IMSI vs SUPI
IMSI (International Mobile Subscriber Identity) is the 15-digit subscriber identifier used since GSM. In 5G it is renamed SUPI (Subscription Permanent Identifier) and, crucially, transmitted as a SUCI (Subscription Concealed Identifier) — a public-key-encrypted form that defeats passive IMSI catchers.
| Attribute | IMSI | SUPI |
|---|---|---|
| Generation | 2G–4G | 5G |
| Over-the-air form | Plaintext during initial attach | SUCI (ECIES-encrypted) |
| IMSI catcher exposure | Trivially captured | Not usable without home-network private key |
| Length | 15 digits (MCC+MNC+MSIN) | IMSI-form SUPI or NAI-form SUPI |
| Home network key | None | HPLMN ECIES public key on USIM |
Verdict
SUCI is the single biggest privacy improvement in 5G — but only in 5G SA. In non-standalone (NSA) deployments the LTE anchor still transmits IMSI in plaintext, so the IMSI catcher risk persists. Operators asking "is 5G safer than 4G?" should first confirm they mean 5G SA.