Section: 6.2.2.1 Keys in network entities
Content: Keys in the ARPF The ARPF shall process the long-term key K and any other sensitive data only in its secure environment. The key K shall be 128 bits or 256 bits long. During an authentication and key agreement procedure, the ARPF shall derive CK' and IK' from K in case EAP-AKA' is used and derive KAUSF from K in case 5G AKA is used. The ARPF shall forward the derived keys to the AUSF. The ARPF holds the Home Network Private Key that is used by the SIDF to deconceal the SUCI and reconstruct the SUPI. The generation and storage of this key material is out of scope of the present document. Keys in the AUSF In case EAP-AKA' is used as authentication method, the AUSF shall derive a key KAUSF from CK' and IK' for EAP-AKA' as specified in clause 6.1.3.1. In case that 5G AKA is used as authentication method, the UDM/ARPF shall generate the KAUSF as specified in clause 6.1.3.2. The KAUSF may be stored in the AUSF between two subsequent authentication and key agreement procedures. When the AUSF stores the KAUSF, the AUSF shall store the latest KAUSF generated after successful completion of the latest primary authentication. The authentication is considered as successful and the AUSF shall store the latest KAUSF or replace the old KAUSF with the new KAUSF (if the AMF(s) end up selecting the same AUSF instance for (re)authentication of the UE): - in case 5G AKA is used as authentication method, when the RES* and the XRES* are equal (see clause 6.1.3.2.0, Step 11). - in case EAP-AKA' is used as authentication method, when the AUSF sends an EAP-Success message to the SEAF (see clause 6.1.3.1, Step 10). The AUSF shall generate the anchor key, also called KSEAF, from the authentication key material received from the ARPF during an authentication and key agreement procedure. Keys in the SEAF The SEAF receives the anchor key, KSEAF, from the AUSF upon a successful primary authentication procedure in each serving network. The SEAF shall never transfer KSEAF to an entity outside the SEAF. Once KAMF is derived KSEAF shall be deleted. The SEAF shall generate KAMF from KSEAF immediately following the authentication and key agreement procedure and hands it to the AMF. NOTE 1: This implies that a new KAMF, along with a new KSEAF, is generated for each run of the authentication and key agreement procedure. NOTE 2: The SEAF is co-located with the AMF. Keys in the AMF The AMF receives KAMF from the SEAF or from another AMF. The AMF shall, based on policy, derive a key KAMF' from KAMF for transfer to another AMF in inter-AMF mobility. The receiving AMF shall use K'AMF as its key KAMF. NOTE 3: The precise rules for key handling in inter-AMF mobility can be found in clause 6.9.3. The AMF shall generate keys KNASint and KNASenc dedicated to protecting the NAS layer. The AMF shall generate access network specific keys from KAMF. In particular, - the AMF shall generate KgNB and transfer it to the gNB. - the AMF shall generate NH and transfer it to the gNB, together with the corresponding NCC value. The AMF may also transfer an NH key, together with the corresponding NCC value, to another AMF, cf. clause 6.9. - the AMF shall generate KN3IWF and transfer it to the N3IWF when KAMF is received from SEAF, or when KAMF' is received from another AMF. Keys in the NG-RAN The NG-RAN (i.e., gNB or ng-eNB) receives KgNB and NH from the AMF. The ng-eNB uses KgNB as KeNB. The NG-RAN (i.e., gNB or ng-eNB) shall generate all further access stratum (AS) keys from KgNB and /or NH. Keys in the N3IWF The N3IWF receives KN3IWF from the AMF. The N3IWF shall use KN3IWF as the key MSK for IKEv2 between UE and N3IWF in the procedures for untrusted non-3GPP access, cf. clause 11. Figure 6.2.2-1 shows the dependencies between the different keys, and how they are derived from the network nodes point of view. Figure 6.2.2-1: Key distribution and key derivation scheme for 5G for network nodes NOTE 4: The key derivation and distribution scheme for standalone non-public networks, when an authentication method other than 5G AKA or EAP-AKA' is used, is given in Annex I.2.3.