Section: 6.8.1.1.2.3 Full native 5G NAS security context not available
Content: If in the process described in clause 6.8.1.1.2.2, there is no full native 5G NAS security context available in the AMF (i.e. either the UE has sent an unprotected Registration Request message or the UE has protected the Registration Request message with a current native 5G security context which no longer is stored in the AMF) a primary authentication run is required. If there is a full native 5G NAS security context available in the AMF, then the AMF may (according to AMF policy) decide to run a new primary authentication and a NAS SMC procedure (which activates the new 5G NAS security context based on the KAMF derived during the primary authentication run) after the Registration Request. If the Registration Request was with "PDU session(s) to be re-activated", the NAS SMC procedure is executed before the corresponding AS SMC. The NAS (uplink and downlink) COUNTs are set to start values, and the start value of the uplink NAS COUNT shall be used as freshness parameter in the KgNB/KeNB derivation from the fresh KAMF (after primary authentication) when UE receives AS SMC the KgNB/KeNB is derived from the current 5G NAS security context, i.e., the fresh KAMF is used to derive the KgNB/KeNB. The KDF as specified in clause Annex A shall be used to derive the KgNB/KeNB. NOTE: Using the start value for the uplink NAS COUNT in this case cannot lead to the same combination of KAMF and NAS COUNT being used twice. This is guaranteed by the fact that the first integrity protected NAS message the UE sends to the AMF after primary authentication is the NAS SMC complete message. The NAS SMC complete message shall include the start value of the uplink NAS COUNT that is used as freshness parameter in the KgNB/KeNB derivation and the KAMF is fresh. After a primary authentication, a NAS SMC needs to be sent from the AMF to the UE in order to take the new NAS keys into use. Both NAS SMC and NAS SMC Complete messages are protected with the new NAS keys.