[Tpm2] is it possible to create a child public that can be use to encrypt data externally ?

Hi Folks,

I am new to tpm2.
I would to create a child key from a primary key.
I need to encrypt my data with the child public key externally.
After that, this encrypted data will be sent to the TPM for decryption.
Provided that, the TPM with only perform the decryption if the encrypted
data was encrypted by a public key cat be linked back to primary key; in
other words, the TPM will not perform decryption if the public key does not
come from itself.
It is possible to do that ? Are there any work around ?

BTW,  I tried to miss-use the endorsement key, makecrendential and
active-crential to do the job I have mentioned above. But I failed, because
the size of encrypted blob must be less than or equal to 64 bytes which is
why too small for my data.

Best regards,
benzwt