| Previous | Next |
| TPM_E_INVALID_POSTINIT | TPM_E_BAD_KEY_PROPERTY |
TPM_E_INAPPROPRIATE_SIG
Locate the first producer
TPM_E_INAPPROPRIATE_SIG (0x80280027) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the signature input includes an encoding form that the TPM 1.2 signing command forbids for the selected scheme.
What distinguishes this value: “Signed data cannot include additional DER information.” Capture evidence for that condition directly so a similar result from the same facility is not confused with this result.
The first producer to identify for this HRESULT is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Data to retain
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the signature input includes an encoding form that the TPM 1.2 signing command forbids for the selected scheme |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | signature scheme, digestInfo or DER prefix, input length, key usage, command ordinal, and whether the caller supplied a raw digest or pre-encoded object |
| What is the controlled comparison? | sign a specification-valid digest of the same length without additional DER material and compare the request buffer |
Record the original command or API call before this result retry logic mutates its nonces, handles, buffers or state. Also retain the full HRESULT as 0x80280027; signed decimal logging can hide the result TPM/TBS facility and make searches less precise.
Verification sequence
- Establish the result baseline with the same device, Windows build, account and TPM generation.
- Perform one narrow experiment: sign a specification-valid digest of the same length without additional DER material and compare the request buffer.
- Compare raw this result inputs and the first response, not only the final application dialog.
- Stop after the first changed the checkpoint; a later error means this boundary was passed even if the whole workflow still fails.
Codes that answer different questions
| Result | Different diagnostic question |
|---|---|
TPM_E_BAD_KEY_PROPERTY | The key properties in TPM_KEY_PARMs are not supported by this TPM — a separate checkpoint when compared with this result. |
TPM_E_INVALID_POSTINIT | The command was received in the wrong sequence relative to TPM_Init and a subsequent TPM_Startup — a separate checkpoint when compared with it. |
TPM_E_BAD_SCHEME | The signature or encryption scheme for this key is incorrect or not permitted in this situation — a separate checkpoint when compared with it. |
The decisive distinction for this HRESULT is that TPM_E_BAD_SIGNATURE reports failed signature validation; this code rejects the data form before producing a signature. The short platform wording — “Signed data cannot include additional DER information.” — does not supply that differential diagnosis by itself.
Exit condition for the incident
The corrective direction is to supply the data form required by the TPM signing scheme and avoid double-wrapping digest metadata. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
A verified it repair reproduces the original request with the same intended security policy and passes this checkpoint. Replacing it with a broader wrapper status, silently falling back to software keys, or suppressing verification is not proof of success.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.