PaperlayerView exact revision on arXiv

Source-linked AI summary

5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information (long version)

Fritz Windisch, Thorsten Strufe

arXiv:2609.07367v1cs.CR

TL;DR

Prior passive 5G sniffing depends on leaked parameters or costly brute force, despite the privacy risks of recovered scheduling traces. This paper presents a fully passive method that bypasses DCI scrambling and integrates it into a sniffer. It reports block error rates below 1% at SNR≥6.5dB and decoding up to 300× faster than prior work on a comparable sample with tuned thresholds.

  • Problem

    Passive PDCCH sniffers have relied on leaked configuration parameters or costly brute-force searches, although scheduling traces can expose sensitive user activity.

    Source: §1 · pp. 1–2

  • Method

    The paper uses structural properties of PDCCH scrambling and DCI encoding to bypass scrambling in a fully passive sniffer, with no side-channel knowledge or brute force.

    Source: §1 · p. 2

  • Results

    Below 1% block error rate at SNR≥6.5dB and up to 300× faster than prior work on a comparable sample with tuned thresholds.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The sniffer provides decoded DCI, RNTI associations, timestamps, and transmission direction as input for subsequent traffic-analysis attacks.

    Source: §1 · p. 2

    Legal restrictions prevented measurements against local network operators, and behavior beyond the tested samples—including realistic scheduler loads, larger bandwidths, and vendor-specific behavior—remains unvalidated.

    Source: §6.1 · pp. 14–15

Abstract

from arXiv · show

Tracking users in 5G NR has recently been successfully demonstrated by exploiting various side-channels. This allows for identification of individuals, classification of user activity in real time as well as tracking by fingerprinting, affecting billions of users with a 5G subscription and companies with private 5G deployments. However, previous work relies on weak operator configurations that leak networking parameters--either the radio network temporary identifier (RNTI) or scrambling factor ($N_{ID}$) during handshake--or to inefficiently brute-force Downlink Control Information (DCI). In this paper we present a novel technique exploiting algebraic structure to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline. It provides enabling input for subsequent attacks like live tracking of users and supports automatic detection of control channel configurations used. We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors. It reaches block error rates of less than $1\%$ at SNRs below expected values for efficient communication, while performing significantly faster on a reference sample than a previously suggested passive technique brute-forcing the required parameters. In addition, it is entirely passive and does not rely on any side-channel leakage.

1 Introduction

The paper addresses passive recovery of 5G scheduling information despite encrypted configuration updates, presenting a descrambling approach and sniffer that avoid side-channel leakage and brute force. It reports low DCI block error rates and substantially faster decoding than prior work on a comparable sample.

1 Introduction

  • Encrypted RRC updates can conceal PDCCH parameters from observers, while recovered scheduling traces can reveal identities, visited webpages, apps, and videos.The paper frames this as a privacy concern for 5G users.Source: §1 · p. 1
  • Prior passive approaches either brute-force parameter combinations with costly polar decoding or depend on side-channel information.The brute-force approach can require up to 2^44 combinations, making real-time use impractical.Source: §1 · p. 2
  • The fully passive sniffer exploits structural properties of PDCCH scrambling and DCI encoding to bypass scrambling without prior knowledge, side channels, or brute force.It outputs decoded binary DCI associated with individual RNTIs, timestamps, and transmission direction.Source: §1 · p. 2
  • Below 1% block error rate at SNR≥6.5dB and up to 300× faster than prior work on a comparable sample with tuned thresholds.The prior work decoded all contained DCI candidates in that comparison.Source: §1 · p. 2
  • 5GDescrambler implements the techniques as an open-source end-to-end binary DCI sniffer and was evaluated on samples from srsRAN, OpenAirInterface5G, and two commercial vendors.It provides input for later traffic analysis and attacks but does not itself perform tasks such as traffic classification or user tracking.Source: §1 · p. 2

2 Background

The background explains how a passive observer reconstructs the 5G resource grid, locates PDCCH candidates, and decodes DCI. The key obstacle is that the configurations and scrambling parameters needed for these steps may be unavailable to an outside observer.

2 Background

  • The background lays out the physical-layer, synchronization, scheduling, and transport details needed to construct a passive 5G sniffer.After cell synchronization, an observer can obtain the transmitted resource grid and required parameters.Source: §2 · p. 2, §2.1 · p. 3

2.1 5G NR Physical layer

  • 5G NR organizes transmissions as OFDM symbols on a time-frequency grid, grouped into frames, subframes, slots, resource elements, and resource blocks.Frames are 10ms, while the precise time structure depends on numerology and frequency band.Source: §2.1 · p. 3

2.2 5G NR Cell synchronization

  • Cell synchronization and the initial random-access handshake expose cell parameters, a C-RNTI, and initial configuration, but later RRC reconfiguration is encrypted.A new C-RNTI and configurations can therefore be concealed from observers of the initial handshake.Source: §2.2 · p. 3

2.3 5G NR Resource Scheduling

  • CORESET and search-space settings determine where and how many PDCCH candidates to decode, but their customization makes configuration discovery harder for passive observers.Observers can obtain only initial configurations from SIB1 and those intercepted during random access.Source: §2.3 · p. 3

2.4 5G NR PDCCH Transport Process

  • DCI candidates are located and demodulated into LLRs, then descrambled, rate-matched, polar-decoded, deinterleaved, and checked using CRC bits and the RNTI.Descrambling and CRC demasking require the RNTI and scrambling factor; encrypted updates can leave these unknown to passive observers.Source: §2.4 · p. 4
  • Because passive observers may lack the RNTI and scrambling factor, the paper introduces 5GDescrambler to decode DCI despite scrambling.The descrambling step reverses the scrambling sequence by XOR, implemented for LLRs as sign flips.Source: §2.4 · p. 4

3 Design of 5GDescrambler

5GDescrambler models DCI encoding and scrambling as linear operations to recover DCI and scrambling parameters, integrating decoding into a passive sniffer pipeline for an over-the-air observer. It separates configuration finding from DCI sniffing, with configurable search effort and cached configurations; real-time operation of the full pipeline is guaranteed only when configuration finding is disabled.

3.1 Assumptions

  • The attacker is a fully passive observer with an SDR and computation device; with beamforming, she must be within range and positioned at a similar angle to the gNB as the UE.Without beamforming, the observer can be anywhere in the cell’s coverage area.Source: §3.1 · p. 4

3.2 Bypassing scrambling on 5G PDCCH

  • The encoder’s linear operations are combined into a reversible generator matrix G, enabling one O(1) decoder execution instead of O(|RNTI|*|N_ID|) parameter-brute-force executions.The method represents the input information, including DCI, RNTI and N_ID, in a vector and decodes it using G^-1.Source: §3.2 · pp. 4, 5, 7
  • Except for some higher-K aggregation-layer-1 configurations, G retains enough information to uniquely recover the DCI, RNTI and N_ID; its rank is 56 + A in USS and 41 + A in CSS.For aggregation layer 1, identical reversibility holds only when K ≤ 76; higher-K configurations can produce false positives and should be avoided by operators.Source: §3.2 · p. 6
  • In USS, the only independent bit is the most significant RNTI bit, while CSS usually has 16 independent bits; CRC syndromes detect and correct these unconstrained bits.For aggregation layers 2, 4, 8 and 16, K ranges from 36 to 164; layer-1 configurations have identical reversibility only through K = 76.Source: §3.2 · p. 6
  • For channel errors, the decoder treats least-reliable LLR bits as variables and solves GF(2) equations from known CRC, negation and padding constraints; free variables may remain uncorrected.Gaussian elimination finds bindings that satisfy the constraints, while the number of corrected bits can be configured as a trade-off between robustness and performance.Source: §3.2 · p. 6

3.3 Components

  • The sniffer synchronizes and estimates channels, filters and phase-aligns active QPSK groups, then decodes candidates using the recovered DCI, RNTI and N_ID.Successful DCI are parsed only for transmission direction; binary DCI output can feed subsequent fingerprinting and activity-classification attacks.Source: §3.3 · p. 7
  • To find unknown candidates, configuration finding incrementally searches remaining active groups using a fast path, active-group sequences, REG-bundle chunks, and finally brute force.It exploits changing cell load and active-group patterns across slots and CORESET symbol sizes.Source: §3.3 · pp. 7–8
  • Configuration finding can check a fixed number of combinations per slot, n_sym, and aggregation layer, with fast and super fast modes using only steps 1–2 or step 1.Error correction during candidate search is optional and can increase configuration-finding speed under good channel conditions (>= 20dB SNR). Finding can be disabled after a specified number of frames or entirely, in which case prior measurements must supply configurations.Source: §3.3 · p. 8
  • Configurations are commonly reused across UEs and converge quickly, but new deployments after UE entry, handover, or RRC reconfiguration can require configuration finding to be re-enabled.Mobility does not affect configurations unless rapid sniffer or gNB movement causes artifacts that prevent candidates from being read.Source: §3.3 · p. 8
  • The full pipeline is guaranteed to run in real time only with configuration finding disabled, though finding often runs in real time unless scheduler load is large and constant.Pure sniffing is the real-time target; cached configurations support sniffing while configuration finding is paused.Source: §3.3 · p. 8

4 Implementation and Evaluation

The evaluation tests 5GDescrambler’s configuration finding, active-group detection, and DCI descrambling on controlled experiments and real-world samples. Results show live sniffing across the tested samples, with performance varying by channel conditions, aggregation layer, and configuration-finding load.

4.1 Results

  • A direct robustness and performance comparison with 5GSniffer was unavailable because its code consistently crashed, and controlled error-correction patterns remain unvalidated.The tested polar decoder tolerated single-bit errors at all tested input bits, whereas 5GDescrambler only supports correcting errors within a specified likely-error set.Source: §4 · p. 8, §4.1 · p. 11

4 Implementation and Evaluation

  • The evaluation measured candidate decoding, configuration finding, and active-group detection across srsRAN, OpenAirInterface5G, and two commercial-vendor samples.The implementation includes Rust tooling for DCI encoding and decoding, cell search, waveform decoding, and packet-capture integration.Source: §4 · pp. 8–9

4.1 Results

  • Active-group detection achieved an F1-macro score above 99% for QPSK at 10dB SNR or higher, while higher-QAM groups approached 3%.At 10dB SNR, rotation estimates had eight times more precision in standard deviation than random guessing.Source: Figure 2 · p. 9, §4.1 · p. 11
  • Above 8dB SNR, BLER fell below 0.1% for typical CSS aggregation-layer-1 input sizes, while maximum-size CSS cases plateaued near 1.3%.For unknown input size at aggregation layer 1, decoding terminates at K=76; larger K values cannot succeed.Source: §4.1 · pp. 9–11
  • 5GDescrambler sniffed live across all tested samples, using at most 48% of available time with error correction; configuration finding was live for all but one sample.The exception involved delays that could overflow SDR processing queues; configuration finding could be disabled after a set number of frames.Source: Table 1 · p. 10, §4.1 · p. 12
  • With error correction, 5GDescrambler outperformed CA-SCL polar decoding with L=8 at aggregation layers 4 and lower, but matched or lagged it at higher layers.Without error correction, it significantly outperformed that polar decoder; highly optimized Aff3ct implementations can be faster in some scenarios but omit the full DCI chain.Source: Table 2 · p. 11, §4.1 · p. 11

5 Related Work

Prior passive 5G PDCCH sniffers address different subsets of unknown configuration, channel unpredictability, and descrambling challenges, often relying on side channels or brute force. The paper contrasts these approaches with 5GDescrambler and identifies unresolved challenges in passive sniffing.

Syndrome descrambling

  • Syndrome methods build reverse-lookup tables from decoder syndromes to scrambling inputs, but the number of combinations makes search and storage unfeasible without assumptions such as N_ID = N_cell_ID.The syndrome depends on C-RNTI, N_ID, polar-decoding layer, and DCI length.Source: §5 · p. 13

RACH side-channel

  • RACH side-channel approaches obtain UE parameters during cell access but cannot capture UEs missed during that handshake or later reconfigurations after access-stratum security is enabled.These approaches rely on RACH and initial configuration information.Source: §5 · p. 13

Divide and conquer

  • 5GSniffer correlates possible DMRS sequences before brute-forcing remaining C-RNTI values, but configuration finding can yield false positives in highly interleaved CORESETs.Cracking DCI still requires substantial brute force, with potentially larger searches when configuration finding is added.Source: §5 · p. 13

Comparison

  • On the sole comparable sample, 5GDescrambler processed the sample 300× faster than 5GSniffer after thresholds were tuned to decode all DCI.The comparison was limited to one sample and setting that 5GSniffer could process without crashing.Source: §5 · p. 14

Capabilities and gap

  • Prior approaches leave configuration finding or core channel and descrambling challenges unresolved, while 5GDescrambler provides binary DCI without implementing scheduled-message parsing or subsequent privacy attacks.The paper distinguishes passive sniffers from active approaches that do not need to circumvent scrambling.Source: §5 · pp. 13–14

6 Conclusion

The conclusion presents an algebraic approach for obtaining scrambled DCI parameters and binary contents, with reported decoding, comparison, configuration-finding, and channel-estimation results. It also describes limitations in evaluation scope and pipeline behavior, alongside future extensions.

6 Conclusion

  • DCI decoding had below 1% block error rate at SNRs of 6.5 dB or higher; on a comparable sample, the technique was either ≈40× faster and found ≈17% more DCI or 300× faster after threshold tuning.The approach uses O(1) decoding attempts per candidate; active group detection reached 99% accuracy above 10 dB SNR.Source: §6 · p. 14
  • Automatic configuration finding worked on samples from multiple base-station implementations and configurations, while active QPSK group detection and phase estimation achieved 99% accuracy above 10 dB SNR.Group detection also reduces the search space for configuration finding and binary DCI decoding.Source: §6 · p. 14
  • The authors argue that mitigating the technique would require eliminating the exploited algebraic properties, such as by replacing scrambling with a cryptographically sound nonlinear function.They note that this would require fundamental physical-layer changes that break 3GPP specifications.Source: §6 · p. 14

6.1 Limitations and Future Work

  • In CSS, a 180-degree candidate rotation flips the RNTI least significant bit; DMRS, subsequent PDSCH DMRS, or nearby CSI-RS can help resolve it.The closer the estimation is in time, the higher the expected success rate.Source: §6.1 · p. 14
  • The evaluation did not include local operator measurements, and results remain unvalidated for realistic scheduler loads, larger bandwidths, mobility, handovers, untested configurations, and RF impairments.Samples came from MATLAB, srsRAN, OpenAirInterface5G, and commercial base stations supplied by a state authority.Source: §6.1 · pp. 14–15
  • Configuration-finding stalls can delay candidate decoding and overflow queues, causing missed DCI; proposed future work includes further pipeline parallelization and DCI interpretation.The authors also identify future support for NSA synchronization and traffic classification.Source: §6.1 · p. 15

A Open Science

The paper releases an open-source Rust implementation and reproducibility artifacts, including controlled lab captures and code for reproducing evaluation results. The package excludes operational commercial network captures.

A Open Science

  • The Rust implementation covers cell synchronization, active group detection, algebraic-structure descrambling, constrained configuration inference, and optional visualization.It is presented as a complete end-to-end binary DCI sniffer.Source: A Open Science · p. 15
  • The public artifact package includes source code, build instructions, dependencies, configuration examples, controlled lab captures, and code reproducing the main evaluation results.The captures include synthetic 5G RAN samples from OpenAirInterface5G and two redacted vendors.Source: A Open Science · p. 15
  • Operational commercial network captures are excluded, while the package supports independent verification of reported results and follows ACM reproducibility guidelines.Documentation, test cases, and validation scripts are included.Source: A Open Science · pp. 15–16

B Ethical Considerations

The ethical discussion characterizes the technique as privacy-sensitive because it can support tracking and traffic analysis, while describing a defensive research purpose. It limits experiments and released data to authorized, controlled, synthetic, or sanitized settings.

B Ethical Considerations

  • The technique can enable passive tracking, traffic analysis, and inference of sensitive user behavior, creating privacy and security risks for subscribers, operators, and vendors.The authors classify the result as security- and privacy-sensitive.Source: B Ethical Considerations · p. 16
  • Experiments used controlled laboratory environments and authorized test deployments, with synthetic or sanitized reproducible samples and no data from unsuspecting users.The stated testbeds included srsRAN, OpenAirInterface5G, and authorized vendor deployments.Source: B Ethical Considerations · p. 16
  • The authors frame the work's intended impact as defensive risk assessment and protocol hardening, and recommend authorized testbeds, sanitized datasets, and responsible disclosure.They call for compliance with applicable radio, interception, and privacy laws.Source: B Ethical Considerations · p. 16

C Supplementary material

The supplementary algorithms construct a generator matrix for DCI encoding, decode received vectors with error correction, and identify active groups and control-channel configurations.

C Supplementary material

  • The generator matrix chains CRC, information-bit, polar-kernel, and rate-matching matrices, while incorporating RNTI and scrambling values.Its inputs include DCI payload size A, encoded size E, and whether the common search space is used.Source: C Supplementary material · p. 17
  • The decoder uses received log-likelihood ratios to select likely errors, solve a linear equation system, and check CRC, negation, and padding.The algorithm returns null if the final correctness and syndrome check fails.Source: C Supplementary material · p. 17
  • Active-group detection evaluates resource-element angle and amplitude variation, then rotates retained groups to match QPSK.The snippets describe reducing groups by their standard angle and amplitude.Source: C Supplementary material · p. 18
  • Frame processing attempts known candidates in active groups, then tests valid configurations and adds newly found candidates to the configuration.The algorithm outputs the frame's DCI list and an extended configuration.Source: C Supplementary material · p. 18
  • Table 5 examines how A/K and E affect properties of the resulting G and G^-1 matrices.The supplied caption identifies the varying parameters and matrices, but not individual table values.Source: Table 5 · p. 19
Loading 2609.07367v1…