diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index ba688bc..dce8e09 100755
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -1345,6 +1345,8 @@
     slot = &global_data.key_slots[key];
     if( slot->type == PSA_KEY_TYPE_NONE )
         return( PSA_ERROR_EMPTY_SLOT );
+    if (!(slot->policy.usage & PSA_KEY_USAGE_VERIFY))
+        return(PSA_ERROR_NOT_PERMITTED);
 
  #if defined(MBEDTLS_RSA_C)
     if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
@@ -1431,6 +1433,8 @@
         return( PSA_ERROR_EMPTY_SLOT );
     if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
         return( PSA_ERROR_INVALID_ARGUMENT );
+    if (!(slot->policy.usage & PSA_KEY_USAGE_ENCRYPT))
+        return(PSA_ERROR_NOT_PERMITTED);
 
 
 #if defined(MBEDTLS_RSA_C)
@@ -1505,6 +1509,8 @@
         return( PSA_ERROR_EMPTY_SLOT );
     if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
         return( PSA_ERROR_INVALID_ARGUMENT );
+    if (!(slot->policy.usage & PSA_KEY_USAGE_DECRYPT))
+        return(PSA_ERROR_NOT_PERMITTED);
 
 #if defined(MBEDTLS_RSA_C)
     if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )