Section: 6.8.1.1.2.2 Full native 5G NAS security context available
Content: The UE shall transmit a NAS Registration Request message. This message is integrity protected using the distinct NAS COUNT values and the NAS connection identifier associated with this access. For the case that the 5G NAS security context used by the UE is non-current in the AMF, the AMF shall delete any existing current 5G security context and make the used 5G security context the current 5G security contex. Furthermore, provided that the NAS Registration Request was with "PDU session(s) to be re-activated" and there is no NAS SMC procedure before the AS SMC the NAS COUNT of the Registration Request message shall be used to derive the KgNB/KeNB with the KDF as specified in Annex A. As a result of the NAS Registration Request with "PDU session(s) to be re-activated", the gNB/ng-eNB shall send an AS SMC to the UE to activate AS security. The KgNB/KeNB used, is derived in the current 5G NAS security context. When the UE receives the AS SMC without having received a NAS Security Mode Command after the Registration Request with "PDU session(s) to be re-activated", it shall use the uplink NAS COUNT of the Registration Request message that triggered the AS SMC to be sent as freshness parameter in the derivation of the initial KgNB/KeNB. From this initial KgNB/KeNB the RRC protection keys and the UP protection keys shall be derived as described in sub-clause 6.2.3.1. The same procedure for generating initial KgNB/KeNB can be used regardless of the fact if the UE is connecting to the same AMF to which it was connected previously or to a different AMF. In case UE connects to a different AMF and this AMF selects different NAS algorithms, the NAS keys have to be re-derived in the AMF with the new algorithm IDs as input using the KDF as specified in Annex A. In addition, there is a need for the AMF to send a NAS SMC to the UE to indicate the change of NAS algorithms and to take the re-derived NAS keys into use. The UE shall assure that the NAS keys used to verify the integrity of the NAS SMC are derived using the algorithm ID specified in the NAS SMC. The NAS SMC Command and NAS SMC Complete messages are protected with the new NAS keys. If there is a NAS Security Mode Command after the Registration Request with "PDU session(s) to be re-activated" but before the AS SMC, the UE and AMF use the uplink NAS COUNT of the most recent NAS Security Mode Complete and the related KAMF as the parameter in the derivation of the KgNB/KeNB. From this KgNB/KeNB the RRC protection keys and the UP protection keys are derived as described in sub-clause 6.2.3.1.