SUCI — The permanent name, encrypted — 5G's answer to the IMSI catcher
The device — identity, state, mobility
Where it sits
What it is
What it is. The Subscription Concealed Identifier — the SUPI, encrypted, so that the permanent identity never crosses the air in the clear. TS 23.501 §5.9.2a names it; TS 33.501 §6.12.2 specifies it. It is 5G's answer to the IMSI catcher, and it is the most consequential privacy change in the generation.
The problem it fixes. In every generation up to LTE, a device that had no valid temporary identity sent its IMSI in the clear. A false base station could simply ask for it — and since the IMSI is permanent and globally unique, capturing it identifies and tracks a specific subscription forever.
What is concealed, and what is not. This is the part worth getting exactly right. TS 33.501 §6.12.2: "The UE shall not conceal the Home Network Identifier and the Routing Indicator."
| Field | Concealed? | Why |
|---|---|---|
| SUPI Type | no | the receiver must know what it is parsing |
| Home Network Identifier (MCC, MNC) | no | the visited network must know which home network to ask |
| Routing Indicator | no | selects which AUSF/UDM in that network |
| Home Network Public Key ID | no | says which key was used |
| Scheme Output — the MSIN, or the NAI username | yes | this is the part that identifies you |
So a SUCI still reveals your operator and your country, and always will. That is not a weakness in the scheme; it is a routing requirement. The concealment protects which subscriber, not which network — and the second could not be protected without making roaming impossible.
The scheme is ECIES (TS 33.501 Annex C), elliptic-curve integrated encryption using the home network's public key. It is probabilistic: the device generates a fresh ephemeral key each time, so the same SUPI produces a different SUCI on every registration. A constant would be as trackable as the IMSI it replaced — freshness is what makes concealment worth anything.
Only the home network can reverse it, via the SIDF in the UDM (§6.12.5). The private key never leaves the home network, so a visited network relays an identifier it genuinely cannot read.
The null-scheme is the hole, and it is in the specification. §6.12.2 requires the ME to support null-scheme, used when the home network has not provisioned a public key — in which case the SUPI is carried unprotected. The privacy gain therefore depends on the USIM having been provisioned, not on the device or the network being new.
A SUCI is only sent when there is no alternative. Normally the device presents a 5G-GUTI; the SUCI appears at first registration, or when the temporary identity is unusable.
Read on
This concept is read as part of one argument in ref-ue-identity, alongside the rest of its group.
Before this concept, the hierarchy says to learn the following — the full chain, in order: