Content for TR 33.821 Word version: 9.0.0
6 User Plane Security p. 33
6.1 Consequences of (not) applying user plane integrity protection p. 33
6.2 Track of Decision p. 35
7 Control Plane Security p. 35
7.1 MAC, RLC and RRC layer security p. 35
7.1.1 Conclusions p. 36
7.2 SAE/LTE AKA p. 36
7.2.1 Requirements on SAE/LTE AKA p. 36
7.2.1.1 General p. 36
7.2.1.2 Non-3GPP access p. 37
7.2.1.3 LTE access p. 37
7.2.1.4 3GPP non-LTE access p. 38
7.2.1.5 UE Attach in LTE p. 38
7.2.2 Comparison of UMTS AKA or EAP AKA p. 38
7.2.2.1 High level items p. 38
7.2.2.2 Particular EAP features p. 40
7.2.2.3 Detailed impacts (outstanding standardization work) p. 42
7.2.2.4 Analysis overview p. 43
7.2.3 RAND and 256-bit keys in E-UTRAN p. 44
7.2.4 Migration path to enable 256-EPS AKA p. 46
7.3 Security set-up procedure p. 47
7.3.1 Security Mode Command p. 47
7.3.1.1 Separated Mode p. 47
7.3.1.2 Combined Mode p. 47
7.3.2 Alternative not using Security Mode Command (SMC) p. 49
7.3.2.1 Validity of the security association p. 49
7.3.2.2 Start of Encryption and the Encryption of NAS message contents p. 49
7.3.3 Establishment of a security context p. 49
7.4 Key handling p. 51
7.4.1 UMTS AKA p. 51
7.4.2 Serving Network Authentication for LTE p. 51
7.4.2.1 Introduction p. 51
7.4.2.2 Threats p. 52
7.4.2.3 Countermeasures p. 53
7.4.2.4 Conclusions p. 54
7.4.3 Key derivation p. 55
7.4.3.1 Key generation during initial access p. 55
7.4.3.2 Key distribution during handover in inter-RAT p. 56
7.4.4 Key management aspects for LTE/UMTS interworking p. 56
7.4.5 Void
7.4.6 Key identities in LTE/SAE p. 57
7.4.7 Hierarchy of user-related keys in SAE/LTE p. 59
7.4.7.1 General p. 59
7.4.7.2 Proposed hierarchy of user-related keys in SAE/LTE p. 59
7.4.7.3 Justification of proposed key hierarchy p. 61
7.4.7.3.1 Binding of a context to a key: p. 61
7.4.7.3.2 Top-level key in the system p. 61
7.4.7.3.3 Binding CK, IK to SAE p. 61
7.4.7.3.4 Binding top-level key for access network to PLMN and RAT p. 63
7.4.7.3.5 Binding keys to traffic type in LTE p. 63
7.4.7.3.6 Binding keys to cryptographic algorithms in LTE p. 64
7.4.7.3.7 Binding keys to identities of eNBs in LTE p. 64
7.4.7.3.8 Binding keys to temporary identities of the UE p. 64
7.4.7.4 Storage of KASME p. 64
7.4.8 Use of AMF for SAE binding p. 66
7.4.8.1 Background p. 66
7.4.8.2 SAE binding with AMF p. 67
7.4.9 Key handling on active to idle and idle to active transitions in SAE p. 68
7.4.9.1 General p. 68
7.4.9.2 Idle to active transition p. 68
7.4.9.3 Active to idle transition p. 68
7.4.10 Key handling on mobility within an SAE/LTE network and between two different SAE/LTE networks p. 69
7.4.11 K_eNB refresh at state transitions p. 69
7.4.12 Key handling on idle mode mobility p. 70
7.4.12.1 Within one SAE/LTE network p. 70
7.4.12.2 Between different SAE/LTE networks p. 71
7.4.12.3 Proposed procedure p. 71
7.4.12.4 Key handling on idle mode mobility from UTRAN to E-UTRAN p. 72
7.4.12.5 Integrity protection of Attach and TAU message p. 73
7.4.13 Key handling on active mode mobility p. 75
7.4.13.1 Overview on alternatives for key handling on handover p. 75
7.4.13.2 Key handling on handover within one SAE/LTE network p. 76
7.4.13.2.1 The necessity of forward security for KeNB derivation p. 76
7.4.13.2.2 AS key Handling Properties p. 77
7.4.13.2.3 Key refresh on Intra eNB handover p. 78
7.4.13.2.4 Key refresh on Inter eNB, intra MME handover p. 78
7.4.13.2.5 Key refresh on Inter MME handover p. 80
7.4.13.3 Alternatives for key handling on handover between different SAE/LTE networks p. 84
7.4.13.4 Summary of evaluation of alternatives p. 84
7.4.13.5 Key handling on handover from UTRAN to E-UTRAN p. 84
7.4.14 Security algorithm negotiation and Security mode command in SAE/LTE networks p. 88
7.4.14.1 General p. 88
7.4.14.2 Background: algorithm selection in UMTS p. 88
7.4.14.3 Requirements for algorithm selection in SAE/LTE p. 88
7.4.14.4 Alternatives for security mode command and algorithm selection in SAE/LTE p. 89
7.4.14.4.1 Security mode command and algorithm selection at initial attachment or in transitions to active mode p. 89
7.4.14.4.2 Security mode command and algorithm selection on idle mode mobility p. 95
7.4.14.4.3 Security mode command and algorithms selection on handover p. 95
7.4.14.4.4 Algorithms selection on handover to and from 2G/3G p. 96
7.4.15 Key-change-on-the-fly p. 97
7.4.15.1 Serving network operator restricts the KASME lifetime p. 97
7.4.15.2 Serving network operator restricts the ECM-CONNECTED lifetime p. 97
7.4.15.3 NAS COUNT reaches maximum p. 97
7.4.15.4 After Inter-RAT handover from UTRAN/GERAN to LTE p. 97
7.4.15.5 Intra LTE Inter-operator Handover p. 98
7.4.15.6 KeNB sequence numbers are about to wrap around. p. 98
7.4.16 Independence of keys at different eNodeBs p. 99
7.5 START value transfer p. 99
7.5.1 Why does START value have to transfer from UE to CN p. 99
7.5.2 How does START transfer from UE to CN p. 99
7.5.3 How many START value should be used p. 100
7.6 Security algorithms p. 100
7.6.1 Choice of algorithms p. 100
7.6.2 Terminal support p. 101
7.6.3 Network support p. 101
7.6.4 Algorithm input p. 101
7.6.4.1 Input parameters to RRC signalling ciphering algorithm p. 101
7.6.4.2 Input parameters to NAS signalling ciphering algorithm p. 102
7.6.4.3 Input parameters to UP ciphering algorithm p. 103
7.6.4.4 Input parameters to RRC signalling Integrity algorithm p. 104
7.6.4.5 Input parameters to NAS signalling Integrity algorithm p. 104
7.6.5 Algorithm IDs in EPS p. 105
7.6.6 KDF negotiation p. 106
7.6.6.1 Overview on the use of KDF functions for EPS p. 106
7.6.6.2 Effects on the security of overview of the use of KDF functions p. 106
7.6.6.3 Possible solutions for KDF negotiation and their requirements p. 107
7.6.6.3.1 (A) One common KDF is negotiated by MME and UE p. 108
7.6.6.3.2 (B) eNB-KDF, MME-KDF, HSS-KDF are negotiated by MME and UE p. 108
7.6.6.3.3 (C) eNB, MME and HSS respectively negotiates an appropriate KDF with UE p. 108
7.6.6.3.3.1 eNB-KDF and MME-KDF negotiation p. 108
7.6.6.3.3.2 HSS-KDF negotiation Alternative 1 p. 109
7.6.6.3.3.3 HSS-KDF negotiation Alternative 2 p. 109
7.6.6.3.4 (D) eNB-KDF and MME-KDF are negotiated by MME and UE, HSS-KDF is negotiated by HSS and UE p. 110
7.6.6.3.5 (E) KDF negotiation between UE and eNB & MME could be implicit p. 111
7.6.6.4 Attacks on KDF negotiation solutions and requirements for secure solutions. p. 111
7.6.6.4.1 Requirements and resistance to bidding down attacks. p. 111
7.6.6.4.2 Resistance to bidding down attacks for HSS-KDF negotiation solutions p. 111
7.6.6.5 Summary and decision made for Rel-8 p. 112
7.7 Rationale for approach to security handling in inter-RAT mobility procedures p. 112
7.7.1 Idle mode mobility from utran to e-utran using mapped context p. 112
7.7.2 Idle mode mobility from utran to e-utran using cached context p. 113
7.7.3 Handover from utran to e-utran using mapped context p. 113
7.7.4 TAU after handover from UTRAN to E-UTRAN using cached context p. 114
7.8 Track of decision p. 114
7.8.1 MAC, RLC, and RRC layer security p. 114
7.8.2 LTE AKA requirements p. 115
7.8.3 NAS level signalling security p. 115
7.8.4 Key handling p. 116
7.8.5 Security procedures p. 116
7.8.6 Security Algorithms p. 117
