diff --git a/tests/msc_vlr/msc_vlr_test_authen_reuse.c b/tests/msc_vlr/msc_vlr_test_authen_reuse.c
index e78ab06..6fd1e66 100644
--- a/tests/msc_vlr/msc_vlr_test_authen_reuse.c
+++ b/tests/msc_vlr/msc_vlr_test_authen_reuse.c
@@ -105,9 +105,9 @@
 	} else {
 		/* On UTRAN */
 		btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-		cipher_mode_cmd_sent = false;
+		expect_security_mode_ctrl(NULL, "27497388b6cb044648f396aa155b95ef");
 		ms_sends_msg("0554" "e229c19e" "2104" "791f2e41");
-		VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 		btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
@@ -179,9 +179,9 @@
 		} else {
 			/* On UTRAN */
 			btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-			cipher_mode_cmd_sent = false;
+			expect_security_mode_ctrl(NULL, "27497388b6cb044648f396aa155b95ef");
 			ms_sends_msg("0554" "e229c19e" "2104" "791f2e41");
-			VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+			VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 			VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
 
 			btw("MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept");
@@ -253,9 +253,9 @@
 		} else {
 			/* On UTRAN */
 			btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-			cipher_mode_cmd_sent = false;
+			expect_security_mode_ctrl(NULL, "1159ec926a50e98c034a6b7d7c9f418d");
 			ms_sends_msg("0554" "7db47cf7" "2104" "f81e4dc7"); /* 2nd vector's res, s.a. */
-			VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+			VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 			VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
 
 			btw("MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept");
diff --git a/tests/msc_vlr/msc_vlr_test_authen_reuse.err b/tests/msc_vlr/msc_vlr_test_authen_reuse.err
index ea3b989..269cd35 100644
--- a/tests/msc_vlr/msc_vlr_test_authen_reuse.err
+++ b/tests/msc_vlr/msc_vlr_test_authen_reuse.err
@@ -497,7 +497,7 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   lu_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
 DMM <- SECURITY MODE COMPLETE IMSI:901700000010650
@@ -677,7 +677,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -808,7 +808,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -1478,7 +1478,7 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   lu_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
 DMM <- SECURITY MODE COMPLETE IMSI:901700000010650
@@ -1658,7 +1658,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -1775,7 +1775,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -1892,7 +1892,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -2362,7 +2362,7 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   lu_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
 DMM <- SECURITY MODE COMPLETE IMSI:901700000010650
@@ -2556,7 +2556,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
diff --git a/tests/msc_vlr/msc_vlr_test_call.c b/tests/msc_vlr/msc_vlr_test_call.c
index 28540b1..42d55bf 100644
--- a/tests/msc_vlr/msc_vlr_test_call.c
+++ b/tests/msc_vlr/msc_vlr_test_call.c
@@ -110,9 +110,9 @@
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 	btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-	cipher_mode_cmd_sent = false;
+	expect_security_mode_ctrl(NULL, "27497388b6cb044648f396aa155b95ef");
 	ms_sends_msg("0554" "e229c19e" "2104" "791f2e41");
-	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+	VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 	btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
@@ -182,9 +182,9 @@
 
 	/* On UTRAN */
 	btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-	cipher_mode_cmd_sent = false;
+	expect_security_mode_ctrl(NULL, "1159ec926a50e98c034a6b7d7c9f418d");
 	ms_sends_msg("0554" "7db47cf7" "2104" "f81e4dc7"); /* 2nd vector's res, s.a. */
-	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+	VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 	VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
 
 	btw("MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept");
@@ -283,9 +283,9 @@
 	VERBOSE_ASSERT(auth_request_sent, == true, "%d");
 
 	btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-	cipher_mode_cmd_sent = false;
+	expect_security_mode_ctrl(NULL, "1159ec926a50e98c034a6b7d7c9f418d");
 	ms_sends_msg("0554" "7db47cf7" "2104" "f81e4dc7"); /* 2nd vector's res, s.a. */
-	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+	VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 
 	btw("MS sends SecurityModeControl acceptance, VLR accepts, sends CC Setup");
 	dtap_expect_tx("0305" /* CC: Setup */);
diff --git a/tests/msc_vlr/msc_vlr_test_call.err b/tests/msc_vlr/msc_vlr_test_call.err
index 9f9b8ba..079a785 100644
--- a/tests/msc_vlr/msc_vlr_test_call.err
+++ b/tests/msc_vlr/msc_vlr_test_call.err
@@ -70,7 +70,7 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   lu_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
 DMM <- SECURITY MODE COMPLETE IMSI:901700000010650
@@ -236,7 +236,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -423,7 +423,7 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   lu_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
 DMM <- SECURITY MODE COMPLETE IMSI:901700000010650
@@ -597,7 +597,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
 - MS sends SecurityModeControl acceptance, VLR accepts, sends CC Setup
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_CIPH}: Received Event PR_ARQ_E_CIPH_RES
diff --git a/tests/msc_vlr/msc_vlr_test_gsm_ciph.c b/tests/msc_vlr/msc_vlr_test_gsm_ciph.c
index a9daaae..1e6bf7c 100644
--- a/tests/msc_vlr/msc_vlr_test_gsm_ciph.c
+++ b/tests/msc_vlr/msc_vlr_test_gsm_ciph.c
@@ -66,7 +66,7 @@
 	VERBOSE_ASSERT(auth_request_sent, == true, "%d");
 
 	btw("MS sends Authen Response, VLR accepts and sends Ciphering Mode Command to MS");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("61855fb81fc2a800");
 	ms_sends_msg("05542d8b2c3e");
 	OSMO_ASSERT(cipher_mode_cmd_sent);
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
@@ -111,7 +111,7 @@
 	thwart_rx_non_initial_requests();
 
 	btw("MS sends Authen Response, VLR accepts and requests Ciphering");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("07fa7502e07e1c00");
 	ms_sends_msg("0554" "20bde240" /* 2nd vector's sres, s.a. */);
 	VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
 	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
@@ -168,7 +168,7 @@
 	thwart_rx_non_initial_requests();
 
 	btw("MS sends Authen Response, VLR accepts and requests Ciphering");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("e2b234f807886400");
 	ms_sends_msg("0554" "a29514ae" /* 3rd vector's sres, s.a. */);
 	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
 
@@ -279,7 +279,7 @@
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 	btw("MS sends Authen Response, VLR accepts and sends Ciphering Mode Command to MS");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("61855fb81fc2a800");
 	ms_sends_msg("05542d8b2c3e");
 	OSMO_ASSERT(cipher_mode_cmd_sent);
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
@@ -350,7 +350,7 @@
 	thwart_rx_non_initial_requests();
 
 	btw("MS sends Authen Response, VLR accepts and requests Ciphering");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("07fa7502e07e1c00");
 	ms_sends_msg("0554" "20bde240" /* 2nd vector's sres, s.a. */);
 	VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
 	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
@@ -407,7 +407,7 @@
 	thwart_rx_non_initial_requests();
 
 	btw("MS sends Authen Response, VLR accepts and requests Ciphering");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("e2b234f807886400");
 	ms_sends_msg("0554" "a29514ae" /* 3rd vector's sres, s.a. */);
 	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
 
@@ -518,7 +518,7 @@
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 	btw("MS sends Authen Response, VLR accepts and sends Ciphering Mode Command to MS");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("61855fb81fc2a800");
 	ms_sends_msg("05542d8b2c3e");
 	OSMO_ASSERT(cipher_mode_cmd_sent);
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
@@ -620,7 +620,7 @@
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 	btw("MS sends Authen Response, VLR accepts and sends Ciphering Mode Command to MS");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("61855fb81fc2a800");
 	ms_sends_msg("05542d8b2c3e");
 	VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
 	VERBOSE_ASSERT(cipher_mode_cmd_sent_with_imeisv, == true, "%d");
@@ -719,7 +719,7 @@
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 	btw("MS sends Authen Response, VLR accepts and sends Ciphering Mode Command to MS");
-	cipher_mode_cmd_sent = false;
+	expect_cipher_mode_cmd("61855fb81fc2a800");
 	ms_sends_msg("05542d8b2c3e");
 	OSMO_ASSERT(cipher_mode_cmd_sent);
 	VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
diff --git a/tests/msc_vlr/msc_vlr_test_umts_authen.c b/tests/msc_vlr/msc_vlr_test_umts_authen.c
index 3b1f6dd..e6dc445 100644
--- a/tests/msc_vlr/msc_vlr_test_umts_authen.c
+++ b/tests/msc_vlr/msc_vlr_test_umts_authen.c
@@ -144,9 +144,9 @@
 	} else {
 		/* On UTRAN */
 		btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-		cipher_mode_cmd_sent = false;
+		expect_security_mode_ctrl(NULL, "27497388b6cb044648f396aa155b95ef");
 		ms_sends_msg("0554" "e229c19e" "2104" "791f2e41");
-		VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 		btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
@@ -213,9 +213,9 @@
 	} else {
 		/* On UTRAN */
 		btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-		cipher_mode_cmd_sent = false;
+		expect_security_mode_ctrl(NULL, "1159ec926a50e98c034a6b7d7c9f418d");
 		ms_sends_msg("0554" "7db47cf7" "2104" "f81e4dc7"); /* 2nd vector's res, s.a. */
-		VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 		VERBOSE_ASSERT(cm_service_result_sent, == RES_NONE, "%d");
 
 		btw("MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept");
@@ -278,9 +278,9 @@
 	} else {
 		/* On UTRAN */
 		btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-		cipher_mode_cmd_sent = false;
+		expect_security_mode_ctrl(NULL, "eb50e770ddcc3060101d2f43b6c2b884");
 		ms_sends_msg("0554" "706f9967" "2104" "19ba609c"); /* 3nd vector's res, s.a. */
-		VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 		VERBOSE_ASSERT(paging_stopped, == false, "%d");
 
 		btw("MS sends SecurityModeControl acceptance, VLR accepts and sends SMS");
@@ -512,9 +512,9 @@
 	} else {
 		/* On UTRAN */
 		btw("MS sends Authen Response, VLR accepts and sends SecurityModeControl");
-		cipher_mode_cmd_sent = false;
+		expect_security_mode_ctrl(NULL, "8a90c769b7272f3bb7a1c1fbb1ea9349");
 		ms_sends_msg("0554" "1df5f0b4" "2104" "f22b696e");
-		VERBOSE_ASSERT(cipher_mode_cmd_sent, == true, "%d");
+		VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 		VERBOSE_ASSERT(lu_result_sent, == RES_NONE, "%d");
 
 		btw("MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR");
diff --git a/tests/msc_vlr/msc_vlr_test_umts_authen.err b/tests/msc_vlr/msc_vlr_test_umts_authen.err
index 8a45167..7ba7c1d 100644
--- a/tests/msc_vlr/msc_vlr_test_umts_authen.err
+++ b/tests/msc_vlr/msc_vlr_test_umts_authen.err
@@ -531,7 +531,7 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   lu_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
 DMM <- SECURITY MODE COMPLETE IMSI:901700000010650
@@ -717,7 +717,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   cm_service_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts; above Ciphering is an implicit CM Service Accept
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -855,7 +855,7 @@
 DVLR Process_Access_Request_VLR(901700000010650){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_WAIT_CIPH
 DMM MSISDN:42342: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF MSISDN:42342: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   paging_stopped == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends SMS
 DMM <- SECURITY MODE COMPLETE MSISDN:42342
@@ -1268,7 +1268,7 @@
 DVLR vlr_lu_fsm(901700000010650){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_WAIT_CIPH
 DMM IMSI:901700000010650: bump: conn still being established (SUBSCR_CONN_S_NEW)
 DREF IMSI:901700000010650: MSC conn use - dtap == 1 (0x4)
-  cipher_mode_cmd_sent == 1
+  security_mode_ctrl_sent == 1
   lu_result_sent == 0
 - MS sends SecurityModeControl acceptance, VLR accepts and sends GSUP LU Req to HLR
 DMM <- SECURITY MODE COMPLETE IMSI:901700000010650
diff --git a/tests/msc_vlr/msc_vlr_tests.c b/tests/msc_vlr/msc_vlr_tests.c
index a9f76f4..97a2e5d 100644
--- a/tests/msc_vlr/msc_vlr_tests.c
+++ b/tests/msc_vlr/msc_vlr_tests.c
@@ -62,6 +62,10 @@
 const char *auth_request_expect_autn;
 bool cipher_mode_cmd_sent;
 bool cipher_mode_cmd_sent_with_imeisv;
+const char *cipher_mode_expect_kc;
+bool security_mode_ctrl_sent;
+const char *security_mode_expect_ck;
+const char *security_mode_expect_ik;
 
 bool iu_release_expected = false;
 bool iu_release_sent = false;
@@ -387,6 +391,14 @@
 	auth_request_expect_rand = NULL;
 	auth_request_expect_autn = NULL;
 
+	cipher_mode_cmd_sent = false;
+	cipher_mode_cmd_sent_with_imeisv = false;
+	cipher_mode_expect_kc = NULL;
+
+	security_mode_ctrl_sent = false;
+	security_mode_expect_ck = NULL;
+	security_mode_expect_ik = NULL;
+
 	next_rand_byte = 0;
 
 	iu_release_expected = false;
@@ -720,6 +732,12 @@
 	btw("...key: %s", osmo_hexdump_nospc(ei->key, ei->key_len));
 	cipher_mode_cmd_sent = true;
 	cipher_mode_cmd_sent_with_imeisv = include_imeisv;
+
+	if (!cipher_mode_expect_kc
+	    || strcmp(cipher_mode_expect_kc, osmo_hexdump_nospc(ei->key, ei->key_len))) {
+		log("FAILURE: expected kc=%s", cipher_mode_expect_kc ? : "NULL");
+		OSMO_ASSERT(false);
+	}
 	return 0;
 }
 
@@ -734,8 +752,18 @@
 	btw("...ik=%s", osmo_hexdump_nospc(vec->ik, sizeof(vec->ik)));
 	if (send_ck)
 		btw("...ck=%s", osmo_hexdump_nospc(vec->ck, sizeof(vec->ck)));
-	cipher_mode_cmd_sent = true;
-	cipher_mode_cmd_sent_with_imeisv = false;
+	security_mode_ctrl_sent = true;
+	if (!security_mode_expect_ik
+	    || strcmp(security_mode_expect_ik, osmo_hexdump_nospc(vec->ik, sizeof(vec->ik)))) {
+		log("FAILURE: expected ik=%s", security_mode_expect_ik ? : "NULL");
+		OSMO_ASSERT(false);
+	}
+	if (((!!send_ck) != (!!security_mode_expect_ck))
+	    || (security_mode_expect_ck
+		&& strcmp(security_mode_expect_ck, osmo_hexdump_nospc(vec->ck, sizeof(vec->ck))))) {
+		log("FAILURE: expected ck=%s", security_mode_expect_ck ? : "NULL");
+		OSMO_ASSERT(false);
+	}
 	return 0;
 }
 
diff --git a/tests/msc_vlr/msc_vlr_tests.h b/tests/msc_vlr/msc_vlr_tests.h
index 03aa3ae..858936c 100644
--- a/tests/msc_vlr/msc_vlr_tests.h
+++ b/tests/msc_vlr/msc_vlr_tests.h
@@ -76,6 +76,28 @@
 
 extern bool cipher_mode_cmd_sent;
 extern bool cipher_mode_cmd_sent_with_imeisv;
+extern const char *cipher_mode_expect_kc;
+
+extern bool security_mode_ctrl_sent;
+extern const char *security_mode_expect_ck;
+extern const char *security_mode_expect_ik;
+
+static inline void expect_cipher_mode_cmd(const char *kc)
+{
+	cipher_mode_cmd_sent = false;
+	cipher_mode_expect_kc = kc;
+	/* make sure we don't mix up the two */
+	security_mode_ctrl_sent = false;
+}
+
+static inline void expect_security_mode_ctrl(const char *ck, const char *ik)
+{
+	security_mode_ctrl_sent = false;
+	security_mode_expect_ck = ck;
+	security_mode_expect_ik = ik;
+	/* make sure we don't mix up the two */
+	cipher_mode_cmd_sent = false;
+}
 
 extern bool paging_sent;
 extern bool paging_stopped;