Section: 6.2.3.3 Key lifetimes
Content: KAUSF, and KSEAF shall be created when running a successful primary authentication as described in clause 6.1.3. KAMF shall be created in the following cases: 1. Primary authentication 2. NAS key re-keying as described in clause 6.9.4.2 3. NAS key refresh as described in clause 6.9.4.3 4. Interworking procedures with EPS (cf. clauses 8 and 10) In case the UE does not have a valid KAMF, an ngKSI with value "111" shall be sent by the UE to the network, which can initiate (re)authentication procedure to get a new KAMF based on a successful primary authentication. KNASint and KNASenc are derived based on a KAMF when running a successful NAS SMC procedure as described in clause 6.7.2. KN3IWF is derived from KAMF and remains valid as long as the UE is connected to the 5GC over non- 3gpp access or until the UE is reauthenticated. KgNB and NH are derived based on KAMF or KgNB or NH in the following cases: 1. Inter-gNB-CU-handover as described in clause 6.9.2.3.1 2. State transitions as described in clause 6.8 3. AS key re-keying as described in clause 6.9.4.4 4. AS key refresh as described in clause 6.9.4.5 The KRRCint, KRRCenc, KUPint and KUPenc are derived based on KgNB after a new KgNB is derived.