bt_gatt: Unable to import the key for AES CMAC -141

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Mon, 16 Feb 2026 16:05:27 GMT

[quote user="kubavit123"]I have confirmed this fix was introduced in NCS v3.1.1.[/quote]

Your issue is fixed by PR 3218, which has been committed to NCS v3.1.1.

[quote user="kubavit123"]NCSDK-31487: Improper reuse of dynamic GATT service handles (known issues of NCS) ?
docs.nordicsemi.com/.../known_issues.html[/quote]

This fixed as the Workaround.

RE: bt_gatt: Unable to import the key for AES CMAC -141

jwitowski — Mon, 16 Feb 2026 14:25:02 GMT

Do you have any estimation already in which release it's going to be fixed ?

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Mon, 16 Feb 2026 14:19:16 GMT

Your issue is more related to the crypto backend.

RE: bt_gatt: Unable to import the key for AES CMAC -141

jwitowski — Mon, 16 Feb 2026 09:17:03 GMT

I have confirmed this fix was introduced in NCS v3.1.1.

I have one additional question. Isn't it also related to:
NCSDK-31487: Improper reuse of dynamic GATT service handles (known issues of NCS) ?
docs.nordicsemi.com/.../known_issues.html

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Thu, 04 Sep 2025 12:53:50 GMT

Thanks for the update. 🙂

RE: bt_gatt: Unable to import the key for AES CMAC -141

jwitowski — Thu, 04 Sep 2025 09:28:54 GMT

Thank you for the support. I have tested it and the bug doesn't exist anymore :)

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Wed, 03 Sep 2025 14:05:19 GMT

yes.

RE: bt_gatt: Unable to import the key for AES CMAC -141

jwitowski — Wed, 03 Sep 2025 13:47:21 GMT

Will test it tomorrow and let you know about the results. BTW, will it be a part of NCS v3.1.1 release ?

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Mon, 25 Aug 2025 17:14:55 GMT

Here is the PR https://github.com/nrfconnect/sdk-zephyr/pull/3218.

RE: bt_gatt: Unable to import the key for AES CMAC -141

jwitowski — Mon, 25 Aug 2025 10:54:16 GMT

Thank you, any updates ?

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Tue, 19 Aug 2025 13:08:33 GMT

Thanks for the testing. I have reported to the internal team to investigate. I will update if we have any way to fix it.

RE: bt_gatt: Unable to import the key for AES CMAC -141

jwitowski — Mon, 18 Aug 2025 14:24:53 GMT

I have changed it's value from 512 to 4096 and the difference is it reproduces now after more bt_gatt_service_register() and bt_gatt_service_unregister() calls. So for me it still looks like some memory leakage.

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Mon, 18 Aug 2025 13:27:35 GMT

Hi,

Seems like lack of mbedtls heap. Please increase the CONFIG_MBEDTLS_HEAP_SIZE value.

See https://github.com/nrfconnect/sdk-mbedtls/blob/v3.6.3-ncs1/include/psa/crypto_values.h#L143

-Amanda H.

RE: bt_gatt: Unable to import the key for AES CMAC -141

Amanda Hsieh — Fri, 15 Aug 2025 19:52:43 GMT

Hi,

I am working on your case, and will update next week.

Regards,
Amanda H.

RE: bt_gatt: Unable to import the key for AES CMAC -141

jwitowski — Fri, 15 Aug 2025 09:19:00 GMT

psa_crypto.c modifications:

diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 301eed0..d9421c1 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -37,6 +37,8 @@
 #include "mbedtls/constant_time.h"
 #include "mbedtls/cipher.h"  // mbedtls_operation_t

+#include <zephyr/logging/log.h>
+LOG_MODULE_REGISTER(psa_crypto_srvc);

 #if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER)
 #include "tfm_builtin_key_loader.h"
@@ -283,9 +285,37 @@ MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
     return PSA_ERROR_INVALID_ARGUMENT;
 }

+// ...existing code...
+static atomic_t g_psa_key_bytes_current;
+static atomic_t g_psa_key_bytes_peak;
+
+static void psa_debug_acc_add(size_t sz)
+{
+    atomic_add(&g_psa_key_bytes_current, sz);
+    size_t cur = atomic_get(&g_psa_key_bytes_current);
+    size_t peak = atomic_get(&g_psa_key_bytes_peak);
+    if (cur > peak) {
+        atomic_set(&g_psa_key_bytes_peak, cur);
+    }
+}
+
+static void psa_debug_acc_sub(size_t sz)
+{
+    atomic_sub(&g_psa_key_bytes_current, sz);
+}
+
+void psa_crypto_debug_dump(void)
+{
+    size_t cur = atomic_get(&g_psa_key_bytes_current);
+    size_t peak = atomic_get(&g_psa_key_bytes_peak);
+    LOG_ERR("=== PSA KEYS: tracked_cur=%zu peak=%zu", cur, peak);
+}
+// ...existing code...
+
 psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
                                          size_t buffer_length)
 {
+    psa_crypto_debug_dump();
 #if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
     if (buffer_length > ((size_t) MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE)) {
         return PSA_ERROR_NOT_SUPPORTED;
@@ -297,8 +327,10 @@ psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,

     slot->key.data = mbedtls_calloc(1, buffer_length);
     if (slot->key.data == NULL) {
+        LOG_ERR("=== mbedtls_calloc failed ===");
         return PSA_ERROR_INSUFFICIENT_MEMORY;
     }
+    psa_debug_acc_add(buffer_length);
 #endif

     slot->key.bytes = buffer_length;
@@ -729,12 +761,14 @@ static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(

 psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
 {
+    LOG_ERR("=== REMOVE KEY DATA ===");
 #if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
     if (slot->key.bytes > 0) {
         mbedtls_platform_zeroize(slot->key.data, MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE);
     }
 #else
     if (slot->key.data != NULL) {
+        psa_debug_acc_sub(slot->key.bytes);
         mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes);
     }

@@ -1541,6 +1575,7 @@ psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
                             size_t data_length,
                             mbedtls_svc_key_id_t *key)
 {
+    LOG_ERR("==== IMPORT KEY ====");
     psa_status_t status;
     psa_key_slot_t *slot = NULL;
     psa_se_drv_table_entry_t *driver = NULL;
@@ -1598,6 +1633,7 @@ psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
         }
         status = psa_allocate_buffer_to_slot(slot, storage_size);
         if (status != PSA_SUCCESS) {
+            LOG_ERR("=== PSA allocate buffer failed ===");
             goto exit;
         }
     }