| Previous | Next |
| TPM_20_E_KEY_SIZE | TPM_20_E_MODE |
TPM_20_E_MGF
Mask-generation functions are algorithm selectors inside TPM command structures, not a Windows-wide cryptography preference. This error means the TPM rejected the selected mask-generation function in the position where the command or scheme uses it. The failure can be due to a function that the TPM does not implement or to a pairing that is not valid for the surrounding scheme.
How to narrow it down
- Identify the serialized field carrying the mask-generation selector instead of looking only at the high-level API call.
- Check the associated hash and scheme parameters as a group; algorithm fields are commonly validated together.
- Query the target TPM capability set and avoid replacing an unsupported selection with a random host-library default.
What this does not prove
The status does not by itself indicate corrupt key material, an authorization problem or a bad TPM driver. It is a parameter-compatibility response. A minimal reproduction with the same command and public template is more useful than retrying unchanged requests.
TCG: TPM response codes and algorithm structures · tpm2-tools: object algorithm syntax · Microsoft: TPM HRESULT codes
Looking for a different code? Search another status or error code.