diff --git a/src/libmsc/gsm_04_08.c b/src/libmsc/gsm_04_08.c
index 18f8412..995bbf6 100644
--- a/src/libmsc/gsm_04_08.c
+++ b/src/libmsc/gsm_04_08.c
@@ -3611,10 +3611,11 @@
 osmo_static_assert(sizeof(((struct gsm0808_encrypt_info*)0)->key) >= sizeof(((struct osmo_auth_vector*)0)->kc),
 		   gsm0808_encrypt_info_key_fits_osmo_auth_vec_kc);
 
-/* VLR asks us to start using ciphering */
-static int msc_vlr_set_ciph_mode(void *msc_conn_ref,
-				 bool umts_aka,
-				 bool retrieve_imeisv)
+/* VLR asks us to start using ciphering.
+ * (Keep non-static to allow regression testing on this function.) */
+int msc_vlr_set_ciph_mode(void *msc_conn_ref,
+			  bool umts_aka,
+			  bool retrieve_imeisv)
 {
 	struct gsm_subscriber_connection *conn = msc_conn_ref;
 	struct vlr_subscr *vsub;
diff --git a/tests/msc_vlr/Makefile.am b/tests/msc_vlr/Makefile.am
index 43b4e07..8194f22 100644
--- a/tests/msc_vlr/Makefile.am
+++ b/tests/msc_vlr/Makefile.am
@@ -32,6 +32,8 @@
 	-Wl,--wrap=osmo_get_rand_id \
 	-Wl,--wrap=msc_mgcp_call_release \
 	-Wl,--wrap=msc_mgcp_call_assignment \
+	-Wl,--wrap=a_iface_tx_cipher_mode \
+	-Wl,--wrap=ranap_iu_tx_sec_mode_cmd \
 	$(NULL)
 
 LDADD = \
diff --git a/tests/msc_vlr/msc_vlr_test_authen_reuse.err b/tests/msc_vlr/msc_vlr_test_authen_reuse.err
index 2899daa..ea3b989 100644
--- a/tests/msc_vlr/msc_vlr_test_authen_reuse.err
+++ b/tests/msc_vlr/msc_vlr_test_authen_reuse.err
@@ -491,7 +491,9 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for IMSI:901700000010650
+DMM -> SECURITY MODE CONTROL IMSI:901700000010650
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
@@ -669,7 +671,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -798,7 +802,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=1159ec926a50e98c034a6b7d7c9f418d
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -1466,7 +1472,9 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for IMSI:901700000010650
+DMM -> SECURITY MODE CONTROL IMSI:901700000010650
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
@@ -1644,7 +1652,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -1759,7 +1769,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -1874,7 +1886,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -2342,7 +2356,9 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for IMSI:901700000010650
+DMM -> SECURITY MODE CONTROL IMSI:901700000010650
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
@@ -2534,7 +2550,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=1159ec926a50e98c034a6b7d7c9f418d
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
diff --git a/tests/msc_vlr/msc_vlr_test_call.err b/tests/msc_vlr/msc_vlr_test_call.err
index 5cfa794..9f9b8ba 100644
--- a/tests/msc_vlr/msc_vlr_test_call.err
+++ b/tests/msc_vlr/msc_vlr_test_call.err
@@ -64,7 +64,9 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for IMSI:901700000010650
+DMM -> SECURITY MODE CONTROL IMSI:901700000010650
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
@@ -228,7 +230,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=1159ec926a50e98c034a6b7d7c9f418d
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -413,7 +417,9 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for IMSI:901700000010650
+DMM -> SECURITY MODE CONTROL IMSI:901700000010650
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
@@ -585,7 +591,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=1159ec926a50e98c034a6b7d7c9f418d
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
diff --git a/tests/msc_vlr/msc_vlr_test_gsm_ciph.err b/tests/msc_vlr/msc_vlr_test_gsm_ciph.err
index 821f779..8f42d6e 100644
--- a/tests/msc_vlr/msc_vlr_test_gsm_ciph.err
+++ b/tests/msc_vlr/msc_vlr_test_gsm_ciph.err
@@ -62,7 +62,10 @@
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for IMSI:901700000004620: ciphers=0x02 kc=61855fb81fc2a800 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND IMSI:901700000004620
+- sending Ciphering Mode Command for IMSI:901700000004620: include_imeisv=0
+- ...perm algo: 2
+- ...key: 61855fb81fc2a800
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000004620: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000004620: MSC conn use - dtap == 1 (0x4)
@@ -225,7 +228,11 @@
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for MSISDN:46071: ciphers=0x02 kc=07fa7502e07e1c00 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND MSISDN:46071
+DMSC CLASSMARK 1 unknown, assuming MS supports A5/1
+- sending Ciphering Mode Command for MSISDN:46071: include_imeisv=0
+- ...perm algo: 2
+- ...key: 07fa7502e07e1c00
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:46071: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:46071: MSC conn use - dtap == 1 (0x4)
@@ -370,7 +377,11 @@
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for MSISDN:46071: ciphers=0x02 kc=e2b234f807886400 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND MSISDN:46071
+DMSC CLASSMARK 1 unknown, assuming MS supports A5/1
+- sending Ciphering Mode Command for MSISDN:46071: include_imeisv=0
+- ...perm algo: 2
+- ...key: e2b234f807886400
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:46071: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:46071: MSC conn use - dtap == 1 (0x4)
@@ -547,7 +558,10 @@
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for IMSI:901700000004620: ciphers=0x02 kc=61855fb81fc2a800 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND IMSI:901700000004620
+- sending Ciphering Mode Command for IMSI:901700000004620: include_imeisv=0
+- ...perm algo: 2
+- ...key: 61855fb81fc2a800
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000004620: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000004620: MSC conn use - dtap == 1 (0x4)
@@ -747,7 +761,11 @@
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for MSISDN:46071: ciphers=0x02 kc=07fa7502e07e1c00 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND MSISDN:46071
+DMSC CLASSMARK 1 unknown, assuming MS supports A5/1
+- sending Ciphering Mode Command for MSISDN:46071: include_imeisv=0
+- ...perm algo: 2
+- ...key: 07fa7502e07e1c00
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:46071: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:46071: MSC conn use - dtap == 1 (0x4)
@@ -892,7 +910,11 @@
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for MSISDN:46071: ciphers=0x02 kc=e2b234f807886400 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND MSISDN:46071
+DMSC CLASSMARK 1 unknown, assuming MS supports A5/1
+- sending Ciphering Mode Command for MSISDN:46071: include_imeisv=0
+- ...perm algo: 2
+- ...key: e2b234f807886400
 DVLR Process_Access_Request_VLR(50462976){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:46071: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:46071: MSC conn use - dtap == 1 (0x4)
@@ -1069,7 +1091,10 @@
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for IMSI:901700000004620: ciphers=0x02 kc=61855fb81fc2a800 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND IMSI:901700000004620
+- sending Ciphering Mode Command for IMSI:901700000004620: include_imeisv=0
+- ...perm algo: 2
+- ...key: 61855fb81fc2a800
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000004620: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000004620: MSC conn use - dtap == 1 (0x4)
@@ -1290,7 +1315,10 @@
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for IMSI:901700000004620: ciphers=0x02 kc=61855fb81fc2a800 retrieve_imeisv=1
+DMM -> CIPHER MODE COMMAND IMSI:901700000004620
+- sending Ciphering Mode Command for IMSI:901700000004620: include_imeisv=1
+- ...perm algo: 2
+- ...key: 61855fb81fc2a800
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000004620: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000004620: MSC conn use - dtap == 1 (0x4)
@@ -1500,7 +1528,10 @@
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending Ciphering Mode Command for IMSI:901700000004620: ciphers=0x02 kc=61855fb81fc2a800 retrieve_imeisv=0
+DMM -> CIPHER MODE COMMAND IMSI:901700000004620
+- sending Ciphering Mode Command for IMSI:901700000004620: include_imeisv=0
+- ...perm algo: 2
+- ...key: 61855fb81fc2a800
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000004620: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000004620: MSC conn use - dtap == 1 (0x4)
diff --git a/tests/msc_vlr/msc_vlr_test_umts_authen.err b/tests/msc_vlr/msc_vlr_test_umts_authen.err
index f4ee4b4..8a45167 100644
--- a/tests/msc_vlr/msc_vlr_test_umts_authen.err
+++ b/tests/msc_vlr/msc_vlr_test_umts_authen.err
@@ -525,7 +525,9 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for IMSI:901700000010650
+DMM -> SECURITY MODE CONTROL IMSI:901700000010650
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=27497388b6cb044648f396aa155b95ef
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
@@ -709,7 +711,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=1159ec926a50e98c034a6b7d7c9f418d
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -845,7 +849,9 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: got VLR_AUTH_RES_PASSED
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: _proc_arq_vlr_node2()
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for MSISDN:42342
+DMM -> SECURITY MODE CONTROL MSISDN:42342
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=eb50e770ddcc3060101d2f43b6c2b884
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
@@ -1256,7 +1262,9 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Received Event VLR_ULA_E_AUTH_RES
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: vlr_loc_upd_post_auth()
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: Set Ciphering Mode
-- sending SecurityModeControl for IMSI:901700000010650
+DMM -> SECURITY MODE CONTROL IMSI:901700000010650
+- sending SecurityModeControl for UE ctx 42 send_ck=0 new_key=1
+- ...ik=8a90c769b7272f3bb7a1c1fbb1ea9349
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
diff --git a/tests/msc_vlr/msc_vlr_tests.c b/tests/msc_vlr/msc_vlr_tests.c
index 4bb31d9..a9f76f4 100644
--- a/tests/msc_vlr/msc_vlr_tests.c
+++ b/tests/msc_vlr/msc_vlr_tests.c
@@ -705,34 +705,59 @@
 	return 0;
 }
 
+/* override, requires '-Wl,--wrap=a_iface_tx_cipher_mode' */
+int __real_a_iface_tx_cipher_mode(const struct gsm_subscriber_connection *conn,
+				  struct gsm0808_encrypt_info *ei, int include_imeisv);
+int __wrap_a_iface_tx_cipher_mode(const struct gsm_subscriber_connection *conn,
+				  struct gsm0808_encrypt_info *ei, int include_imeisv)
+{
+	int i;
+	btw("sending Ciphering Mode Command for %s: include_imeisv=%d",
+	    vlr_subscr_name(conn->vsub), include_imeisv);
+	for (i = 0; i < ei->perm_algo_len; i++)
+		btw("...perm algo: %u", ei->perm_algo[i]);
+	OSMO_ASSERT(ei->key_len <= sizeof(ei->key));
+	btw("...key: %s", osmo_hexdump_nospc(ei->key, ei->key_len));
+	cipher_mode_cmd_sent = true;
+	cipher_mode_cmd_sent_with_imeisv = include_imeisv;
+	return 0;
+}
+
+/* override, requires '-Wl,--wrap=ranap_iu_tx_sec_mode_cmd' */
+int __real_ranap_iu_tx_sec_mode_cmd(struct ranap_ue_conn_ctx *uectx, struct osmo_auth_vector *vec,
+				    int send_ck, int new_key);
+int __wrap_ranap_iu_tx_sec_mode_cmd(struct ranap_ue_conn_ctx *uectx, struct osmo_auth_vector *vec,
+				    int send_ck, int new_key)
+{
+	btw("sending SecurityModeControl for UE ctx %u send_ck=%d new_key=%d",
+	    uectx->conn_id, send_ck, new_key);
+	btw("...ik=%s", osmo_hexdump_nospc(vec->ik, sizeof(vec->ik)));
+	if (send_ck)
+		btw("...ck=%s", osmo_hexdump_nospc(vec->ck, sizeof(vec->ck)));
+	cipher_mode_cmd_sent = true;
+	cipher_mode_cmd_sent_with_imeisv = false;
+	return 0;
+}
+
+extern int msc_vlr_set_ciph_mode(void *msc_conn_ref, bool umts_aka, bool retrieve_imeisv);
+
 static int fake_vlr_tx_ciph_mode_cmd(void *msc_conn_ref, bool umts_aka, bool retrieve_imeisv)
 {
-	/* FIXME: we actually would like to see the message bytes checked here,
-	 * not possible while msc_vlr_set_ciph_mode() calls
-	 * gsm0808_cipher_mode() directly. When the MSCSPLIT is ready, check
-	 * the tx bytes in the sense of dtap_expect_tx() above. */
+	int rc;
+#ifndef BUILD_IU
+	/* If we built without support for IU, fake the IU part here. The root cause is that we don't
+	 * have differing sets of expected outputs for --enable-iu and --disable-iu. */
 	struct gsm_subscriber_connection *conn = msc_conn_ref;
-	switch (conn->via_ran) {
-	case RAN_GERAN_A:
-		btw("sending Ciphering Mode Command for %s: ciphers=0x%02x kc=%s"
-		    " retrieve_imeisv=%d",
-		    vlr_subscr_name(conn->vsub),
-		    conn->network->a5_encryption_mask,
-		    osmo_hexdump_nospc(conn->vsub->last_tuple->vec.kc, 8),
-		    retrieve_imeisv);
-		break;
-	case RAN_UTRAN_IU:
-		btw("sending SecurityModeControl for %s",
-		    vlr_subscr_name(conn->vsub));
-		break;
-	default:
-		btw("UNKNOWN RAN TYPE %d", conn->via_ran);
-		OSMO_ASSERT(false);
-		return -1;
-	}
-	cipher_mode_cmd_sent = true;
-	cipher_mode_cmd_sent_with_imeisv = retrieve_imeisv;
-	return 0;
+	if (conn->via_ran == RAN_UTRAN_IU) {
+		DEBUGP(DMM, "-> SECURITY MODE CONTROL %s\n", vlr_subscr_name(conn->vsub));
+		rc = __wrap_ranap_iu_tx_sec_mode_cmd(conn->iu.ue_ctx, &conn->vsub->last_tuple->vec,
+						     0, 1);
+	} else
+#endif
+	rc = msc_vlr_set_ciph_mode(msc_conn_ref, umts_aka, retrieve_imeisv);
+	if (rc)
+		btw("ERROR sending ciphering mode command: rc=%d", rc);
+	return rc;
 }
 
 void ms_sends_security_mode_complete()