| Previous | Next |
| TPM_E_IOERROR | TPM_E_DECRYPT_ERROR |
TPM_E_ENCRYPT_ERROR
Meaning beyond the built-in message
TPM_E_ENCRYPT_ERROR (0x80280020) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the TPM 1.2 encryption operation could not complete with the selected key, scheme, or input representation.
The first producer to identify for it is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Read this result as its own boundary in a sequence, not as a verdict that every TPM feature is broken. The sequence reaches the TPM 1.2 encryption operation could not complete with the selected key, scheme, or input representation, and the component returns 0x80280020 before the application can safely assume that later key, attestation, boot or licensing work occurred.
Decode the relevant state
- Request identity: exact function or command, input lengths, flags, caller context and this result.
- State identity: key usage and algorithm parameters, encryption scheme, modulus size, input length, padding expectations, and the exact command that consumed the data.
- Platform identity for it: TPM generation, manufacturer/firmware revision, Windows build and relevant service events.
- Binary identity: preserve opaque structures byte-for-byte and log
0x80280020in hexadecimal.
One-variable test
Repeat with a specification-valid short test message under the same public key and scheme, without reusing production secrets. Keep every other this result test condition unchanged. If the comparison reaches a later checkpoint, then the original the condition has been isolated even when a second defect remains.
| Observed outcome | Interpretation |
|---|---|
| The exact request succeeds | The changed condition belongs to the rejected the TPM 1.2 encryption operation could not complete with the selected key, scheme, or input representation. |
| A more specific earlier code appears | Preserve the earlier result in the result trace; the previous trace probably lost the first producer. |
| The same code returns with identical bytes | Escalate the persistent it with firmware, service and command evidence rather than broad configuration changes. |
| The code disappears only after destructive reset | The result experiment is not diagnostic because original protected state and evidence were removed. |
Differential diagnosis
| Nearby constant | Why it is different |
|---|---|
TPM_E_DECRYPT_ERROR | The decryption process did not complete — a separate checkpoint when compared with it. |
TPM_E_IOERROR | An IO error occurred transmitting information to the TPM — a separate checkpoint when compared with it. |
TPM_E_INVALID_AUTHHANDLE | An invalid handle was used — a separate checkpoint when compared with it. |
For this page, the useful contrast is: TPM_E_BAD_SCHEME rejects a scheme choice; it is the failure while performing encryption.
Supported corrective direction
Apply the narrow remedy: align the key usage, scheme and input size with the TPM 1.2 command contract or recreate the key with compatible parameters. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
Close the incident only when the same API or TPM command passes with the intended hardware-backed behavior and the expected output can be independently validated.
References
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.