ese security association establishments shall be mutually authenticated and used for user and control plane communication between the entities. DU Internal. 3GPP defines requirements that the base station shall execute authorized data/software, and that this shall execute with the help from a secure environment. This environment is defined in the secure boot section earlier in this document. Keys stored Table 5-2 Security algorithms for 4G/LTE. Algorithm Description Recommendation No encryption 128-EEA1/128-EIA1 (Snow 3G) Privacy (EEA1) and Integrity TS 35.215/TS33.401 Mandatory (EIA1) 128-EEA2/128-EIA2 (AES) Privacy (EEA2) and Integrity NIST 800-38A/TS33.401 Mandatory (EIA2) 128-EEA3/128-EIA3 (ZUC) Privacy (EEA3) and Integrity At the request of Chinese Optional (EIA3) operators Chapter 5 System software Table 5-3 Security algorithms for 5G/NR. Algorithm Description Recommendation No encryption 128-NEA1/128-NIA1 (Snow 3G) Privacy (NEA1) and Integrity TS 35.215/TS33.401 Mandatory (NIA1) 128-NEA2/128-NIA2 (AES) Privacy (NEA2) and Integrity NIST 800-38A/TS33.401 Mandatory (NIA2) 128-NEA3/128-NIA3 (ZUC) Privacy (NEA3) and Integrity At the request of Chinese Optional (NIA3) operators inside base stations are not allowed to leave a secure environment. This implies that, technically speaking, the cipher keys are not allowed to be stored in insecure memory. Whether (unprotected) external volatile memory is defined as secure is left open for interpretation. The CU converts packets from a secure (IPSec) link from the fronthaul network to (secure) packets. As part of this, the IPSec frame is decrypted to plaintext and re-encrypted using the PDCP cipher protocol (discussed below). As part of this operation, the plaintext packet is made visible and likely stored in volatile memory, external to the processor executing the cipher operations. 3GPP defines this user plane data cipher and integrity processing to take place within a secure environment-the same one as where keys are stored. Fronthaul. Algorithms include AES, SNOW, a