diff --git a/tests/scripts/thread-cert/Cert_8_1_01_Commissioning.py b/tests/scripts/thread-cert/Cert_8_1_01_Commissioning.py
index 447ebbbae..73cd4d926 100755
--- a/tests/scripts/thread-cert/Cert_8_1_01_Commissioning.py
+++ b/tests/scripts/thread-cert/Cert_8_1_01_Commissioning.py
@@ -65,12 +65,12 @@ class Cert_8_1_01_Commissioning(thread_cert.TestCase):
     TOPOLOGY = {
         COMMISSIONER: {
             'name': 'COMMISSIONER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         JOINER: {
             'name': 'JOINER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/Cert_8_1_02_Commissioning.py b/tests/scripts/thread-cert/Cert_8_1_02_Commissioning.py
index c28fca899..0b80d8313 100755
--- a/tests/scripts/thread-cert/Cert_8_1_02_Commissioning.py
+++ b/tests/scripts/thread-cert/Cert_8_1_02_Commissioning.py
@@ -44,12 +44,12 @@ class Cert_8_1_02_Commissioning(thread_cert.TestCase):
     TOPOLOGY = {
         COMMISSIONER: {
             'name': 'COMMISSIONER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         JOINER: {
             'name': 'JOINER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/Cert_8_1_06_Commissioning.py b/tests/scripts/thread-cert/Cert_8_1_06_Commissioning.py
index bf167aef3..0b2326a00 100755
--- a/tests/scripts/thread-cert/Cert_8_1_06_Commissioning.py
+++ b/tests/scripts/thread-cert/Cert_8_1_06_Commissioning.py
@@ -65,11 +65,11 @@ class Cert_8_1_06_Commissioning(thread_cert.TestCase):
     TOPOLOGY = {
         COMMISSIONER: {
             'name': 'COMMISSIONER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         JOINER: {
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/Cert_8_2_01_JoinerRouter.py b/tests/scripts/thread-cert/Cert_8_2_01_JoinerRouter.py
index c00df8f0d..7284d8bf8 100755
--- a/tests/scripts/thread-cert/Cert_8_2_01_JoinerRouter.py
+++ b/tests/scripts/thread-cert/Cert_8_2_01_JoinerRouter.py
@@ -45,17 +45,17 @@ class Cert_8_2_01_JoinerRouter(thread_cert.TestCase):
     TOPOLOGY = {
         COMMISSIONER: {
             'name': 'COMMISSIONER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         JOINER_ROUTER: {
             'name': 'JOINER_ROUTER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
         JOINER: {
             'name': 'JOINER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/Cert_8_2_02_JoinerRouter.py b/tests/scripts/thread-cert/Cert_8_2_02_JoinerRouter.py
index c51a63093..f4f3639e9 100755
--- a/tests/scripts/thread-cert/Cert_8_2_02_JoinerRouter.py
+++ b/tests/scripts/thread-cert/Cert_8_2_02_JoinerRouter.py
@@ -45,17 +45,17 @@ class Cert_8_2_02_JoinerRouter(thread_cert.TestCase):
     TOPOLOGY = {
         COMMISSIONER: {
             'name': 'COMMISSIONER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         JOINER_ROUTER: {
             'name': 'JOINER_ROUTER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
         JOINER: {
             'name': 'JOINER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/Cert_8_2_05_JoinerRouter.py b/tests/scripts/thread-cert/Cert_8_2_05_JoinerRouter.py
index f4c03773f..83fd26f71 100755
--- a/tests/scripts/thread-cert/Cert_8_2_05_JoinerRouter.py
+++ b/tests/scripts/thread-cert/Cert_8_2_05_JoinerRouter.py
@@ -71,17 +71,17 @@ class Cert_8_2_05_JoinerRouter(thread_cert.TestCase):
     TOPOLOGY = {
         COMMISSIONER: {
             'name': 'COMMISSIONER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         JOINER_ROUTER: {
             'name': 'JOINER_ROUTER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
         JOINER: {
             'name': 'JOINER',
-            'networkkey': 'deadbeefdeadbeefdeadbeefdeadbeef',
+            'network_key': 'deadbeefdeadbeefdeadbeefdeadbeef',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/Cert_8_3_01_CommissionerPetition.py b/tests/scripts/thread-cert/Cert_8_3_01_CommissionerPetition.py
index d9e017060..9108514d1 100755
--- a/tests/scripts/thread-cert/Cert_8_3_01_CommissionerPetition.py
+++ b/tests/scripts/thread-cert/Cert_8_3_01_CommissionerPetition.py
@@ -66,12 +66,12 @@ class Cert_8_3_01_CommissionerPetition(thread_cert.TestCase):
     TOPOLOGY = {
         LEADER: {
             'name': 'LEADER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         COMMISSIONER: {
             'name': 'COMMISSIONER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/Cert_9_2_11_NetworkKey.py b/tests/scripts/thread-cert/Cert_9_2_11_NetworkKey.py
index e63a8606e..f7095948f 100755
--- a/tests/scripts/thread-cert/Cert_9_2_11_NetworkKey.py
+++ b/tests/scripts/thread-cert/Cert_9_2_11_NetworkKey.py
@@ -116,7 +116,7 @@ class Cert_9_2_11_NetworkKey(thread_cert.TestCase):
             'name': 'ED',
             'channel': CHANNEL_INIT,
             'is_mtd': True,
-            'networkkey': KEY1,
+            'network_key': KEY1,
             'mode': 'rn',
             'panid': PANID_INIT,
             'allowlist': [ROUTER1]
@@ -125,7 +125,7 @@ class Cert_9_2_11_NetworkKey(thread_cert.TestCase):
             'name': 'SED',
             'channel': CHANNEL_INIT,
             'is_mtd': True,
-            'networkkey': KEY1,
+            'network_key': KEY1,
             'mode': '-',
             'panid': PANID_INIT,
             'timeout': config.DEFAULT_CHILD_TIMEOUT,
diff --git a/tests/scripts/thread-cert/Cert_9_2_18_RollBackActiveTimestamp.py b/tests/scripts/thread-cert/Cert_9_2_18_RollBackActiveTimestamp.py
index a5b2db255..78ab43727 100755
--- a/tests/scripts/thread-cert/Cert_9_2_18_RollBackActiveTimestamp.py
+++ b/tests/scripts/thread-cert/Cert_9_2_18_RollBackActiveTimestamp.py
@@ -92,7 +92,7 @@ class Cert_9_2_18_RollBackActiveTimestamp(thread_cert.TestCase):
             'name': 'ED',
             'channel': CHANNEL_INIT,
             'is_mtd': True,
-            'networkkey': KEY1,
+            'network_key': KEY1,
             'mode': 'rn',
             'panid': PANID_INIT,
             'allowlist': [ROUTER1]
@@ -101,7 +101,7 @@ class Cert_9_2_18_RollBackActiveTimestamp(thread_cert.TestCase):
             'name': 'SED',
             'channel': CHANNEL_INIT,
             'is_mtd': True,
-            'networkkey': KEY1,
+            'network_key': KEY1,
             'mode': '-',
             'panid': PANID_INIT,
             'timeout': config.DEFAULT_CHILD_TIMEOUT,
diff --git a/tests/scripts/thread-cert/border_router/test_publish_meshcop_service.py b/tests/scripts/thread-cert/border_router/test_publish_meshcop_service.py
index 70ff9e802..390092023 100755
--- a/tests/scripts/thread-cert/border_router/test_publish_meshcop_service.py
+++ b/tests/scripts/thread-cert/border_router/test_publish_meshcop_service.py
@@ -183,7 +183,7 @@ class PublishMeshCopService(thread_cert.TestCase):
             'channel_mask': config.CHANNEL_MASK,
             'extended_panid': config.EXTENDED_PANID,
             'mesh_local_prefix': config.MESH_LOCAL_PREFIX.split('/')[0],
-            'network_key': binascii.hexlify(config.DEFAULT_NETWORK_KEY).decode(),
+            'network_key': config.DEFAULT_NETWORK_KEY,
             'network_name': 'ot-br-1-3',
             'panid': config.PANID,
             'pskc': config.PSKC,
diff --git a/tests/scripts/thread-cert/config.py b/tests/scripts/thread-cert/config.py
index fc81f0d0c..372e7d602 100644
--- a/tests/scripts/thread-cert/config.py
+++ b/tests/scripts/thread-cert/config.py
@@ -85,24 +85,7 @@ ONLINK_GUA_PREFIX = '2021::/64'
 # Any address starts with 'fd' are considered on-link address.
 ONLINK_PREFIX_REGEX_PATTERN = '^fd'
 
-DEFAULT_NETWORK_KEY = bytearray([
-    0x00,
-    0x11,
-    0x22,
-    0x33,
-    0x44,
-    0x55,
-    0x66,
-    0x77,
-    0x88,
-    0x99,
-    0xaa,
-    0xbb,
-    0xcc,
-    0xdd,
-    0xee,
-    0xff,
-])
+DEFAULT_NETWORK_KEY = '00112233445566778899aabbccddeeff'
 
 
 class ADDRESS_TYPE(Enum):
@@ -309,15 +292,13 @@ def create_default_mle_tlvs_factories():
     }
 
 
-def create_default_mle_crypto_engine(network_key):
-    return net_crypto.CryptoEngine(crypto_material_creator=net_crypto.MleCryptoMaterialCreator(network_key))
-
-
-def create_default_mle_message_factory(network_key):
+def create_default_mle_message_factory(key_manager=None):
+    key_manager = key_manager or create_default_thread_key_manager()
+    key_manager.add_key(bytes.fromhex(DEFAULT_NETWORK_KEY))
     return mle.MleMessageFactory(
         aux_sec_hdr_factory=net_crypto.AuxiliarySecurityHeaderFactory(),
         mle_command_factory=mle.MleCommandFactory(tlvs_factories=create_default_mle_tlvs_factories()),
-        crypto_engine=create_default_mle_crypto_engine(network_key),
+        crypto_engines=key_manager.mle_crypto_engines,
     )
 
 
@@ -469,8 +450,8 @@ def create_default_ipv6_hop_by_hop_options_factory():
     return ipv6.HopByHopOptionsFactory(options_factories=create_default_ipv6_hop_by_hop_options_factories())
 
 
-def create_default_based_on_src_dst_ports_udp_payload_factory(network_key):
-    mle_message_factory = create_default_mle_message_factory(network_key)
+def create_default_based_on_src_dst_ports_udp_payload_factory(key_manager):
+    mle_message_factory = create_default_mle_message_factory(key_manager)
     coap_message_factory = create_default_coap_message_factory()
     dtls_message_factory = create_default_dtls_message_factory()
 
@@ -497,12 +478,12 @@ def create_default_ipv6_icmp_body_factories():
     }
 
 
-def create_default_ipv6_upper_layer_factories(network_key):
+def create_default_ipv6_upper_layer_factories(key_manager):
     return {
         ipv6.IPV6_NEXT_HEADER_UDP:
             ipv6.UDPDatagramFactory(
                 udp_header_factory=ipv6.UDPHeaderFactory(),
-                udp_payload_factory=create_default_based_on_src_dst_ports_udp_payload_factory(network_key),
+                udp_payload_factory=create_default_based_on_src_dst_ports_udp_payload_factory(key_manager),
             ),
         ipv6.IPV6_NEXT_HEADER_ICMP:
             ipv6.ICMPv6Factory(body_factories=create_default_ipv6_icmp_body_factories()),
@@ -523,10 +504,10 @@ def create_default_ipv6_extension_headers_factories():
     }
 
 
-def create_default_ipv6_packet_factory(network_key):
+def create_default_ipv6_packet_factory(key_manager):
     return ipv6.IPv6PacketFactory(
         ehf=create_default_ipv6_extension_headers_factories(),
-        ulpf=create_default_ipv6_upper_layer_factories(network_key),
+        ulpf=create_default_ipv6_upper_layer_factories(key_manager),
     )
 
 
@@ -546,27 +527,31 @@ def create_default_thread_context_manager():
     return context_manager
 
 
-def create_default_lowpan_parser(context_manager, network_key=DEFAULT_NETWORK_KEY):
+def create_default_lowpan_parser(context_manager, key_manager):
     return lowpan.LowpanParser(
         lowpan_mesh_header_factory=lowpan.LowpanMeshHeaderFactory(),
         lowpan_decompressor=create_default_lowpan_decompressor(context_manager),
         lowpan_fragements_buffers_manager=lowpan.LowpanFragmentsBuffersManager(),
-        ipv6_packet_factory=create_default_ipv6_packet_factory(network_key),
+        ipv6_packet_factory=create_default_ipv6_packet_factory(key_manager),
     )
 
 
-def create_default_thread_message_factory(network_key=DEFAULT_NETWORK_KEY):
+def create_default_thread_key_manager():
+    return message.KeyManager()
+
+
+def create_default_thread_message_factory(key_manager):
     context_manager = create_default_thread_context_manager()
-    lowpan_parser = create_default_lowpan_parser(context_manager, network_key)
+    lowpan_parser = create_default_lowpan_parser(context_manager, key_manager)
 
-    return message.MessageFactory(lowpan_parser=lowpan_parser)
+    return message.MessageFactory(lowpan_parser, key_manager)
 
 
-def create_default_thread_sniffer(use_message_factory=True):
-    return sniffer.Sniffer(create_default_thread_message_factory() if use_message_factory else None)
+def create_default_thread_sniffer(message_factory=None):
+    return sniffer.Sniffer(message_factory)
 
 
-def create_default_simulator(use_message_factory=True):
+def create_default_simulator(message_factory=None):
     if VIRTUAL_TIME:
-        return simulator.VirtualTime(use_message_factory=use_message_factory)
-    return simulator.RealTime(use_message_factory=use_message_factory)
+        return simulator.VirtualTime(message_factory)
+    return simulator.RealTime(message_factory)
diff --git a/tests/scripts/thread-cert/mac802154.py b/tests/scripts/thread-cert/mac802154.py
index b63f43471..60d257a09 100644
--- a/tests/scripts/thread-cert/mac802154.py
+++ b/tests/scripts/thread-cert/mac802154.py
@@ -165,7 +165,7 @@ class MacFrame:
 
     IEEE802154_VERSION_2015 = 0x02
 
-    def parse(self, data):
+    def parse(self, data, mac_crypto_engines=set()):
         """Parse a MAC 802.15.4 frame
 
         Format of MAC 802.15.4 Frame:
@@ -346,8 +346,20 @@ class MacFrame:
             else:
                 message_info.source_mac_address = src_address.mac_address
 
-            sec_obj = CryptoEngine(MacCryptoMaterialCreator(config.DEFAULT_NETWORK_KEY))
-            self.payload = MacPayload(bytearray(open_payload) + sec_obj.decrypt(private_payload, mic, message_info))
+            if len(mac_crypto_engines) == 0:
+                mac_crypto_engines.add(
+                    CryptoEngine(MacCryptoMaterialCreator(bytes.fromhex(config.DEFAULT_NETWORK_KEY))))
+
+            error = None
+            for engine in mac_crypto_engines:
+                try:
+                    self.payload = MacPayload(
+                        bytearray(open_payload) + engine.decrypt(private_payload, mic, message_info))
+                    break
+                except ValueError as e:
+                    error = e
+            else:
+                raise ValueError("Unable to decrypt MAC payload") from error
 
         else:
             self.payload = MacPayload(payload)
diff --git a/tests/scripts/thread-cert/message.py b/tests/scripts/thread-cert/message.py
index bf42c6008..79c5acc70 100644
--- a/tests/scripts/thread-cert/message.py
+++ b/tests/scripts/thread-cert/message.py
@@ -38,6 +38,12 @@ import ipv6
 import mac802154
 import mle
 
+from net_crypto import (
+    CryptoEngine,
+    MacCryptoMaterialCreator,
+    MleCryptoMaterialCreator,
+)
+
 from enum import IntEnum
 
 
@@ -554,10 +560,22 @@ class MessagesSet(object):
         return str(self.messages)
 
 
+class KeyManager:
+
+    def __init__(self):
+        self.mac_crypto_engines = set()
+        self.mle_crypto_engines = set()
+
+    def add_key(self, key):
+        self.mac_crypto_engines.add(CryptoEngine(MacCryptoMaterialCreator(key)))
+        self.mle_crypto_engines.add(CryptoEngine(MleCryptoMaterialCreator(key)))
+
+
 class MessageFactory:
 
-    def __init__(self, lowpan_parser):
+    def __init__(self, lowpan_parser, key_manager):
         self._lowpan_parser = lowpan_parser
+        self.key_manager = key_manager
 
     def _add_device_descriptors(self, message):
         for tlv in message.mle.command.tlvs:
@@ -570,7 +588,7 @@ class MessageFactory:
 
     def _parse_mac_frame(self, data):
         mac_frame = mac802154.MacFrame()
-        mac_frame.parse(data)
+        mac_frame.parse(data, self.key_manager.mac_crypto_engines)
         return mac_frame
 
     def set_lowpan_context(self, cid, prefix):
diff --git a/tests/scripts/thread-cert/mle.py b/tests/scripts/thread-cert/mle.py
index 2bf6c9313..f11ec2b84 100644
--- a/tests/scripts/thread-cert/mle.py
+++ b/tests/scripts/thread-cert/mle.py
@@ -1281,20 +1281,30 @@ class MleMessageSecured(MleMessage):
 
 class MleMessageFactory:
 
-    def __init__(self, aux_sec_hdr_factory, mle_command_factory, crypto_engine):
+    def __init__(self, aux_sec_hdr_factory, mle_command_factory, crypto_engines):
         self._aux_sec_hdr_factory = aux_sec_hdr_factory
         self._mle_command_factory = mle_command_factory
-        self._crypto_engine = crypto_engine
+        self._crypto_engines = crypto_engines
 
     def _create_mle_secured_message(self, data, message_info):
         aux_sec_hdr = self._aux_sec_hdr_factory.parse(data, message_info)
 
         enc_data_length = len(data.getvalue())
 
-        enc_data = bytearray(data.read(enc_data_length - data.tell() - self._crypto_engine.mic_length))
-        mic = bytearray(data.read())
+        raw = data.read(enc_data_length - data.tell())
 
-        dec_data = self._crypto_engine.decrypt(enc_data, mic, message_info)
+        error = None
+        for crypto_engine in self._crypto_engines:
+            enc_data = bytearray(raw[0:-crypto_engine.mic_length])
+            mic = bytearray(raw[-crypto_engine.mic_length:])
+
+            try:
+                dec_data = crypto_engine.decrypt(enc_data, mic, message_info)
+                break
+            except ValueError as e:
+                error = e
+        else:
+            raise ValueError("Failed to parse MLE message") from error
 
         command = self._mle_command_factory.parse(io.BytesIO(dec_data), message_info)
 
diff --git a/tests/scripts/thread-cert/net_crypto.py b/tests/scripts/thread-cert/net_crypto.py
index d9d007f1c..faa612d63 100644
--- a/tests/scripts/thread-cert/net_crypto.py
+++ b/tests/scripts/thread-cert/net_crypto.py
@@ -45,6 +45,10 @@ class CryptoEngine:
         """
         self._crypto_material_creator = crypto_material_creator
 
+    @property
+    def key(self):
+        return self._crypto_material_creator.network_key
+
     @property
     def mic_length(self):
         return self._crypto_material_creator.mic_length
diff --git a/tests/scripts/thread-cert/node.py b/tests/scripts/thread-cert/node.py
index 66bfdd359..fe328c9b0 100755
--- a/tests/scripts/thread-cert/node.py
+++ b/tests/scripts/thread-cert/node.py
@@ -1737,6 +1737,7 @@ class NodeImpl:
         cmd = 'networkkey %s' % networkkey
         self.send_command(cmd)
         self._expect_done()
+        self.simulator.add_network_key(network_key)
 
     def get_key_sequence_counter(self):
         self.send_command('keysequence counter')
@@ -2728,6 +2729,7 @@ class NodeImpl:
             cmd = 'dataset networkkey %s' % network_key
             self.send_command(cmd, go=False)
             self._expect_done()
+            self.simulator.add_network_key(network_key)
 
         if network_name is not None:
             cmd = 'dataset networkname %s' % network_name
@@ -2863,6 +2865,7 @@ class NodeImpl:
 
         if network_key is not None:
             cmd += 'networkkey %s ' % network_key
+            self.simulator.add_network_key(network_key)
 
         if mesh_local is not None:
             cmd += 'localprefix %s ' % mesh_local
@@ -2940,6 +2943,7 @@ class NodeImpl:
 
         if network_key is not None:
             cmd += 'networkkey %s ' % network_key
+            self.simulator.add_network_key(network_key)
 
         if mesh_local is not None:
             cmd += 'localprefix %s ' % mesh_local
diff --git a/tests/scripts/thread-cert/simulator.py b/tests/scripts/thread-cert/simulator.py
index cc77f2815..960b3553e 100755
--- a/tests/scripts/thread-cert/simulator.py
+++ b/tests/scripts/thread-cert/simulator.py
@@ -52,15 +52,20 @@ def dbg_print(*args):
 
 class BaseSimulator(object):
 
-    def __init__(self):
+    def __init__(self, message_factory):
         self._nodes = {}
         self.commissioning_messages = {}
         self._payload_parse_factory = mesh_cop.MeshCopCommandFactory(mesh_cop.create_default_mesh_cop_tlv_factories())
         self._mesh_cop_msg_set = mesh_cop.create_mesh_cop_message_type_set()
+        self._message_factory = message_factory
 
     def __del__(self):
         self._nodes = None
 
+    def add_network_key(self, network_key):
+        if self._message_factory:
+            self._message_factory.key_manager.add_key(bytes.fromhex(network_key))
+
     def add_node(self, node):
         self._nodes[node.nodeid] = node
         self.commissioning_messages[node.nodeid] = []
@@ -93,9 +98,9 @@ class BaseSimulator(object):
 
 class RealTime(BaseSimulator):
 
-    def __init__(self, use_message_factory=True):
-        super(RealTime, self).__init__()
-        self._sniffer = config.create_default_thread_sniffer(use_message_factory=use_message_factory)
+    def __init__(self, message_factory=None):
+        super().__init__(message_factory)
+        self._sniffer = config.create_default_thread_sniffer(message_factory)
         self._sniffer.start()
 
     def set_lowpan_context(self, cid, prefix):
@@ -158,8 +163,8 @@ class VirtualTime(BaseSimulator):
 
     _message_factory = None
 
-    def __init__(self, use_message_factory=True):
-        super().__init__()
+    def __init__(self, message_factory=None):
+        super().__init__(message_factory)
 
         self.port = self.BASE_PORT + (self.PORT_OFFSET * (self.MAX_NODES + 1))
 
@@ -203,10 +208,7 @@ class VirtualTime(BaseSimulator):
         self.current_nodeid = None
         self._pause_time = 0
 
-        if use_message_factory:
-            self._message_factory = config.create_default_thread_message_factory()
-        else:
-            self._message_factory = None
+        self._message_factory = message_factory
 
     def __del__(self):
         if self.sock:
diff --git a/tests/scripts/thread-cert/test_diag.py b/tests/scripts/thread-cert/test_diag.py
index 801bd6044..0de03f780 100755
--- a/tests/scripts/thread-cert/test_diag.py
+++ b/tests/scripts/thread-cert/test_diag.py
@@ -36,7 +36,7 @@ import thread_cert
 class TestDiag(thread_cert.TestCase):
     SUPPORT_NCP = False
 
-    TOPOLOGY = {1: None}
+    TOPOLOGY = {1: {}}
 
     def test(self):
         node = self.nodes[1]
diff --git a/tests/scripts/thread-cert/test_mle.py b/tests/scripts/thread-cert/test_mle.py
index 7e77752bd..c225471be 100755
--- a/tests/scripts/thread-cert/test_mle.py
+++ b/tests/scripts/thread-cert/test_mle.py
@@ -1723,7 +1723,7 @@ class TestMleMessageFactory(unittest.TestCase):
             0x27, 0xc2, 0x96, 0xf4, 0x9c, 0x65, 0x82, 0x97, 0xcf, 0x97, 0x35, 0x89, 0xc2
         ])
 
-        factory = config.create_default_mle_message_factory(network_key=config.DEFAULT_NETWORK_KEY)
+        factory = config.create_default_mle_message_factory()
 
         # WHEN
         actual_mle_message = factory.parse(io.BytesIO(data), message_info)
@@ -1773,7 +1773,7 @@ class TestMleMessageFactory(unittest.TestCase):
             0x94, 0x01, 0x6d, 0x20, 0xdf, 0x30, 0x82, 0xf8, 0xbb, 0x34, 0x47, 0x42, 0x50, 0xe9, 0x41, 0xa7, 0x33, 0xa5
         ])
 
-        factory = config.create_default_mle_message_factory(network_key=config.DEFAULT_NETWORK_KEY)
+        factory = config.create_default_mle_message_factory()
 
         # WHEN
         actual_mle_message = factory.parse(io.BytesIO(data), message_info)
diff --git a/tests/scripts/thread-cert/test_srp_client_change_lease.py b/tests/scripts/thread-cert/test_srp_client_change_lease.py
index e55df6448..4c98c8c99 100755
--- a/tests/scripts/thread-cert/test_srp_client_change_lease.py
+++ b/tests/scripts/thread-cert/test_srp_client_change_lease.py
@@ -64,12 +64,12 @@ class SrpClientChangeLeaseTime(thread_cert.TestCase):
     TOPOLOGY = {
         SERVER: {
             'name': 'SRP_SERVER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         CLIENT: {
             'name': 'SRP_CLIENT',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/test_srp_client_save_server_info.py b/tests/scripts/thread-cert/test_srp_client_save_server_info.py
index ca657897d..094205a35 100755
--- a/tests/scripts/thread-cert/test_srp_client_save_server_info.py
+++ b/tests/scripts/thread-cert/test_srp_client_save_server_info.py
@@ -59,22 +59,22 @@ class SrpAutoStartMode(thread_cert.TestCase):
     TOPOLOGY = {
         CLIENT: {
             'name': 'SRP_CLIENT',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         SERVER1: {
             'name': 'SRP_SERVER1',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rn',
         },
         SERVER2: {
             'name': 'SRP_SERVER2',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rn',
         },
         SERVER3: {
             'name': 'SRP_SERVER3',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rn',
         },
     }
diff --git a/tests/scripts/thread-cert/test_srp_lease.py b/tests/scripts/thread-cert/test_srp_lease.py
index 863c91a38..fa5864f96 100755
--- a/tests/scripts/thread-cert/test_srp_lease.py
+++ b/tests/scripts/thread-cert/test_srp_lease.py
@@ -58,12 +58,12 @@ class SrpRegisterSingleService(thread_cert.TestCase):
     TOPOLOGY = {
         SERVER: {
             'name': 'SRP_SERVER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         CLIENT: {
             'name': 'SRP_CLIENT',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/test_srp_name_conflicts.py b/tests/scripts/thread-cert/test_srp_name_conflicts.py
index 984547f70..4f41258c1 100755
--- a/tests/scripts/thread-cert/test_srp_name_conflicts.py
+++ b/tests/scripts/thread-cert/test_srp_name_conflicts.py
@@ -57,17 +57,17 @@ class SrpNameConflicts(thread_cert.TestCase):
     TOPOLOGY = {
         SERVER: {
             'name': 'SRP_SERVER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         CLIENT1: {
             'name': 'SRP_CLIENT1',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         CLIENT2: {
             'name': 'SRP_CLIENT2',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/test_srp_register_single_service.py b/tests/scripts/thread-cert/test_srp_register_single_service.py
index 33d298b72..f9a43ee9d 100755
--- a/tests/scripts/thread-cert/test_srp_register_single_service.py
+++ b/tests/scripts/thread-cert/test_srp_register_single_service.py
@@ -56,12 +56,12 @@ class SrpRegisterSingleService(thread_cert.TestCase):
     TOPOLOGY = {
         SERVER: {
             'name': 'SRP_SERVER',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
         CLIENT: {
             'name': 'SRP_CLIENT',
-            'networkkey': '00112233445566778899aabbccddeeff',
+            'network_key': '00112233445566778899aabbccddeeff',
             'mode': 'rdn',
         },
     }
diff --git a/tests/scripts/thread-cert/thread_cert.py b/tests/scripts/thread-cert/thread_cert.py
index 27f8d826d..05bfc0cbc 100644
--- a/tests/scripts/thread-cert/thread_cert.py
+++ b/tests/scripts/thread-cert/thread_cert.py
@@ -97,7 +97,7 @@ class TestCase(NcpSupportMixin, unittest.TestCase):
     """
 
     USE_MESSAGE_FACTORY = True
-    TOPOLOGY = None
+    TOPOLOGY = {}
     CASE_WIRESHARK_PREFS = None
     SUPPORT_THREAD_1_1 = True
     PACKET_VERIFICATION = config.PACKET_VERIFICATION_DEFAULT
@@ -142,7 +142,10 @@ class TestCase(NcpSupportMixin, unittest.TestCase):
         """
         self._clean_up_tmp()
 
-        self.simulator = config.create_default_simulator(use_message_factory=self.USE_MESSAGE_FACTORY)
+        key_manager = config.create_default_thread_key_manager()
+
+        self.simulator = config.create_default_simulator(
+            config.create_default_thread_message_factory(key_manager) if self.USE_MESSAGE_FACTORY else None)
         self.nodes = {}
 
         os.environ['LD_LIBRARY_PATH'] = '/tmp/thread-wireshark'
@@ -255,7 +258,7 @@ class TestCase(NcpSupportMixin, unittest.TestCase):
             'channel_mask': config.CHANNEL_MASK,
             'extended_panid': config.EXTENDED_PANID,
             'mesh_local_prefix': config.MESH_LOCAL_PREFIX.split('/')[0],
-            'network_key': binascii.hexlify(config.DEFAULT_NETWORK_KEY).decode(),
+            'network_key': config.DEFAULT_NETWORK_KEY,
             'network_name': config.NETWORK_NAME,
             'panid': config.PANID,
             'pskc': config.PSKC,
@@ -264,8 +267,8 @@ class TestCase(NcpSupportMixin, unittest.TestCase):
 
         if 'channel' in params:
             dataset['channel'] = params['channel']
-        if 'networkkey' in params:
-            dataset['network_key'] = params['networkkey']
+        if 'network_key' in params:
+            dataset['network_key'] = params['network_key']
         if 'network_name' in params:
             dataset['network_name'] = params['network_name']
         if 'panid' in params:
diff --git a/tools/otci/tests/test_otci.py b/tools/otci/tests/test_otci.py
index 19b75271a..4d3353650 100644
--- a/tools/otci/tests/test_otci.py
+++ b/tools/otci/tests/test_otci.py
@@ -82,7 +82,7 @@ class TestOTCI(unittest.TestCase):
         import simulator
 
         if VIRTUAL_TIME:
-            sim = simulator.VirtualTime(use_message_factory=False)
+            sim = simulator.VirtualTime()
         else:
             sim = None