diff --git a/src/hsm/cmd_cipher_sym.c b/src/hsm/cmd_cipher_sym.c
index 03023da..294fe73 100644
--- a/src/hsm/cmd_cipher_sym.c
+++ b/src/hsm/cmd_cipher_sym.c
@@ -167,6 +167,9 @@ int cmd_cipher_sym(void) {
         if (!ef) {
             return SW_FILE_NOT_FOUND();
         }
+        if (get_key_counter(ef) == 0) {
+            return SW_FILE_FULL();
+        }
         if (key_has_purpose(ef, algo) == false) {
             return SW_CONDITIONS_NOT_SATISFIED();
         }
@@ -605,5 +608,8 @@ int cmd_cipher_sym(void) {
         mbedtls_platform_zeroize(kdata, sizeof(kdata));
         return SW_WRONG_P1P2();
     }
+    if (ef) {
+        decrement_key_counter(ef);
+    }
     return SW_OK();
 }
diff --git a/src/hsm/cmd_decrypt_asym.c b/src/hsm/cmd_decrypt_asym.c
index c9c5094..d61b911 100644
--- a/src/hsm/cmd_decrypt_asym.c
+++ b/src/hsm/cmd_decrypt_asym.c
@@ -178,6 +178,7 @@ int cmd_decrypt_asym(void) {
                             return SW_EXEC_ERROR();
                         }
                         mbedtls_platform_zeroize(res_APDU, 32);
+                        decrement_key_counter(ef);
                         return SW_OK();
                     }
                 }