NAS Security Mode Complete failure
Diagnose Security Mode Command / Security Mode Complete failures in 5GS: integrity check failures, algorithm mismatch, IMEISV requests, and replay protection.
8 min read
The Security Mode procedure is where NAS ciphering and integrity protection begin, so it is also where key derivation mistakes surface. If authentication passed but Security Mode fails, the problem is almost always key derivation or algorithm selection, not the USIM secret itself.
Expected flow
AMF -> UE : Security Mode Command (NIA2/NEA2, ngKSI, replayed UE capabilities)
UE -> AMF: Security Mode Complete (integrity protected + ciphered)
[ optionally carries IMEISV if requested ]Failure modes
| Symptom | Cause | Fix |
|---|---|---|
| Security Mode Reject #23 | UE security capabilities mismatch | Replayed capabilities differ from those in Registration Request — UE bug |
| Security Mode Reject #24 | Integrity check of the Command failed | K_AMF derivation wrong; verify SN name and ABBA handling |
| No Complete, T3560 expiry | UE discarded the Command | Check ngKSI matches the authenticated key set |
| Complete sent unprotected | UE applied security in wrong order | Spec violation — Complete must be integrity protected with the new context |
| IMEISV missing | Command requested IMEISV, UE omitted it | Set usim.imeisv in ue.conf |
Verify key derivation
aeon copilot explain --exec 4821 --focus "security mode" # typical answer: # TS 33.501 A.7 - K_AMF derived with the wrong SN name string. # Expected "5G:mnc001.mcc001.3gppnetwork.org"; UE used the LTE format.
Why this one is worth automating
Security Mode bugs are release-sensitive and easy to regress: a change to capability encoding or ABBA handling breaks it silently and only conformance testing catches it. Putting the security procedure cases in your per-commit smoke gate costs a few minutes of lane time and prevents the class of bug that is most expensive to find in the field.
Run this against a real SDR lane
The tester is a service, not a box. Push a build, reserve a lane, get a verdict.