Question: What is the procedure followed by the AMF when initiating a re-authentication to create a new 5G NAS security context?
Option 1: The AMF sends a SECURITY MODE COMMAND message integrity protected and ciphered with the current 5G NAS security context, including the ngKSI of the new 5G NAS security context.
Option 2: The AMF sends a SECURITY MODE COMMAND message integrity protected but unciphered with the current 5G NAS security context, including the ngKSI of the new 5G NAS security context.
Option 3: The UE initiates a security mode control procedure and sends a SECURITY MODE COMPLETE message integrity protected and ciphered with the new 5G NAS security context.
Option 4: The AMF modifies the current 5G NAS security context without sending a SECURITY MODE COMMAND message.
Explanation: According to the text, when the AMF initiates a re-authentication to create a new 5G NAS security context, it sends a SECURITY MODE COMMAND message integrity protected but unciphered with the current 5G NAS security context, including the ngKSI of the new 5G NAS security context. This is because both UE and AMF continue to use the current 5G NAS security context until the AMF initiates a security mode control procedure.