diff --git a/wifi/1.0/default/hidl_struct_util.cpp b/wifi/1.0/default/hidl_struct_util.cpp
index c7b8c41..c498206 100644
--- a/wifi/1.0/default/hidl_struct_util.cpp
+++ b/wifi/1.0/default/hidl_struct_util.cpp
@@ -950,7 +950,7 @@
         hidl_request.baseConfigs.disableMatchExpirationIndication ? 0x2 : 0x0;
   legacy_request->recv_indication_cfg |=
         hidl_request.baseConfigs.disableFollowupReceivedIndication ? 0x4 : 0x0;
-  legacy_request->cipher_type = hidl_request.baseConfigs.supportedCipherTypes;
+  legacy_request->cipher_type = (unsigned int) hidl_request.baseConfigs.cipherType;
   legacy_request->pmk_len = hidl_request.baseConfigs.pmk.size();
   if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
     LOG(ERROR) << "convertHidlNanPublishRequestToLegacy: pmk_len too large";
@@ -1041,7 +1041,7 @@
         hidl_request.baseConfigs.disableMatchExpirationIndication ? 0x2 : 0x0;
   legacy_request->recv_indication_cfg |=
         hidl_request.baseConfigs.disableFollowupReceivedIndication ? 0x4 : 0x0;
-  legacy_request->cipher_type = hidl_request.baseConfigs.supportedCipherTypes;
+  legacy_request->cipher_type = (unsigned int) hidl_request.baseConfigs.cipherType;
   legacy_request->pmk_len = hidl_request.baseConfigs.pmk.size();
   if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
     LOG(ERROR) << "convertHidlNanSubscribeRequestToLegacy: pmk_len too large";
@@ -1230,14 +1230,15 @@
         legacy_hal::NAN_DP_CONFIG_SECURITY : legacy_hal::NAN_DP_CONFIG_NO_SECURITY;
   legacy_request->app_info.ndp_app_info_len = hidl_request.appInfo.size();
   if (legacy_request->app_info.ndp_app_info_len > NAN_DP_MAX_APP_INFO_LEN) {
-    LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: ndp_app_info_len to large";
+    LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: ndp_app_info_len too large";
     return false;
   }
   memcpy(legacy_request->app_info.ndp_app_info, hidl_request.appInfo.data(),
         legacy_request->app_info.ndp_app_info_len);
-  legacy_request->cipher_type = hidl_request.supportedCipherTypes;
+  legacy_request->cipher_type = (unsigned int) hidl_request.cipherType;
   legacy_request->pmk_len = hidl_request.pmk.size();
   if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
+    LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: pmk_len too large";
     return false;
   }
   memcpy(legacy_request->pmk, hidl_request.pmk.data(), legacy_request->pmk_len);
@@ -1267,7 +1268,7 @@
   }
   memcpy(legacy_request->app_info.ndp_app_info, hidl_request.appInfo.data(),
         legacy_request->app_info.ndp_app_info_len);
-  legacy_request->cipher_type = hidl_request.supportedCipherTypes;
+  legacy_request->cipher_type = (unsigned int) hidl_request.cipherType;
   legacy_request->pmk_len = hidl_request.pmk.size();
   if (legacy_request->pmk_len > NAN_PMK_INFO_LEN) {
     LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: pmk_len too large";
@@ -1337,7 +1338,7 @@
   hidl_ind->matchOccuredInBeaconFlag = legacy_ind.match_occured_flag == 1;
   hidl_ind->outOfResourceFlag = legacy_ind.out_of_resource_flag == 1;
   hidl_ind->rssiValue = legacy_ind.rssi_value;
-  hidl_ind->peerSupportedCipherTypes = legacy_ind.peer_cipher_type;
+  hidl_ind->peerCipherType = (NanCipherSuiteType) legacy_ind.peer_cipher_type;
   hidl_ind->peerRequiresSecurityEnabledInNdp =
         legacy_ind.peer_sdea_params.security_cfg == legacy_hal::NAN_DP_CONFIG_SECURITY;
   hidl_ind->peerRequiresRanging =
diff --git a/wifi/1.0/types.hal b/wifi/1.0/types.hal
index a843ce8..5ffb55c 100644
--- a/wifi/1.0/types.hal
+++ b/wifi/1.0/types.hal
@@ -877,6 +877,7 @@
  * Cipher suite flags.
  */
 enum NanCipherSuiteType : uint32_t {
+  NONE = 0, // No (open) security
   SHARED_KEY_128_MASK = 1 << 0, // NCS-SK-128
   SHARED_KEY_256_MASK = 1 << 1  // NCS-SK-256
 };
@@ -991,13 +992,15 @@
    */
   bool disableFollowupReceivedIndication;
   /**
-   * Cipher types supported in data-paths constructed in the context of this discovery session.
+   * Cipher type for data-paths constructed in the context of this discovery session. Must be
+   * specified as |NanCipherSuiteType.NONE| if no |pmk| is provided.
    */
-  bitfield<NanCipherSuiteType> supportedCipherTypes;
+  NanCipherSuiteType cipherType;
   /**
    * Optional Pairwise Master Key (PMK) for data-paths constructed in the context of this discovery
    * session. A PMK can also be provided during the actual construction of the data-path (which
-   * allows for unique PMKs for each data-path).
+   * allows for unique PMKs for each data-path). The |cipherType| must be specified if a PMK is
+   * provided.
    * Max length: 32
    * Ref: IEEE 802.11i
    */
@@ -1199,11 +1202,13 @@
    */
   vec<uint8_t> appInfo;
   /**
-   * Cipher types supported in data-paths constructed in the context of this discovery session.
+   * Cipher type for the data-path being requested. Must be specified as |NanCipherSuiteType.NONE|
+   * if no |pmk| is provided.
    */
-  bitfield<NanCipherSuiteType> supportedCipherTypes;
+  NanCipherSuiteType cipherType;
   /**
    * Pairwise Master Key (PMK) for the data-path being requested (if |securityRequired| is true).
+   * The |cipherType| must be specified if a PMK is provided.
    * Max length: 32
    * Ref: IEEE 802.11i
    */
@@ -1243,11 +1248,13 @@
    */
   vec<uint8_t> appInfo;
   /**
-   * Cipher types supported in data-paths constructed in the context of this discovery session.
+   * Cipher type for the data-path being negotiated. Must be specified as |NanCipherSuiteType.NONE|
+   * if no |pmk| is provided.
    */
-  bitfield<NanCipherSuiteType> supportedCipherTypes;
+  NanCipherSuiteType cipherType;
   /**
    * Pairwise Master Key (PMK) for the data-path being negotiated (if |securityRequired| is true).
+   * The |cipherType| must be specified if a PMK is provided.
    * Max length: 32
    */
   vec<uint8_t> pmk;
@@ -1374,13 +1381,14 @@
    */
   uint8_t rssiValue;
   /**
-   * Cipher types supported by the peer for data-paths constructed in the context of this discovery
-   * session.
+   * Cipher type for data-paths constructed in the context of this discovery session. Valid if
+   * |peerRequiresSecurityEnabledInNdp| is true.
    */
-  bitfield<NanCipherSuiteType> peerSupportedCipherTypes;
+  NanCipherSuiteType peerCipherType;
   /**
    * Indicates whether or not the peer requires security enabled in any data-path (NDP) constructed
-   * in the context of this discovery session.
+   * in the context of this discovery session. The |cipherType| specifies the cipher type for such
+   * data-paths.
    * NAN Spec: Service Discovery Extension Attribute (SDEA) / Control / Security Required
    */
   bool peerRequiresSecurityEnabledInNdp;