Section: 6.8.1.3 Key handling for the Registration procedure when registered in NG-RAN
Content: NOTE: This clause applies to both 3GPP access and non-3GPP access. Before the UE can initiate the Registration procedure, the UE needs to transition to CM-CONNECTED state. The UE shall use the current 5G security context to protect the Registration Request and include the corresponding 5G-GUTI and ngKSI value. The Registration Request shall be integrity-protected, but not confidentiality-protected. UE shall use the current 5G security context algorithms to protect the Registration Request message. For the case that this security context is non-current in the AMF, the AMF shall delete any existing current 5G security context and make the used 5G NAS security context the current 5G security context. If "PDU session(s) to be re-activated" is included in the Registration request message or if the AMF chooses to establish radio bearers when there is pending downlink UP data or pending downlink signalling, radio bearers will be established as part of the Registration procedure and a KgNB/KeNB will be derived. If there was no subsequent NAS SMC, the value of the uplink NAS COUNT, associated with the 3GPP access over which the Registration request message was sent from the UE to the AMF, is used as freshness parameter in the KgNB/KeNB derivation using the KDF as specified in clause Annex A.9. In the case a primary authentication is run successfully, the uplink and downlink NAS COUNT shall be set to the start values (i.e. zero). In the case source and target AMF use different NAS algorithms, the target AMF re-derives the NAS keys from KAMF with the new algorithm identities as input and provides the new algorithm identifiers within a NAS SMC. The UE shall assure that the NAS keys used to verify the integrity of the NAS SMC are derived using the algorithm identity specified in the NAS SMC. If there is a NAS Security Mode Command after the Registration Request over 3GPP access, the UE and AMF shall use the value of the uplink NAS COUNT associated with the 3GPP access of the most recent NAS Security Mode Complete and the related KAMF as the parameter in the derivation of the KgNB/KeNB. From this KgNB/KeNB the RRC protection keys and the UP protection keys are derived as described in sub-clause 6.2.3.1. In the case of Registration over non-3GPP access, the UE and AMF shall use the uplink NAS COUNT associated with the non-3GPP access of the most recent NAS Security Mode Complete and the related KAMF as the parameter in the derivation of the KN3IWF. IPsec SA is established between the UE and N3IWF using the KN3IWF as described in sub-clause 7.2.1 of this document.