diff --git a/examples/bench/bench.c b/examples/bench/bench.c
index c71b214b..2ffedd6a 100644
--- a/examples/bench/bench.c
+++ b/examples/bench/bench.c
@@ -28,6 +28,7 @@
 #ifndef WOLFTPM2_NO_WRAPPER
 
 #include <examples/tpm_io.h>
+#include <examples/tpm_test.h>
 #include <examples/bench/bench.h>
 
 /* Configuration */
diff --git a/examples/csr/csr.c b/examples/csr/csr.c
index 134df01f..cb3a8f12 100644
--- a/examples/csr/csr.c
+++ b/examples/csr/csr.c
@@ -27,6 +27,7 @@
      defined(WOLF_CRYPTO_DEV) && !defined(WOLFTPM2_NO_WOLFCRYPT)
 
 #include <examples/tpm_io.h>
+#include <examples/tpm_test.h>
 #include <examples/csr/csr.h>
 #include <wolfssl/wolfcrypt/asn_public.h>
 
diff --git a/examples/native/native_test.c b/examples/native/native_test.c
index 7bd7abac..b9458cb9 100644
--- a/examples/native/native_test.c
+++ b/examples/native/native_test.c
@@ -25,7 +25,7 @@
 
 #include <examples/native/native_test.h>
 #include <examples/tpm_io.h>
-
+#include <examples/tpm_test.h>
 
 /******************************************************************************/
 /* --- BEGIN TPM Native API Tests -- */
@@ -50,23 +50,12 @@ typedef struct tmpHandle {
     TPM2B_AUTH         auth;
 } TpmHandle;
 
-#ifndef WOLFTPM_ST33
-#define TEST_AES_MODE TPM_ALG_CFB
-#else
-#define TEST_AES_MODE TPM_ALG_CBC
-#endif
 
 int TPM2_Native_Test(void* userCtx)
 {
     int rc;
     TPM2_CTX tpm2Ctx;
 
-    const BYTE TPM_20_EK_AUTH_POLICY[] = {
-        0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc,
-        0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7, 0x6e, 0x06, 0x52,
-        0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa,
-    };
-
     union {
         Startup_In startup;
         Shutdown_In shutdown;
diff --git a/examples/pkcs7/pkcs7.c b/examples/pkcs7/pkcs7.c
index e435f0da..123c443f 100644
--- a/examples/pkcs7/pkcs7.c
+++ b/examples/pkcs7/pkcs7.c
@@ -27,6 +27,7 @@
      defined(WOLF_CRYPTO_DEV)
 
 #include <examples/tpm_io.h>
+#include <examples/tpm_test.h>
 #include <examples/pkcs7/pkcs7.h>
 #include <wolfssl/wolfcrypt/pkcs7.h>
 
diff --git a/examples/tls/tls_client.c b/examples/tls/tls_client.c
index 3405533e..02fb9563 100644
--- a/examples/tls/tls_client.c
+++ b/examples/tls/tls_client.c
@@ -27,6 +27,7 @@
     !defined(WOLFTPM2_NO_WOLFCRYPT)
 
 #include <examples/tpm_io.h>
+#include <examples/tpm_test.h>
 #include <examples/tls/tls_client.h>
 
 #include <wolfssl/ssl.h>
diff --git a/examples/tls/tls_server.c b/examples/tls/tls_server.c
index 3a42d882..06454efd 100644
--- a/examples/tls/tls_server.c
+++ b/examples/tls/tls_server.c
@@ -27,6 +27,7 @@
     !defined(WOLFTPM2_NO_WOLFCRYPT)
 
 #include <examples/tpm_io.h>
+#include <examples/tpm_test.h>
 #include <examples/tls/tls_server.h>
 
 #include <wolfssl/ssl.h>
diff --git a/examples/tpm_io.h b/examples/tpm_io.h
index 9cade901..183252c1 100644
--- a/examples/tpm_io.h
+++ b/examples/tpm_io.h
@@ -24,21 +24,6 @@
 
 #include <wolftpm/tpm2.h>
 
-/* Configuration */
-#define TPM2_DEMO_STORAGE_KEY_HANDLE    0x81000200  /* Persistent Storage Key Handle */
-
-#define TPM2_DEMO_RSA_IDX               0x20        /* offset handle to unused index */
-#define TPM2_DEMO_RSA_KEY_HANDLE        (0x81000000 + TPM2_DEMO_RSA_IDX) /* Persistent Key Handle */
-#define TPM2_DEMO_RSA_CERT_HANDLE       (0x01800000 + TPM2_DEMO_RSA_IDX) /* NV Handle */
-
-#define TPM2_DEMO_ECC_IDX               0x21        /* offset handle to unused index */
-#define TPM2_DEMO_ECC_KEY_HANDLE        (0x81000000 + TPM2_DEMO_ECC_IDX) /* Persistent Key Handle */
-#define TPM2_DEMO_ECC_CERT_HANDLE       (0x01800000 + TPM2_DEMO_ECC_IDX) /* NV Handle */
-
-static const char gStorageKeyAuth[] = "ThisIsMyStorageKeyAuth";
-static const char gKeyAuth[] =        "ThisIsMyKeyAuth";
-static const char gUsageAuth[] =      "ThisIsASecretUsageAuth";
-
 /* TPM2 IO Examples */
 #ifdef WOLFTPM_ADV_IO
 int TPM2_IoCb(TPM2_CTX*, int isRead, word32 addr, byte* buf, word16 size,
diff --git a/examples/tpm_test.h b/examples/tpm_test.h
index da36935e..d0f9f846 100755
--- a/examples/tpm_test.h
+++ b/examples/tpm_test.h
@@ -23,6 +23,29 @@
 #ifndef _TPM_TEST_H_
 #define _TPM_TEST_H_
 
+
+/* Test Configuration */
+#define TPM2_DEMO_STORAGE_KEY_HANDLE    0x81000200  /* Persistent Storage Key Handle */
+
+#define TPM2_DEMO_RSA_IDX               0x20        /* offset handle to unused index */
+#define TPM2_DEMO_RSA_KEY_HANDLE        (0x81000000 + TPM2_DEMO_RSA_IDX) /* Persistent Key Handle */
+#define TPM2_DEMO_RSA_CERT_HANDLE       (0x01800000 + TPM2_DEMO_RSA_IDX) /* NV Handle */
+
+#define TPM2_DEMO_ECC_IDX               0x21        /* offset handle to unused index */
+#define TPM2_DEMO_ECC_KEY_HANDLE        (0x81000000 + TPM2_DEMO_ECC_IDX) /* Persistent Key Handle */
+#define TPM2_DEMO_ECC_CERT_HANDLE       (0x01800000 + TPM2_DEMO_ECC_IDX) /* NV Handle */
+
+static const char gStorageKeyAuth[] = "ThisIsMyStorageKeyAuth";
+static const char gKeyAuth[] =        "ThisIsMyKeyAuth";
+static const char gUsageAuth[] =      "ThisIsASecretUsageAuth";
+
+#ifndef WOLFTPM_ST33
+    #define TEST_AES_MODE TPM_ALG_CFB
+#else
+    #define TEST_AES_MODE TPM_ALG_CBC
+#endif
+
+
 /* RAW KEY MATERIAL */
 
 /* from wolfSSL ./certs/client-key.der */
diff --git a/examples/wrap/wrap_test.c b/examples/wrap/wrap_test.c
index 2f775e96..7d52ca35 100644
--- a/examples/wrap/wrap_test.c
+++ b/examples/wrap/wrap_test.c
@@ -27,8 +27,8 @@
 #ifndef WOLFTPM2_NO_WRAPPER
 
 #include <examples/tpm_io.h>
-#include <examples/wrap/wrap_test.h>
 #include <examples/tpm_test.h>
+#include <examples/wrap/wrap_test.h>
 
 /* Configuration */
 #define TPM2_DEMO_NV_TEST_INDEX                 0x01800200
@@ -51,7 +51,7 @@ void TPM2_Wrapper_SetReset(int reset)
 
 int TPM2_Wrapper_Test(void* userCtx)
 {
-    int rc;
+    int rc, i;
     WOLFTPM2_DEV dev;
     WOLFTPM2_CAPS caps;
     WOLFTPM2_KEY ekKey;
@@ -59,6 +59,7 @@ int TPM2_Wrapper_Test(void* userCtx)
     WOLFTPM2_KEY rsaKey;
     WOLFTPM2_KEY eccKey;
     WOLFTPM2_KEY publicKey;
+    WOLFTPM2_KEY aesKey;
     WOLFTPM2_BUFFER message;
     WOLFTPM2_BUFFER cipher;
     WOLFTPM2_BUFFER plain;
@@ -70,7 +71,6 @@ int TPM2_Wrapper_Test(void* userCtx)
 #endif
     WOLFTPM2_HASH hash;
 #ifdef ENABLE_LARGE_HASH_TEST
-    int i;
     const char* hashTestDig =
         "\x27\x78\x3e\x87\x96\x3a\x4e\xfb\x68\x29\xb5\x31\xc9\xba\x57\xb4"
         "\x4f\x45\x79\x7f\x67\x70\xbd\x63\x7f\xbf\x0d\x80\x7c\xbd\xba\xe0";
@@ -535,12 +535,56 @@ int TPM2_Wrapper_Test(void* userCtx)
     printf("Hash SHA256 test success\n");
 
 
+    /*------------------------------------------------------------------------*/
+    /* ENCRYPT/DECRYPT TESTS */
+    /*------------------------------------------------------------------------*/
+    rc = wolfTPM2_GetKeyTemplate_Symmetric(&publicTemplate, 128, TEST_AES_MODE,
+        YES, YES);
+    if (rc != 0) goto exit;
+    rc = wolfTPM2_CreateAndLoadKey(&dev, &aesKey, &storageKey.handle,
+        &publicTemplate, (byte*)gUsageAuth, sizeof(gUsageAuth)-1);
+    if (rc != 0) goto exit;
+
+    /* Test data */
+    message.size = sizeof(message.buffer);
+    for (i=0; i<message.size; i++) {
+        message.buffer[i] = (byte)(i & 0xff);
+    }
+
+    XMEMSET(cipher.buffer, 0, sizeof(cipher.buffer));
+    cipher.size = sizeof(cipher.buffer);
+    rc = wolfTPM2_EncryptDecrypt(&dev, &aesKey, message.buffer, cipher.buffer,
+        message.size, NULL, 0, WOLFTPM2_ENCRYPT);
+    if (rc != 0 && rc != TPM_RC_COMMAND_CODE) goto exit;
+
+    XMEMSET(plain.buffer, 0, sizeof(plain.buffer));
+    plain.size = sizeof(plain.buffer);
+    rc = wolfTPM2_EncryptDecrypt(&dev, &aesKey, cipher.buffer, plain.buffer,
+        cipher.size, NULL, 0, WOLFTPM2_DECRYPT);
+
+    wolfTPM2_UnloadHandle(&dev, &aesKey.handle);
+
+    if (rc == TPM_RC_SUCCESS &&
+         message.size == plain.size &&
+         XMEMCMP(message.buffer, plain.buffer, message.size) == 0) {
+        printf("Encrypt/Decrypt test success\n");
+    }
+    else if (rc == TPM_RC_COMMAND_CODE) {
+        printf("Encrypt/Decrypt: Is not a supported feature due to export controls\n");
+        rc = TPM_RC_SUCCESS; /* clear error code */
+    }
+    else {
+        printf("Encrypt/Decrypt test failed, result not as expected!\n");
+        goto exit;
+    }
+
 exit:
 
     if (rc != 0) {
         printf("Failure 0x%x: %s\n", rc, wolfTPM2_GetRCString(rc));
     }
 
+    wolfTPM2_UnloadHandle(&dev, &aesKey.handle);
     wolfTPM2_UnloadHandle(&dev, &publicKey.handle);
     wolfTPM2_UnloadHandle(&dev, &rsaKey.handle);
     wolfTPM2_UnloadHandle(&dev, &eccKey.handle);
diff --git a/src/tpm2_wrap.c b/src/tpm2_wrap.c
index 5ea9fc9f..e8013468 100644
--- a/src/tpm2_wrap.c
+++ b/src/tpm2_wrap.c
@@ -503,7 +503,7 @@ int wolfTPM2_ComputeName(const TPM2B_PUBLIC* pub, TPM2B_NAME* out)
         return rc;
     hashSz = rc;
 
-    /* Encode hash alorithm in first 2 bytes */
+    /* Encode hash algorithm in first 2 bytes */
     nameAlg = TPM2_Packet_SwapU16(nameAlg);
     XMEMCPY(&out->name[0], &nameAlg, sizeof(UINT16));
 
@@ -872,7 +872,7 @@ int wolfTPM2_RsaKey_TpmToWolf(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* tpmKey,
     XMEMSET(e, 0, sizeof(e));
     XMEMSET(n, 0, sizeof(n));
 
-    /* load exponenet */
+    /* load exponent */
     exponent = tpmKey->pub.publicArea.parameters.rsaDetail.exponent;
     if (exponent == 0)
         exponent = RSA_DEFAULT_PUBLIC_EXPONENT;
@@ -2055,7 +2055,7 @@ int wolfTPM2_HashUpdate(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
         return BAD_FUNC_ARG;
     }
 
-    /* set session auth for key */
+    /* set session auth for hash handle */
     dev->session[0].auth = hash->handle.auth;
 
     XMEMSET(&in, 0, sizeof(in));
@@ -2098,7 +2098,7 @@ int wolfTPM2_HashFinish(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
         return BAD_FUNC_ARG;
     }
 
-    /* set session auth for key */
+    /* set session auth for hash handle */
     dev->session[0].auth = hash->handle.auth;
 
     XMEMSET(&in, 0, sizeof(in));
@@ -2126,6 +2126,128 @@ int wolfTPM2_HashFinish(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
     return rc;
 }
 
+/* EncryptDecrypt */
+int wolfTPM2_EncryptDecryptBlock(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
+    const byte* in, byte* out, word32 inOutSz, const byte* iv, word32 ivSz,
+    int isDecrypt)
+{
+    int rc;
+    EncryptDecrypt2_In encDecIn;
+    EncryptDecrypt2_Out encDecOut;
+
+    if (dev == NULL || key == NULL || in == NULL || out == NULL || inOutSz == 0) {
+        return BAD_FUNC_ARG;
+    }
+
+    /* this function expects block size */
+    /* use wolfTPM2_Encrypt and wolfTPM2_Decrypt for other sizes */
+    if (inOutSz > MAX_AES_BLOCK_SIZE_BYTES) {
+    #ifdef DEBUG_WOLFTPM
+        printf("wolfTPM2_EncryptDecryptBlock expects %d size blocks\n",
+            MAX_AES_BLOCK_SIZE_BYTES);
+    #endif
+        return BAD_FUNC_ARG;
+    }
+
+    /* set session auth for key */
+    dev->session[0].auth = key->handle.auth;
+
+    XMEMSET(&encDecIn, 0, sizeof(encDecIn));
+    encDecIn.keyHandle = key->handle.hndl;
+    if (iv == NULL || ivSz == 0) {
+        encDecIn.ivIn.size = MAX_AES_BLOCK_SIZE_BYTES; /* zeros */
+    }
+    else {
+        encDecIn.ivIn.size = ivSz;
+        XMEMCPY(encDecIn.ivIn.buffer, iv, ivSz);
+    }
+    encDecIn.decrypt = isDecrypt;
+    /* use symmetric algorithm from key */
+    encDecIn.mode = key->pub.publicArea.parameters.symDetail.sym.mode.aes;
+
+    encDecIn.inData.size = inOutSz;
+    XMEMCPY(encDecIn.inData.buffer, in, inOutSz);
+
+    /* make sure this is a block */
+    if (encDecIn.inData.size < MAX_AES_BLOCK_SIZE_BYTES)
+        encDecIn.inData.size = MAX_AES_BLOCK_SIZE_BYTES;
+
+    rc = TPM2_EncryptDecrypt2(&encDecIn, &encDecOut);
+    if (rc == TPM_RC_COMMAND_CODE) { /* some TPM's may not support command */
+        /* try to enable support */
+        rc = wolfTPM2_SetCommand(dev, TPM_CC_EncryptDecrypt2, YES);
+        if (rc == TPM_RC_SUCCESS) {
+            /* try command again */
+            rc = TPM2_EncryptDecrypt2(&encDecIn, &encDecOut);
+        }
+    }
+
+    if (rc != TPM_RC_SUCCESS) {
+    #ifdef DEBUG_WOLFTPM
+        printf("TPM2_EncryptDecrypt2 failed 0x%x: %s\n", rc,
+            TPM2_GetRCString(rc));
+    #endif
+        return rc;
+    }
+
+    /* return block */
+    if (inOutSz > encDecOut.outData.size)
+        inOutSz = encDecOut.outData.size;
+    XMEMCPY(out, encDecOut.outData.buffer, inOutSz);
+
+    return rc;
+}
+
+int wolfTPM2_EncryptDecrypt(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
+    const byte* in, byte* out, word32 inOutSz,
+    const byte* iv, word32 ivSz, int isDecrypt)
+{
+    int rc;
+    word32 pos = 0, xfer;
+
+    while (pos < inOutSz) {
+        xfer = inOutSz - pos;
+        if (xfer > MAX_AES_BLOCK_SIZE_BYTES)
+            xfer = MAX_AES_BLOCK_SIZE_BYTES;
+
+        rc = wolfTPM2_EncryptDecryptBlock(dev, key, &in[pos], &out[pos],
+            xfer, iv, ivSz, isDecrypt);
+        if (rc != TPM_RC_SUCCESS)
+            break;
+
+        pos += xfer;
+    }
+
+    return rc;
+}
+
+
+int wolfTPM2_SetCommand(WOLFTPM2_DEV* dev, TPM_CC commandCode, int enableFlag)
+{
+    int rc;
+#ifdef WOLFTPM_ST33
+    SetCommandSet_In in;
+
+    /* Enable TPM2_EncryptDecrypt2 command */
+    XMEMSET(&in, 0, sizeof(in));
+    in.authHandle = TPM_RH_PLATFORM;
+    in.commandCode = commandCode;
+    in.enableFlag = enableFlag;
+    rc = TPM2_SetCommandSet(&in);
+    if (rc != TPM_RC_SUCCESS) {
+    #ifdef DEBUG_WOLFTPM
+        printf("TPM2_SetCommandSet failed 0x%x: %s\n", rc,
+            TPM2_GetRCString(rc));
+    #endif
+    }
+#else
+    (void)commandCode;
+    (void)enableFlag;
+    rc = TPM_RC_COMMAND_CODE; /* not supported */
+#endif
+    (void)dev;
+    return rc;
+}
 
 /******************************************************************************/
 /* --- END Wrapper Device Functions-- */
@@ -2210,12 +2332,6 @@ int wolfTPM2_GetKeyTemplate_Symmetric(TPMT_PUBLIC* publicTemplate, int keyBits,
     return 0;
 }
 
-static const BYTE TPM_20_EK_AUTH_POLICY[] = {
-    0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc,
-    0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7, 0x6e, 0x06, 0x52,
-    0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa,
-};
-
 int wolfTPM2_GetKeyTemplate_RSA_EK(TPMT_PUBLIC* publicTemplate)
 {
     if (publicTemplate == NULL)
diff --git a/wolftpm/tpm2.h b/wolftpm/tpm2.h
index 85513070..1e007d6f 100644
--- a/wolftpm/tpm2.h
+++ b/wolftpm/tpm2.h
@@ -1596,6 +1596,13 @@ typedef struct TPMS_AUTH_RESPONSE {
 #define TPM_20_NV_INDEX_EK_NONCE       (TPM_20_PLATFORM_MFG_NV_SPACE + 3)
 #define TPM_20_NV_INDEX_EK_TEMPLATE    (TPM_20_PLATFORM_MFG_NV_SPACE + 4)
 
+/* Predetermined TPM 2.0 Endorsement policy auth template */
+static const BYTE TPM_20_EK_AUTH_POLICY[] = {
+    0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xb3, 0xf8, 0x1a, 0x90, 0xcc,
+    0x8d, 0x46, 0xa5, 0xd7, 0x24, 0xfd, 0x52, 0xd7, 0x6e, 0x06, 0x52,
+    0x0b, 0x64, 0xf2, 0xa1, 0xda, 0x1b, 0x33, 0x14, 0x69, 0xaa,
+};
+
 
 
 /* HAL IO Callbacks */
diff --git a/wolftpm/tpm2_wrap.h b/wolftpm/tpm2_wrap.h
index 845b3b27..d2ca500a 100644
--- a/wolftpm/tpm2_wrap.h
+++ b/wolftpm/tpm2_wrap.h
@@ -211,6 +211,17 @@ WOLFTPM_API int wolfTPM2_HashUpdate(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
 WOLFTPM_API int wolfTPM2_HashFinish(WOLFTPM2_DEV* dev, WOLFTPM2_HASH* hash,
     byte* digest, word32* digestSz);
 
+#define WOLFTPM2_ENCRYPT NO
+#define WOLFTPM2_DECRYPT YES
+WOLFTPM_API int wolfTPM2_EncryptDecryptBlock(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
+    const byte* in, byte* out, word32 inOutSz, const byte* iv, word32 ivSz,
+    int isDecrypt);
+WOLFTPM_API int wolfTPM2_EncryptDecrypt(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* key,
+    const byte* in, byte* out, word32 inOutSz,
+    const byte* iv, word32 ivSz, int isDecrypt);
+
+WOLFTPM_API int wolfTPM2_SetCommand(WOLFTPM2_DEV* dev, TPM_CC commandCode,
+    int enableFlag);
 
 /* Utility functions */
 WOLFTPM_API int wolfTPM2_GetKeyTemplate_RSA(TPMT_PUBLIC* publicTemplate,