3GPP 24.501 v20.0.0 — the document's own text
5.4.1.3.1 General
Taught in 4. Inside TS 24.501, the document at the centre (CT1 — the group that writes what your phone says, overview).
The purpose of the 5G AKA based primary authentication and key agreement procedure is to provide mutual authentication between the UE and the network and to agree on the keys KAUSF, KSEAF and KAMF (see 3GPP TS 33.501 [24]). The cases when the 5G AKA based primary authentication and key agreement procedure is used are defined in 3GPP TS 33.501 [24].
The network initiates the 5G AKA based primary authentication and key agreement procedure by sending an AUTHENTICATION REQUEST message to the UE without the EAP message IE. The network shall include the ngKSI and the ABBA in AUTHENTICATION REQUEST message.
The 5G AKA based primary authentication and key agreement procedure is always initiated and controlled by the network. However, the UE can reject the 5G authentication challenge sent by the network.
The UE shall proceed with a 5G authentication challenge only if a USIM is present.
A partial native 5G NAS security context is established in the UE and the network when a 5G authentication is successfully performed. During a successful 5G AKA based primary authentication and key agreement procedure, the CK and IK are computed by the USIM. CK and IK are then used by the ME as key material to compute new keys KAUSF, KSEAF and KAMF. KAMF is stored in the 5G NAS security contexts (see 3GPP TS 33.501 [24]) of both the network and in the volatile memory of the ME while registered to the network, and is the root for the 5GS integrity protection and ciphering key hierarchy.
NOTE 1: Generation of the new KAUSF and the new KSEAF does not result into deletion of the valid KAUSF and the valid KSEAF, if any.
Upon successful completion of the 5G AKA based primary authentication, the AMF shall initiate a security mode control procedure (see clause 5.4.2) to take the new partial native 5G NAS security context into use.
NOTE 2: The AMF immediately initiates a security mode control procedure (see clause 5.4.2) after 5G AKA primary authentication is successful to avoid KAUSF key mismatch between the UE and the network.