RE: psa_open_key failed PSA_ERROR_DOES_NOT_EXIST (-134) on nRF9151 with NCS v3.2.2 and MCUboot

luqman — Fri, 03 Apr 2026 11:46:06 GMT

Hi,

Is there any update on my issue?

Thanks

RE: psa_open_key failed PSA_ERROR_DOES_NOT_EXIST (-134) on nRF9151 with NCS v3.2.2 and MCUboot

Carl Richard — Tue, 31 Mar 2026 15:34:02 GMT

Hi!

Vidar is out of office this week and will follow up on this when he's back.

I will have a look tomorrow myself to see if I can provide any insight.

Best regards,
Carl Richard

RE: psa_open_key failed PSA_ERROR_DOES_NOT_EXIST (-134) on nRF9151 with NCS v3.2.2 and MCUboot

luqman — Sun, 29 Mar 2026 12:56:08 GMT

Hi Vidar,

Thank you for the suggestion. I tested the softsim_static_profile sample and it works correctly, the device connects to the network successfully.

*** Booting nRF Connect SDK v3.2.2 ***
[00:00:00.333,038] <inf> softsim_sample: SoftSIM sample started.
[00:00:00.661,956] <inf> softsim_sample: Waiting for LTE connect event.
+CEREG: 2,"2F12","01F80701",7
[00:00:08.241,210] <inf> softsim_sample: LTE cell changed: Cell ID: 33031937, Tracking area: 12050
+CSCON: 1
[00:00:08.295,562] <inf> softsim_sample: RRC mode: Connected
+CEREG: 2,"B07D","00D69C03",7
[00:00:08.801,300] <inf> softsim_sample: LTE cell changed: Cell ID: 14064643, Tracking area: 45181
+CSCON: 1
[00:00:08.849,609] <inf> softsim_sample: RRC mode: Connected

However, when integrating SoftSIM into my full application (TF-M + MCUboot + LwM2M on nRF9151), psa_open_key returns -134 during network authentication.

Root cause found: After investigation I traced the issue to CRYPTO_STORAGE_DISABLED=ON in TF-M's CMake build, which is set when CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C is not enabled. This results in tfm_config.h having.

CRYPTO_KEY_MODULE_ENABLED 0
CRYPTO_CIPHER_MODULE_ENABLED 0
CRYPTO_MAC_MODULE_ENABLED 0

Key difference between working sample and my project:

Working sample: no MCUboot, CONFIG_PM_PARTITION_SIZE_TFM=0x10000
My project: MCUboot enabled + TF-M + LwM2M + SoftSIM

hat I've tried:

CONFIG_TFM_PARTITION_PROTECTED_STORAGE=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=n
CONFIG_TFM_PARTITION_INTERNAL_TRUSTED_STORAGE=y
CONFIG_MBEDTLS_PSA_CRYPTO_STORAGE_C=y
CONFIG_NRF_SECURITY=y
CONFIG_PSA_WANT_KEY_TYPE_AES=y
CONFIG_PSA_WANT_ALG_CBC_NO_PADDING=y
CONFIG_PSA_WANT_ALG_CMAC=y

But TF-M CMakeCache still shows TFM_PARTITION_INTERNAL_TRUSTED_STORAGE:BOOL=OFF.

[00:00:00.262,939] <err> softsim_crypto: Failed to open key 10, error: -134
[00:00:00.264,373] <inf> softsim: Provisioning static profile
[00:00:00.264,617] <err> softsim_crypto: Failed to open a persistent key, ERR: -134
[00:00:00.264,709] <err> softsim_crypto: Failed to open a persistent key, ERR: -134
[00:00:00.264,801] <err> softsim_crypto: Failed to open a persistent key, ERR: -134
[00:00:00.264,801] <inf> softsim: SoftSIM keys written to KMU
[00:00:09.108,764] <err> softsim_crypto: ss_utils_aes_decrypt: psa_open_key failed! (Error: -134)
[00:00:09.539,489] <wrn> lte_lc: Registration rejected, EMM cause: 17

Also, i remove the private SIM configuration due to public, so you may need your own

Full reproduction code available here: https://github.com/luqman8230339900/nrf9151-softsim-tfm-mcuboot-issue

Best regards:

Luqman

RE: psa_open_key failed PSA_ERROR_DOES_NOT_EXIST (-134) on nRF9151 with NCS v3.2.2 and MCUboot

Vidar Berg — Tue, 24 Mar 2026 10:29:03 GMT

Update: I didn't anyone who immediately recognised the problem you are observing. However, when looking at the logs again now I see that the actual error is PSA_ERROR_NOT_SUPPORTED (-134), which indicates that there is a problem with the crypto configuration in your project. Have you tried the provided softsim_static_profile sample provided in this repo to see if it results in the same errors?

Best regards,

Vidar

RE: psa_open_key failed PSA_ERROR_DOES_NOT_EXIST (-134) on nRF9151 with NCS v3.2.2 and MCUboot

Vidar Berg — Mon, 23 Mar 2026 14:14:17 GMT

Hello,

I need to check with my coworkers who are familiar with this softsim solution and get back to you. Expect to have an answer by tomorrow.

Best regards,

vidar