From 605b39bd9d65ea1bff77b70038130e21c7f44a3d Mon Sep 17 00:00:00 2001 From: Guido Casati Date: Fri, 19 Dec 2025 16:59:18 +0100 Subject: [PATCH] Fix RRCReestablishment key derivation to use horizontal derivation Per TS 33.501 6.9.2.3.4 and Fig 6.9.2.1.1-1, when sending RRCReestablishment with nextHopChainingCount, the gNB is staying at the same NCC level (not advancing). Therefore, horizontal derivation from the currently active KgNB must be used, not vertical derivation from NH. Vertical derivation (from NH) is only used when advancing to a new NCC level, which happens during handover or masterKeyUpdate procedures. The previous implementation incorrectly used vertical derivation from NH whenever nh_ncc > 0, which caused key mismatch between gNB and UE during reestablishment after handover, leading to integrity check failures. This fix ensures both gNB and UE use horizontal derivation when nextHopChainingCount matches the current NCC level, aligning with the specification's "virtual NH at NCC=0" model where: - Horizontal derivation = derive KNG-RAN* from currently active KgNB - Vertical derivation = derive KNG-RAN* from NH (only when advancing NCC) --- openair2/RRC/NR/rrc_gNB.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/openair2/RRC/NR/rrc_gNB.c b/openair2/RRC/NR/rrc_gNB.c index 0e07b6a060..285740096a 100644 --- a/openair2/RRC/NR/rrc_gNB.c +++ b/openair2/RRC/NR/rrc_gNB.c @@ -1092,7 +1092,13 @@ static void rrc_gNB_generate_RRCReestablishment(rrc_gNB_ue_context_t *ue_context const f1ap_served_cell_info_t *cell_info = &du->setup_req->cell[0].info; uint32_t ssb_arfcn = get_ssb_arfcn(du); LOG_I(NR_RRC, "Reestablishment update key pci=%d, earfcn_dl=%u\n", cell_info->nr_pci, ssb_arfcn); - nr_derive_key_ng_ran_star(cell_info->nr_pci, ssb_arfcn, ue_p->nh_ncc > 0 ? ue_p->nh : ue_p->kgnb, ue_p->kgnb); + + /* Per TS 33.501 6.9.2.3.4: When sending RRCReestablishment with nextHopChainingCount, + * we're staying at the same NCC level (not advancing), so use horizontal derivation + * from the currently active KgNB. Vertical derivation (from NH) is only used when + * advancing to a new NCC level, which happens during handover or masterKeyUpdate. */ + const uint8_t *base_key = ue_p->kgnb; + nr_derive_key_ng_ran_star(cell_info->nr_pci, ssb_arfcn, base_key, ue_p->kgnb); int size = do_RRCReestablishment(ue_context_pP->ue_context.nh_ncc, buffer, NR_RRC_BUF_SIZE, xid); LOG_A(NR_RRC, "Send RRCReestablishment [%d bytes] to RNTI %04x\n", size, ue_p->rnti);