| Previous | Next |
| TPM_E_REQUIRES_SIGN | TPM_E_AUTH_CONFLICT |
TPM_E_KEY_NOTSUPPORTED
Meaning beyond the built-in message
TPM_E_KEY_NOTSUPPORTED (0x8028003A) belongs to TPM 1.2 nonvolatile-storage policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the caller tried to load or use a key form that the TPM 1.2 NV operation does not support.
The first producer to identify for this HRESULT is the TPM 1.2 NV permission and lifecycle checks. TPM 1.2 NV indices combine permissions, authorization mode, locality masks and lock semantics. Two indices of the same size can behave differently because those attributes were fixed when each index was defined.
Decode the relevant state
Preserve these this result items before changing anything:
- This result and
0x8028003A, the exact returning method or command, and the first nested status. - key type and usage, NV command, blob origin, parent, algorithm parameters, and whether the key is an ordinary TPM key or the special form expected by the operation.
- The TPM generation, manufacturer/firmware revision, Windows build, caller identity and TBS/provider state for this HRESULT.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
One-variable test
Run this focused check: repeat with a key explicitly created for the documented NV-key role and compare public attributes. Do not combine the result test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Checkpoint | Pass condition |
|---|---|
| the caller tried to load or use a key form that the TPM 1.2 NV operation does not support | The original this result command reaches the next defined state without returning it. |
| Security behavior | The result verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Differential diagnosis
| Related result | Separate meaning |
|---|---|
TPM_E_AUTH_CONFLICT | NV_LoadKey blob requires both owner and blob authorization — a separate checkpoint when compared with it. |
TPM_E_REQUIRES_SIGN | The operation requires a signed command — a separate checkpoint when compared with it. |
TPM_E_AREA_LOCKED | The NV area is locked and not writtable — a separate checkpoint when compared with it. |
The practical distinction is that TPM_E_BAD_KEY_PROPERTY rejects a key template generally, while it is specific to the operation’s supported key class.
Supported corrective direction
The supported direction is to select the supported key class and regenerate dependent blobs; changing only the handle does not change key semantics. Do not undefine a production NV index until its public attributes and authorization policy have been recorded. NV policy is established at definition time, and destructive recreation can remove counters, certificates or provisioning state.
If the same bytes still return it after the documented preconditions are satisfied, retain this code-specific trace for the platform vendor or Windows component owner rather than erasing state.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — NV structures and permissions — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — NV commands — source for the checkpoint.
- Microsoft: Win32_Tpm class — source for the checkpoint.
Looking for a different code? Search another status or error code.