diff --git a/components/esp_wifi/include/esp_private/wifi.h b/components/esp_wifi/include/esp_private/wifi.h
index c7d5d8d9402..6047ad67a1f 100644
--- a/components/esp_wifi/include/esp_private/wifi.h
+++ b/components/esp_wifi/include/esp_private/wifi.h
@@ -67,8 +67,8 @@ typedef struct {
     uint16_t csid_bitmap;              /**< Selected Cipher Suite ID bit (WIFI_NAN_CSID_BIT_*) */
     uint8_t nd_pmk[ESP_WIFI_NAN_NDP_PMK_LEN];     /**< ND-PMK */
     uint8_t nd_pmkid[ESP_WIFI_NAN_NDP_PMKID_LEN]; /**< ND-PMKID */
-    uint8_t group_data_prot: 1;        /**< Group addressed data frame protection. Reserved: not supported right now. */
-    uint8_t group_mgmt_prot: 1;        /**< Group addressed management frame protection. Reserved: not supported right now. */
+    uint8_t group_data_prot: 1;        /**< Group addressed data frame protection (GTKSA): distribute a GTK on the secured NDP so multicast data frames are protected. */
+    uint8_t group_mgmt_prot: 1;        /**< Group addressed management frame protection (IGTKSA/BIGTKSA): BIP-protect multicast SDFs and Beacons. */
     uint8_t reserved: 6;               /**< Reserved */
 } wifi_nan_security_params_t;
 
@@ -1209,7 +1209,7 @@ esp_err_t esp_wifi_disconnect_internal(void);
 uint32_t esp_nan_get_nira_len(void);
 
 /**
- * @brief      Construct dummy NAN Identity Resolution Attribute (NIRA)
+ * @brief      Construct NAN Identity Resolution Attribute (NIRA)
  *
  * @param[out] frm     Buffer to write the attribute to
  *
diff --git a/components/esp_wifi/include/esp_wifi_types_generic.h b/components/esp_wifi/include/esp_wifi_types_generic.h
index 28b7d0bde6e..3827f022db0 100644
--- a/components/esp_wifi/include/esp_wifi_types_generic.h
+++ b/components/esp_wifi/include/esp_wifi_types_generic.h
@@ -933,9 +933,9 @@ typedef enum {
     WIFI_NAN_CSID_NCS_SK_256       = 2,    /**< NCS-SK-256 (PSK/Passphrase). Reserved: not supported right now. */
     WIFI_NAN_CSID_NCS_PK_2WDH_128  = 3,    /**< NCS-PK-2WDH-128. Reserved: not supported right now. */
     WIFI_NAN_CSID_NCS_PK_2WDH_256  = 4,    /**< NCS-PK-2WDH-256. Reserved: not supported right now. */
-    WIFI_NAN_CSID_NCS_GTK_CCM_128  = 5,
-    WIFI_NAN_CSID_NCS_GTK_GCM_256  = 6,
-    WIFI_NAN_CSID_NCS_PK_PASN_128  = 7,    /**< NCS-PK-PASN-128. Reserved: not supported right now. */
+    WIFI_NAN_CSID_NCS_GTK_CCM_128  = 5,    /**< Group-data cipher (GTKSA). Selected internally when group_data_prot is set; not user-selectable via csid_bitmap. */
+    WIFI_NAN_CSID_NCS_GTK_GCM_256  = 6,    /**< Reserved: not supported right now. */
+    WIFI_NAN_CSID_NCS_PK_PASN_128  = 7,    /**< NCS-PK-PASN-128 (NAN Pairing). Requires CONFIG_ESP_WIFI_NAN_PAIRING and the Wi-Fi Aware component (esp-wifi-apps); not usable with stand-alone ESP-IDF. */
     WIFI_NAN_CSID_NCS_PK_PASN_256  = 8,    /**< NCS-PK-PASN-256. Reserved: not supported right now. */
 } wifi_nan_cipher_suite_id_t;
 
@@ -975,8 +975,8 @@ typedef struct {
   * is computed by the stack as the union of each credential's @c csid.
   */
 typedef struct {
-    uint8_t group_data_prot: 1;                  /**< Group addressed data frame protection. Reserved: not supported right now. */
-    uint8_t group_mgmt_prot: 1;                  /**< Group addressed management frame protection. Reserved: not supported right now. */
+    uint8_t group_data_prot: 1;                  /**< Group addressed data frame protection (GTKSA): distribute a GTK on the secured NDP so multicast data frames are protected. */
+    uint8_t group_mgmt_prot: 1;                  /**< Group addressed management frame protection (IGTKSA/BIGTKSA): BIP-protect multicast SDFs and Beacons. */
     uint8_t reserved: 6;                         /**< Reserved */
     uint8_t num_credentials;                     /**< Number of valid entries in @c creds (0..ESP_WIFI_NAN_MAX_CREDS_PER_SVC). 0 = open service. */
     wifi_nan_credential_t creds[ESP_WIFI_NAN_MAX_CREDS_PER_SVC]; /**< Credentials list. */
diff --git a/components/esp_wifi/wifi_apps/nan_app/src/nan_security.c b/components/esp_wifi/wifi_apps/nan_app/src/nan_security.c
index ee029d90e89..03fc2f4e52b 100644
--- a/components/esp_wifi/wifi_apps/nan_app/src/nan_security.c
+++ b/components/esp_wifi/wifi_apps/nan_app/src/nan_security.c
@@ -645,7 +645,7 @@ static int nan_build_rsna_key_descriptor(uint8_t *kd, uint16_t key_info_flags,
  * Group Key Data (GTK/IGTK/BIGTK KDEs) — Wi-Fi Aware v4.0 §7.1.3.2/§7.1.3.5/
  * §9.5.21.5. Initiator distributes in M3, responder in M4; KDEs are always
  * KEK-wrapped (NIST AES Key Wrap), never in clear. Structure mirrors hostap
- * src/nan/nan_sec.c nan_sec_add_kdes(); IGTK/BIGTK are placeholders for now.
+ * src/nan/nan_sec.c nan_sec_add_kdes().
  *-----------------------------------------------------------------------*/
 
 /* True if a GTKSA was negotiated for this NDP. gtk_required is the explicit