| Previous | Next |
| TPM_E_FAILEDSELFTEST | TPM_E_BADTAG |
TPM_E_AUTH2FAIL
TPM_E_AUTH2FAIL is a TPM 1.2 authorization result for a command that uses two key or entity authorizations. The second authorization failed. This is more specific than TPM_E_AUTHFAIL, which reports a failed authorization without identifying the second authorization position of a two-authorization operation.
The distinction matters when the first key and its authorization path are valid but the second protected entity, session, or authorization value is not. Replacing both credentials blindly can obscure which object or command binding is wrong.
Evidence to collect
- The exact two-authorization command, the order of the involved entities, and the redacted session metadata for each authorization.
- Whether the second entity was loaded from the intended TPM context and has the expected policy and key usage.
- Nonces, continuation flags, and parameter digests as logged by the trusted client stack, without exposing secrets.
Correct the second authorization path and regenerate the command through the supported TPM 1.2 library rather than modifying an HMAC field manually.
References
- Microsoft: TPM HRESULT values in Winerror.h
- TCG TPM 1.2 Part 1: Design Principles
- TCG TPM 1.2 Part 3: Commands
Looking for a different code? Search another status or error code.