| Previous | Next |
| TPM_20_E_HANDLE | TPM_20_E_RANGE |
TPM_20_E_KDF
TPM 2.0 exposes a separate interface type for key and mask derivation functions. The TPM validates a KDF in the context in which it is used: an identifier can be known to the specification but unavailable in the target device, or it can be wrong for the selected scheme and associated hash algorithm.
Why this needs a full-template check
Key derivation parameters often appear next to a scheme selector and a hash selector. Looking only at the KDF name hides the actual compatibility question: whether the selected combination is implemented and allowed by that command or object type.
- Capture the scheme, KDF and hash fields together in diagnostics.
- Query device capabilities before using an optional KDF selected by a portable configuration.
- Keep the operation-specific context and label data; substituting another KDF can change protocol semantics, not merely performance.
TCG: TPMI_ALG_KDF and scheme structures · tpm2_createprimary: template construction · tpm2-tss ESAPI command mapping
Looking for a different code? Search another status or error code.