Question: In a Generic Bootstrapping Architecture (GBA) scenario, how do a User Equipment (UE) and a Network Application Function (NAF) agree on which key (Ks_ext_NAF or Ks_int_NAF) to use as the GBA-based shared secret for securing reference point Ua, in cases where both keys may be used?
Option 1: Through a predefined configuration stored in the UE and NAF.
Option 2: Depending on the application protocol used over Ua, either (a) the protocol indicates which key to use (for generic, multi-application protocols like HTTPS), or (b) an implicit agreement based on application-specific knowledge (for specific protocols like MIKEY in MBMS).
Option 3: The UE and NAF always default to using Ks_ext_NAF for security.
Option 4: This agreement is not necessary as the keys are interchangeable.
Explanation: The correct answer reflects the nuanced approach outlined in GBA specifications for handling key agreements over reference point Ua, acknowledging a dual strategy based on the application protocol: (a) explicit indication by the protocol for generic cases, and (b) implicit agreement for application-specific protocols, ensuring flexibility and security across various applications utilizing GBA.