One 5G frame, two security contexts — reading a decrypted NR attach

In a recent 5G radio capture, Wireshark work-item 19757 presented a trace with the user equipment's keys, providing an unusually transparent insight into the two security contexts used. The capture, taken at the MAC layer of a single cell with NEA2 (AES) ciphering and NIA2 (AES-CMAC) integrity, showcased how 5G secures the core and the radio separately, with both procedures running simultaneously.

Frames 11-16 displayed the NAS (core) Security Mode procedure between the UE and the AMF, repeated twice. Frames 17-18 introduced the AS (radio) Security Mode Command from the gNB, employing NEA2/NIA2 with separate peer and key sets. Frame 38 contained both states, showing an RRC Reconfiguration readable due to deciphered PDCP by the AS keys, carrying a NAS PDU with security-header type 2 that remained an opaque blob.

Underneath, a third context protected IMS signaling inside PDCP with IPsec, resulting in an SDAP user plane with QFI 2 and an 18-bit sequence number. The UE never acknowledged the RRC Release, with a repeated RLC PollRetransmit. The identical SN and MAC-I indicated retransmission, not a second command.

The keys provided with the capture were crucial in deciphering the RRC Reconfiguration and the entire user plane, which would otherwise remain opaque PDCP blobs and keep NEA2 in its NEA2 state. The full walkthrough covered six phases frame by frame, and six companion articles dissected the same capture layer by layer. The complete walkthrough can be found at https://www.eventhelix.com/5G/nr-attach-air-interface/.