Security policy
In OPC UA, a security policy is a named suite of cryptographic algorithms - identified by a URI such as Basic256Sha256 or Aes256_Sha256_RsaPss - that fixes the signature, encryption, key-derivation and key-length rules for a secure channel. Every EndpointDescription advertises one policy plus one MessageSecurityMode, and the two are independent choices.
The policies that are current
The RSA-based policies in normal use are Basic256Sha256 with AES-256, RSA-OAEP and HMAC-SHA-256 and a 2048-bit minimum key; Aes128_Sha256_RsaOaep; and Aes256_Sha256_RsaPss. Basic256Sha256 is the interoperability baseline - if you can only enable one, enable that. Aes256_Sha256_RsaPss is preferable where both ends support it, because RSA-PSS is the modern signature padding.
The deprecated ones, and why they linger
Basic256 and Basic128Rsa15 are the SHA-1 era policies. Basic128Rsa15 additionally uses RSA PKCS#1 v1.5 encryption padding. Both should be off, and both are still shipped enabled by some PLC and gateway firmware because an old client on the plant floor needs them. Separately, the reference stack rejects SHA-1-signed certificates by default via RejectSHA1SignedCertificates, so an old CA can fail you even on a modern policy.
ECC exists in the specification and thinly in stacks
The specification and the .NET reference stack define ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1 and ECC_brainpoolP384r1, and stack 2.0 adds curve25519 and curve448 plus AES-GCM and ChaCha20-Poly1305 AEAD variants and RSA_DH_AesGcm. open62541 1.5 lists no ECC policy at all. So the specification supports ECC and your stack probably does not: treat ECC as a two-sided capability check, not a configuration setting, and confirm support with both vendors before designing it in.
None is a policy too
SecurityPolicy None means no signing, no encryption and no channel-level authentication, and it forces MessageSecurityMode None. It belongs on a bench and nowhere else, because it also means a UserName token travels in clear. Note that the JSON and OpenAPI transport profiles are advertised with security mode None and lean entirely on TLS - a legitimate design, but you have moved your security boundary to the web tier, and you should say so out loud in the design document.
Example
Policy URIs as they appear in an EndpointDescription - these are the exact strings a client matches on
http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256
http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep
http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss
http://opcfoundation.org/UA/SecurityPolicy#None
deprecated, disable in production:
http://opcfoundation.org/UA/SecurityPolicy#Basic256
http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15Defined in: Part 2 - Security Model; Part 7 - Profiles for the policy definitions.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.