diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn
index c29095f..981e924 100644
--- a/sgsn/SGSN_Tests.ttcn
+++ b/sgsn/SGSN_Tests.ttcn
@@ -465,13 +465,13 @@
 
 /* helper function to create, connect and start a BSSGP_ConnHdlr component */
 function f_start_handler(void_fn fn, charstring id, GbInstances gb, integer imsi_suffix,
-			 float t_guard := 30.0)
+			 float t_guard := 30.0, boolean expect_ciph := false)
 runs on test_CT return BSSGP_ConnHdlr {
 	var BSSGP_ConnHdlr vc_conn;
 	var SGSN_ConnHdlrNetworkPars net_pars := {
 		expect_ptmsi := true,
 		expect_auth := true,
-		expect_ciph := false
+		expect_ciph := expect_ciph
 	};
 	var BSSGP_ConnHdlrPars pars := {
 		imei := f_gen_imei(imsi_suffix),
@@ -687,6 +687,34 @@
 	return l3_mt;
 }
 
+/* (copied from msc/BSC_ConnectionHandler.ttcn) */
+private altstep as_ciph_utran() runs on BSSGP_ConnHdlr
+{
+	[g_pars.net.expect_ciph] BSSAP.receive(tr_RANAP_SecurityModeCmdEnc(uia_algs := ?,
+									   uia_key := oct2bit(g_pars.vec.ik),
+									   key_sts := ?,
+									   uea_algs := ?,
+									   uea_key := oct2bit(g_pars.vec.ck))) {
+		var IntegrityProtectionAlgorithm uia_chosen := 0; /*standard_UMTS_integrity_algorithm_UIA1*/
+		var EncryptionAlgorithm uea_chosen := 1; /*standard_UMTS_encryption_algorith_UEA1*/
+		BSSAP.send(ts_RANAP_SecurityModeCompleteEnc(uia_chosen, uea_chosen));
+		}
+	[g_pars.net.expect_ciph] BSSAP.receive(tr_RANAP_SecurityModeCmdEnc(?,?,?,?,?)) {
+		setverdict(fail, "Invalid SecurityModeCommand (ciphering case)");
+		mtc.stop;
+		}
+	[not g_pars.net.expect_ciph] BSSAP.receive(tr_RANAP_SecurityModeCmd(uia_algs := ?,
+									    uia_key := oct2bit(g_pars.vec.ik),
+									    key_sts := ?)) {
+		var IntegrityProtectionAlgorithm uia_chosen := 0; /*standard_UMTS_integrity_algorithm_UIA1;*/
+		BSSAP.send(ts_RANAP_SecurityModeComplete(uia_chosen));
+		}
+	[not g_pars.net.expect_ciph] BSSAP.receive(tr_RANAP_SecurityModeCmd(?,?,?)) {
+		setverdict(fail, "Invalid SecurityModeCommand (non-ciphering case)");
+		mtc.stop;
+		}
+}
+
 /* perform GMM authentication (if expected).
  * Note, for umts_aka_challenge to work, the revisionLevelIndicatior needs to
  * be 1 to mark R99 capability, in the GMM Attach Request, see f_gmm_attach(). */
@@ -754,12 +782,8 @@
 
 		/* Security Mode Command + Complete on Iu case */
 		if (is_iu(ran_index)) {
-			BSSAP.receive(tr_RANAP_SecurityModeCmd(uia_algs := ?, uia_key := oct2bit(g_pars.vec.ik),
-								key_sts := ?)) {
-				var IntegrityProtectionAlgorithm uia_chosen := 0; /* 0 = standard_UMTS_integrity_algorithm_UIA1 */
-				BSSAP.send(ts_RANAP_SecurityModeComplete(uia_chosen));
-				BSSAP.receive(tr_RANAP_CommonId(imsi_hex2oct(g_pars.imsi)))
-			}
+			as_ciph_utran();
+			BSSAP.receive(tr_RANAP_CommonId(imsi_hex2oct(g_pars.imsi)));
 		}
 	} else {
 		/* wait for identity procedure */
diff --git a/sgsn/SGSN_Tests_Iu.ttcn b/sgsn/SGSN_Tests_Iu.ttcn
index 2b63b4e..236a6a7 100644
--- a/sgsn/SGSN_Tests_Iu.ttcn
+++ b/sgsn/SGSN_Tests_Iu.ttcn
@@ -1,6 +1,7 @@
 module SGSN_Tests_Iu {
 
 import from Osmocom_Types all;
+import from Osmocom_VTY_Functions all;
 
 import from SGSN_Tests all;
 
@@ -36,6 +37,29 @@
 	f_cleanup();
 }
 
+testcase TC_iu_attach_encr() runs on test_CT {
+	/* MS -> SGSN: Attach Request IMSI
+	 * MS <- SGSN: Identity Request IMEI
+	 * MS -> SGSN: Identity Response IMEI
+	 * MS <- SGSN: Auth Request
+	 * MS -> SGSN: Auth Response
+	 * MS <- SGSN: Security Mode Command
+	 * MS -> SGSN: Security Mode Complete
+	 * hNodeB <- SGSN: Common Id
+	 * MS <- SGSN: Attach Accept
+	 * MS -> SGSN: Attach Complete
+	 */
+	var BSSGP_ConnHdlr vc_conn;
+	g_ranap_enable := true;
+	f_init();
+	f_vty_config(SGSNVTY, "sgsn", "encryption uea 1 2");
+	f_sleep(1.0);
+	vc_conn := f_start_handler(refers(f_TC_iu_attach), testcasename(), g_gb, 1001, expect_ciph := true);
+	vc_conn.done;
+	f_vty_config(SGSNVTY, "sgsn", "encryption uea 0");
+	f_cleanup();
+}
+
 private function f_TC_iu_attach_geran_rau(charstring id) runs on BSSGP_ConnHdlr {
 	var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
 
@@ -85,6 +109,7 @@
 
 control {
 	execute( TC_iu_attach() );
+	execute( TC_iu_attach_encr() );
 	execute( TC_iu_attach_geran_rau() );
 	execute( TC_geran_attach_iu_rau() );
 }