diff --git a/sim/src/image.rs b/sim/src/image.rs
index b7f8ed6..fe97f12 100644
--- a/sim/src/image.rs
+++ b/sim/src/image.rs
@@ -1267,8 +1267,11 @@
             TlvGen::new_enc_rsa()
         }
     } else if Caps::EncEc256.present() {
-        //FIXME: should fail with RSA signature?
-        TlvGen::new_ecdsa_ecies_p256()
+        if Caps::EcdsaP256.present() {
+            TlvGen::new_ecdsa_ecies_p256()
+        } else {
+            TlvGen::new_ecies_p256()
+        }
     } else {
         // The non-encrypted configuration.
         if Caps::RSA2048.present() {
diff --git a/sim/src/tlv.rs b/sim/src/tlv.rs
index c4bd54e..80d82ae 100644
--- a/sim/src/tlv.rs
+++ b/sim/src/tlv.rs
@@ -215,6 +215,16 @@
     }
 
     #[allow(dead_code)]
+    pub fn new_ecies_p256() -> TlvGen {
+        TlvGen {
+            flags: TlvFlags::ENCRYPTED as u32,
+            kinds: vec![TlvKinds::SHA256, TlvKinds::ENCEC256],
+            size: 4 + 32 + 4 + 32 + 4 + 113,
+            ..Default::default()
+        }
+    }
+
+    #[allow(dead_code)]
     pub fn new_ecdsa_ecies_p256() -> TlvGen {
         TlvGen {
             flags: TlvFlags::ENCRYPTED as u32,