Can I use an AES key stored in NVM as the source (IKM) for PBKDF2 without exposing it as plaintext?

[sochoi]

Hello,

In my S32K3 project, I need to use an AES key stored in NVM as the input key material (IKM) for the HSE PBKDF2 service. 
AES Key usage was possible in HKDF.

However, according to the HSE Service API Reference Manual:
PBKDF2 requires the srcKeyHandle to be of type HSE_KEY_TYPE_SHARED_SECRET.
HSE_KEY_TYPE_SHARED_SECRET keys are only supported in RAM catalogs, not in NVM.

That means my AES key in NVM cannot be directly used as the PBKDF2 input.
To avoid exposing the key in plaintext, I tried:
Exporting the AES key as an enc&auth container,
Importing it into a RAM key slot,
Attempting to convert or copy it to a Shared-Secret slot (so it can be used as PBKDF2 input).

But the documentation does not describe any service to convert or copy an AES key to a Shared-Secret key type.
Key Derive – Copy Key and Import Key both require the same key type.

My question:
Is there any supported method to make an AES key (stored in NVM) usable as a PBKDF2 source without revealing it as plaintext?

[sochoi]

Thank you.
I appreciate your support, and I will wait for your update.

[davidtosenovjan]

It should be possible. I am forwarding an answer as I have obtained it:

"You can do this by specifying a key handle to the key derivation service of the HSE. That key handle can point to an AES key that has been provisioned to secure NVM.

Take a look at the HSE_PBKDF2Req_Example(void) function in the HSE demo app. for the source key, instead of specifying a RAM key handle, you can instead refer to the handle of an NVM key."

[davidtosenovjan]

In my opinion there is no service for such operation but let me discuss it with HSE experts. I will let you know.