OPC UA Security Policy Explorer
Policy and mode
Messages are signed and encrypted — recommended for production.
Valid and recommended.
Basic256Sha256
Current
URI
http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
Symmetric encryption
AES-256-CBC
Symmetric signature
HMAC-SHA256
Asymmetric encryption
RSA-OAEP (SHA-1)
Asymmetric signature
RSA PKCS#1 v1.5 SHA-256
Key derivation
P_SHA256
Certificate key
RSA
Key length
2048 … 4096 bit
The most widely supported current policy; use it when devices do not offer the newer RSA-PSS policy.
All policies
| Security policy | Status | Symmetric encryption | Asymmetric signature | Key length |
|---|---|---|---|---|
| None | No security | — | — | — |
| Basic128Rsa15 | Deprecated | AES-128-CBC | RSA PKCS#1 v1.5 SHA-1 | 1024–2048 |
| Basic256 | Deprecated | AES-256-CBC | RSA PKCS#1 v1.5 SHA-1 | 1024–2048 |
| Aes128_Sha256_RsaOaep | Current | AES-128-CBC | RSA PKCS#1 v1.5 SHA-256 | 2048–4096 |
| Basic256Sha256 | Current | AES-256-CBC | RSA PKCS#1 v1.5 SHA-256 | 2048–4096 |
| Aes256_Sha256_RsaPss | Current | AES-256-CBC | RSA-PSS SHA-256 | 2048–4096 |
| ECC_nistP256 | ECC (v1.05) | AES-128-CBC | ECDSA SHA-256 | 256 |
| ECC_nistP384 | ECC (v1.05) | AES-256-CBC | ECDSA SHA-384 | 384 |
| ECC_brainpoolP256r1 | ECC (v1.05) | AES-128-CBC | ECDSA SHA-256 | 256 |
| ECC_brainpoolP384r1 | ECC (v1.05) | AES-256-CBC | ECDSA SHA-384 | 384 |
Algorithms per OPC 10000-7 (profiles) as implemented by the OPC Foundation reference stack (UA-.NETStandard). ECC curve25519/448 variants are not listed.