## 4 Integration of AKMA and the TLS 1.3 PSK Option for the AKMA Authentication Phase
### TLS 1.3 PSK Option as the \(\text{Ua}^{*}\) Protocol
* **Naanf_AKMA_ApplicationKey_Get_Request** Upon receiving the A-KID from the UE via the Application Session Establishment Request message, the AF retrieves the corresponding context. If the context is not found, it selects an AAnF and sends the selected function the 'Naanf_AKMA_ApplicationKey_Get_Request' message containing the received A-KID and its own identifier, AF_ID. It is important to note that the communication path between the AF and the AAnF is assumed to be secure. * **Naaf_AKMA_ApplicationKey_Get_Response** Following the receipt of the Naanf_AKMA_ApplicationKey _Get_Request message, the AAnF verifies whether the AF is authorized to provide the service and identifies the \(K_{AKMA}\) using the A-KID provided in that message. Once authorization is confirmed, it calculates the \(K_{AF}\) from the identified \(K_{AKMA}\) and sends the calculated \(K_{AF}\), the key's lifetime, and the SUPI to the AF in the 'Naaf_AKMA_Applicationkey_Get_Response' message. * **Application Session Establishment Response** Once obtaining the \(K_{AF}\), the AF proceeds to prepare the Application Session Establishment Response message. A critical step in this process is the generation of the ServerHello sub-message, which varies according to the modes of the TLS 1.3 PSK option and unfolds as follows: * **Common part and PSK-only (4a)** Initially, regardless of the mode, the AF generates a random nonce \(srand\) and includes the A-KID in the 'pre_shared_key' value. Then, it sets \(PSK\) to \(K_{AF}\) and computes the early secret \(ES\) using the \(PSK\). From the computed \(ES\), the binder key \(K_{bind}\) and the handshake secret \(HS\) are derived. Using the \(K_{bind}\), the AF validates the received _binder_ to confirm that the ClientHello sub-message is correct. Once confirmed, in the case of the PSK-only mode, the \(HS\) is calculated using HKDF-Extract(0, Derive-Secret(\(ES\), \"derived\", \"\")). * **PSK-(EC)DE (4b) and 0-RTT (4c)** If the 'early_data' value is included in the Application Session Establishment Request message, thus indicating the 0-RTT mode, the AF computes the client early traffic secret \(tk_{cets}\) in the same way as the UE and then executes AEAD\({}_{DEC}\)(\(tk_{cets}\), AD1, (Application Data1)) to recover the early application data Application Data1. In the case of the PSK-(EC)DE or 0-RTT modes, the AF generates its ephemeral public key pair \(y\) and \(y\cdot G\), then generating the handshake secret \(HS\) through HKDF-Extract(\(x\cdot y\cdot G\), Derive-Secret(\(ES\), \"derived\", \"\")). At this point, the AF's ephemeral public key \(y\cdot G\) should be included in the 'key_share' value within the ServerHello sub-message. After producing the handshake secret \(HS\), the AF calculates the master secret \(MS\) = Derive-Secret(\(HS\), \"derived\", \"\"), from which the traffic secrets \(tk_{chs}\), \(tk_{shs}\), \(tk_{capp}\), and \(tk_{sapp}\) are derived. Additionally, the finished keys \(fk_{c}\) and \(fk_{s}\) are extracted from the handshake traffic secret \(tk_{chs}\) and \(tk_{shs}\), respectively. The AF then computes the protected server finished message [Finished] = AEAD\({}_{enc}\)(\(tk_{shs}\), AD2, Server_Finished), where Server_Finished = HKDF-Expanded-Label(\(fk_{s}\), \"finished\", Hash.Length). The process also involves generating both the encrypted extensions and the protected application data, [EncryptedExtensions] and [Application Data2], through the AEAD\({}_{enc}\) operation with the server traffic secrets. After the ServerHello sub-message is completed as mentioned above, it is transmitted to the UE via the Application Session Establishment Response message. * **Application Session Communication** Upon receiving the Application Session Establishment Response message, the UE first calculates both the handshake and master secrets \(HS\) and \(MS\), which are then used to derive the traffic secrets \(tk_{chs}\), \(tk_{shs}\), \(tk_{capp}\), and \(tk_{sapp}\), followed by the finished keys \(fk_{c}\) and \(fk_{s}\).