Section: 5.8.1 Generic requirements
Content: The long-term key(s) used for authentication and security association setup purposes shall be protected from physical attacks and shall never leave the secure environment of the UDM/ARPF unprotected. NOTE 1: Security mechanisms for protection of subscription credentials in ARPF are left to implementation. NOTE 2: Security mechanisms for storage of subscription credentials in the UDR and for the transfer of authentication subscription data (as specified in 3GPP TS 29.505[ 5G System; Usage of the Unified Data Repository services for Subscription Data; Stage 3 ]  [70]) between UDR and ARPF are left to implementation.