A Static Workflow for Cryptography Verification in 4G/5G Basebands

In this paper we detail a workflow devised to identify and verify cryptographic implementations within baseband firmware. The approach combines constant-guided function discovery, semantic comparison against 3GPP specifications, parameter bound extraction, and library fingerprinting. We apply the method to three commercial firmware images from Samsung (Shannon) and MediaTek devices, finding and validating vendor implementations of KASUMI, SNOW-3G, AES, and 4G/5G integrity and confidentiality algorithms. Our analysis reveals security-relevant issues, including incorrect S-Box indexing in KASUMI and a firmware update failure caused by a malformed signature field. We further extract a 1792-bit RSA limit in Shannon and identify an outdated OpenSSL 1.0.2c bundle in MediaTek, implying exposure to unpatched CVEs. Results demonstrate that structured cryptographic verification in baseband firmware is not only feasible but essential for supply-chain transparency and long-term security audits.