| Previous | Next |
| TPM_E_ERROR_MASK | TPM_E_BADINDEX |
TPM_E_AUTHFAIL
TPM_E_AUTHFAIL is a legacy TPM 1.2 command result: the TPM could not validate the authorization proof supplied for the protected operation. It is not a general Windows sign-in error and does not, by itself, prove that a user password is wrong. TPM 1.2 authorization may involve an entity’s authorization data, an authorization session, nonces and an HMAC over the command inputs.
This code is distinct from a missing or non-existent key. A valid key handle can still produce TPM_E_AUTHFAIL when the command was addressed to the correct object but the authorization calculation, session state, or expected authorization value does not match.
What to capture
- The TPM 1.2 command name, key or owner entity being authorized, and whether the caller used an OIAP, OSAP, or delegated authorization path.
- The full command result and the application’s TPM Base Services or TSS log; do not record authorization values or session secrets.
- Whether the same protected object succeeds through a different approved client path. A mismatch limited to one client usually points to its authorization material or command construction.
Do not clear or re-own the TPM merely to retry an authorization failure. Those operations can invalidate keys or sealed data and do not establish why this command’s proof failed.
References
- Microsoft: TPM HRESULT values in Winerror.h
- TCG TPM 1.2 Part 1: Design Principles
- TCG TPM 1.2 Part 3: Commands
Looking for a different code? Search another status or error code.