From 01d93e372cfa00a00df6611478372ba8b3db6d70 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Tue, 29 Sep 2026 07:45:59 +0200
Subject: [PATCH] Correct Basic256Sha256 security-level ranking (#4568)

# Description

`Aes128_Sha256_RsaOaep` was ranked above `Basic256Sha256` despite its
weaker AES-128 symmetric encryption. The calculated levels are swapped
to reflect their relative strength.

- **Security-level ranking**
  - `Aes128_Sha256_RsaOaep`: `6`
  - `Basic256Sha256`: `8`

```csharp
case SecurityPolicies.Basic256Sha256:
    result = 8;
    break;
case SecurityPolicies.Aes128_Sha256_RsaOaep:
    result = 6;
    break;
```

- **Regression coverage**
- Updates the policy-ordering test to assert the corrected relationship.

## Related Issues

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [ ] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes #4560

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
---
 src/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs         | 4 ++--
 .../Schema/SecuredApplicationHelpersTests.cs                | 6 +++---
 .../Opc.Ua.Subscriptions.Classic.Tests/SubscriptionTest.cs  | 6 +++++-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs b/src/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs
index 21aa8f0c68..2807bf4497 100644
--- a/src/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs
+++ b/src/Opc.Ua.Core/Schema/SecuredApplicationHelpers.cs
@@ -393,10 +393,10 @@ namespace Opc.Ua.Security
                     logger.SecuredApplicationHelpersLogMessage3(policyUri);
                     result = 4;
                     break;
-                case SecurityPolicies.Basic256Sha256:
+                case SecurityPolicies.Aes128_Sha256_RsaOaep:
                     result = 6;
                     break;
-                case SecurityPolicies.Aes128_Sha256_RsaOaep:
+                case SecurityPolicies.Basic256Sha256:
                     result = 8;
                     break;
                 case SecurityPolicies.Aes256_Sha256_RsaPss:
diff --git a/tests/Opc.Ua.Core.Tests/Schema/SecuredApplicationHelpersTests.cs b/tests/Opc.Ua.Core.Tests/Schema/SecuredApplicationHelpersTests.cs
index 42389ff8cc..d67eff43c9 100644
--- a/tests/Opc.Ua.Core.Tests/Schema/SecuredApplicationHelpersTests.cs
+++ b/tests/Opc.Ua.Core.Tests/Schema/SecuredApplicationHelpersTests.cs
@@ -94,15 +94,15 @@ namespace Opc.Ua.Core.Tests.Schema
             Assert.That(
                 SecuredApplication.CalculateSecurityLevel(
                     MessageSecurityMode.Sign,
-                    SecurityPolicies.Basic256Sha256, logger),
+                    SecurityPolicies.Aes128_Sha256_RsaOaep, logger),
                 Is.LessThan(SecuredApplication.CalculateSecurityLevel(
                     MessageSecurityMode.Sign,
-                    SecurityPolicies.Aes128_Sha256_RsaOaep, logger)));
+                    SecurityPolicies.Basic256Sha256, logger)));
 
             Assert.That(
                 SecuredApplication.CalculateSecurityLevel(
                     MessageSecurityMode.Sign,
-                    SecurityPolicies.Aes128_Sha256_RsaOaep,
+                    SecurityPolicies.Basic256Sha256,
                     logger
                 ),
                 Is.LessThan(SecuredApplication.CalculateSecurityLevel(
diff --git a/tests/Opc.Ua.Subscriptions.Classic.Tests/SubscriptionTest.cs b/tests/Opc.Ua.Subscriptions.Classic.Tests/SubscriptionTest.cs
index e6ed7974ab..11be6f2052 100644
--- a/tests/Opc.Ua.Subscriptions.Classic.Tests/SubscriptionTest.cs
+++ b/tests/Opc.Ua.Subscriptions.Classic.Tests/SubscriptionTest.cs
@@ -450,6 +450,8 @@ namespace Opc.Ua.Subscriptions.Classic.Tests
             const int monitoredItemsPerSubscription = 50;
             const int subscriptions = 50;
             const int maxServerPublishRequest = 20;
+            // Server revises the requested publishing interval of 0 to 100 ms
+            const int samplingInterval = 100;
 
             for (int i = 0; i < subscriptions; i++)
             {
@@ -473,7 +475,9 @@ namespace Opc.Ua.Subscriptions.Classic.Tests
                         new TestableMonitoredItem(subscription.DefaultItem)
                         {
                             StartNodeId = nextNode,
-                            SamplingInterval = 0
+                            // Sample at the revised publishing interval to keep
+                            // the server load of 2500 items bounded on CI hosts
+                            SamplingInterval = samplingInterval
                         });
                 }
                 var dict = list.ToDictionary(item => item.ClientHandle, _ => DateTime.MinValue);