Section: 6.9.4.2 NAS key re-keying
Content: After a primary authentication has taken place, new NAS keys from a new KAMF shall be derived, according to Annex A.8. To re-activate a non-current full native 5G security context after handover from E-UTRAN the UE and the AMF take the NAS keys into use by running a NAS SMC procedure according to clause 6.7.2. AMF shall activate fresh NAS keys from a primary authentication run or activate native security context, which has a sufficiently low NAS COUNT values, before the NAS uplink or downlink COUNT wraps around with the current security context.