This application relates to communication technologies, and provides a channel key-based encryption method and an apparatus, to resolve a problem that a terminal cannot avoid an attack from a false base station before a security mode is enabled, and a security risk. The method includes: A network device broadcasts a system information block, indicating that channel key generation is supported, where the system information block includes a preamble and a resource configuration of a physical random access channel; receives, on the physical random access channel, a first message from a user equipment, where the first message includes the preamble; sends a second message to the user equipment, where the second message includes configuration information of a first time-frequency resource; receives, on the first time-frequency resource, a third message from the user equipment; and performs channel measurement based on the third message, to obtain a channel key.