diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/Akm.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/Akm.aidl
new file mode 100644
index 0000000..5baf2e8
--- /dev/null
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/Akm.aidl
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi;
+@VintfStability
+parcelable Akm {
+  const long NONE = 0;
+  const long PASN = (1 << 0) /* 1 */;
+  const long SAE = (1 << 1) /* 2 */;
+  const long FT_EAP_SHA256 = (1 << 2) /* 4 */;
+  const long FT_PSK_SHA256 = (1 << 3) /* 8 */;
+  const long FT_EAP_SHA384 = (1 << 4) /* 16 */;
+  const long FT_PSK_SHA384 = (1 << 5) /* 32 */;
+  const long FILS_EAP_SHA256 = (1 << 6) /* 64 */;
+  const long FILS_EAP_SHA384 = (1 << 7) /* 128 */;
+}
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/CipherSuite.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/CipherSuite.aidl
new file mode 100644
index 0000000..32fb5ba
--- /dev/null
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/CipherSuite.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi;
+@VintfStability
+parcelable CipherSuite {
+  const long NONE = 0;
+  const long CCMP_128 = (1 << 0) /* 1 */;
+  const long CCMP_256 = (1 << 1) /* 2 */;
+  const long GCMP_128 = (1 << 2) /* 4 */;
+  const long GCMP_256 = (1 << 3) /* 8 */;
+}
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/PasnConfig.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/PasnConfig.aidl
new file mode 100644
index 0000000..9b26c97
--- /dev/null
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/PasnConfig.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi;
+@VintfStability
+parcelable PasnConfig {
+  long baseAkm;
+  long cipherSuite;
+  @nullable byte[] passphrase;
+  @nullable byte[] pmkid;
+}
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttCapabilities.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttCapabilities.aidl
index 6c64084..6197585 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttCapabilities.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttCapabilities.aidl
@@ -47,4 +47,8 @@
   boolean ntbInitiatorSupported;
   boolean ntbResponderSupported;
   @nullable android.hardware.wifi.common.OuiKeyedData[] vendorData;
+  long akmsSupported;
+  long cipherSuitesSupported;
+  boolean secureHeLtfSupported;
+  boolean rangingFrameProtectionSupported;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttConfig.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttConfig.aidl
index 3613616..5507280 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttConfig.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttConfig.aidl
@@ -51,4 +51,5 @@
   long ntbMinMeasurementTime;
   long ntbMaxMeasurementTime;
   @nullable android.hardware.wifi.common.OuiKeyedData[] vendorData;
+  @nullable android.hardware.wifi.RttSecureConfig secureConfig;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttResult.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttResult.aidl
index 13202ba..87257be 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttResult.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttResult.aidl
@@ -66,4 +66,9 @@
   byte numTxSpatialStreams;
   byte numRxSpatialStreams;
   @nullable android.hardware.wifi.common.OuiKeyedData[] vendorData;
+  boolean isRangingFrameProtectionEnabled;
+  boolean isSecureLtfEnabled;
+  long baseAkm;
+  long cipherSuite;
+  int secureHeLtfProtocolVersion;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttSecureConfig.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttSecureConfig.aidl
new file mode 100644
index 0000000..c2d7866
--- /dev/null
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttSecureConfig.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi;
+@VintfStability
+parcelable RttSecureConfig {
+  android.hardware.wifi.PasnConfig pasnConfig;
+  boolean enableSecureHeLtf;
+  boolean enableRangingFrameProtection;
+}
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttStatus.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttStatus.aidl
index 2817497..08bca77 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttStatus.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttStatus.aidl
@@ -52,4 +52,9 @@
   FAIL_FTM_PARAM_OVERRIDE = 15,
   NAN_RANGING_PROTOCOL_FAILURE = 16,
   NAN_RANGING_CONCURRENCY_NOT_SUPPORTED = 17,
+  SECURE_RANGING_FAILURE_INVALID_AKM = 18,
+  SECURE_RANGING_FAILURE_INVALID_CIPHER = 19,
+  SECURE_RANGING_FAILURE_INVALID_CONFIG = 20,
+  SECURE_RANGING_FAILURE_REJECTED = 21,
+  SECURE_RANGING_FAILURE_UNKNOWN = 22,
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttType.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttType.aidl
index cb25673..8545d73 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttType.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/RttType.aidl
@@ -38,4 +38,5 @@
   TWO_SIDED = 2,
   TWO_SIDED_11MC = TWO_SIDED /* 2 */,
   TWO_SIDED_11AZ_NTB = 3,
+  TWO_SIDED_11AZ_NTB_SECURE = 4,
 }
diff --git a/wifi/aidl/android/hardware/wifi/Akm.aidl b/wifi/aidl/android/hardware/wifi/Akm.aidl
new file mode 100644
index 0000000..e3a913b
--- /dev/null
+++ b/wifi/aidl/android/hardware/wifi/Akm.aidl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi;
+
+/**
+ * Authentication and Key Management types.
+ */
+@VintfStability
+parcelable Akm {
+    const long NONE = 0;
+    const long PASN = 1 << 0;
+    const long SAE = 1 << 1;
+    const long FT_EAP_SHA256 = 1 << 2;
+    const long FT_PSK_SHA256 = 1 << 3;
+    const long FT_EAP_SHA384 = 1 << 4;
+    const long FT_PSK_SHA384 = 1 << 5;
+    const long FILS_EAP_SHA256 = 1 << 6;
+    const long FILS_EAP_SHA384 = 1 << 7;
+}
diff --git a/wifi/aidl/android/hardware/wifi/CipherSuite.aidl b/wifi/aidl/android/hardware/wifi/CipherSuite.aidl
new file mode 100644
index 0000000..02b62e8
--- /dev/null
+++ b/wifi/aidl/android/hardware/wifi/CipherSuite.aidl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi;
+
+/**
+ * Cipher Suite types.
+ */
+@VintfStability
+parcelable CipherSuite {
+    const long NONE = 0;
+    const long CCMP_128 = 1 << 0;
+    const long CCMP_256 = 1 << 1;
+    const long GCMP_128 = 1 << 2;
+    const long GCMP_256 = 1 << 3;
+}
diff --git a/wifi/aidl/android/hardware/wifi/PasnConfig.aidl b/wifi/aidl/android/hardware/wifi/PasnConfig.aidl
new file mode 100644
index 0000000..4c6b5bf
--- /dev/null
+++ b/wifi/aidl/android/hardware/wifi/PasnConfig.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi;
+
+/**
+ * Pre-Association Security Negotiation (PASN) configuration.
+ */
+@VintfStability
+parcelable PasnConfig {
+    /**
+     * Base Authentication and Key Management (AKM) protocol used for PASN as defined in |Akm|.
+     */
+    long baseAkm;
+    /**
+     * Pairwise cipher suite used for the PTKSA (Pairwise Transient Key Security Association)
+     * as defined in |CipherSuite|
+     */
+    long cipherSuite;
+    /**
+     * Passphrase for the base AKM. This can be null based on the AKM type.
+     */
+    @nullable byte[] passphrase;
+    /**
+     * PMKID corresponding to the cached PMK from the base AKM. PMKID can be null if no cached PMK
+     * is present.
+     */
+    @nullable byte[] pmkid;
+}
diff --git a/wifi/aidl/android/hardware/wifi/RttCapabilities.aidl b/wifi/aidl/android/hardware/wifi/RttCapabilities.aidl
index c193924..0cf048d 100644
--- a/wifi/aidl/android/hardware/wifi/RttCapabilities.aidl
+++ b/wifi/aidl/android/hardware/wifi/RttCapabilities.aidl
@@ -84,4 +84,20 @@
      * that no vendor data is provided.
      */
     @nullable OuiKeyedData[] vendorData;
+    /**
+     * Bitmap of |Akm| values indicating the set of supported AKMs.
+     */
+    long akmsSupported;
+    /**
+     * Bitmap of |CipherSuite| values indicating the set of supported pairwise cipher suites.
+     */
+    long cipherSuitesSupported;
+    /**
+     * Whether secure HE-LTF is supported.
+     */
+    boolean secureHeLtfSupported;
+    /**
+     * Whether frame protection for ranging is supported.
+     */
+    boolean rangingFrameProtectionSupported;
 }
diff --git a/wifi/aidl/android/hardware/wifi/RttConfig.aidl b/wifi/aidl/android/hardware/wifi/RttConfig.aidl
index 496ffd2..8dfbea8 100644
--- a/wifi/aidl/android/hardware/wifi/RttConfig.aidl
+++ b/wifi/aidl/android/hardware/wifi/RttConfig.aidl
@@ -19,6 +19,7 @@
 import android.hardware.wifi.RttBw;
 import android.hardware.wifi.RttPeerType;
 import android.hardware.wifi.RttPreamble;
+import android.hardware.wifi.RttSecureConfig;
 import android.hardware.wifi.RttType;
 import android.hardware.wifi.WifiChannelInfo;
 import android.hardware.wifi.common.OuiKeyedData;
@@ -140,4 +141,8 @@
      * that no vendor data is provided.
      */
     @nullable OuiKeyedData[] vendorData;
+    /**
+     * Secure Ranging configuration
+     */
+    @nullable RttSecureConfig secureConfig;
 }
diff --git a/wifi/aidl/android/hardware/wifi/RttResult.aidl b/wifi/aidl/android/hardware/wifi/RttResult.aidl
index 2f9aefe..dd41868 100644
--- a/wifi/aidl/android/hardware/wifi/RttResult.aidl
+++ b/wifi/aidl/android/hardware/wifi/RttResult.aidl
@@ -213,4 +213,25 @@
      * that no vendor data is provided.
      */
     @nullable OuiKeyedData[] vendorData;
+    /**
+     * Whether ranging frame protection is enabled.
+     */
+    boolean isRangingFrameProtectionEnabled;
+    /**
+     * Whether Secure HE-LTF is enabled.
+     */
+    boolean isSecureLtfEnabled;
+    /**
+     * Base Authentication and Key Management (AKM) protocol used for PASN as defined in |Akm|.
+     */
+    long baseAkm;
+    /**
+     * Pairwise cipher suite used for the PTKSA (Pairwise Transient Key Security Association)
+     * as defined in |CipherSuite|
+     */
+    long cipherSuite;
+    /**
+     * Secure HE-LTF protocol version used.
+     */
+    int secureHeLtfProtocolVersion;
 }
diff --git a/wifi/aidl/android/hardware/wifi/RttSecureConfig.aidl b/wifi/aidl/android/hardware/wifi/RttSecureConfig.aidl
new file mode 100644
index 0000000..c10e6b5
--- /dev/null
+++ b/wifi/aidl/android/hardware/wifi/RttSecureConfig.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi;
+
+import android.hardware.wifi.PasnConfig;
+
+/**
+ * RTT secure configuration.
+ */
+@VintfStability
+parcelable RttSecureConfig {
+    /**
+     * Pre-Association Security Negotiation (PASN) configuration.
+     */
+    PasnConfig pasnConfig;
+    /**
+     * Enable secure HE-LTF (High Efficiency Long Training Field).
+     */
+    boolean enableSecureHeLtf;
+    /**
+     * Enable Ranging frame protection.
+     */
+    boolean enableRangingFrameProtection;
+}
diff --git a/wifi/aidl/android/hardware/wifi/RttStatus.aidl b/wifi/aidl/android/hardware/wifi/RttStatus.aidl
index 600165c..94bc9e3 100644
--- a/wifi/aidl/android/hardware/wifi/RttStatus.aidl
+++ b/wifi/aidl/android/hardware/wifi/RttStatus.aidl
@@ -88,4 +88,24 @@
      * NAN concurrency not supported (NDP + RTT).
      */
     NAN_RANGING_CONCURRENCY_NOT_SUPPORTED = 17,
+    /**
+     * Secure Ranging failed due to invalid AKM (Authentication and Key Management)
+     */
+    SECURE_RANGING_FAILURE_INVALID_AKM = 18,
+    /**
+     * Secure Ranging failed due to invalid Cipher.
+     */
+    SECURE_RANGING_FAILURE_INVALID_CIPHER = 19,
+    /**
+     * Secure Ranging failed due to invalid configuration.
+     */
+    SECURE_RANGING_FAILURE_INVALID_CONFIG = 20,
+    /**
+     * Secure ranging rejected by the AP.
+     */
+    SECURE_RANGING_FAILURE_REJECTED = 21,
+    /**
+     * Secure ranging failure unknown.
+     */
+    SECURE_RANGING_FAILURE_UNKNOWN = 22,
 }
diff --git a/wifi/aidl/android/hardware/wifi/RttType.aidl b/wifi/aidl/android/hardware/wifi/RttType.aidl
index 3f1a2f1..d7cf9fe 100644
--- a/wifi/aidl/android/hardware/wifi/RttType.aidl
+++ b/wifi/aidl/android/hardware/wifi/RttType.aidl
@@ -37,4 +37,8 @@
      * Two-sided RTT 11az non trigger based (non-TB) type.
      */
     TWO_SIDED_11AZ_NTB = 3,
+    /**
+     * Two-sided RTT 11az non trigger based (non-TB) secure type.
+     */
+    TWO_SIDED_11AZ_NTB_SECURE = 4,
 }
diff --git a/wifi/aidl/default/aidl_struct_util.cpp b/wifi/aidl/default/aidl_struct_util.cpp
index 0455be7..bf6c206 100644
--- a/wifi/aidl/default/aidl_struct_util.cpp
+++ b/wifi/aidl/default/aidl_struct_util.cpp
@@ -2478,6 +2478,8 @@
             return legacy_hal::RTT_TYPE_2_SIDED_11MC;
         case RttType::TWO_SIDED_11AZ_NTB:
             return legacy_hal::RTT_TYPE_2_SIDED_11AZ_NTB;
+        case RttType::TWO_SIDED_11AZ_NTB_SECURE:
+            return legacy_hal::RTT_TYPE_2_SIDED_11AZ_NTB_SECURE;
     };
     CHECK(false);
 }
@@ -2491,6 +2493,8 @@
             return RttType::TWO_SIDED_11MC;
         case legacy_hal::RTT_TYPE_2_SIDED_11AZ_NTB:
             return RttType::TWO_SIDED_11AZ_NTB;
+        case legacy_hal::RTT_TYPE_2_SIDED_11AZ_NTB_SECURE:
+            return RttType::TWO_SIDED_11AZ_NTB_SECURE;
     };
     CHECK(false) << "Unknown legacy type: " << type;
 }
@@ -2723,6 +2727,16 @@
             return RttStatus::NAN_RANGING_PROTOCOL_FAILURE;
         case legacy_hal::RTT_STATUS_NAN_RANGING_CONCURRENCY_NOT_SUPPORTED:
             return RttStatus::NAN_RANGING_CONCURRENCY_NOT_SUPPORTED;
+        case legacy_hal::RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_AKM:
+            return RttStatus::SECURE_RANGING_FAILURE_INVALID_AKM;
+        case legacy_hal::RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_CIPHER:
+            return RttStatus::SECURE_RANGING_FAILURE_INVALID_CIPHER;
+        case legacy_hal::RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_CONFIG:
+            return RttStatus::SECURE_RANGING_FAILURE_INVALID_CONFIG;
+        case legacy_hal::RTT_STATUS_SECURE_RANGING_FAILURE_REJECTED:
+            return RttStatus::SECURE_RANGING_FAILURE_REJECTED;
+        case legacy_hal::RTT_STATUS_SECURE_RANGING_FAILURE_UNKNOWN:
+            return RttStatus::SECURE_RANGING_FAILURE_UNKNOWN;
     };
     CHECK(false) << "Unknown legacy status: " << status;
 }
diff --git a/wifi/aidl/default/wifi_legacy_hal.h b/wifi/aidl/default/wifi_legacy_hal.h
index 3fd567b..aa563cb 100644
--- a/wifi/aidl/default/wifi_legacy_hal.h
+++ b/wifi/aidl/default/wifi_legacy_hal.h
@@ -212,10 +212,16 @@
 using ::RTT_STATUS_NAN_RANGING_CONCURRENCY_NOT_SUPPORTED;
 using ::RTT_STATUS_NAN_RANGING_PROTOCOL_FAILURE;
 using ::RTT_STATUS_NO_WIFI;
+using ::RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_AKM;
+using ::RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_CIPHER;
+using ::RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_CONFIG;
+using ::RTT_STATUS_SECURE_RANGING_FAILURE_REJECTED;
+using ::RTT_STATUS_SECURE_RANGING_FAILURE_UNKNOWN;
 using ::RTT_STATUS_SUCCESS;
 using ::RTT_TYPE_1_SIDED;
 using ::RTT_TYPE_2_SIDED;
 using ::RTT_TYPE_2_SIDED_11AZ_NTB;
+using ::RTT_TYPE_2_SIDED_11AZ_NTB_SECURE;
 using ::RTT_TYPE_2_SIDED_11MC;
 using ::RX_PKT_FATE_DRV_DROP_FILTER;
 using ::RX_PKT_FATE_DRV_DROP_INVALID;
diff --git a/wifi/legacy_headers/include/hardware_legacy/rtt.h b/wifi/legacy_headers/include/hardware_legacy/rtt.h
index 426abe0..631821d 100644
--- a/wifi/legacy_headers/include/hardware_legacy/rtt.h
+++ b/wifi/legacy_headers/include/hardware_legacy/rtt.h
@@ -7,24 +7,33 @@
 
 /* Ranging status */
 typedef enum {
-    RTT_STATUS_SUCCESS       = 0,
-    RTT_STATUS_FAILURE       = 1,           // general failure status
-    RTT_STATUS_FAIL_NO_RSP   = 2,           // target STA does not respond to request
-    RTT_STATUS_FAIL_REJECTED = 3,           // request rejected. Applies to 2-sided RTT only
-    RTT_STATUS_FAIL_NOT_SCHEDULED_YET  = 4,
-    RTT_STATUS_FAIL_TM_TIMEOUT         = 5, // timing measurement times out
-    RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6, // Target on different channel, cannot range
-    RTT_STATUS_FAIL_NO_CAPABILITY  = 7,     // ranging not supported
-    RTT_STATUS_ABORTED             = 8,     // request aborted for unknown reason
-    RTT_STATUS_FAIL_INVALID_TS     = 9,     // Invalid T1-T4 timestamp
-    RTT_STATUS_FAIL_PROTOCOL       = 10,    // 11mc protocol failed
-    RTT_STATUS_FAIL_SCHEDULE       = 11,    // request could not be scheduled
-    RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,    // responder cannot collaborate at time of request
-    RTT_STATUS_INVALID_REQ         = 13,    // bad request args
-    RTT_STATUS_NO_WIFI             = 14,    // WiFi not enabled
-    RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE = 15, // Responder overrides param info, cannot range with new params
-    RTT_STATUS_NAN_RANGING_PROTOCOL_FAILURE =16, //Negotiation failure
-    RTT_STATUS_NAN_RANGING_CONCURRENCY_NOT_SUPPORTED=17, //concurrency not supported (NDP+RTT)
+    RTT_STATUS_SUCCESS = 0,
+    RTT_STATUS_FAILURE = 1,        // general failure status
+    RTT_STATUS_FAIL_NO_RSP = 2,    // target STA does not respond to request
+    RTT_STATUS_FAIL_REJECTED = 3,  // request rejected. Applies to 2-sided RTT only
+    RTT_STATUS_FAIL_NOT_SCHEDULED_YET = 4,
+    RTT_STATUS_FAIL_TM_TIMEOUT = 5,          // timing measurement times out
+    RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL = 6,  // Target on different channel, cannot range
+    RTT_STATUS_FAIL_NO_CAPABILITY = 7,       // ranging not supported
+    RTT_STATUS_ABORTED = 8,                  // request aborted for unknown reason
+    RTT_STATUS_FAIL_INVALID_TS = 9,          // Invalid T1-T4 timestamp
+    RTT_STATUS_FAIL_PROTOCOL = 10,           // 11mc protocol failed
+    RTT_STATUS_FAIL_SCHEDULE = 11,           // request could not be scheduled
+    RTT_STATUS_FAIL_BUSY_TRY_LATER = 12,     // responder cannot collaborate at time of request
+    RTT_STATUS_INVALID_REQ = 13,             // bad request args
+    RTT_STATUS_NO_WIFI = 14,                 // WiFi not enabled
+    RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE =
+            15,  // Responder overrides param info, cannot range with new params
+    RTT_STATUS_NAN_RANGING_PROTOCOL_FAILURE = 16,           // Negotiation failure
+    RTT_STATUS_NAN_RANGING_CONCURRENCY_NOT_SUPPORTED = 17,  // concurrency not supported (NDP+RTT)
+    RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_AKM = 18,  // Secure Ranging failed due to invalid AKM
+                                                         // (Authentication and Key Management)
+    RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_CIPHER = 19,  // Secure Ranging failed due to invalid
+                                                            // Cipher
+    RTT_STATUS_SECURE_RANGING_FAILURE_INVALID_CONFIG = 20,  // Secure Ranging failed due to invalid
+                                                            // configuration
+    RTT_STATUS_SECURE_RANGING_FAILURE_REJECTED = 21,        // Secure ranging rejected by the AP.2
+    RTT_STATUS_SECURE_RANGING_FAILURE_UNKNOWN = 22,         // Secure ranging failure unknown
 } wifi_rtt_status;
 
 /* RTT peer type */
@@ -60,14 +69,57 @@
 
 /* RTT Type */
 typedef enum {
-    RTT_TYPE_1_SIDED          = 0x1,
+    RTT_TYPE_1_SIDED = 0x1,
     /* Deprecated. Use RTT_TYPE_2_SIDED_11MC instead. */
-    RTT_TYPE_2_SIDED          = 0x2,
-    RTT_TYPE_2_SIDED_11MC     = RTT_TYPE_2_SIDED,
+    RTT_TYPE_2_SIDED = 0x2,
+    RTT_TYPE_2_SIDED_11MC = RTT_TYPE_2_SIDED,
     RTT_TYPE_2_SIDED_11AZ_NTB = 0x3,
-
+    RTT_TYPE_2_SIDED_11AZ_NTB_SECURE = 0x4,
 } wifi_rtt_type;
 
+/* RTT AKM type */
+typedef enum {
+    WPA_KEY_MGMT_NONE = 0x0,
+    WPA_KEY_MGMT_PASN = 0x1,
+    WPA_KEY_MGMT_SAE = 0x2,
+    WPA_KEY_MGMT_EAP_FT_SHA256 = 0x4,
+    WPA_KEY_MGMT_FT_PSK_SHA256 = 0x8,
+    WPA_KEY_MGMT_EAP_FT_SHA384 = 0x10,
+    WPA_KEY_MGMT_FT_PSK_SHA384 = 0x20,
+    WPA_KEY_MGMT_EAP_FILS_SHA256 = 0x40,
+    WPA_KEY_MGMT_EAP_FILS_SHA384 = 0x80
+} wifi_rtt_akm;
+
+typedef enum {
+    WPA_CIPHER_NONE = 0x0,
+    WPA_CIPHER_CCMP_128 = 0x1,
+    WPA_CIPHER_CCMP_256 = 0x2,
+    WPA_CIPHER_GCMP_128 = 0x4,
+    WPA_CIPHER_GCMP_256 = 0x8,
+} wifi_rtt_cipher_suite;
+
+#define RTT_SECURITY_MAX_PASSPHRASE_LEN 63
+#define PMKID_LEN 16
+
+typedef struct {
+    wifi_rtt_akm base_akm;  // Base Authentication and Key Management (AKM) protocol used for PASN
+    wifi_rtt_cipher_suite pairwise_cipher_suite;  // Pairwise cipher suite used for the PTKSA
+                                                  // (Pairwise Transient Key Security Association)
+    u32 passphrase_len;
+    u8 passphrase[RTT_SECURITY_MAX_PASSPHRASE_LEN];  // Passphrase for the base AKM. This can be
+                                                     // empty based on the AKM type.
+    u32 pmkid_len;
+    u8 pmkid[PMKID_LEN];  // PMKID corresponding to the cached PMK from the base AKM. PMKID can be
+                          // null if no cached PMK is present.
+
+} wifi_rtt_pasn_config;
+
+typedef struct {
+    wifi_rtt_pasn_config pasn_config;
+    bool enable_secure_he_ltf;
+    bool enable_ranging_frame_protection;
+} wifi_rtt_secure_config;
+
 /* RTT configuration */
 typedef struct {
     mac_addr addr;                 // peer device mac address
@@ -127,6 +179,11 @@
                                   // units of 10 milliseconds
 } wifi_rtt_config_v3;
 
+typedef struct {
+    wifi_rtt_config_v3 rtt_config;
+    wifi_rtt_secure_config rtt_secure_config;
+} wifi_rtt_config_v4;
+
 /* RTT results */
 typedef struct {
     mac_addr addr;                // device mac address
@@ -197,6 +254,14 @@
   byte num_rx_sts;                 // Number of receive space-time streams used.
 } wifi_rtt_result_v3;
 
+typedef struct {
+    wifi_rtt_result_v3 rtt_result_v3;
+    bool is_ranging_protection_enabled;
+    bool is_secure_ltf_enabled;
+    wifi_rtt_akm base_akm;
+    wifi_rtt_cipher_suite cipher_suite;
+    int secure_he_ltf_protocol_version;
+} wifi_rtt_result_v4;
 
 /* RTT result callbacks */
 typedef struct {
@@ -234,6 +299,15 @@
                                wifi_rtt_result_v3 *rtt_result_v3[]);
 } wifi_rtt_event_handler_v3;
 
+/* RTT result v4 callback (secure ranging support) */
+typedef struct {
+    /*
+     * Called when vendor implementation supports sending RTT results version 4 (Added support for
+     * secure 11az ranging)
+     */
+    void (*on_rtt_results_v4)(wifi_request_id id, unsigned num_results,
+                              wifi_rtt_result_v4* rtt_result_v4[]);
+} wifi_rtt_event_handler_v4;
 
 /* v3 API to request RTT measurement(11az support).  */
 wifi_error wifi_rtt_range_request_v3(wifi_request_id id,
@@ -242,6 +316,11 @@
                                      wifi_rtt_config_v3 rtt_config_v3[],
                                      wifi_rtt_event_handler_v3 handler);
 
+/* v4 API to request RTT measurement(11az security support). */
+wifi_error wifi_rtt_range_request_v4(wifi_request_id id, wifi_interface_handle iface,
+                                     unsigned num_rtt_config, wifi_rtt_config_v4 rtt_config_v4[],
+                                     wifi_rtt_event_handler_v4 handler);
+
 /* API to cancel RTT measurements */
 wifi_error wifi_rtt_range_cancel(wifi_request_id id,  wifi_interface_handle iface,
         unsigned num_devices, mac_addr addr[]);
@@ -313,10 +392,26 @@
     byte ntb_responder_supported;   // if 11az non-TB responder is supported
 } wifi_rtt_capabilities_v3;
 
+/* RTT Capabilities v4 (11az secure support) */
+typedef struct {
+    wifi_rtt_capabilities_v3 rtt_capab_v3;
+    bool secure_ltf_supported;
+    bool ranging_fame_protection_supported;
+    wifi_rtt_akm supported_akms;  // Bitmap of wifi_rtt_akm values indicating the set of supported
+                                  // AKMs.
+    wifi_rtt_cipher_suite
+            supported_cipher_suites;  // Bitmap of wifi_rtt_cipher_suite values
+                                      // indicating the set of supported pairwise cipher suites.
+} wifi_rtt_capabilities_v4;
+
 /*  RTT capabilities v3 of the device (11az support) */
 wifi_error wifi_get_rtt_capabilities_v3(wifi_interface_handle iface,
                                         wifi_rtt_capabilities_v3 *capabilities);
 
+/*  RTT capabilities v4 of the device (11az secure support) */
+wifi_error wifi_get_rtt_capabilities_v4(wifi_interface_handle iface,
+                                        wifi_rtt_capabilities_v4* capabilities);
+
 /* debugging definitions */
 enum {
     RTT_DEBUG_DISABLE,
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/PmkSaCacheData.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/PmkSaCacheData.aidl
index c31b167..b1269ba 100644
--- a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/PmkSaCacheData.aidl
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/PmkSaCacheData.aidl
@@ -37,4 +37,5 @@
   byte[6] bssid;
   long expirationTimeInSec;
   byte[] serializedEntry;
+  @nullable byte[] pmkid;
 }
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/PmkSaCacheData.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/PmkSaCacheData.aidl
index e0f1d31..4071179 100644
--- a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/PmkSaCacheData.aidl
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/PmkSaCacheData.aidl
@@ -34,4 +34,9 @@
      * The content is opaque for the framework and depends on the native implementation.
      */
     byte[] serializedEntry;
+    /**
+     * Pairwise Master Key Identifier (PMKID), which is a unique key identifier used by AP to
+     * track PMK used (Pairwise Master Key) for a station.
+     */
+    @nullable byte[] pmkid;
 }