← Back to Blog Industry

6G Research and PQC: ITU-T and 3GPP Direction

12 min read

Every cellular generation arrives roughly every ten years. 1G in the early 1980s. 2G in the 1990s. 3G in the early 2000s. 4G around 2010. 5G in 2020. 6G is targeted for around 2030. The research is happening now, the standards are being shaped now, and the architectural decisions being made today will determine how secure the next decade of mobile communication is. Unlike previous generations, 6G is being designed in a world where post-quantum cryptography is no longer a research topic. The NIST standards exist. The migration timelines are clear. And 6G has the unusual opportunity to bake in PQC from day one rather than retrofit it later.

The two main standards bodies driving 6G are ITU-R, which sets the international vision through IMT-2030 (the successor to IMT-2020 which defined 5G), and 3GPP, which translates the vision into detailed technical specifications. ITU-R published the IMT-2030 framework in November 2023, defining the requirements that 6G needs to meet. 3GPP began Release 19 work in 2023 on 5G-Advanced and is expected to begin 6G normative work around Release 21 (timeline 2027 to 2030). Post-quantum cryptography is mentioned explicitly in early 6G security research and is expected to be a baseline requirement.

What ITU-R IMT-2030 Says

ITU-R Recommendation M.2160, "Framework and overall objectives of the future development of IMT for 2030 and beyond", was approved in November 2023. It defines six broad usage scenarios for 6G:

Immersive Communication (extended reality, holographic communications)
Massive Communication (very high-density IoT)
Hyper Reliable and Low-Latency Communication (industrial automation, telesurgery)
Ubiquitous Connectivity (rural, satellite-integrated coverage)
Artificial Intelligence and Communication (network-integrated AI, distributed intelligence)
Integrated Sensing and Communication (the network as a sensor)

Each of these scenarios has implications for cryptography. Holographic communications require ultra-low-latency security with sub-millisecond cryptographic processing. Massive IoT requires lightweight cryptography that scales to trillions of devices. AI integration raises new questions about model integrity, training data confidentiality, and inference privacy. Sensing integration means the network itself collects fine-grained physical-world data that must be protected.

ITU-T Study Group 17 is the security study group, and it has been actively working on PQC topics in parallel. ITU-T X.1816, "Guidelines for cryptographic algorithm transition", provides general guidance on quantum-resistant migration. More specific 6G security recommendations are expected in 2026 to 2028.

What 3GPP Is Doing in 5G-Advanced

3GPP Release 17 (frozen 2022) introduced reduced-capability NR (RedCap) for IoT, NR coverage enhancements, and various 5G-Advanced precursors. Release 18 (frozen 2024) is the first 5G-Advanced release, with significant work on AI/ML for the air interface, integrated sensing, network slicing enhancements, and enhanced security including initial PQC studies.

The most relevant security work is TR 33.700-41, "Study on enabling Post-Quantum Cryptography in 5G". This study item examines:

Migration of SUCI from ECIES to PQ-secure profiles
PQ migration of authentication protocols
Application of PQC to the SBA TLS layer
Crypto-agility framework for future algorithm transitions
Performance and overhead implications

Release 19 work is targeted for finalization in 2025 to 2026 and is expected to include the first normative PQC specifications for 5G. Release 20 (2027 to 2028) is expected to expand PQC coverage and lay groundwork for the 6G transition.

Read more about the 5G core context in 5G core network PQC.

Why 6G Has the Opportunity to Be PQC-Native

5G was designed with classical public-key cryptography because PQC standards did not exist when 5G work began in 2017. Migrating 5G to PQC is now a retrofit problem: existing protocols must add hybrid modes, existing certificates must be reissued, existing devices must be updated. This is the standard pain of any cryptographic transition.

6G has the unusual opportunity to start fresh. By the time 6G specifications are written (2027 to 2030), PQC will be:

Standardized by NIST (already done as of 2024)
Standardized by IETF for major protocols (TLS, DNSSEC, SSH, IPsec, etc.)
Implemented in mainstream cryptographic libraries (BoringSSL, OpenSSL, BouncyCastle, etc.)
Hardware-accelerated in commodity silicon (vendors are adding ML-KEM acceleration)
Deployed in production at scale (the migration of TLS on the public Internet is well underway)

This means 6G can be specified with PQC as the default, with classical algorithms either retired or relegated to hybrid mode for backward compatibility. The practical implication is that 6G security architecture should look quite different from 5G's TS 33.501.

What "PQC-Native" Could Mean for 6G

Several technical decisions are different in a PQC-native architecture:

Identity protection: 5G's SUCI uses ECIES with Curve25519 or P-256. A PQC-native equivalent would use ML-KEM-768 directly. The trade-off is bandwidth: SUCI grows from 32 bytes to about 1100 bytes. 6G is targeting much higher data rates than 5G, so the relative cost of larger SUCI is smaller.

Certificates: 5G uses RSA or ECDSA certificates today. A PQC-native 6G would use ML-DSA-65 certificates by default, with possibly hybrid certificates for backward compatibility with legacy roaming partners. ML-DSA-65 signatures are about 3.3 KB, so certificate chains are larger but still tractable.

Key derivation: AKA-style key derivation already uses HKDF, which is quantum-resistant. The 6G equivalent would likely use HKDF or KMAC and derive long-term keys from PQC-protected seeds.

Symmetric algorithms: AES-256 is quantum-resistant when used with appropriate parameters. 6G is likely to standardize on AES-256-GCM or ChaCha20-Poly1305 for confidentiality and AES-CMAC or Poly1305 for integrity.

Signature schemes: For network function authentication and software signing, ML-DSA is the primary candidate, with SLH-DSA as a high-assurance alternative for long-term signing where hash-only security is preferred.

Sensing Integration and New Attack Surfaces

One of the new IMT-2030 capabilities is "Integrated Sensing and Communication" (ISAC). The radio infrastructure doubles as a sensor network: by analyzing reflected radio signals, the network can detect motion, presence, and physical objects without explicit sensors deployed.

This creates a new privacy and security problem. Sensing data is sensitive: it can reveal which rooms are occupied in a building, when employees come and go, where vehicles are parked. The cryptography that protects sensing data must be at least as strong as the cryptography that protects voice or messaging.

For PQC, this means sensing data flows need the same hybrid PQC protection as user plane data. The architecture is still being designed, but most early proposals treat sensing as another data type with the same security requirements as user data.

Distributed AI and Confidential Computing

Another IMT-2030 capability is integration of AI into the network itself. The radio scheduler runs ML models. The core network uses ML for anomaly detection. Edge applications use ML for everything from object detection to language processing.

This creates new cryptographic requirements:

Model confidentiality: protecting trained model weights from extraction
Inference privacy: hiding what the user is asking the AI from the network
Training data confidentiality: protecting data used in federated learning
Model integrity: ensuring the model has not been tampered with

For all of these, post-quantum cryptography matters because the data flows are long-lived and high-value. A federated learning round that an adversary records today and decrypts in 2040 reveals training data that may still be sensitive.

For a deeper look at edge cryptography, see edge computing PQC.

Quantum Networks and 6G

There is a parallel research thread on actual quantum networks: communication channels that use quantum mechanics for security via quantum key distribution (QKD) or for distributed quantum computing. ITU-T Y.3800 and Y.3801 define reference architectures for quantum networks integrated with classical networks.

Most 6G research treats quantum networks as a complement to classical PQC rather than a replacement. QKD has limitations (line-of-sight or fiber, limited distance without trusted relays, infrastructure cost) that mean it cannot replace ubiquitous public-key cryptography. PQC is the practical answer for protecting traffic at scale; QKD is the answer for specific high-value point-to-point links.

The ITU-T framework recognizes this and recommends a layered approach: PQC for general traffic, optional QKD overlay for specific high-assurance links. Most 6G operators are unlikely to deploy QKD at scale; nearly all will deploy PQC.

Crypto-Agility as a First-Class Requirement

One lesson from the slow 5G-to-PQC migration is that cryptographic agility, the ability to swap algorithms cleanly, is a system property that must be designed in from the start. 5G has limited agility because many protocols hard-code specific algorithm choices.

6G architecture proposals universally treat crypto-agility as a first-class design requirement. The expected pattern is:

Algorithm identifiers in every cryptographic header
Negotiation of cryptographic suites at every protocol layer
Centralized policy that can update suites across the network
Test vectors and validation suites for every supported algorithm

This is the right answer regardless of PQC. It also means the next algorithm transition (whatever it is) will be easier than the PQC transition has been.

For more on the broader migration context, see the NIST FIPS guide and hybrid encryption.

What Operators Should Be Doing Now

Even though 6G is years away, decisions made now affect 6G readiness:

Migrate 5G control plane to hybrid PQC during 5G-Advanced rollouts. This builds operational experience.
Inventory cryptographic dependencies. Many operators do not know exactly which algorithms are used where in their networks.
Engage with vendors on crypto-agility roadmaps. Insist that every new platform support algorithm updates as configuration changes, not firmware revisions.
Update procurement requirements to mandate PQC support in new equipment.
Train staff on PQC concepts and migration patterns.

Spectrum and Regulatory Considerations

6G is expected to use new spectrum bands, including possibly sub-terahertz frequencies (above 100 GHz) for ultra-high-bandwidth scenarios. Higher frequencies mean shorter range, more directional beams, and different propagation characteristics, but they do not directly affect cryptography.

What does affect cryptography is regulatory compliance. National regulators (FCC in the US, Ofcom in the UK, ITU regional bodies) set licensing terms that increasingly include cryptographic requirements. Mandates for PQC in commercial telecom infrastructure are expected to appear from 2027 onwards in some jurisdictions.

For 6G, regulators are likely to mandate PQC from the start rather than retrofit it later. This gives 6G a stronger foundation than 5G but adds complexity to the standardization process because regulatory requirements must be coordinated across many jurisdictions during 6G specification.

Open Source 6G Reference Implementations

Like 5G with srsRAN, Open5GS, and similar open source implementations, 6G is expected to have open source reference implementations that researchers, operators, and vendors can build on. These reference implementations will likely be PQC-aware from day one because they are being developed in the post-NIST-PQC era.

Early 6G research platforms have already integrated PQC libraries. Universities and research labs are publishing prototypes that use ML-KEM and ML-DSA for 6G control-plane experiments. This research will inform 3GPP normative specifications and will likely accelerate operator adoption of PQC in production 6G.

Roaming, Inter-Operator PKI, and SS7 Lessons

The 5G ecosystem inherits a long history of inter-operator security gaps. SS7 vulnerabilities documented since the 2010s allowed location tracking and SMS interception across roaming partners. Diameter, the SS7 successor in 4G core networks, has its own catalog of cross-operator authentication weaknesses. 5G's Service Based Architecture (SBA) and the SEPP (Security Edge Protection Proxy) component were specifically designed to address inter-operator security, but the deployment of SEPP across the global operator base is incomplete, and many roaming relationships still rely on weaker mechanisms during the transition.

For 6G, the inter-operator PKI question is critical. The PLMN (Public Land Mobile Network) PKI, which authenticates operators to each other and signs roaming agreements, must transition to post-quantum cryptography ahead of the broader 6G rollout. GSMA, the industry body coordinating operator PKI, has begun planning this transition. The GSMA NESAS (Network Equipment Security Assurance Scheme) and the related supplier security baseline are evolving to include PQC requirements. Operators should expect their RAN equipment vendors (Nokia, Ericsson, Samsung Networks, NEC) and core network vendors (Ericsson, Nokia, Cisco, Mavenir) to provide PQC-capable products as part of the 6G procurement cycle.

The lesson from SS7 and Diameter is that backward compatibility creates security debt. 6G's design opportunity is to make pure PQC the default for inter-operator communication while supporting hybrid mode for backward compatibility with legacy 5G partners. Operators who participate actively in GSMA and 3GPP standardization can shape this design.

Frequently Asked Questions

When will 6G actually deploy? Initial commercial deployments are targeted for 2030. Mature large-scale deployment is expected by 2032 to 2035, similar to the 5G timeline.

Will 6G phones still work with 5G networks? Yes. Like every previous transition, 6G devices will support 5G as a fallback. The cryptographic implication is that 6G devices will need to support both PQC and classical cryptography for backward compatibility, at least during the 6G transition period.

Is 6G going to use hybrid PQC or pure PQC? This is an open question. The conservative view (preferred by national security operators and many researchers) is hybrid PQC during the 6G transition, with pure PQC eventually as classical algorithms are deprecated. The aggressive view is pure PQC from day one, given that PQC standards will be mature by the time 6G ships. Most likely outcome: hybrid in early 6G releases, pure PQC by later releases.

Will 6G specify SLH-DSA, ML-DSA, or both? Probably both, with ML-DSA as the primary signature scheme and SLH-DSA as an option for high-assurance long-term signing where hash-only security is required. The signature size difference (ML-DSA at 3.3 KB vs SLH-DSA at 8 to 50 KB depending on parameters) makes ML-DSA the practical default.

What about FN-DSA (Falcon)? FN-DSA was standardized as FIPS 206 in 2024 with smaller signatures than ML-DSA but more complex implementation. It may appear in 6G as an option for size-constrained applications. Operators evaluating it cite the implementation complexity and side-channel risk as reasons for caution.

How will 6G handle satellite-integrated coverage and NTN cryptography? Non-Terrestrial Networks (NTN) are part of 5G NR and will expand significantly in 6G. The cryptographic challenge for NTN is the longer round-trip time (LEO satellites have 5 to 50 ms RTT, GEO satellites have 250 to 600 ms RTT). PQC handshakes that involve more round trips than classical handshakes can become noticeably slower over satellite links. 3GPP TR 38.821 and related NTN study items are exploring optimized handshake structures and 0-RTT mechanisms that work for both terrestrial and satellite paths. The expectation is that 6G will have NTN-aware PQC profiles that minimize round trips.

What is the relationship between 6G and the broader IoT PQC migration? 6G includes massive IoT scenarios with trillions of connected devices. Many IoT devices have constrained processing and memory budgets that make full ML-KEM and ML-DSA expensive. NIST's lightweight cryptography standardization (Ascon as the winner) covers symmetric primitives but the asymmetric story for tightly constrained devices is still emerging. 6G IoT profiles are expected to use ML-KEM-512 and ML-DSA-44 (the smaller variants) where the device can support them, with potentially additional schemes optimized for the smallest devices as the standardization landscape continues to evolve.

Sources

ITU-R Recommendation M.2160, "Framework and overall objectives of the future development of IMT for 2030 and beyond", https://www.itu.int/rec/R-REC-M.2160/en
ITU-T X.1816, "Guidelines for cryptographic algorithm transition", https://www.itu.int/rec/T-REC-X.1816/en
3GPP TR 33.700-41, "Study on enabling Post-Quantum Cryptography in 5G", https://www.3gpp.org/DynaReport/33700-41.htm
NIST FIPS 203, "Module-Lattice-Based Key-Encapsulation Mechanism Standard", https://csrc.nist.gov/pubs/fips/203/final
NIST FIPS 204, "Module-Lattice-Based Digital Signature Standard", https://csrc.nist.gov/pubs/fips/204/final
ITU-T Y.3800, "Overview on networks supporting quantum key distribution", https://www.itu.int/rec/T-REC-Y.3800/en
GSMA. "Network Equipment Security Assurance Scheme (NESAS)." https://www.gsma.com/security/network-equipment-security-assurance-scheme/

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY