| Previous | Next |
| TPM_E_ENCRYPT_ERROR | TPM_E_INVALID_AUTHHANDLE |
TPM_E_DECRYPT_ERROR
Classify the layer correctly
TPM_E_DECRYPT_ERROR (0x80280021) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the TPM 1.2 decrypt or unwrap stage could not recover valid plaintext from the submitted ciphertext.
The first producer to identify for it is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Incident worksheet
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | the TPM 1.2 decrypt or unwrap stage could not recover valid plaintext from the submitted ciphertext |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | key handle and usage, scheme, ciphertext length, wrapping origin, authorization result, and whether the blob was transformed or truncated in storage |
| What is the controlled comparison? | decrypt a freshly produced test blob with the same key and compare the complete binary envelope with the failing blob |
Record the original command or API call before this result retry logic mutates its nonces, handles, buffers or state. Also retain the full HRESULT as 0x80280021; signed decimal logging can hide the result TPM/TBS facility and make searches less precise.
A reproducible comparison
- Establish the result baseline with the same device, Windows build, account and TPM generation.
- Perform one narrow experiment: decrypt a freshly produced test blob with the same key and compare the complete binary envelope with the failing blob.
- Compare raw this result inputs and the first response, not only the final application dialog.
- Stop after the first changed the checkpoint; a later error means this boundary was passed even if the whole workflow still fails.
Boundaries often confused with this one
| Result | Different diagnostic question |
|---|---|
TPM_E_INVALID_AUTHHANDLE | An invalid handle was used — a separate checkpoint when compared with this result. |
TPM_E_ENCRYPT_ERROR | The encryption process had a problem — a separate checkpoint when compared with it. |
TPM_E_NO_ENDORSEMENT | The TPM does not have an Endorsement Key (EK) installed — a separate checkpoint when compared with it. |
The decisive distinction for it is that TPM_E_BAD_DATASIZE rejects inconsistent lengths before or during parsing, while this code identifies failed decryption. The short platform wording — “The decryption process did not complete.” — does not supply that differential diagnosis by itself.
Restore service safely
The corrective direction is to restore the exact ciphertext and compatible key or regenerate the wrapped object; do not treat decryption failure as proof that authorization alone is wrong. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
A verified it repair reproduces the original request with the same intended security policy and passes this checkpoint. Replacing it with a broader wrapper status, silently falling back to software keys, or suppressing verification is not proof of success.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.