For the purposes of the present document, the terms given in TR 21.905 and the following apply. A term defined in the present document takes precedence over the definition of the same term, if any, in TR 21.905.

Void

For the purposes of the present document, the abbreviations given in TR 21.905 and the following apply. An abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in TR 21.905. AES SMC ZUC

Introduction of any new algorithm into the 5G system will have a certain amount of impact. The deployment of the new algorithms will not take place everywhere all at once. There are already today a set of algorithms specified for 5G (128-NEA-1,2,3 and 128-NIA-1,2,3). For AS and NAS protocols there are negotiation mechanisms in place that will help both peers of a connection to find a set of algorithms (one for confidentiality and one for integrity) that they share. The network operator is in control of the prioritization of the algorithms. The algorithm with the highest priority that both endpoints can agree on gets selected. If the introduction of 256-bit key algorithms is considered as introduction of any new algorithms, it is a fair assumption that current mechanisms can be reused and provide equally strong negotiation protection for the 256-bit algorithms just by adding possibility to negotiate the new algorithms (i.e. define new algorithm identifiers/code points). The purpose of this Annex is to discuss the different aspects of introducing 256-bit algorithms and its potential impact to the 5G system, especially in terms of backward compatibility when 128-bit and 256-bit algorithms are co-existed in the 5G system. The current mechanisms allow for introducing new algorithms. That would work as described below. The impact to key derivation and AS/NAS protocols is described in clauses B.2 and B.3. For more detailed analysis of the impact to AS protocols, the impact to dual connectivity, RRC-reconnection, and handovers and interworking are discussed in clauses B.4, B.5 and B.6.

The Key (or long-term key(s) of the subscription credential(s)) can be either 128 or 256 bits, see clause 6.2.2 of TS 33.501. If a 128-bit long-term key is used for authenticating the UE, all output keys in the 5G key hierarchy are 256 bits, which means that they need truncation to be used in 128-bit algorithms. The truncation is defined in Annex A.8 of TS 33.501 as: "For an algorithm key of length n bits, where n is less or equal to 256, the n least significant bits of the 256 bits of the KDF output shall be used as the algorithm key." According to the above, when n=128, the 128 least significant bits of the output key are used, and when n=256, all of the bits of the output key are used. It was confirmed that the existing key derivation function and truncation for generating keys for NAS, UP and RRC work for both 128-bit and 256-bit algorithms without any changes to the mechanisms.

Clause 6.4.6 of TS 33.501 defines the protection of initial NAS message, and one of the information elements in the initial NAS message is UE security capabilities. Therefore, the initial NAS message can carry the list of supported 256-bit algorithms if algorithm identifier values are assigned. In clause 6.7.2 of TS 33.501, the information element for NAS Security Mode Command is defined. Mandatory elements are the replayed UE security capabilities, the selected NAS algorithms, and the ngKSI for identifying the KAMF. H The key length is not involved in this procedure, and NAS Security Mode Command can be applied for 256-bit algorithms if corresponding algorithm identifier values are assigned to 256-bit algorithms. The AS algorithms are selected between UE and gNB in the similar manner as NAS algorithms. Therefore, 256-bit AS algorithms can be adopted to AS algorithm selection. It was agreed that 128-bit algorithms are still sufficiently secure for the 5G system and that no need to differentiate the security levels provided by 128-bit and 256-bit algorithms. Therefore, from a specification perspective, 256-bit algorithms can be treated as an additional set of algorithms and the NAS and AS SMC procedures for negotiating algorithms between the UE and AMF and the UE and gNB respectively can be used. What is needed is for the new algorithms to be assigned new identifiers in clause 5.11.1 of TS 33.501 and that new code points are assigned in the UE security capability information element for the new encryption and integrity protection algorithms in stage 3 specifications.

In NR-NR Dual Connectivity (NR-DC) the UE is simultaneously connected to more than one RAN node, a MN and a SN, see clause 6.10 of TS 33.501. The rules for setting up security contexts in Dual connectivity are very complex, but (very much simplified), it can be summarized so that if protection on the air interface is activated on one access, it needs to be active on the other access as well. There is no rule that the two accesses need to use the same air-interface security algorithms, see the note in clause 6.10.3.3 of TS 33.501. It was confirmed that 128-bit algorithms are secure for the 5G system and that 256-bit algorithms are just a set of additional algorithms. Therefore, it is possible to use a 128-bit algorithm over one access and a 256-bit algorithm over the other access in Dual connectivity, reusing existing mechanisms.

When RRC connection is re-established, the same air-interface security algorithm as the source gNB can be selected between the UE and target gNB. However, this does not prohibit the algorithm negotiation between the UE and the target gNB, a new algorithm can be selected based on the UE security capability and the security policy of gNB. When the new algorithm is to be selected between the UE and the target gNB, AS algorithm selection can be used. As discussed in B.3, AS algorithm selection can be used for both 128-bit and 256-bit algorithms if adequate algorithm identifier values are assigned. It was confirmed that 128-bit algorithms are secure for the 5G system and that 256-bit algorithms are just a set of additional algorithms, then it is possible to use a 256-bit algorithm over one access and handover to an access that is using a 128-bit algorithm or vice versa.

After a handover from one network that does not support the 256-bit air-interface security algorithms (e.g. a LTE network) to a network supporting one or more of the 256-bit algorithms, the AMF of the latter can run a new NAS SMC with UE to switch to the 256-bit algorithm. Hence, the UE does not "get stuck" in using the old type of algorithms, but the operator policy can take the UE's full UE security capability into account. As discussed in clause B.3, NAS SMC can support both 128-bit and 256-bit algorithms if adequate algorithm identifier values are assigned. It was confirmed that 128-bit algorithms are secure for the 5G system and that 256-bit algorithms are just a set of additional algorithms, then it is possible to use a 256-bit algorithm over one access and handover to an access that is using a 128-bit algorithm or vice versa. Therefore, there is no security issue identified for reusing the existing mechanisms in handovers and interworking scenarios.