up:: In the Protocols MOC

Why Mobile Networks Are the Hardest Migration

A mobile operator’s most quantum-exposed surface is subscriber-identity concealment, and it runs on the SIM in the subscriber’s pocket. An enterprise migrating a data center controls every machine it has to change, and an operator controls neither the hardware carrying its most harvestable cryptography nor the counterparties it has to interoperate with. Those two facts make telecom structurally the hardest post-quantum migration, and neither of them is a resourcing problem that a bigger budget resolves.

The consequence reaches past the industry, because for a large part of the world’s population a mobile network is not one route to the internet, it’s the only one.

The short version:

• The exposed surface is on the card. SUCI subscriber-identity concealment uses ECIES, running on the SIM or embedded secure element, and it’s harvestable today.
• A large part of the installed base cannot be updated over the air, so closing that surface waits on physical card replacement across hundreds of millions of subscribers.
• The inter-operator layer needs bilateral agreement. Roaming means an operator’s subscribers traverse networks it does not control and cannot compel.
• No binding sector deadline exists. GSMA’s own impact assessment is explicitly non-normative and borrows its dates from NIST and national mandates.
• The exposure is population-scale, not enterprise-scale, and it lands hardest where mobile is the only connectivity available.

An enterprise migration is like re-keying a building you own: hard, expensive, and every lock is reachable. A mobile migration is like re-keying a building where a few hundred million keys are already in strangers’ pockets, some of those keys cannot be re-cut, and the fire exits open onto buildings owned by other companies in other countries who are each on their own schedule.

What is actually exposed in a mobile network?

Three surfaces, and they don’t share a difficulty level.

Subscriber-identity concealment (SUCI). To keep a permanent subscriber identity off the air, the device conceals it using ECIES, the Elliptic Curve Integrated Encryption Scheme. The device generates a fresh ephemeral elliptic-curve key pair and combines it with the home network’s provisioned public key, and 3GPP’s profiles use Curve25519 and secp256r1. Both rest on classical elliptic-curve cryptography, so an adversary recording concealed identities today and later running Shor’s algorithm can de-conceal them retroactively, undoing the exact privacy protection the mechanism exists to provide.

Source: 3GPP TS 33.501, Annex C (Protection schemes for concealing the SUPI), 3gpp.org.

The inter-operator link (SEPP and N32). Traffic between operator networks is protected by TLS, which puts it on the same migration path as any other TLS surface, with the difference that both ends belong to different companies under different regulators.

Authentication (5G-AKA). Largely symmetric, so it inherits the milder Grover problem rather than the Shor one.

Full technical treatment of all three is in PQC in 5G and Mobile Networks. What matters for the argument is that the most harvestable of them is also the one an operator has the least physical control over.

Why does the SIM change everything?

Because it converts a software migration into a logistics problem, and logistics does not respond to urgency the way software does.

SUCI concealment executes on the subscriber’s SIM or embedded secure element. Replacing ECIES with a post-quantum key-establishment scheme therefore reaches down onto the card, which makes it a constrained-device problem: post-quantum keys and ciphertexts are substantially larger than elliptic-curve ones, and a SIM has tight limits on storage, compute, and message size.

The harder half is reach. A significant portion of the installed base has no over-the-air update path, so for those subscribers the migration completes when the physical card is replaced. An operator can accelerate that with handset upgrade cycles and card swaps, and the timing ultimately belongs to the customer, because so does the card.

Two properties follow, and they pull against each other:

1. This surface is harvestable now. Concealed identities recorded today are decipherable later, so the exposure is accruing while the fix is pending.
2. This surface closes slowest. It’s gated by the replacement rate of physical objects held by the public.

The most exposed thing is the last thing you can fix. In an enterprise migration those two properties almost never land on the same asset, because the most exposed systems are usually the ones the security team can reach fastest.

What does roaming do to the problem?

It removes the assumption that migrating your own network protects your own subscribers.

A roaming subscriber’s traffic traverses a visited network that belongs to someone else, sits outside the home operator’s audit reach, and runs on its own schedule. The inter-operator link is secured bilaterally, so the protection of any given roaming session is set by the less-migrated of the 2 operators rather than by the more diligent one.

This is the same structure as The Coalition Interoperability Gap, with commercial agreements in place of treaties and no equivalent of an alliance to coordinate through. Where allied militaries at least share a strategic forum, roaming partners share only a contract, and the number of bilateral relationships across the global operator population is far larger than the number of allies in any coalition.

Why doesn’t a sector deadline force it?

Because none exists. The mobile industry’s consensus document on this is GSMA PQ.1, and it’s explicitly non-normative: an informational industry whitepaper that imposes no compliance obligation on its own and takes its dates from NIST and national mandates rather than setting any.

So a mobile operator’s clock is the same general mandate landscape as everyone else’s, applied to surfaces that are structurally slower to change than everyone else’s. Sectors that got a dated regulator (financial services under supervisory expectations, US national-security systems under CNSA 2.0) have a forcing function that telecom’s hardest surface does not.

	Enterprise data center	Mobile network
Who owns the exposed hardware	The migrating organization	The subscriber
Update path to the exposed surface	Push, on the operator’s schedule	Over-the-air where supported, otherwise physical card replacement
Counterparties required to agree	Vendors, under contract	Other operators, bilaterally, across jurisdictions
Sector deadline	Varies by regulator, several are dated	None binding; GSMA PQ.1 is non-normative
Most exposed surface	Usually reachable soonest	Reachable slowest
Population affected by delay	The organization and its customers	Any subscriber, including those with no alternative connectivity

What does the strongest counterargument say?

That I’m overstating the SIM problem, and there’s a real version of that objection worth stating properly.

The strongest form runs: SUCI concealment protects subscriber identity privacy, and identity privacy is a lower-severity exposure than the content of communications. Mobile traffic content is protected by other layers, much of it symmetric and therefore quantum-resilient, and the application traffic riding over the mobile network carries its own TLS that migrates on the ordinary internet schedule regardless of what the SIM does. On that reading, the slowest surface is also among the less consequential ones, and the operator’s genuinely important surfaces migrate on normal timelines.

Two parts of that hold. Content protection really does sit largely outside the SIM, and application-layer TLS really does migrate independently. An operator that has migrated its N32 links and its application infrastructure has closed most of the volume of its exposure.

Where it stops holding is on who the exposure belongs to and how long it lasts. Identity privacy is a low-severity problem in aggregate and a severe one for specific people: a journalist’s presence on a network, a dissident’s movements, a source’s location history. Those are exactly the subscribers for whom retroactive de-concealment matters most, and they’re the least able to solve it themselves. Aggregate severity is the wrong measure for a harm that concentrates.

Where does this argument stop holding?

Three boundaries worth marking.

1. It’s a claim about difficulty, not about outcome. Nothing here says mobile networks fail to migrate. It says the last part of the migration is bounded by physical replacement rather than by engineering effort.
2. The installed-base constraint erodes on its own. Handsets and cards turn over, and eSIM provisioning improves the update path for a growing share of subscribers. The argument weakens each year, and the open question is whether it weakens faster than harvesting accumulates.
3. The severity depends on the value of identity privacy, which is genuinely contested and varies enormously by subscriber. An analysis that treated it as uniformly critical would be overclaiming as badly as one treating it as negligible.

Common misconceptions

• “5G is quantum-safe because it’s new.” Recency is unrelated. The 5G security architecture specifies classical elliptic-curve cryptography for identity concealment, and it inherits the same exposure as any other elliptic-curve deployment.
• “An over-the-air update fixes the SIM.” For part of the base, yes. For the part that cannot be updated over the air, the migration waits on physical replacement.
• “Migrating my own network protects my own subscribers.” Roaming sessions traverse networks you do not control, and the weaker of the two operators sets the protection.
• “GSMA PQ.1 is the telecom deadline.” It’s a non-normative industry whitepaper that borrows its dates from NIST and national mandates.
• “Authentication is the exposed part.” 5G-AKA is largely symmetric. The harvestable surfaces are identity concealment and the inter-operator TLS.
• “This is a rich-world engineering problem.” Delay lands hardest where mobile is the only connectivity, which is most of the world’s population.

Questions people ask

Is my phone’s data being harvested right now? The concealed subscriber identity your device sends is protected by classical elliptic-curve cryptography, so a party recording it today could de-conceal it later. That exposes who was on a network and when, rather than the contents of your messages, which are protected by other layers.

Can operators just push a software update? For network infrastructure, yes, and that part follows an ordinary migration path. The subscriber-identity concealment runs on the SIM or secure element, and where a card cannot be updated over the air the change waits on physical replacement.

Does eSIM solve this? It improves it, by making the provisioning path remote for devices that support it, and it doesn’t retire the physical cards already in service. The constraint shrinks as the installed base turns over.

Why is a SIM so limited? It’s a secure element built for tight storage, compute, and message-size budgets, and post-quantum keys and ciphertexts are substantially larger than elliptic-curve ones. That’s the constrained-device problem in its sharpest form.

Which mobile surface should be understood as most urgent? The harvestable ones, meaning identity concealment and the inter-operator TLS, because those accrue exposure today. Authentication is largely symmetric and sits on the slower track.

Is there any regulator forcing telecom specifically? Not through a dated sector mandate. Operators inherit the general national and NIST deadlines, and GSMA PQ.1 is explicit that it imposes no obligation of its own.

How is this different from the coalition problem between militaries? Structurally it’s the same shape, with bilateral commercial agreements instead of treaties, no coordinating alliance, and far more relationships to reconcile. See The Coalition Interoperability Gap.

Does this mean mobile networks will not migrate? No. It means the final portion of the migration is paced by hardware replacement in the hands of the public rather than by how much effort an operator applies, which is a different kind of constraint from the ones enterprise programs manage.

The map is free and I keep it that way. When these constraints have to be turned into a sequenced plan for a specific network, with its own installed base and its own roaming partners, that’s the work I do at LaMarr Labs.

Go deeper

• PQC in 5G and Mobile Networks for the full technical treatment of every surface
• GSMA PQ.1 (Post-Quantum Telco Network Impact Assessment) for the industry’s own assessment
• Constrained-Device PQC for why small secure elements make this hard
• The Coalition Interoperability Gap for the same bilateral problem between states
• Harvest Now, Decrypt Later (HNDL) for why a surface that closes slowly accrues exposure

Last verified 2026-08-02 · Maintained by Addie LaMarr, LaMarr Labs.