1. PSoC 5 does not have a hardware accelerator for encryption and the UDBs are to small for that.
2. PSoC 6 supports hardware based AES encryption. technically there are two cryptio units in the device, a general purpose one and one in the SMIF, that can both be used to generate your encrypted message. Preferred is the first one. PSoC 63 has BLE, so the CY8CROTO-063 should be the right kit.
3. There is a code example for AES encryption on PSoC 6:
Additional information can be found in the PSoC 6 architecture manual.
And the PDL documentation accessible via the Help section in PSoC Creator or Modus toolbox.