What does HRESULT 0x8028001B (TPM_E_SHA_ERROR) mean?

 
Previous Next
TPM_E_SHA_THREAD TPM_E_FAILEDSELFTEST

TPM_E_SHA_ERROR

Which layer owns this HRESULT

TPM_E_SHA_ERROR (0x8028001B) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks an existing TPM 1.2 SHA-1 thread has become unusable, so later update or completion work cannot continue.

The first producer to identify for TPM_E_SHA_ERROR is the TPM 1.2 command decoder and state machine. For TPM_E_SHA_ERROR, tPM 1.2 is a command/response device with strict binary structures and stateful resources. For TPM_E_SHA_ERROR, windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.

Diagnostic record

Preserve these TPM_E_SHA_ERROR items before changing anything:

  • TPM_E_SHA_ERROR and 0x8028001B, the exact returning method or command, and the first nested status.
  • the first failing chunk, total byte count promised at start, update sizes, completion command, and whether the device slept or the context was closed.
  • The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for TPM_E_SHA_ERROR.
  • The complete opaque TPM_E_SHA_ERROR request artifacts, redacting authorization secrets but not rewriting structure boundaries.

How to verify the distinction

Run this focused check: repeat with the same data in a fresh SHA thread and fixed chunk boundaries, stopping at the first command that changes the state. Do not combine the TPM_E_SHA_ERROR test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.

CheckpointPass condition
an existing TPM 1.2 SHA-1 thread has become unusable, so later update or completion work cannot continueThe original TPM_E_SHA_ERROR command reaches the next defined state without returning this result.
Security behaviorThe TPM_E_SHA_ERROR verification still uses the intended TPM, authorization, locality and policy.
Output integrityThe object, digest, event log or state transition produced after TPM_E_SHA_ERROR validates independently.

Common false equivalences

Related resultSeparate meaning
TPM_E_BADTAGThe tag value sent to for a command is invalid — a separate checkpoint when compared with TPM_E_SHA_ERROR.
TPM_E_SHA_THREADThere is no existing SHA-1 thread — a separate checkpoint when compared with TPM_E_SHA_ERROR.
TPM_E_IOERRORAn IO error occurred transmitting information to the TPM — a separate checkpoint when compared with TPM_E_SHA_ERROR.

The practical distinction is that TPM_E_SHA_THREAD indicates that no thread exists; this result indicates a thread whose prior operation already failed.

What a real fix looks like

The supported direction is to discard the failed thread and correct the earlier length, sequencing, or transport problem before starting a new hash. For TPM_E_SHA_ERROR, do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.

If the same bytes still return TPM_E_SHA_ERROR after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.

Technical references


Looking for a different code? Search another status or error code.