Security — NAS/AS Security (Key Hierarchy, SMC, NEA/NIA)¶

Learning objectives¶

After reading this page, you will be able to do the following.

• Explain Why (that authentication alone cannot protect the content of communication) as a countermeasure against eavesdropping and tampering.
• Explain the derivation tree from KSEAF onward in the key hierarchy (KSEAF→KAMF→{KNASenc/KNASint, KgNB}→{KRRCenc/KRRCint, KUPenc/KUPint}). State what each key protects.
• Follow the NAS Security Mode Command / Complete procedure and explain from which message ciphering and integrity protection become active.
• Follow the AS Security Mode Command / Complete procedure and explain the flow by which the KgNB-derived RRC/UP protection becomes active.
• Explain the meaning of NEA/NIA (NEA0/1/2/3 · NIA0/1/2/3 = NULL/SNOW 3G/AES/ZUC) and the mechanism by which they are selected.
• Understand security contexts (Native / Mapped, ngKSI, ABBA) and the ordering that NAS SMC comes first and AS SMC comes after.
• Organize what integrity protection and ciphering apply to (NAS/RRC/UP, and the Rel-16 enhancement of User Plane integrity protection).

Prerequisites¶

It will go more smoothly if you understand the following first. If you haven't yet, start from the Curriculum.

• Up to how KSEAF is established in primary authentication → Authentication chapter (this chapter is its continuation, dealing with what comes "next" after KSEAF is established)
• The big picture of Registration (establishing security was outlined as part of the registration procedure) → Initial Registration
• NAS / N1 (the layer that carries control messages between UE and AMF) → N1
• The roles of the NFs that terminate security → AMF (co-located with SEAF) / AUSF / UDM

What you'll learn in this chapter¶

This chapter narrows its focus to what happens "next" after KSEAF is established. That is, it deals precisely with key derivation from KSEAF onward (KAMF→NAS/AS keys) and the procedure that enables NAS/AS protection (Security Mode Command).

• Primary authentication (5G-AKA / EAP-AKA') itself (up to KSEAF establishment) is not repeated. See the Authentication chapter.
• SUCI concealment (concealing the real SUPI) is also not covered in this chapter; you are directed to the Authentication chapter / Registration chapter.
• The bird's-eye view of the key hierarchy from the root through KSEAF is consolidated in AUSF's key hierarchy. To avoid duplication, this chapter puts the branches from KAMF onward in the spotlight of its diagrams.

Why — why NAS/AS security is necessary¶

We start from Why (why it is necessary). When primary authentication (Authentication chapter) finishes, you can confirm "that the counterpart is a legitimate subscriber / a legitimate network." But that alone does not protect the content of communication. After authentication, the following two threats remain.

• Eavesdropping — Because anyone can receive radio waves, if you do not encrypt, the content of control messages and user data can be read.
• Tampering — If the content is rewritten in transit and you cannot detect it, you will act exactly as the attacker instructs (e.g., a spoofed command from an impersonating network).

So, based on the shared key agreed in authentication, subsequent communication is protected with ciphering (confidentiality) and integrity protection (tamper detection). Doing this across the two systems of the NAS layer (UE⇔AMF control) and the AS layer (UE⇔gNB radio control and user data) is the theme of this chapter.

Overview¶

KSEAF is the anchor key established in authentication. Starting from here, the keys branch into two systems: NAS protection (terminated by the AMF) and AS protection (terminated by the gNB).

• NAS system — KSEAF→KAMF→KNASenc / KNASint. Protects the NAS messages between UE and AMF. Enabled by NAS Security Mode Command / Complete (AMF-led).
• AS system — KAMF→KgNB→KRRCenc / KRRCint / KUPenc / KUPint. Protects the RRC (radio control) and UP (user data) between UE and gNB. Enabled by AS Security Mode Command / Complete (gNB-led).

Ordering is important. First NAS SMC runs first and establishes NAS protection, and only after KgNB is handed to the gNB does AS SMC establish AS protection.

flowchart LR
    KSEAF["KSEAF
(established in authentication)"] --> KAMF["KAMF
(derived by the AMF)"]
    KAMF --> NAS["NAS protection
KNASenc / KNASint
(UE⇔AMF)"]
    KAMF --> KGNB["KgNB
(→ to the gNB)"]
    KGNB --> AS["AS protection
KRRCenc/KRRCint
KUPenc/KUPint
(UE⇔gNB)"]
    NAS -. "NAS SMC comes first" .-> AS

For the bird's-eye view of the key hierarchy from the root through KSEAF, see AUSF's key hierarchy. This chapter drills into the branches from KAMF onward in the diagram above.

Basic Concept — a beginner-friendly explanation¶

To understand security, keep four keywords in mind.

1. The difference between ciphering (confidentiality) and integrity protection (tamper detection)¶

• Ciphering (Ciphering / Confidentiality) — Make the content unreadable to third parties. A countermeasure against eavesdropping. In 5G it is done with the NEA (NR Encryption Algorithm) algorithms.
• Integrity protection — Attach a short verification code called MAC-I (Message Authentication Code for Integrity) to the message and detect tampering. It does not hide the content, but it guarantees "that it has not been rewritten." In 5G it is done with NIA (NR Integrity Algorithm).

2. The idea of key derivation (KDF)¶

To make a lower key from a higher key, you use a KDF (Key Derivation Function). When you put a "parent key" and an "input parameter representing the purpose" into the KDF, a "child key" comes out. Because different inputs yield a different child key even from the same parent, you can safely mass-produce independent keys per purpose (the basics of KDF are in TS 33.220, and the application in 5G is in TS 33.501 Annex A; the details of individual input parameters are to be confirmed).

3. Why split keys per layer¶

The reason for splitting keys for NAS, RRC, and UP use is containment of damage (key separation). Even if the key of one layer leaks, the keys of the other layers cannot be back-calculated thanks to the one-way property of the KDF, so the damage can be contained. Also, because NAS is terminated by the AMF and AS by the gNB, by handing the gNB only KgNB and below, and not KAMF or the NAS keys, the scope of compromise of the radio-side node is limited.

4. ngKSI and the security context¶

• Security context (5G NAS security context) — The bundle of the established set of keys (KAMF, selected algorithms, counters, etc.).
• ngKSI (Key Set Identifier in 5G) — A short number that identifies that security context. Used so the UE and the network can agree on "which key set they are talking with." It is assigned at authentication and referenced in subsequent messages.

Architecture¶

Here is the key derivation tree starting from KSEAF. The root side (K through KSEAF) is consolidated in AUSF's key hierarchy, and this diagram concentrates on the branches from KAMF onward.

flowchart TB
    KSEAF["KSEAF
(established in authentication, anchor key)"]
    KAMF["KAMF
(derived by SEAF/AMF)"]
    KNASenc["KNASenc
NAS ciphering"]
    KNASint["KNASint
NAS integrity"]
    KgNB["KgNB
(conveyed AMF→gNB)"]
    KRRCenc["KRRCenc
RRC ciphering"]
    KRRCint["KRRCint
RRC integrity"]
    KUPenc["KUPenc
UP ciphering"]
    KUPint["KUPint
UP integrity (introduced in Rel-15 / relaxed in Rel-16)"]

    KSEAF --> KAMF
    KAMF --> KNASenc
    KAMF --> KNASint
    KAMF --> KgNB
    KgNB --> KRRCenc
    KgNB --> KRRCint
    KgNB --> KUPenc
    KgNB --> KUPint

What each key "protects, and where":

• KAMF — Derived by SEAF/AMF from KSEAF. The parent of the NAS keys and KgNB. Held by the AMF and not handed to the gNB.
• KNASenc / KNASint — Ciphering / integrity protection of the NAS messages between UE and AMF. Terminated by the AMF.
• KgNB — Derived from KAMF and conveyed from the AMF to the gNB over N2 (NGAP) (N2). The parent of the AS keys.
• KRRCenc / KRRCint — Ciphering / integrity protection of the RRC (radio control) between UE and gNB. Terminated by the gNB.
• KUPenc / KUPint — Ciphering / integrity protection of the UP (User Plane / user data) between UE and gNB. UP integrity protection (KUPint) was introduced in Rel-15 with constraints on its application, but Rel-16 relaxed the constraints and advanced full data rate support (see Release differences below).

Network Function (the elements involved)¶

The elements involved in this procedure, and how they act in this chapter.

Interface / Protocol¶

The interfaces and protocols used in this procedure.

Procedure — Call Flow¶

This is the heart of this page. Enabling protection proceeds in the order (A) NAS SMC first, (B) AS SMC after. The premise is that KSEAF is already established (Authentication chapter).

(A) NAS Security Mode Command / Complete¶

The AMF leads, and with the selected NAS algorithms (NEA/NIA) enables NAS integrity protection first, followed by ciphering. Basis: TS 33.501 §6.7.2 / TS 24.501 (the NAS SMC messages).

sequenceDiagram
    autonumber
    participant UE
    participant AMF as AMF / SEAF

    Note over UE,AMF: Authentication succeeded → AMF derives KAMF → derives KNASint/KNASenc
    Note right of AMF: AMF selects NEA/NIA from the
UE security capability (TS 33.501 §6.7.2)
    AMF->>UE: Security Mode Command (NAS)
(selected NEA/NIA, ngKSI, ABBA,
 replayed UE security capability)
    Note right of AMF: This message is 【integrity-protected only】
(MAC-I added with KNASint, no ciphering)
    Note right of UE: UE derives the same KNASint/KNASenc,
verifies MAC-I and checks the resent UE sec capability matches
    UE->>AMF: Security Mode Complete (NAS)
(IMEISV etc. as needed)
    Note right of UE: This reply is 【integrity-protected + ciphered】
    Note over UE,AMF: Subsequent NAS has ciphering + integrity protection active

Step-by-step (numbers correspond to the diagram above)¶

1. AMF→UE: Security Mode Command(NAS) — The AMF sends the selected NEA/NIA, the ngKSI (which key set), the ABBA, and the replay (resend) of the UE security capability.
   • This message itself is sent integrity-protected only (MAC-I added with KNASint) and is not ciphered. So the content (selected algorithms, etc.) can be read in the clear by the UE and by observers (TS 33.501 §6.7.2).
2. (Inside the UE) verification — The UE also derives the same KNASint/KNASenc itself and verifies the MAC-I. It further checks whether the replayed UE security capability matches its own declared values (detection of a downgrade / bidding-down attack).
3. UE→AMF: Security Mode Complete(NAS) — If verification is OK, it returns a reply. From this reply, both integrity protection and ciphering are active. Subsequent NAS messages (Registration Accept, etc.) are ciphered and their content becomes invisible.

(B) AS Security Mode Command / Complete¶

After NAS protection is established, the AMF derives KgNB and hands it to the gNB over N2. The gNB derives the RRC/UP keys from KgNB and enables radio-segment protection with the AS SMC (RRC message). Basis: TS 33.501 §6.7.4 / TS 38.331 (RRC).

sequenceDiagram
    autonumber
    participant UE
    participant gNB
    participant AMF

    Note over AMF: AMF derives KgNB from KAMF
    AMF->>gNB: (N2/NGAP) Convey KgNB and UE security capability
via Initial Context Setup, etc.
    Note right of gNB: gNB derives
KRRCint/KRRCenc/KUPint/KUPenc from KgNB
and selects NEA/NIA for AS
    gNB->>UE: AS Security Mode Command (RRC)
(selected AS algorithms, MAC-I)
    Note right of gNB: Integrity protection becomes active first (RRC)
    Note right of UE: UE derives the same KgNB-derived keys
and verifies MAC-I
    UE->>gNB: AS Security Mode Complete (RRC)
    Note over UE,gNB: Subsequent RRC/UP protection active (enforced at the PDCP layer)

Step-by-step (numbers correspond to the diagram above)¶

1. AMF→gNB (N2/NGAP) — The AMF conveys KgNB and the UE security capability to the gNB in an NGAP message such as Initial Context Setup (N2).
2. (Inside the gNB) key derivation and algorithm selection — The gNB derives KRRCint/KRRCenc/KUPint/KUPenc from KgNB and selects the NEA/NIA for AS.
3. gNB→UE: AS Security Mode Command(RRC) — Contains the selected AS algorithms and MAC-I. Integrity protection becomes active first (TS 33.501 §6.7.4 / TS 38.331).
4. UE→gNB: AS Security Mode Complete(RRC) — The UE derives the same KgNB-derived keys, verifies the MAC-I, and replies. Subsequent RRC / UP protection is active (the actual protection is enforced at the PDCP layer. TS 38.323).

Signal Flow¶

The main messages are organized in a table. The IEs are made consistent with the Message Dictionary.

Main IE terms: selected NEA/NIA (the selected ciphering/integrity algorithms) / ngKSI (key set identifier) / ABBA (anti-bidding-down defense) / replayed UE security capability (the resend of the UE's declared capability = for tamper detection) / MAC-I (integrity verification code). For details, see the Message Dictionary.

State Machine¶

The state transitions of security establishment as seen from the UE (basis: TS 33.501 §6.7; the classification of security contexts is in TS 33.501 §6.3 / TS 24.501 §4.4).

stateDiagram-v2
    [*] --> NoSecurity: Before authentication / no protection
    NoSecurity --> KSEAFEstablished: Primary authentication succeeds (Authentication chapter)
    KSEAFEstablished --> NASProtected: NAS SMC Command/Complete succeeds
    NASProtected --> ASProtected: AS SMC Command/Complete succeeds
    NASProtected --> NoSecurity: NAS SMC Reject / MAC-I failure
    ASProtected --> [*]: NAS + AS protection established (normal operation)

• NoSecurity — No protection. The first Registration Request, etc., is sent in this state (some may be sent without integrity protection = there are details to be confirmed).
• KSEAFEstablished — Authentication succeeded and established up to KSEAF/KAMF. NAS protection is still "before being enabled."
• NASProtected — NAS SMC completed. NAS between UE and AMF is ciphered + integrity-protected.
• ASProtected — AS SMC completed. RRC/UP between UE and gNB is also protected. The normal operating state.

Packet Analysis (Wireshark)¶

Because the NAS SMC is a NAS message, capture it with nas-5gs. The point that NAS is carried nested inside NGAP(N2) is the same as in Registration's Packet Analysis.

Main display filters¶

Points to look at when decoding¶

• Security Mode Command can be read in the clear — Because it is sent integrity-protected only (no ciphering), you can confirm selected NEA/NIA, ngKSI, ABBA, and replayed UE security capability in the clear.
• After ciphering, the NAS payload becomes invisible — From Security Mode Complete onward (for DL, from the message after SMC), NAS is ciphered and appears in Wireshark as a Security protected NAS message, and the inner 5GMM message cannot be seen without the decryption key.
• MAC — Integrity-protected NAS carries a MAC (Message Authentication Code) field.

Configuration¶

The structure-level essentials of the configuration that makes protection work. Concrete values and vendor-specific ones (Cisco, etc.) are implementation-dependent, and no fictitious values are written here.

AMF side (NAS security) — e.g., Open5GS / free5GC¶

• Supported NEA / NIA and priority — Enumerate the ciphering algorithms (NEA0/1/2/3) and integrity algorithms (NIA0/1/2/3) the AMF supports, and set their priority. Selection is made by matching against the UE's security capability.
• Whether the NULL algorithms (NEA0 / NIA0) are allowed — Whether to allow NEA0 (no ciphering) or NIA0 (no integrity) is a policy. In operational networks, NIA0 is in principle not allowed, and it is permitted only for unauthenticated emergency calls (TS 33.501).

gNB side (AS security)¶

• Supported AS algorithms and priority — Enumeration and priority of the ciphering/integrity algorithms for RRC/UP.
• Enabling User Plane integrity protection (UP IP) — Whether to request/enable UP integrity protection (introduced in Rel-15, application range expanded in Rel-16; the application conditions are to be confirmed).

Trouble Shooting¶

Isolating typical security-establishment failures. For details of Cause values, see the Cause Dictionary.

Comparison with EPC¶

Contrasting 4G(EPC) security with 5G.

Release differences¶

Uncertain items are marked to be confirmed and are not asserted.

• Rel-15 — The basis of 5G security. KSEAF/KAMF, the NAS/AS key hierarchy, NAS/AS SMC, NEA/NIA(0/1/2/3), ngKSI, and ABBA are established (the basis of TS 33.501).
• Rel-16 — The main topic is the extension of User Plane integrity protection (UP IP). In Rel-15 there were constraints on applying UP integrity protection, but Rel-16 strengthened the application range/performance aspects (the concrete mandatory conditions and application range are to be confirmed).
• Rel-17 / Rel-18 (5G-Advanced) — Extensions of security features continue (the concrete differences to this chapter's procedure are to be confirmed).

3GPP Specification¶

FAQ¶

Summary¶

• Authentication (identity verification) alone cannot protect the content of communication. The theme of this chapter is protecting NAS/AS with ciphering (confidentiality) + integrity protection (tamper detection).
• Starting from KSEAF, keys derive as KAMF→{KNASenc/KNASint, KgNB}→{KRRCenc/KRRCint, KUPenc/KUPint}. Keys are split per layer to contain damage.
• Protection is enabled in the order NAS SMC (AMF-led, first) → AS SMC (gNB-led, after). The NAS SMC is sent integrity-protected only, and ciphering begins from Complete onward (from the next message for DL).
• The algorithms are NEA (ciphering) / NIA (integrity) in 0/1/2/3 (NULL/SNOW 3G/AES/ZUC). Selection is decided by the UE security capability and the network's priority.
• ngKSI identifies the security context. Contexts come in Native / Mapped. ABBA prevents downgrade attacks.
• For the key hierarchy from the root through KSEAF, see AUSF's key hierarchy; for primary authentication, see the Authentication chapter.
• The basis is TS 33.501 §5.11 (NEA/NIA) / §6.2 (key hierarchy) / §6.7.2 (NAS SMC) · §6.7.4 (AS SMC) / TS 24.501 / TS 38.331 / TS 38.323.

Practice — comprehension check and exercises¶

Comprehension check¶

Exercises¶

Problem: Fill in the blanks [1]–[4] in the following key derivation tree, then reorder the protection-enabling steps A–D correctly.

[Key derivation tree]
KSEAF → [1] → { [2] / KNASint, [3] }
[3] → { KRRCenc / KRRCint, KUPenc / [4] }

[Order]
A. UE→gNB: AS Security Mode Complete
B. AMF→UE: NAS Security Mode Command
C. gNB→UE: AS Security Mode Command
D. UE→AMF: NAS Security Mode Complete

Next Step¶

The next steps to deepen your understanding.

• PDU Session chapter (establishing the data-communication pipe, including Secondary Authentication)
• Related NFs: AMF (co-located with SEAF, NAS termination) / AUSF (has the key hierarchy diagram, the source of KSEAF) / UDM (the source of K/OPc)
• Preceding procedures: Authentication chapter (up to KSEAF establishment) / Initial Registration (the positioning of security establishment)
• Dictionaries: Message Dictionary / Cause Dictionary / Protocol Dictionary / NF Dictionary / Interface Dictionary