free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Summary

The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions.

Two authentication flows are affected in internal/sbi/processor/ue_authentication.go:

• 5G-AKA confirmation compares RES* and XRES* with strings.EqualFold().

• EAP-AKA' confirmation compares AT_MAC with bytes.Equal() and compares XRES and RES with ==.

These functions are not designed to be constant-time cryptographic comparators and may return earlier depending on the location of the first mismatch.

Additionally, the 5G-AKA confirmation path logs both the received res* and the expected Xres* at INFO level immediately before comparing them. The XRES* value is authentication material and should not be written to application logs.

The timing side channel was confirmed as a code issue, but practical exploitation over HTTP was not demonstrated in the lab because the comparator-level signal is much smaller than HTTP/SBI noise. The XRES* logging issue is directly observable in AUSF logs.

Confirmed on github.com/free5gc/ausf v1.4.4 and current main as of the May 2026 analysis.

Details

5G-AKA: RES* / XRES*

In Auth5gAkaComfirmRequestProcedure(), the AUSF logs both values and then compares them with strings.EqualFold():

// internal/sbi/processor/ue_authentication.go
logger.Auth5gAkaLog.Infof("res*: %x\nXres*: %x\n",
    updateConfirmationData.ResStar, ausfCurrentContext.XresStar)

if strings.EqualFold(updateConfirmationData.ResStar, ausfCurrentContext.XresStar) {
    ausfCurrentContext.AuthStatus = models.AusfUeAuthenticationAuthResult_SUCCESS
    confirmDataRsp.AuthResult = models.AusfUeAuthenticationAuthResult_SUCCESS
    success = true
    logger.Auth5gAkaLog.Infoln("5G AKA confirmation succeeded")
    // ...
}