From b053436e0f1dbf5152177892d57177d590eefaa0 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Sat, 11 Apr 2020 10:19:49 +0200 Subject: [PATCH] spec: Refer to standard OTA SMS security The encryption is "out of scope" because it already exists. Hence we specify that the existing means of 23.048 shall be used. --- docs/imsi-pseudo-spec.adoc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/imsi-pseudo-spec.adoc b/docs/imsi-pseudo-spec.adoc index a74441b..84bf449 100644 --- a/docs/imsi-pseudo-spec.adoc +++ b/docs/imsi-pseudo-spec.adoc @@ -402,8 +402,10 @@ pseudonymous IMSI in the SMS was changed, the SIM would be locked out of the network. The safest way to protect the next pseudonymous IMSI SMS is a layer of end to -end encryption from the HLR to the SIM. It was considered for this -specification, but found to be out of scope. +end encryption from the HLR to the SIM. The existing means for OTA SMS security +(3GPP TS 23.048) provide mechanisms for integrity protection, confidentiality +as well as replay protection and must be implemented when using IMSI +pseudonymization. === User-configurable Minimum Duration Between IMSI Changes