Section: 6.9.4 Key-change-on-the-fly 6.9.4.1 General
Content: Key change on-the-fly consists of key refresh or key re-keying. Key refresh shall be possible for KgNB, KRRC-enc, KRRC-int, KUP-enc, and KUP-int (if available ) and shall be initiated by the gNB/ng-eNB when a PDCP COUNTs are about to be re-used with the same Radio Bearer identity and with the same KgNB. The procedure is described in clause 6.9.4.5. Key re-keying shall be possible for the KgNB, KRRC-enc, KRRC-int, KUP-enc, and KUP-int (if available). This re-keying shall be initiated by the AMF when a 5G AS security context different from the currently active one shall be activated. The procedures for doing this are described in clause 6.9.4.4. AS Key change on-the-fly is accomplished using a procedure based on intra-cell handover. The following AS key changes on-the-fly shall be possible: local KgNB refresh (performed when PDCP COUNTs are about to wrap around), KgNB re-keying performed after an AKA run, activation of a native context after handover from E-UTRAN. Key re-keying shall be possible for KNAS-enc and KNAS-int. Re-keying of KNAS-enc and KNAS-int shall be initiated by the AMF when a 5G NAS security context different from the currently active one shall be activated. The procedures for doing this are described in clause 6.9.4.2. Re-keying of the entire 5G key hierarchy including KAMF shall be achieved by first re-keying KAMF, then KNAS-enc and KNAS-int, followed by re-keying of the KgNB and derived keys. For NAS key change on-the-fly, activation of NAS keys is accomplished by a NAS SMC procedure.