In 5G, the non-access stratum (NAS) carries the control signalling between the device and the core network: registration, mobility management and session management all travel over NAS between the UE and the Access and Mobility Management Function (AMF). 3GPP protects NAS with a ciphering algorithm and an integrity algorithm, but it also defines a null ciphering algorithm, NEA0 in the 5G security architecture and 5G-EA0 in the NAS protocol specification, that applies no confidentiality at all. That algorithm exists for a reason and is a legitimate part of the standard. The security question is not whether NEA0 exists, but where and when it ends up in use, because a NAS connection running null ciphering exposes signalling content that operators usually assume is protected.
This article explains what 5G NAS ciphering protects, what the null algorithm removes, how the network chooses the NAS algorithms, when null ciphering is legitimate, what it exposes when it is not, how it can end up applied to ordinary traffic, and how to detect and harden against it.
What 5G NAS ciphering protects, and what null ciphering removes
NAS messages between the UE and the AMF carry sensitive control information: the registration requests that attach a device to the network, mobility updates as it moves, session management that sets up data connectivity, and slice selection information such as the requested NSSAI (network slice selection assistance information). 3GPP TS 33.501 defines two independent protections for this traffic: ciphering, which provides confidentiality, and integrity protection, which detects tampering and replay.
These two protections are separate, and this is the detail that makes null ciphering easy to misread. NEA0 switches off confidentiality while integrity protection, if a real integrity algorithm is selected, can still apply. In that state the NAS payload is authenticated against tampering but is readable by anyone able to observe the signalling. The messages are not forgeable, but they are no longer private. For control traffic that operators generally treat as confidential, that is a meaningful gap, and it is invisible unless someone checks which algorithm was actually negotiated.
The 5G NAS security algorithms
3GPP defines a small, fixed set of algorithms for 5G, and it is worth naming them precisely because the null members of each family are the ones that matter here. For ciphering there are NEA0 (the null algorithm, no confidentiality), 128-NEA1 (based on SNOW 3G), 128-NEA2 (based on AES) and 128-NEA3 (based on ZUC). For integrity there is a mirrored family: NIA0 (the null integrity algorithm), 128-NIA1, 128-NIA2 and 128-NIA3, based on the same underlying primitives.
The non null algorithms all use 128-bit keys and are considered strong; the practical strength of a given NAS connection therefore comes down to which algorithm was selected, not to a weakness in the algorithms themselves. NEA0 and NIA0 are the exceptions by design: they provide no confidentiality and no integrity respectively, and they exist to cover specific cases where protection cannot be established. Everything in this article is about keeping those two null members confined to the narrow situations they were meant for.
How the network chooses NAS algorithms: the Security Mode Command
The algorithm selection happens through the NAS Security Mode Command (SMC) procedure, and understanding it is what lets you reason about how null ciphering can slip in. After primary authentication with 5G-AKA or EAP-AKA prime succeeds and a security context exists, the AMF selects the NAS ciphering and integrity algorithms based on two inputs: the UE 5G security capabilities that the device advertised, and the AMF local policy and its ordered list of allowed algorithms.
The AMF then sends a NAS Security Mode Command that is integrity protected with the newly selected algorithm, and the UE replies with a NAS Security Mode Complete that is both ciphered and integrity protected. Because the command is integrity protected, the UE can detect if its advertised capabilities were altered in transit, which is the standard defence against a bidding down attack that tries to force a weaker algorithm. Only a limited set of cleartext information elements are allowed to travel before this security context is established, which bounds, but does not eliminate, what is exposed early in the exchange.
The security of this procedure depends on two things being right. The AMF must be configured to select a strong algorithm and to reject or deprioritise the null algorithms for normal service, and the capability handling must be robust so that tampered or downgraded capabilities are detected rather than accepted. When either of those is wrong, the same procedure that is meant to protect NAS can instead settle on NEA0.
When NEA0 (5G-EA0) is legitimate
Null ciphering is not a bug, and treating every appearance of it as an attack will produce false positives. 3GPP permits NEA0 and NIA0 for unauthenticated emergency calls, where the priority is reachability: an emergency call must connect even when the network cannot authenticate the subscriber or establish a normal security context, so the standard allows the null algorithms in that narrow case. Regulatory obligations around emergency access are the reason the null option has to exist at all.
The corollary is just as important. Outside unauthenticated emergency service, NEA0 and NIA0 should not be in use for normal, authenticated traffic. A NAS connection that has authenticated successfully and is carrying ordinary registration, mobility and session signalling has no legitimate reason to run null ciphering. So the detection goal is not to eliminate NEA0, it is to confine it to the emergency case and to flag it everywhere else.
What null ciphering exposes
When NAS runs with null ciphering on ordinary traffic, the direct effect is that NAS control content is readable to a passive observer of the signalling. The most cited example is the requested NSSAI: if slice selection information travels in the clear, an observer can learn which network slices a subscriber is asking for, which can reveal the type of service or the class of customer behind the connection. Beyond slice information, other NAS control content and the general baseline of confidentiality for the connection are weakened.
It is worth being precise about what null NAS ciphering does not automatically do, because the risk is often overstated. 5G conceals the permanent subscriber identity by sending it as a SUCI rather than a cleartext IMSI, and that concealment is a separate mechanism from NAS ciphering. Null NAS ciphering is therefore a signalling confidentiality problem, not an automatic disclosure of the permanent identity. The identity linkability question is a distinct topic, covered in our post on 5G-AKA linkability attacks and why 5G did not kill the IMSI catcher. Keeping the two apart matters: conflating them leads teams to either dismiss null ciphering as harmless or to overclaim what it reveals.
How null ciphering ends up in use
There are two broad paths by which NEA0 reaches ordinary traffic, and they call for different responses.
The first is misconfiguration. If policy, a roaming configuration, or the AMF algorithm list permits NEA0 for normal service, the network can select it legitimately as far as the protocol is concerned, with no attacker involved. This is the more common and more overlooked path, precisely because it produces no error and no alarm: the network is doing exactly what it was told to do, and the exposure is invisible unless someone inventories the negotiated algorithms.
The second is downgrade or false base station scenarios. Here an attacker manipulates the algorithm selection, for example by influencing the advertised UE security capabilities or by operating a rogue radio, to push a connection toward null ciphering. This overlaps with the wider family of fake base station and overshadowing attacks on the 5G air interface, and with the location and tracking techniques discussed in our post on location tracking attacks in mobile networks. The integrity protection of the Security Mode Command is the designed defence against the capability tampering variant, which is why validating that defence is a specific test rather than an assumption.
How to detect and harden against NAS null ciphering
Because null ciphering is silent by nature, detection is mostly a matter of looking for it deliberately rather than waiting for it to announce itself. A practical programme covers the following, in priority order:
- Inventory the NAS ciphering and integrity algorithms actually negotiated across the network, rather than assuming the configured policy is the effective one.
- Restrict NEA0 and NIA0 to unauthenticated emergency service in AMF policy, and confirm that restriction holds for roaming configurations too.
- Validate the AMF capability handling against bidding down: confirm that tampered or downgraded UE security capabilities are detected through the integrity protected Security Mode Command.
- Monitor for the conditions associated with downgrade, including unexpected null ciphering on authenticated connections and radio anomalies consistent with a false base station.
- Add NAS algorithm selection as an explicit test case in 5G security assessments, so that null ciphering on ordinary traffic is something you find on purpose rather than by accident.
The through line is that NEA0 is a legitimate tool with a narrow purpose, and the risk is entirely about scope. Kept to unauthenticated emergency service it is exactly what the standard intends; allowed onto normal authenticated traffic, whether through misconfiguration or downgrade, it quietly removes a layer of confidentiality that operators assume is always present. For a wider view of how NAS sits within the 5G core, see our overview of the mobile core network and its security risks.
If you want NAS algorithm selection and downgrade resistance checked as part of a 5G assessment, or help building detection for null ciphering on your network, reach us at [email protected].
