Section: 28.7.3 NAI format for SUCI
Content: When the SUPI is defined as a Network Specific Identifier, the SUCI shall take the form of a Network Access Identifier (NAI). In this case, the NAI format of the SUCI shall have the form username@realm as specified in clause 2.2 of IETF RFC 7542 [126], where the realm part shall be identical to the realm part of the Network Specific Identifier. In SNPN scenarios, the realm part of the NAI may include MCC, MNC and the NID of the SNPN (see 3GPP TS 23.501[ System architecture for the 5G System (5GS) ]  clauses 5.30.2.3, 5.30.2.9, 6.3.4, and 6.3.8; for the realm part format see Home Network Domain for an SNPN in clause 28.2). When the SUPI is defined as an IMSI, the SUCI in NAI format shall have the form username@realm, where the realm part shall be constructed by converting the leading digits of the IMSI, i.e. MNC and MCC, into a domain name, as described in clause 28.2. In SNPN scenarios, the realm part shall additionally include the NID of the SNPN, if available. The resulting realm part of the NAI shall be in the form: "5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org", or "5gc.nid<NID>.mnc<MNC>.mcc<MCC>.3gppnetwork.org" (for SNPN scenarios where the NID is available). NOTE: The NID might not be available for the UE if an operator chooses the SUCI calculation to be the done inside the USIM, since the NID is configured within the ME part of the UE. The username part of the NAI shall take one of the following forms: a) for the null-scheme: type<supi type>.rid<routing indicator>.schid<protection scheme id>.userid<MSIN or Network Specific Identifier SUPI username> b) for the Scheme Output for Elliptic Curve Integrated Encryption Scheme Profile A and Profile B: type<supi type>.rid<routing indicator>.schid<protection scheme id>.hnkey<home network public key id>.ecckey<ECC ephemeral public key value>.cip<ciphertext value>.mac<MAC tag value> c) for HPLMN proprietary protection schemes: type<supi type>.rid<routing indicator>.schid<protection scheme id>.hnkey<home network public key id>. out<HPLMN defined scheme output> See clause 2.2B for the definition and format of the different fields of the SUCI. EXAMPLES: Assuming the IMSI 234150999999999, where MCC=234, MNC=15 and MSISN=0999999999, the Routing Indicator 678, and a Home Network Public Key Identifier of 27, the NAI format for the SUCI takes the form: - for the null-scheme: type0.rid678.schid0.userid0999999999@5gc.mnc015.mcc234.3gppnetwork.org - for the Profile <A> protection scheme: type0.rid678.schid1.hnkey27.ecckey<ECC ephemeral public key>.cip< encryption of 0999999999>.mac<MAC tag value>@5gc.mnc015.mcc234.3gppnetwork.org Assuming the Network Specific Identifier user17@example.com, the Routing Indicator 678, and a Home Network Public Key Identifier of 27, the NAI format for the SUCI takes the form: - for the null-scheme: type1.rid678.schid0.useriduser17@example.com - for an anonymous SUCI: type1.rid678.schid0.useridanonymous@example.com (with username corresponding to "anonymous"), or type1.rid678.schid0.userid@example.com (with username corresponding to an empty string) - for the Profile <A> protection scheme: type1.rid678.schid1.hnkey27.ecckey<ECC ephemeral public key>.cip< encryption of user17>.mac<MAC tag value>@example.com See clauses 28.15.5 and 28.16.5 for the NAI format for a SUCI containing a GCI or a GLI.