BLE_SPP_SERVER_DEMO how to add AES128

[MichaelS]

I am using an ESP32-S3 on IDF ver 5.5.0
I am in the early stages of developing a BLE Server for message data transfer.
I have been playing with the Example app ble_spp_server_demo and have tested this successfully with the iPhone nRF Connect app and it seems to meet my requirements.
I need to add AES128 encryption using CBC mode but am struggling to find the matching functions for the ble_spp_server_demo.
The application requirements provide an independent secure mechanism to get the encryption keys. I just need to know how to use them for encrypting data when calling esp_ble_gatts_send_indicate and decrypt data in the gatts_profile_event_handler ESP_GATTS_WRITE_EVT event.

Can anyone give me some direction with this or point me to an example application