* Without a valid 5G NAS security context:
  * Send REGISTRATION REQUEST with cleartext IEs only.
  * After activating a security context via Security Mode Control:
    wrap the entire REGISTRATION REQUEST (with both non-cleartext and cleartext)
    in a NAS message container IE, include it in SECURITY MODE COMPLETE

* With a valid 5G NAS security context:
  * If non-cleartext IEs are needed, wrap the entire message in a NAS message container IE and cipher it.
  * If only cleartext IEs are needed, send the message directly without the NAS message container IE.