diff --git a/tests/hwsim/test_ap_ciphers.py b/tests/hwsim/test_ap_ciphers.py
new file mode 100644
index 000000000..989fe1ff4
--- /dev/null
+++ b/tests/hwsim/test_ap_ciphers.py
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+#
+# Cipher suite tests
+# Copyright (c) 2013, Jouni Malinen <j@w1.fi>
+#
+# This software may be distributed under the terms of the BSD license.
+# See README for more details.
+
+import time
+import subprocess
+import logging
+logger = logging.getLogger()
+
+import hwsim_utils
+import hostapd
+
+def check_cipher(dev, ap, cipher):
+    if cipher not in dev.get_capability("pairwise"):
+        return "skip"
+    params = { "ssid": "test-wpa2-psk",
+               "wpa_passphrase": "12345678",
+               "wpa": "2",
+               "wpa_key_mgmt": "WPA-PSK",
+               "rsn_pairwise": cipher }
+    hostapd.add_ap(ap['ifname'], params)
+    dev.connect("test-wpa2-psk", psk="12345678",
+                pairwise=cipher, group=cipher)
+    hwsim_utils.test_connectivity(dev.ifname, ap['ifname'])
+
+def test_ap_cipher_tkip(dev, apdev):
+    """WPA2-PSK/TKIP connection"""
+    check_cipher(dev[0], apdev[0], "TKIP")
+
+def test_ap_cipher_ccmp(dev, apdev):
+    """WPA2-PSK/CCMP connection"""
+    check_cipher(dev[0], apdev[0], "CCMP")
+
+def test_ap_cipher_gcmp(dev, apdev):
+    """WPA2-PSK/GCMP connection"""
+    check_cipher(dev[0], apdev[0], "GCMP")
+
+def test_ap_cipher_ccmp_256(dev, apdev):
+    """WPA2-PSK/CCMP-256 connection"""
+    check_cipher(dev[0], apdev[0], "CCMP-256")
+
+def test_ap_cipher_gcmp_256(dev, apdev):
+    """WPA2-PSK/GCMP-256 connection"""
+    check_cipher(dev[0], apdev[0], "GCMP-256")
diff --git a/tests/hwsim/wpasupplicant.py b/tests/hwsim/wpasupplicant.py
index 8c449787f..b344b36f8 100644
--- a/tests/hwsim/wpasupplicant.py
+++ b/tests/hwsim/wpasupplicant.py
@@ -629,3 +629,9 @@ class WpaSupplicant:
                 return
             time.sleep(0.5)
         raise Exception("Timeout while waiting for COMPLETED state")
+
+    def get_capability(self, field):
+        res = self.request("GET_CAPABILITY " + field)
+        if "FAIL" in res:
+            return None
+        return res.split(' ')