NAS 5G AMF to UE 3GPP TS 24.501

5G NAS - Authentication Result

Authentication Result is the NAS message used to transport the final EAP authentication result from the network to the UE.

Message Fact Sheet

Protocol	nas	Network	5g
Spec	3GPP TS 24.501	Spec Section	8.2.3
Direction	AMF to UE	Message Type	5GMM signaling

Full message name	5G NAS - Authentication Result
Protocol	NAS
Technology	5G
Direction	AMF to UE
Interface	N1
Signaling bearer / channel	NAS signaling / Dedicated NAS message, commonly via DL Information Transfer
Typical trigger	Sent when the network must deliver EAP-based primary authentication result to the UE.
Main purpose	Carries the EAP success or failure result in EAP-based primary authentication.
Main specification	3GPP TS 24.501, 8.2.3
Release added	Release 15
Procedures where used	5G Authentication Procedure, 5G Initial Registration
Related timers	None highlighted
Related cause values	EAP success or EAP failure context

What is Authentication Result in simple terms?

Authentication Result is the NAS message used to transport the final EAP authentication result from the network to the UE.

Carries the EAP success or failure result in EAP-based primary authentication.

Why this message matters

Authentication Result tells the UE the final EAP-based authentication outcome.

Where this message appears in the call flow

5G Authentication Procedure

Call flow position: Network result message in the EAP-based authentication branch.

Typical state: UE has already answered an EAP-based authentication request.

Preconditions:

The procedure is using EAP-based primary authentication.

Next likely message: Security Mode Command, Registration continuation, or termination depending on result

Call flow position

Previous message(s): Authentication Response

Next message(s): Security Mode Command, Registration Accept, Procedure termination

Message direction and transport

Sender and receiver: AMF to UE

Interface: N1

Domain: Core-side mobility management signaling for EAP-based authentication result transport

Signaling bearer: NAS signaling

Logical channel: Dedicated NAS message, commonly via DL Information Transfer

Transport / encapsulation: NAS 5GS message carried end-to-end between AMF and UE

Security context: Used in the EAP-based authentication branch; protection depends on the exact procedure stage.

Message Structure Overview

Authentication Result is mainly relevant for EAP-based primary authentication, not for every ordinary 5G AKA path.

Structure Syntax

This message is not typically analyzed as ASN.1 on the wire. Engineers usually inspect it as a NAS or protocol field decode rather than an ASN.1 tree.

Authentication Result is a NAS 24.501 message, not an ASN.1 message.

Decoded Message Dump

Authentication Result
  Extended Protocol Discriminator: 5G Mobility Management
  Security Header Type: Plain NAS
  Message Type: Authentication Result
  ngKSI: 3
  EAP Message: Success

How to read this dump

Check whether the procedure is actually EAP-based before expecting this message in the trace.

Important Information Elements

IE	Required	Description
`ngKSI`	Yes	Identifies the NAS key set context selected with the EAP result.
`EAP message`	Yes	Carries the EAP success or EAP failure message delivered to the UE.

Detailed field explanation

`ngKSI`

Identifies the NAS key set context selected with the EAP result.

Presence: Required

`EAP message`

Carries the EAP success or EAP failure message delivered to the UE.

Presence: Required

What to check in logs and traces

Confirm the authentication branch uses EAP and not pure 5G AKA-only result handling.
Inspect the EAP message result carefully.
Correlate the result with the next Security Mode or registration step.

Common Issues and Troubleshooting

Authentication seems to succeed but no normal registration continuation follows.

Likely cause: The EAP result may indicate failure or the next NAS step may not have been triggered correctly.

What to inspect: Check the EAP result contents and the next AMF action.

Next step: Verify whether the registration path continues into Security Mode Command or terminates.

Detailed explanation

5G NAS - Authentication Result Explained

Authentication Result is the NAS message used to deliver the final result of EAP-based primary authentication to the UE. It is not the most common message in every authentication trace, but it is important when the authentication branch uses EAP rather than only the simpler 5G AKA challenge-response path.

For beginners, the simple meaning is: the network is telling the UE the final EAP authentication result.
For engineers, this message is useful because it confirms that the authentication branch is EAP-based and provides the final success or failure payload.

What is Authentication Result in simple terms?

The UE answered an authentication challenge. The network then sends the final EAP-based result back to the UE.

Why Authentication Result matters

This message matters because it helps engineers distinguish:

ordinary 5G AKA flow
from EAP-based primary authentication flow

If this message appears, it changes how the authentication procedure should be read.

Where Authentication Result appears in the call flow

UE                              gNB / AMF
|<-- Authentication Request -----|
|--- Authentication Response ---->|
|<-- Authentication Result ------|
|<-- Security Mode / next step ---|

Transport characteristics

Direction: AMF to UE
Interface: N1
Transport on access side: commonly via DL Information Transfer
Security expectation: depends on the EAP-based procedure stage

What Authentication Result means operationally

Operationally, this message tells engineers that the procedure has reached the final result-delivery point for EAP-based authentication. The useful first check is whether the EAP message indicates success or failure, because that determines whether the registration path should continue or stop.

Important Information Elements

IE	Why it matters
`ngKSI`	Shows the selected NAS key set context.
`EAP message`	Carries the actual EAP success or failure result.

Example message dump

Authentication Result
  Extended Protocol Discriminator: 5G Mobility Management
  Security Header Type: Plain NAS
  Message Type: Authentication Result
  ngKSI: 3
  EAP Message: Success

How to read this dump

First confirm that the authentication branch is EAP based.
Then inspect the EAP result itself.
After that, check whether the registration path continues or terminates as expected.

What to check in logs

verify that the trace actually used EAP-based primary authentication
inspect whether the EAP result is success or failure
correlate the message with the next Security Mode Command or registration decision
avoid expecting this message in ordinary non-EAP-only authentication branches

FAQ

Is Authentication Result always present in 5G?

No. It is mainly associated with EAP-based authentication result delivery rather than every basic 5G AKA flow.

Summary

Authentication Result is the NAS message used to transport the final EAP authentication result from the network to the UE.

Advanced Engineer Notes

This message is not always present in every authentication trace. It is especially relevant when EAP-based primary authentication is used.

Related message pages

Related Procedures

Related Tools

Use This Reference in Practice

Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.