| Previous | Next |
| TPM_E_SHA_THREAD | TPM_E_FAILEDSELFTEST |
TPM_E_SHA_ERROR
Which layer owns this HRESULT
TPM_E_SHA_ERROR (0x8028001B) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks an existing TPM 1.2 SHA-1 thread has become unusable, so later update or completion work cannot continue.
The first producer to identify for TPM_E_SHA_ERROR is the TPM 1.2 command decoder and state machine. For TPM_E_SHA_ERROR, tPM 1.2 is a command/response device with strict binary structures and stateful resources. For TPM_E_SHA_ERROR, windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Diagnostic record
Preserve these TPM_E_SHA_ERROR items before changing anything:
TPM_E_SHA_ERRORand0x8028001B, the exact returning method or command, and the first nested status.- the first failing chunk, total byte count promised at start, update sizes, completion command, and whether the device slept or the context was closed.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for
TPM_E_SHA_ERROR. - The complete opaque
TPM_E_SHA_ERRORrequest artifacts, redacting authorization secrets but not rewriting structure boundaries.
How to verify the distinction
Run this focused check: repeat with the same data in a fresh SHA thread and fixed chunk boundaries, stopping at the first command that changes the state. Do not combine the TPM_E_SHA_ERROR test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| an existing TPM 1.2 SHA-1 thread has become unusable, so later update or completion work cannot continue | The original TPM_E_SHA_ERROR command reaches the next defined state without returning this result. |
| Security behavior | The TPM_E_SHA_ERROR verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after TPM_E_SHA_ERROR validates independently. |
Common false equivalences
| Related result | Separate meaning |
|---|---|
TPM_E_BADTAG | The tag value sent to for a command is invalid — a separate checkpoint when compared with TPM_E_SHA_ERROR. |
TPM_E_SHA_THREAD | There is no existing SHA-1 thread — a separate checkpoint when compared with TPM_E_SHA_ERROR. |
TPM_E_IOERROR | An IO error occurred transmitting information to the TPM — a separate checkpoint when compared with TPM_E_SHA_ERROR. |
The practical distinction is that TPM_E_SHA_THREAD indicates that no thread exists; this result indicates a thread whose prior operation already failed.
What a real fix looks like
The supported direction is to discard the failed thread and correct the earlier length, sequencing, or transport problem before starting a new hash. For TPM_E_SHA_ERROR, do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
If the same bytes still return TPM_E_SHA_ERROR after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- TCG: TPM 1.2 Main Specification — source for the
TPM_E_SHA_ERRORcheckpoint. - TCG: TPM 1.2 Part 2 — Structures — source for the
TPM_E_SHA_ERRORcheckpoint. - TCG: TPM 1.2 Part 3 — Commands — source for the
TPM_E_SHA_ERRORcheckpoint. - Microsoft: TPM Base Services portal — source for the
TPM_E_SHA_ERRORcheckpoint.
Looking for a different code? Search another status or error code.