#Code decipher tool how to#
#Code decipher tool registration#

Wireshark 3.0 or above installed on the computer on which this tool is running, as tshark of wireshark is needed to read the pcap file.

#Code decipher tool registration#

Your pcap need to contain the registration request or identity response message from UEs so that the tool could retrieve the SUPI from that, the pcap need to contain authentication request message as well so that the tool could retrieve the CK/IK based on the rand value during authentication procedure. Prerequisite needed to make this tool work: With the encryption key derived, we can decrypt the NAS payload based on below scheme of ciphering-data defined in 33.401 Annex B. This tool currently support deriving the encryption key based on secret key and OP only, as it's supposed to be used for internal testing so it's shouldn't be a problem to get secret key and OP, it may support later the derivation of encription key based on Kseaf captured between AUSF and SEAF(AMF). shared key and encryption key for SUCI decryption.ДҐG AKA authentication procedure defined by 33.501, from which we could retrieve the RAND value and compute CK/IK and eventually get the encryption key of NAS to decrypt NAS payload.ДЄn alternative way to derive KAMF and KNASenc key is to capture the message between AUSF and SEAF, then derive the Kseaf from message, by that, we can eventually derive the KAMF & KNASenc without having to get the secret key and OP value,as usually secret key and OP are quite confidential and won't be exposed to outside user. With the CK/IK and below key derivation scheme defined in 3GPP 33.501, we can eventually derive the KAMF and the subsquent KNASenc key to decipher the NAS payload.Д«elow is the Key derivation scheme defined by 33.501, based on which we could compute the Eph. decription key to decrypt the SUCI and get the plain text based SUPI.Д«elow is the diaram of encryption of SUPI based on ECIES:ДЇurther more, after getting SUPI,if we have the secret key of UE and OP(or OPc) of network,we can retrieve the RAND/MAC/RES value from authentication request in pcap file, then compute the CK/IK based on Milenage algorithm(3GPP 35.205/35.206) on our own. shared key based on the private key of home network and Eph. public key of UE in regisration request message from pcap file,then we can compute the Eph.

The encrption of ECIES profileA or profileB is based on below diagram, so if we have the private key of home network, and retreive the Eph.

#Code decipher tool how to#

The basic idea of how to decipher the 5G NAS message:ДЈGPP TS 33.501 Annex C defines Elliptic Curve Integrated Encryption Scheme (ECIES) to conceal the Subscription Permanent Identifier(SUPI) in registration request. Support 5G AKA authentication only, no EAP-AKAвЂ™ support. NAS ciphering with EEA1(snow3G)/EEA2(AES)/EEA3(ZUC) Current limitation: SUCI encryption based on profile A(curve 22519) or profile B( EC secp256r1)Д«. Pycryptodome: a self-contained Python package of low-level cryptographic primitivesД¬ryptography: a package which provides cryptographic recipes and primitives to Python developersД¬ryptoMobile: python wrappers around 3G and LTE encryption and integrity protection algorithms Supported ciphering algorithm:ДЄ. Pyshark: Python wrapper for tshark, allowing python packet parsing using wireshark dissectors By that, we can browse and check the deciphered NAS details by wireshark very easily. So I come up with this idea to write a python program to decipher the 5G NAS payload retrieved from pcap file, then write the plain NAS payload back into the pcap file.

5G_ciphered_NAS_decipher_tool A python tool to decipher/decrypt 5G ciphered NAS payload and export plain 5G NAS payload back into wireshark pcap fileДuring my work in 5G testing and troubleshooting, I have been seeing many cases that 5G NAS message captured in wireshark are ciphered by AES,snow3G, or ZUC, and the SUCI in registration request could also be ciphered by profileA/profileB defined in 3GPP 33.501.