5G NR - Security Mode Complete

Message Fact Sheet

Protocol	rrc	Network	5g
Spec	3GPP TS 38.331	Spec Section	5.3.4, 6.2.2, Annex B.1
Direction	UE -> gNB	Message Type	Security Control

Full message name	5G NR - Security Mode Complete
Protocol	RRC
Technology	5G
Direction	UE -> gNB
Interface	Uu
Signaling bearer / channel	SRB1 / UL-DCCH
Typical trigger	The UE successfully verifies SecurityModeCommand and activates the selected NR AS security algorithms.
Main purpose	Confirms that the UE accepted and applied the AS security configuration commanded by the gNB so later protected RRC signaling can continue.
Main specification	3GPP TS 38.331, 5.3.4, 6.2.2, Annex B.1
Release added	Release 15
Procedures where used	Initial AS Security Activation, Initial Registration, Connected-Mode Security Setup
Related timers	T380

What is Security Mode Complete in simple terms?

Uplink NR RRC message used by the UE to confirm successful activation of the selected AS security configuration.

Confirms that the UE accepted and applied the AS security configuration commanded by the gNB so later protected RRC signaling can continue.

Why this message matters

SecurityModeComplete is the UE saying that it successfully applied the security settings requested by the gNB.

Where this message appears in the call flow

Initial AS Security Activation

Call flow position: UE confirmation message sent after successfully processing SecurityModeCommand.

Typical state: UE is in RRC_CONNECTED and has just transitioned into AS-protected RRC operation.

Preconditions:

SecurityModeCommand was received and verified successfully.
The UE accepted the selected security algorithms.
AS security activation completed locally at the UE.

Next likely message: RRCReconfiguration or other later protected dedicated RRC signaling

5G Initial Registration

Call flow position: Appears after SecurityModeCommand in the radio-side security activation stage of the wider registration path.

Typical state: The registration path is progressing with AS security now active for later RRC signaling.

Preconditions:

Initial radio connection setup completed successfully.
The network initiated AS security activation.

Next likely message: RRCReconfiguration or continued protected RRC handling

Call flow position

Previous message(s): SecurityModeCommand

Next message(s): RRCReconfiguration, Other protected connected-mode RRC signaling

Message direction and transport

Sender and receiver: UE -> gNB

Interface: Uu

Domain: Access-side radio control under activated AS security context

Signaling bearer: SRB1

Logical channel: UL-DCCH

Transport / encapsulation: RRC over DCCH on SRB1 after SecurityModeCommand and before later protected connected-mode RRC procedures continue

Security context: SecurityModeComplete is sent after the UE has successfully applied the selected AS security configuration. It is part of the secured connected-mode signaling path.

Message Structure Overview

SecurityModeComplete is structurally very small. Its main practical meaning is procedural rather than payload-heavy.
The important question is not complex IE decoding, but whether the UE sent it at all and whether it correctly matches the preceding SecurityModeCommand transaction.
Once this message is sent successfully, later RRC signaling is expected to continue under the activated AS security context.

ASN.1 for 5G NR - Security Mode Complete

SecurityModeComplete ::= SEQUENCE {
  rrc-TransactionIdentifier RRC-TransactionIdentifier,
  criticalExtensions CHOICE {
    securityModeComplete SecurityModeComplete-IEs,
    criticalExtensionsFuture SEQUENCE {}
  }
}

SecurityModeComplete-IEs ::= SEQUENCE {
  lateNonCriticalExtension OCTET STRING OPTIONAL,
  nonCriticalExtension     SEQUENCE {} OPTIONAL
}

How to read this ASN.1

This is a confirmation message, so most engineering value comes from procedure correlation, transaction matching, and verifying that protected RRC signaling continues afterward.

5G NR - Security Mode Complete - Example Dump

UL-DCCH-Message
  message: securityModeComplete
    rrc-TransactionIdentifier: 2
    criticalExtensions:
      securityModeComplete:
        lateNonCriticalExtension: absent
        nonCriticalExtension: absent

How to read this dump

The transaction identifier should match the preceding SecurityModeCommand.
A clean SecurityModeComplete usually means the UE accepted and activated the selected AS security configuration.
The next useful check is whether later RRC signaling, such as RRC Reconfiguration, is protected and proceeds normally.

Important Information Elements

IE	Required	Description
`rrc-TransactionIdentifier`	Yes	Transaction identifier that matches the SecurityModeCommand transaction being completed.
`criticalExtensions`	Yes	Versioned wrapper around the SecurityModeComplete payload and future extensions.
`lateNonCriticalExtension`	Optional	Extension container used for later release evolution and compatibility handling.
`nonCriticalExtension`	Optional	Forward-compatible extension branch for later additions.

Detailed field explanation

`rrc-TransactionIdentifier`

Transaction identifier that matches the SecurityModeCommand transaction being completed.

Presence: Required

In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.

`criticalExtensions`

Versioned wrapper around the SecurityModeComplete payload and future extensions.

Presence: Required

In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.

`lateNonCriticalExtension`

Extension container used for later release evolution and compatibility handling.

Presence: Optional

In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.

`nonCriticalExtension`

Forward-compatible extension branch for later additions.

Presence: Optional

In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.

What to check in logs and traces

Confirm the message follows SecurityModeCommand and uses SRB1 / UL-DCCH.
Verify the transaction identifier matches the preceding command.
Check that the UE did not send SecurityModeFailure instead.
Inspect whether later RRC messages are protected and decoded as expected after this point.
If the message is missing, inspect UE integrity verification and algorithm acceptance behavior.

Common Issues and Troubleshooting

SecurityModeCommand is present but SecurityModeComplete never arrives.

Likely cause: The UE may have failed integrity verification, rejected the selected algorithm set, or failed during AS security activation.

What to inspect: Check transaction matching, UE security capability assumptions, integrity verification, and any immediate release or failure behavior.

Next step: Compare with a successful security activation trace and check for SecurityModeFailure or silent drop behavior.

SecurityModeComplete is present but later RRC signaling still fails.

Likely cause: The confirmation alone does not guarantee the rest of the protected signaling path is healthy.

What to inspect: Check whether later messages such as RRCReconfiguration are integrity protected and decoded consistently.

Next step: Walk forward from SecurityModeComplete into the first protected follow-up message.

Transaction identifiers do not line up.

Likely cause: The UE response may not correspond to the expected SecurityModeCommand transaction.

What to inspect: Correlate the command and complete message pair carefully in repeated or retried procedures.

Next step: Verify whether multiple security transactions or trace reordering are confusing the decode.

Engineers expect detailed security parameters in SecurityModeComplete.

Likely cause: SecurityModeComplete is intentionally lightweight and mainly confirms acceptance rather than restating the configuration.

What to inspect: Read the selected algorithm details from SecurityModeCommand instead.

Next step: Use SecurityModeComplete as a procedural checkpoint, not as the main algorithm container.

LTE / 5G / Variant Comparison

Compared with SecurityModeCommand

SecurityModeCommand carries the selected AS security configuration from the gNB. SecurityModeComplete is the UE-side confirmation that the configuration was accepted and applied.

FAQ

What does SecurityModeComplete do in 5G NR?

It confirms that the UE successfully applied the AS security configuration requested by SecurityModeCommand.

Who sends SecurityModeComplete?

The UE sends SecurityModeComplete to the gNB.

What comes before SecurityModeComplete?

SecurityModeCommand comes immediately before it in the normal success path.

What comes after SecurityModeComplete?

Later protected connected-mode RRC signaling such as RRCReconfiguration usually follows.

Does SecurityModeComplete contain the algorithm list?

No. The selected security algorithms are carried in SecurityModeCommand, not repeated in detail here.

Why is SecurityModeComplete important in traces?

It shows that the UE accepted the commanded AS security activation and that later protected RRC signaling can proceed.

Related message pages

Related Procedures

Related Tools

Use This Reference in Practice

Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.