in NSA deployments and default open-source core configurations.
No. A correctly configured 5G SA network with ECIES enforced and Null Scheme rejected outside emergency context is not vulnerable to this specific technique — that configuration was tested and held in the IEEE S&P 2022 research. The exposure shows up in NSA deployments anchored on LTE, and in 5G SA cores (commercial and open-source) where Null Scheme acceptance wasn't explicitly locked down.
The rogue-cell mechanics are identical to classic IMSI catcher deployment — attract a UE with a stronger signal, capture the identity during initial registration, no authentication required. What changed is the target field: instead of a bare IMSI, the attacker is either forcing Null-Scheme SUCI or bidding the device down to an anchor technology that never had identity concealment to begin with.
Yes, and it's the most robust control available to a subscriber. A USIM provisioned with a mandatory ECIES protection scheme (TS 31.102 §5.3.48) will not generate a Null-Scheme SUCI even if a rogue or misconfigured network requests one. This is stronger than relying on the network's AMF configuration alone, since it removes the decision from the network side entirely.
Only partially. Disabling 2G closes the oldest and easiest downgrade path, but the NSA bidding-down technique described here targets the LTE anchor directly — a device can be pushed off 5G NR onto 4G without ever touching 2G. Full protection requires 5G SA deployment with Null Scheme disabled at the network, combined with USIM-level ECIES enforcement.
Conclusion & Next Steps
SUCI is a real architectural improvement over every prior generation's plaintext identity exposure — but it is only as strong as its weakest configured path. The Null Scheme exception exists for a narrow, legitimate reason, and every AMF deployment that doesn't explicitly gate it behind emergency registration reopens the exact identity exposure 5G was built to close. NSA deployments compound the problem by giving an attacker a second, entirely separate route back to plaintext IMSI through the LTE anchor.
The defense stack is straightforward and well-specified: reject non-emergency Null Scheme at the AMF, provision USIMs with mandatory ECIES so the device itself won't cooperate with a hostile request, and monitor for the rogue-cell indicators — unexpected neighbour cells, Null-Scheme registration attempts, unexplained inter-RAT fallback — that the same detection discipline built for classic IMSI catchers already covers.
