3GPP 24.501 v20.0.0 — the document's own text

5.4.1.2.5 EAP result message transport procedure

Taught in 4. Inside TS 24.501, the document at the centre (CT1 — the group that writes what your phone says, overview).

5.4.1.2.5.1 General

The purpose of the EAP result message transport procedure is to provide an EAP-success message or an EAP-failure message, and ngKSI from the network to the UE, when the EAP message cannot be piggybacked by another NAS message.

The EAP result message transport procedure is initiated:

by an AUTHENTICATION RESULT message with the EAP message IE carrying the EAP-success message or the EAP-failure message; or
by an AUTHENTICATION REJECT message with the EAP message IE carrying the EAP-failure message.

5.4.1.2.5.2 EAP result message transport procedure initiation by the network

In order to initiate the EAP result message transport procedure, the AMF shall create an AUTHENTICATION RESULT message or an AUTHENTICATION REJECT message.

The AMF shall set the EAP message IE of the AUTHENTICATION RESULT message to an EAP-success message or an EAP-failure message to be sent to the UE. If the AUTHENTICATION RESULT message is provided to a 5G-RG that is acting on behalf of an AUN3 device and the EAP message IE is set to an EAP-success message, the AMF shall include the AUN3 device security key IE in the AUTHENTICATION RESULT message with its value set to:

the Master session key, if the AUN3 device does not support 5G key hierarchy; or
the KWAGF key, if the AUN3 device supports 5G key hierarchy.

NOTE: The network is aware from the AUN3 device subscription data in UDM whether the AUN3 device supports 5G key hierarchy or not as specified in clause 7B.7 of 3GPP TS 33.501 [24].

The AMF shall set the EAP message IE of the AUTHENTICATION REJECT message to an EAP-failure message to be sent to the UE. The AMF shall set the ngKSI IE of the AUTHENTICATION RESULT message or the AUTHENTICATION REJECT message to the ngKSI value selected in clause 5.4.1.2.2.2, clause 5.4.1.2.3.1 or clause 5.4.1.2.3A.1.

The AMF shall send the AUTHENTICATION RESULT message or the AUTHENTICATION REJECT message to the UE (see example in figure 5.4.1.2.5.2.1).

Figure 5.4.1.2.5.2.1: EAP result message transport procedure

Upon receipt of an AUTHENTICATION RESULT message or an AUTHENTICATION REJECT message with the EAP message IE, the UE handles the EAP message received in the EAP message IE and the ABBA if received of the AUTHENTICATION RESULT message or in the AUTHENTICATION REJECT message, and the 5G-RG that is acting on behalf of an AUN3 device handles the AUN3 device security key IE if received in the AUTHENTICATION RESULT message.