add NAS encryption config

Author: robswain

articles/private-5g-core/modify-packet-core.md

@@ -40,7 +40,8 @@ The following changes will trigger components of the packet core software to res
   - Static UE IP pool prefixes
   - Network address and port translation parameters
   - DNS addresses
-- Changing the UE Maximum Transmission Unit (MTU) signaled by the packet core.
+- Changing the UE maximum transmission unit (MTU) signaled by the packet core.
+- Changing the non-access stratum (NAS) encryption type.
 
 The following changes will trigger the packet core to reinstall, during which your service will be unavailable for up to two hours:
 
@@ -101,6 +102,7 @@ To modify the packet core and/or access network configuration:
    - Use the information you collected in [Collect packet core configuration values](collect-required-information-for-a-site.md#collect-packet-core-configuration-values) for the top-level configuration values.
    - Use the information you collected in [Collect access network values](collect-required-information-for-a-site.md#collect-access-network-values) for the configuration values under **Access network**.
    - If you want to enable UE usage monitoring, use the information collected in [Collect UE usage tracking values](collect-required-information-for-a-site.md#collect-ue-usage-tracking-values) to fill out the **Azure Event Hub Namespace**, **Event Hub name** and **User Assigned Managed Identity** values.
+   - If you want to change the non-access stratum (NAS) encryption type, use the **Advanced configuration** tab. You can set up to three levels of preference. For example, you could set the first preference to `NEA2/EEA2`, the second preference to `NEA1/EEA1` and the third preference to `none` to ensure that one of the two encryption algorithms is used and NEA0/EEA0 (null encryption) is not permitted.
 1. Choose the next step:
    - If you've finished modifying the packet core instance, go to [Submit and verify changes](#submit-and-verify-changes).
    - If you want to configure a new or existing data network and attach it to the packet core instance, go to [Attach a data network](#attach-a-data-network).

articles/private-5g-core/private-5g-core-overview.md

@@ -125,13 +125,13 @@ Azure Private 5G Core supports the following authentication methods:
 - 5G Authentication and Key Agreement (5G-AKA) for mutual authentication between 5G UEs and the network.
 - Evolved Packet System based Authentication and Key Agreement (EPS-AKA) for mutual authentication between 4G UEs and the network.
 
-The packet core instance performs ciphering and integrity protection of 5G non-access stratum (NAS). During UE registration, the UE includes its security capabilities for 5G NAS with 128-bit keys.
+The packet core performs ciphering and integrity protection of 5G non-access stratum (NAS). During UE registration, the UE includes its security capabilities for 5G NAS with 128-bit keys.
 
 Azure Private 5G Core supports the following algorithms for ciphering and integrity protection:
 
-- 5GS null encryption algorithm
-- 128-bit Snow3G
-- 128-bit Advanced Encryption System (AES) encryption
+- NEA2: 128-bit Advanced Encryption System (AES) encryption
+- NEA1: 128-bit Snow3G
+- NEA0: 5GS null encryption algorithm
 
 ### UE-to-UE traffic
 

articles/private-5g-core/security.md

@@ -50,6 +50,18 @@ Azure Private 5G Core provides write-only access to SIM credentials. SIM credent
 
 As these credentials are highly sensitive, Azure Private 5G Core won't allow users of the service read access to the credentials, except as required by law. Sufficiently privileged users may overwrite the credentials, or revoke them.
 
+## NAS encryption
+
+Non-access stratum (NAS) signaling runs between the UE and the AMF (5G) or MME (4G). It carries the information to allow mobility and session management operations that enable data plane connectivity between the UE and network.
+
+The packet core performs ciphering and integrity protection of NAS. During UE registration, the UE includes its security capabilities for NAS with 128-bit keys. By default, Azure Private 5G Core supports the following algorithms in order of preference:
+
+- NEA2: 128-bit Advanced Encryption System (AES) encryption
+- NEA1: 128-bit Snow3G
+- NEA0: 5GS null encryption algorithm
+
+This enables the highest level of encryption that the UE supports while still allowing UEs that do not support encryption. To make encryption mandatory, you can disallow NEA0. You can change these preferences after deployment by [modifying the packet core configuration](modify-packet-core.md).
+
 ## Access to local monitoring tools
 
 ### Secure connectivity using TLS/SSL certificates