3GPP Rel-17 & GSMA PRD FS.34 / FS.36

5G Core Roaming, SEPP & Post-Quantum Cryptographic Defense Hub

Zero-Trust Cross-Border IPX Interconnects, N32-c/f JWS Mediation & NIST FIPS-203 Quantum-Safe Transit.

100% PQCNIS2 Art. 21.2(h) Compliant

5G CORE ARCHITECTURE

SA OPTION 2 32 SEPP EDGES

✓ 16 EU Roaming Partners Active

N32-c PRF PROFILENIST FIPS-203

HYBRID TLS 1.3 + KYBER-1024

🔑 Sig: Dilithium-5 ML-DSA (EU-Trust)

SEPP ROAMING REQ/S[3 JWS FAULTS]

840,291 REQ/S

⛔ 3 Tampered Payloads Quarantined

GSMA FS.34/36 AUDIT100% AUDIT

99.98% LATTICE ENTROPY

🛡️ Hardware TRNG Core Nominal

🌐

N32-c / N32-f Carrier-Grade Roaming Interconnect & Mediation Gate

3GPP Rel-17 & GSMA PRD FS.34/36 Telemetry

e2e JWS Payload Signing (FS.34)IPX Modification Policy (FS.36)Zero-Trust Roaming

Home PLMN (hSEPP)ORIGIN 208-01

Orange France

MCC 208 · MNC 01 · Paris Edge DC-04

TLS Profile:TLS 1.3 / Kyber-1024

Key Exch ID:0x9F41B...CE02

SEPP VIP:194.153.220.14

✓ JWS Signer: Dilithium5-EU-CERT

N32-c (PRF Control Handshake) N32-f (Forwarding Encrypted JSON Stream)

TRANSIT MEDIATION GATEWAYDeutsche Telekom ICSS (AS3320)FS.36 GATE ACTIVE

Allowed Modifications:3 Registered Paths

e2e Integrity Check:Enforced (Pass)

Visited PLMN (vSEPP)PEER 262-01

Vodafone Germany

MCC 262 · MNC 01 · Frankfurt Node 12

TLS Profile:TLS 1.3 / Kyber-1024

e2e PRF Check:VERIFIED

SEPP VIP:145.253.112.98

✓ JWS Signer: BSI-DE-GOV-CERT

🌍 Connected EU PLMN Registry

16 ACTIVE PEERS

PLMN	Operator	PQC Status	RTT
208-01	Orange France	[PQC-ACTIVE]	1.2ms
214-07	Telefónica Spain	[PQC-ACTIVE]	4.1ms
222-01	TIM Italia	[HYBRID]	6.8ms
240-01	Telia Sweden	[PQC-ACTIVE]	2.3ms
204-04	Vodafone Netherlands	[PQC-ACTIVE]	3.1ms

GSMA FS.36 Mediation FilterSTRICT GATE

Blacklisted Foreign SEPP Elements8 QUARANTINED

sepp-gw.as9801.non-eu.net

Origin: MCC 460 · Fake JWS Signer Key

N32-f Message #8942-AFault: JWS Invalid

Namf_Communication

PROTECTED JWS COMPACT HEADER (CBOR/JSON)ALGORITHM: ML-DSA-65 (DILITHIUM)

// N32-f JOSE Protected Envelope
{
  "alg": "ML-DSA-65",
  "enc": "A256GCM",
  "cty": "application/5g-sepp",
  "kid": "eu-hplmn-sepp-2025-v3",
  "pqc_kem": "KYBER-1024",
  "crit": ["sigVal", "fs36Mods"],
  "fs36_modifications": [
    {
      "op": "replace",
      "path": "/plmnId/mcc",   // <-- BLOCKED: UNAUTHORIZED MUTATION
      "val": "460"
    }
  ]
}

KYBER-1024 ENCAPSULATION CIPHERTEXTSHA3-512 MATCH: VALID

7F 4A C1 89 E2 10 9B AA FF 21 00 BC 4D EF 98 12 33 45 AA EE CC DD 87 65 43 21 0F ED CB A9 87 65 43 21 00 FF 12 90 AB CD EF 01 23 45 67 89 AB CD EF

🔐 PQC Core Migration

NIS2 ART. 21.2(h)

Quantum-Resistant Edge84%

● 84% ML-KEM Kyber-1024● 16% Curve25519

Mandatory Target: 100% Q1 2027 (BSI / ANSSI Mandate)

Kyber-1024 Decap Latency0.42 ms

OPTIMAL

Dilithium-5 Sign Rate42,000 /sec

LINE RATE

Quantum Entropy Pool99.98% / TRNG

💾

🛡️MANDATORY PQC ENFORCEMENT

Inhibits classical TLS 1.2/1.3 cipher fallback across all N32-c and N32-f SEPP edges.