| Previous | Next |
| TPM_20_E_SIZE | TPM_20_E_TAG |
TPM_20_E_SYMMETRIC
This condition covers the full symmetric selection, not just the cipher name. The TPM can reject an unsupported block cipher, an unavailable key size, or a symmetric definition that is inappropriate for the object or command context. A valid host-side AES setting is therefore not enough evidence that a TPM template is valid.
Where to look
- For a symmetric object, inspect algorithm, key bits and mode together.
- For an RSA or ECC parent, inspect the companion
TPMT_SYM_DEF_OBJECTand whether the object is a restricted decryption key. - Check that a generic symmetric algorithm is being used in a field that accepts it; some structures allow only block ciphers and explicitly exclude XOR.
Useful next step
Obtain the target TPM algorithm capability list and regenerate the public template from explicit values. Avoid silently downgrading an algorithm or size in production, because a different symmetric configuration can alter wrapping, migration or policy behavior.
TCG: TPMI_ALG_SYM and TPMT_SYM_DEF_OBJECT · tpm2-tools: symmetric object algorithms · Microsoft: TPM HRESULT mapping
Looking for a different code? Search another status or error code.