Section: 5.3.5.6.3 SRB addition/modification
Content: The UE shall: 1> If any DAPS bearer is configured, for each SRB: 2> establish a PDCP entity for the target cell group as specified in TS 38.323[ NR; Packet Data Convergence Protocol (PDCP) specification ]  [5], with the same configuration as the PDCP entity for the source cell group; 2> if the masterKeyUpdate is received: 3> configure the PDCP entity with the security algorithms according to securityConfig and apply the keys (KRRCenc and KRRCint) associated with the master key (KgNB); 2> else: 3> configure the PDCP entity for the target cell group with state variables continuation as specified in TS 38.323[ NR; Packet Data Convergence Protocol (PDCP) specification ]  [5], and with the same security configuration as the PDCP entity for the source cell group; 1> for each srb-Identity value included in the srb-ToAddModList that is not part of the current UE configuration (SRB establishment or reconfiguration from E-UTRA PDCP to NR PDCP): 2> establish a PDCP entity; 2> if AS security has been activated: 3> if target RAT of handover is E-UTRA/5GC; or 3> if the UE is connected to E-UTRA/5GC: 4> if the UE is capable of E-UTRA/5GC, but not capable of NGEN-DC: 5> configure the PDCP entity with the security algorithms and keys (KRRCenc and KRRCint) configured/derived as specified in TS 36.331[ Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification ]  [10]; 4> else (i.e., UE capable of NGEN-DC): 5> configure the PDCP entity with the security algorithms according to securityConfig and apply the keys (KRRCenc and KRRCint) associated with the master key (KeNB) or secondary key (S-KgNB) as indicated in keyToUse, if applicable; 3> else (i.e., UE connected to NR or UE connected to E-UTRA/EPC): 4> configure the PDCP entity with the security algorithms according to securityConfig and apply the keys (KRRCenc and KRRCint) associated with the master key (KeNB/ KgNB) or secondary key (S-KgNB) as indicated in keyToUse, if applicable; 2> if the current UE configuration as configured by E-UTRA in TS 36.331[ Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification ]  [10] includes an SRB identified with the same srb-Identity value: 3> associate the E-UTRA RLC entity and DCCH of this SRB with the NR PDCP entity; 3> release the E-UTRA PDCP entity of this SRB; 2> if the pdcp-Config is included: 3> configure the PDCP entity in accordance with the received pdcp-Config; 2> else: 3> configure the PDCP entity in accordance with the default configuration defined in 9.2.1 for the corresponding SRB; 1> if any DAPS bearer is configured, for each srb-Identity value included in the srb-ToAddModList that is part of the current UE configuration: 2> if the pdcp-Config is included: 3> reconfigure the PDCP entity for the target cell group in accordance with the received pdcp-Config; 1> else, for each srb-Identity value included in the srb-ToAddModList that is part of the current UE configuration: 2> if the reestablishPDCP is set: 3> if target RAT of handover is E-UTRA/5GC; or 3> if the UE is connected to E-UTRA/5GC: 4> if the UE is capable of E-UTRA/5GC, but not capable of NGEN-DC: 5> configure the PDCP entity to apply the integrity protection algorithm and KRRCint key configured/derived as specified in TS 36.331[ Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification ]  [10], i.e. the integrity protection configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure; 5> configure the PDCP entity to apply the ciphering algorithm and KRRCenc key configured/derived as specified in TS 36.331[ Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification ]  [10], i.e. the ciphering configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure; 4> else (i.e., a UE capable of NGEN-DC): 5> configure the PDCP entity to apply the integrity protection algorithm and KRRCint key associated with the master key (KeNB) or secondary key (S-KgNB), as indicated in keyToUse, i.e. the integrity protection configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure; 5> configure the PDCP entity to apply the ciphering algorithm and KRRCenc key associated with the master key (KeNB) or secondary key (S-KgNB) as indicated in keyToUse, i.e. the ciphering configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure; 3> else (i.e., UE connected to NR or UE in EN-DC): 4> configure the PDCP entity to apply the integrity protection algorithm and KRRCint key associated with the master key (KeNB/KgNB) or secondary key (S-KgNB), as indicated in keyToUse , i.e. the integrity protection configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure; 4> configure the PDCP entity to apply the ciphering algorithm and KRRCenc key associated with the master key (KeNB/KgNB) or secondary key (S-KgNB) as indicated in keyToUse, i.e. the ciphering configuration shall be applied to all subsequent messages received and sent by the UE, including the message used to indicate the successful completion of the procedure; 3> re-establish the PDCP entity of this SRB as specified in TS 38.323[ NR; Packet Data Convergence Protocol (PDCP) specification ]  [5]; 2> else, if the discardOnPDCP is set: 3> trigger the PDCP entity to perform SDU discard as specified in TS 38.323[ NR; Packet Data Convergence Protocol (PDCP) specification ]  [5]; 2> if the pdcp-Config is included: 3> reconfigure the PDCP entity in accordance with the received pdcp-Config.