TESLA-for-5G: Broadcast Authentication for 5G Networks Using TESLA

Source: arXiv:2606.26528 · Published 2026-06-25 · By Subin Song, Michael K. Reiter, Taekyoung Kwon

TL;DR

This paper addresses the critical vulnerability in 5G networks where base stations (gNBs) broadcast unauthenticated system information (SI), specifically System Information Block 1 (SIB1), enabling attackers to deploy fake base stations (FBS) that impersonate legitimate cells. Existing solutions rely on digital signatures for each SIB1 message, which impose heavy computational overhead on resource-constrained user equipment (UE). The authors propose TESLA-for-5G (TF5), a novel broadcast authentication protocol that combines the TESLA delayed key disclosure mechanism with the GG09 Schnorr-like identity-based signature (IBS) scheme. TF5 bootstraps trust with a single IBS signature during cell entry and subsequently authenticates each SIB1 message efficiently with symmetric-key MACs, avoiding per-message expensive signature verification.

The authors formally verify TF5's security properties under a strong Dolev–Yao adversary model using the Tamarin prover. They implement TF5 in the OpenAirInterface 5G stack and evaluate its performance through trace-driven analysis and benchmarking against eight baseline schemes, including certificate-based, pairing-based, and IBS schemes. Results show TF5 achieves roughly a 55–65% reduction in daily UE verification costs compared to a signature-only baseline, with a low end-to-end latency (~109 ms for returning UEs). Communication and storage overheads also remain within practical limits for 5G SI messages. These contributions present a practical, formally verified solution to achieve scalable broadcast authentication in 5G.

Key findings

• TF5 reduces daily UE verification costs by 55–65% compared to signature-only GG09 IBS verification in two diverse real-world mobility traces.
• End-to-end latency for returning UEs to complete cell camp after SIB1 decoding is ~109 ms, including TESLA MAC verification and key disclosure wait time.
• UE-side verification latency for the initial GG09 IBS signature bootstrap is ~454 µs on a Raspberry Pi 4B device; TESLA MAC verification on each SIB1 costs ~4 µs on the same device.
• TF5’s per-message air-interface overhead is 53 bytes, fitting comfortably within the 5G SIB1 372-byte capacity, with total overhead of 187 bytes combining bootstrap and per-message data.
• TF5’s TESLA parameter set and runtime state require ~444 bytes of UE memory, affordable for mobile devices.
• Formal verification using Tamarin proves source authentication, message integrity, and replay protection hold for gNBs with uncompromised keys under the Dolev–Yao adversary.
• Chain renewal via TESLA MAC-protected next-chain commitments allows seamless key chain transitions without repeated IBS signature verification.
• Pairing-based signature schemes are 1–2 orders of magnitude slower than TF5 and other Schnorr-based schemes for UE verification.

Threat model

The adversary is a computationally bounded Dolev–Yao attacker who controls the wireless broadcast channel, capable of injection, modification, replay, and blocking of messages, including deployment of rogue fake base stations broadcasting forged system information at arbitrary power. The attacker may compromise individual gNB signing keys but cannot compromise the core network PKG, break standard cryptographic assumptions, or mount physical/relay-layer attacks. The UE and legitimate gNB clocks are loosely but sufficiently synchronized to enable TESLA timing based on SSB signals.

Methodology — deep read

1. Threat Model and Assumptions: The adversary is a computationally bounded Dolev–Yao attacker controlling the wireless channel capable of eavesdropping, injection, modification, and replay of broadcast messages and deployment of rogue gNBs with arbitrary transmission power. The adversary may compromise individual gNB signing keys but cannot break core cryptographic assumptions or the core network infrastructure controlling the Private Key Generator (PKG). The UE and gNB clocks are loosely synchronized within a few seconds (via GNSS or NTP). Relay attacks, physical-layer jamming, and waveform manipulation are outside the threat model.

2. Data: The evaluation utilizes two real-world UE mobility and Radio Resource Control (RRC) trace datasets collected from environments in Durham, NC (car-dominated) and Seoul, South Korea (dense urban), each comprising hundreds of hours of UE cell reselections, handovers, and idle returns triggering SIB1 acquisition. Android-based logging recorded detailed protocol events used for trace-driven simulation of verification cost.

3. Architecture: TF5 integrates two main cryptographic components—TESLA, a delayed key disclosure symmetric-key broadcast authentication scheme, and GG09, a Schnorr-like pairing-free identity-based signature (IBS) scheme. The PKG in the core network generates GG09 IBS keys for authorized gNBs identified by their cell ID and validity window. Upon cell entry, the UE verifies a dedicated bootstrap message (SIB-TF5) signed with GG09 IBS to obtain TESLA parameters and a root key commitment. Then, TESLA authenticates all subsequent SIB1 messages via efficient MAC verification using keys disclosed after a one-interval delay. Next-chain TESLA key commitments are embedded within SIB1 broadcasts for seamless chain renewal.

4. Training Regime: Not applicable (cryptographic protocol design). However, performance evaluation was done via implementation on OpenAirInterface 5G stack and benchmarking on desktop and Raspberry Pi 4B platforms with statistical averaging over 1000 runs.

5. Evaluation Protocol: Security properties (source authentication, integrity, replay protection) were formally verified with the Tamarin prover modeling the TF5 protocol under Dolev–Yao adversaries including compromised gNB keys. Empirical evaluation benchmarks latency and computation overheads against 8 baseline schemes spanning certificate-based, pairing-based, and IBS protocols. Communication overhead was analytically estimated per 3GPP SI message constraints. A trace-driven simulator derived daily UE verification cost reductions on real-world mobility traces. State caching and chain renewal mechanisms were ablated in simulation to quantify their benefits.

6. Reproducibility: Evaluation code and Tamarin models are to be released upon publication; OpenAirInterface platform and libsodium implementations were used. Real mobility trace datasets appear proprietary and were anonymized.

Concrete example: A UE entering a cell receives SIB-TF5 containing a GG09 signature over TESLA parameters. It verifies this single signature to bootstrap trust. Then, for each 160ms interval (~the SIB1 broadcast period), the UE buffers incoming SIB1 messages authenticated by a TESLA MAC keyed by a chain key from the TESLA key chain. Each TESLA key is disclosed after a one-interval delay, allowing the UE to verify the MAC with minimal computation (using symmetric cryptography). The UE uses cached trust anchors and next-chain commitments embedded in broadcast SIB1 extensions to avoid repeated expensive signature verification, dramatically reducing computational load compared to verifying every SIB1 with the GG09 signature scheme alone.

Technical innovations

• Integration of TESLA delayed key disclosure with GG09 Schnorr-like identity-based signatures to bootstrap trust for broadcast authentication of 5G SIB1 messages.
• Design of a dedicated bootstrap message (SIB-TF5) carrying GG09 IBS signatures over TESLA parameters, enabling a single signature verification per cell entry.
• Embedding TESLA next-chain commitment keys within each SIB1 broadcast to enable seamless TESLA key chain renewal without repeated expensive IBS signature verification.
• Detailed formal verification of both the GG09 IBS bootstrapping and the TESLA MAC-based broadcast authentication phases under a strong Dolev–Yao adversary model using the Tamarin prover.
• Trace-driven evaluation methodology combining real UE mobility and RRC state transitions with event-driven simulation to quantify daily UE verification cost savings in practical 5G environments.

Datasets

• TD (Durham, NC, USA) — ~371 hours of modem-level RRC state transition traces across 590 reselections, 1,079 handovers, and 1,763 idle returns — proprietary Android-based logging app
• TS (Seoul, South Korea) — ~376.5 hours of similar RRC traces with 2,008 reselections, 2,825 handovers, and 6,481 idle returns — proprietary Android-based logging app

Baselines vs proposed

• GG09 IBS baseline: daily UE verification cost = 42.1 ms (TD), 149.6 ms (TS) vs TF5: 27.7 ms (TD, 34.0% reduction), 105.2 ms (TS, 29.7% reduction)
• End-to-end latency for returning UE camp completion: baseline undefined; TF5 achieves 108.8 ms mean latency
• UE verification time on Raspberry Pi 4B: GG09 IBS bootstrap ~454 µs vs TESLA MAC per-message verification ~4 µs
• TF5 per-message communication overhead = 53 bytes vs CertECDSA baseline = 67 bytes
• Pairing-based schemes (Hes03, BLMQ): UE verification >500 µs on RPi 4B vs TF5 bootstrap ~454 µs and TF5 MAC ~4 µs

Limitations

• TESLA requires loose time synchronization (within ~1 ms) between gNB and UE clocks; TF5 relies on unauthenticated SSB timing signals and assumes no malicious manipulation of SSB timing by legitimate gNBs.
• MIB broadcast messages remain unauthenticated due to payload size constraints, exposing minor denial-of-service risks though not more severe attacks.
• Relay attacks and physical-layer signal manipulation attacks are outside the threat model and not mitigated by TF5.
• Compromise of a single gNB’s signing key breaks security for that cell but does not affect other cells; however, key revocation and management overhead are not deeply addressed.
• The formal security proof models ideal cryptographic primitives and symbolic trace time rather than real-time delays; implementation subtleties could pose unforeseen practical challenges.
• Trace-driven evaluation simulates known events but may not capture all UE behaviors or network conditions affecting verification cost and latency.

Open questions / follow-ons

• How robust is TF5 to clock synchronization errors, including potential malicious clock manipulation or timestamp delays?
• Can TF5 be extended to authenticate MIB messages or accommodate 5G SI messages with tighter size constraints?
• What are the practical challenges and overheads of key revocation and management for ~millions of cell IDs in large-scale deployments?
• How effective is TF5 against combined physical-layer and protocol-layer attacks such as relay or jamming that modify timing or block key disclosures?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, TF5 offers an instructive example of leveraging delayed key disclosure and identity-based cryptography to achieve efficient broadcast authentication in highly constrained wireless environments. The approach addresses the tension between cryptographic assurance and computational cost—key for client-side resource-limited devices akin to bots or embedded clients. While TF5 targets 5G mobile network system information messages, the principle of bootstrapping trust via a single signature and subsequently using lightweight symmetric verification can inspire CAPTCHA mechanisms that require scalable and low-latency verification at large scale.

Moreover, the formal modeling approach using symbolic protocol verification (Tamarin) under a strong adversary model demonstrates rigorous security validation for broadcast authentication systems. Defenses relying on broadcast trust anchors, delayed key disclosures, and chaining might also be applicable in bot-defense contexts where distributed clients must verify ephemeral server challenges securely and efficiently under adversarial injection. Lastly, the tradeoffs in latency, communication overhead, and caching state are relevant design considerations for any real-time authentication protocol deployed at Internet scale against adaptive adversaries.

Cite

@article{arxiv2606_26528,
  title={ TESLA-for-5G: Broadcast Authentication for 5G Networks Using TESLA },
  author={ Subin Song and Michael K. Reiter and Taekyoung Kwon },
  journal={arXiv preprint arXiv:2606.26528},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.26528}
}

Read the full paper

• arXiv:2606.26528 (abstract)
• arXiv:2606.26528 (PDF)