Section: I.2.3 Key hierarchy, key derivation and key distribution I.2.3.1 General
Content: The text in clauses 6.2.1 and 6.2.2 cannot apply directly for an EAP authentication method other than EAP-AKA' as these clauses assume that an AKA-based authentication method is used. The major differences are the way in which KAUSF is calculated and that the UDM/ARPF is not necessarily involved in the key derivation or distribution. Depending on the selected authentication method, the KAUSF is generated as follows: - For 5G AKA and EAP-AKA' refer to clause 6.2.1. - When using a key-generating EAP authentication method other than EAP-AKA', the key derivation of KAUSF is based on the EAP-method credentials in the UE and AUSF and shall be done as shown in Figure I.2.3-1. NOTE: For EAP authentication methods other than EAP-AKA', this key derivation replaces clauses 6.2.1 and 6.2.2 for the generation of KAUSF . Figure I.2.3.1-1: KAUSF derivation for key-generating EAP authentication methods other than EAP-AKA' KAUSF shall be derived by the AUSF and UE from the EMSK created by the EAP authentication as for EAP-AKA'. All of figures 6.2.1-1, 6.2.2.1-1 and 6.2.2.2.2-1 from the KAUSF downwards are used without modification. Similarly, text relating to the key hierarchy, key derivation and key distribution in clauses 6.2.1, 6.2.2.1 and 6.2.2.2 for keys derived from KAUSF (e.g. KSEAF, KAMF, KgNB etc) apply without modification.