| Previous | Next |
| TPM_E_DAA_STAGE | TPM_E_DAA_WRONG_W |
TPM_E_DAA_ISSUER_VALIDITY
The state machine behind the code
TPM_E_DAA_ISSUER_VALIDITY (0x80280056) belongs to TPM 1.2 Direct Anonymous Attestation. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the DAA issuer-validity proof is inconsistent with the issuer parameters or current protocol transcript.
The first producer to identify for this HRESULT is the staged DAA enrollment or signing state machine. Direct Anonymous Attestation in TPM 1.2 is a multi-stage protocol. Each stage consumes issuer data, TPM-specific state and outputs from earlier stages, so the first inconsistent transcript element is more useful than the final generic application failure.
The result value 0x80280056 should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the DAA issuer-validity proof is inconsistent with the issuer parameters or current protocol transcript as precisely as it.
Evidence table
- Producer for this HRESULT: the staged DAA enrollment or signing state machine.
- Rejected invariant: the DAA issuer-validity proof is inconsistent with the issuer parameters or current protocol transcript.
- Decisive capture: issuer validity values, issuer settings, stage, nonces, signed material, and the authority that produced the proof.
- Safe comparison: verify the issuer package and validity proof outside the TPM, then test a freshly issued credential set.
Reproduction plan
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the DAA issuer-validity proof is inconsistent with the issuer parameters or current protocol transcript |
| Which layer owns the result? | The staged DAA enrollment or signing state machine. |
| What must be correlated? | issuer validity values, issuer settings, stage, nonces, signed material, and the authority that produced the proof |
| What is the controlled comparison? | verify the issuer package and validity proof outside the TPM, then test a freshly issued credential set |
Contrast with neighboring results
| Constant | Checkpoint represented by its standard message |
|---|---|
TPM_E_DAA_WRONG_W | The consistency check on w has failed — a separate checkpoint when compared with this result. |
TPM_E_DAA_STAGE | The atomic process indicated by the submitted DAA command is not the expected process — a separate checkpoint when compared with this result. |
TPM_E_DAA_TPM_SETTINGS | The consistency check on DAA_tpmSpecific has failed — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TPM_E_DAA_ISSUER_SETTINGS rejects the settings structure before this proof check.
Confirming remediation
Obtain a coherent issuer package and restart daa enrollment rather than reusing rejected validity data. Do not mix values from separate DAA attempts. The protocol is staged and transcript-bound; substituting one issuer value or nonce can make every later stage misleading.
Proof for this HRESULT consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — DAA structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — DAA commands — source for the checkpoint.
- Microsoft: TPM technology overview — source for the checkpoint.
Looking for a different code? Search another status or error code.