What does HRESULT 0x80280039 (TPM_E_REQUIRES_SIGN) mean?

TPM_E_REQUIRES_SIGN

A signed authorization path is mandatory

TPM_E_REQUIRES_SIGN (0x80280039) means the object/policy requires signature-based proof for this NV or delegation operation and the submitted command did not provide a valid signed path. This is distinct from owner authorization or locality checks.

Evidence to capture

Capture target index/delegation object, permission attributes, signing requirement, signing key identity, nonce/session data, and the authorization structure actually sent.

Focused correction

Construct the command using the required signing authorization and verify the signature over the exact TPM-defined data. Do not remove the signing requirement from policy merely to make the test pass.

Technical references

• TCG: TPM 1.2 Main Specification.
• TCG: TPM 1.2 Part 2 — NV structures and permissions.
• TCG: TPM 1.2 Part 3 — NV commands.
• Microsoft: Win32_Tpm class.