HRESULT 0x80280131 (TPM_20_E_UNBALANCED): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The selected TPM session hash and symmetric key sizes do not form an allowed combination.

Previous	Next
TPM_20_E_REBOOT	TPM_20_E_COMMAND_SIZE

TPM_20_E_UNBALANCED

Session protection algorithms must have compatible strength

TPM_20_E_UNBALANCED wraps TPM_RC_UNBALANCED. TPM 2.0 sessions can combine a hash algorithm with a symmetric algorithm for parameter encryption. The specification requires the hash digest size to be larger than the symmetric key size for this construction. A caller that requests an incompatible pair is rejected before the session can provide the intended protection.

For example, changing only the cipher name is not enough; the selected key size and the session's authHash must be evaluated together. The response concerns the algorithm parameters supplied to the TPM, not the size of an application data buffer.

How to correct it

Inspect the authHash, symmetric algorithm, mode, and key-size fields used by TPM2_StartAuthSession.
Choose an algorithm combination reported by the TPM's capabilities.
Prefer library defaults unless interoperability requirements demand a custom pair.
Do not weaken the hash merely to match an old cipher configuration; select a balanced, supported suite instead.

References

Looking for a different code? Search another status or error code.