← Back to Blog Guide

Post Quantum Cryptography for 5G and 6G Telecom: What 3GPP, ETSI, and GSMA Are Doing

14 min read

Why Telecom Cannot Skip Post Quantum Cryptography

A 5G core network moves the most sensitive traffic on the planet. Subscriber identities, roaming handshakes, law enforcement intercepts, backhaul between base stations, and the control plane between operators all travel over cryptographic channels designed long before quantum computing was taken seriously. A large cryptographically relevant quantum computer would break the elliptic-curve and RSA math that underpins 5G SUCI concealment, interworking certificates, and service-based interface TLS. The question for mobile network operators is not whether Post Quantum Cryptography is coming to their networks, but how fast they can migrate and how much historical ciphertext an adversary will already have by then.

This guide walks telecom engineers and product managers through the quantum-safe programs active inside 3GPP, ETSI, GSMA, and ATIS as of 2026. It explains what is actually in the standards today, what is still being drafted, and where operators should be putting cryptographic agility work right now.

The HNDL Threat in Mobile Networks

Harvest Now, Decrypt Later means an adversary captures encrypted traffic today, stores it, and decrypts it in ten or fifteen years when a quantum computer becomes available. Telecom is uniquely exposed to this threat because:

Interception of N6, N9, and backhaul traffic is within reach of nation-state adversaries.
Intercepted content often retains value for decades (diplomatic cables, defense contracts, trade secrets, long-lived user profiles).
Subscriber identity concealment (SUCI) uses ECIES with Curve25519 or P-256, which Shor's algorithm dismantles in polynomial time.
Operator-to-operator roaming agreements are signed with classical PKI that will long outlive current asymmetric assumptions.

Michele Mosca's theorem states that if X is how long your data must stay confidential, Y is how long it takes you to migrate, and Z is how long until a quantum computer arrives, then X plus Y greater than Z means you are already late. For mobile operators, X is typically decades and Y is multi-year. Z is the uncertain variable, but the 2025 Global Risk Institute survey puts the 10-year pessimistic probability of a cryptographically relevant quantum computer at 28 percent, with the optimistic estimate now at 49 percent.

What 3GPP Is Actually Doing

3GPP Service and System Aspects Working Group 3 (SA3), the security working group, has opened a study item and a normative work item on the transition to Post Quantum Cryptography. The work is partial and in progress. As of Release 19 and expected Release 20 work, SA3 is examining where quantum-resistant algorithms need to plug in across the 5G architecture:

SUCI concealment using ML-KEM as an alternative to ECIES.
TLS 1.3 hybrid key establishment for service-based interfaces (SBA) between network functions.
Network domain security (NDS/IP) and IKEv2 upgrades.
Authentication and key agreement (AKA) primitives and the long-term key K.
Roaming interfaces including IPX and SEPP (Security Edge Protection Proxy).

The work item is the first formal acknowledgement from 3GPP that quantum-resistant cryptography has to enter the mobile standard. Operators should expect profile annexes specifying ML-KEM key sizes and hybrid combinations rather than any forklift replacement of existing primitives in the near term.

ETSI TS 103 744 and the Hybrid Key Exchange Standard

ETSI published Technical Specification 103 744 as a quantum-safe hybrid key exchange profile. Version 1.1.1 landed in December 2020 and Version 1.2.1 was published in March 2025. The specification defines how to combine a classical key exchange (such as ECDH over Curve25519 or P-384) with a post-quantum KEM (such as ML-KEM) to produce a single shared secret that remains secure as long as at least one of the two underlying algorithms holds. This is important: TS 103 744 is about hybrid key exchange, not QKD interoperability. If a vendor claims TS 103 744 compliance, they are running hybrid classical plus PQC, not a quantum key distribution link.

Hybrid is the right default for telecom today. It hedges against both classical attacks on early PQC implementations and against quantum attacks on classical primitives. It also lets operators deploy PQC without betting everything on a standard that is still young.

ATIS and the North American View

The Alliance for Telecommunications Industry Solutions published a whitepaper, Preparing 5G for the Quantum Era, in February 2025. The document lays out a migration framework for North American carriers, focusing on inventorying quantum-vulnerable cryptography, prioritizing long-lived secrets, and beginning hybrid deployments on high-value interfaces. ATIS does not write the core 5G spec, but it coordinates US operator positions into 3GPP and informs FCC and NTIA policy. The whitepaper echoes what 3GPP and ETSI are saying: hybrid first, crypto agility everywhere, and do not wait for a formal 6G start.

What 6G Will Ship With

6G research is explicit that Post Quantum Cryptography is a baseline requirement rather than a bolt-on. Research consortia across Europe (Hexa-X-II), Japan (Beyond 5G), and the US are assuming ML-KEM and ML-DSA as the asymmetric primitives from day one. Expect 6G to formalize:

Crypto agility as a first-class requirement in the control plane.
Post-quantum SUCI concealment by default.
Native integration of quantum-safe authentication and roaming.
Possible accommodation of QKD at the optical transport layer, separate from the logical PQC layer above.

6G is unlikely to ship commercially before the early 2030s. The NSA CNSA 2.0 deadline for national security systems is 2035, which aligns roughly with commercial 6G rollout. Operators that start PQC migration on 5G now will have the operational experience to deploy quantum-safe 6G without panic.

V2X, eSIM, and the IoT Edge

Cellular V2X uses IEEE 1609.2 certificates based on ECDSA over P-256 and P-384. None of that is quantum-safe. eSIM provisioning relies on GSMA SGP.22 and SGP.32, which also use classical asymmetric primitives. GSMA has begun discussions around post-quantum eSIM but no normative specification has been finalized as of April 2026. This is a known gap, and vehicle OEMs and IoT device makers should demand crypto-agile profiles from their telecom partners.

Practical Migration Steps for Operators

Any operator serious about quantum readiness should be doing the following this year:

Inventory every use of RSA, DH, ECDH, and ECDSA across the 5G core, RAN, transport, BSS/OSS, and management plane.
Classify data by confidentiality lifetime. Subscriber content, lawful intercept archives, and roaming records often need 20 to 30 years of confidentiality.
Begin hybrid TLS pilots on SBA interfaces using ML-KEM with X25519 or P-384.
Plan firmware paths for base stations, IMS nodes, and SEPPs that allow PQC algorithm addition without hardware refresh.
Align procurement language with CNSA 2.0, ETSI TS 103 744, and NIST FIPS 203 and 204 requirements.

How QNSQY Fits

QNSQY is a Post Quantum Cryptography data encryption platform built on NIST ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), with hybrid defaults that combine X25519 and ML-KEM for key establishment. Telecom operators use QNSQY to protect high-value data at rest (subscriber archives, roaming settlement records, law enforcement packages) using the same quantum-safe primitives that 3GPP and ETSI are moving toward for in-flight traffic.

Bottom line. 5G standards are catching up to the quantum-safe future. 6G will start there. Operators who wait for a single final date will miss the window for harvest-now-decrypt-later protection of data that already sits on adversary disks.

Frequently Asked Questions

Is 3GPP 5G already post-quantum secure?

No. 3GPP SA3 has a Post Quantum Cryptography work item active through Release 19 and expected Release 20, but normative PQC profiles for SUCI, SBA TLS, and roaming are partial and still being drafted as of 2026.

What is ETSI TS 103 744?

ETSI TS 103 744 is a quantum-safe hybrid key exchange profile combining a classical key exchange with a post-quantum KEM. Version 1.2.1 was published in March 2025. It is not a QKD interoperability standard.

When does CNSA 2.0 require telecom migration?

CNSA 2.0 applies to US national security systems with a full-migration target of 2035. Commercial telecom is not directly bound by CNSA 2.0, but operators carrying federal traffic or roaming with NSS partners will be affected earlier.

Is V2X quantum-safe today?

No. V2X certificates under IEEE 1609.2 use ECDSA P-256 and P-384, which Shor's algorithm breaks. Post-quantum V2X profiles are not yet standardized.

Will 6G use Post Quantum Cryptography by default?

Yes. All major 6G research programs assume ML-KEM and ML-DSA as baseline asymmetric primitives rather than legacy RSA or ECC.

Sources

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/pqc-telecom-5g-6g.