| Previous | Next |
| TPM_E_MA_TICKET_SIGNATURE | TPM_E_MA_SOURCE |
TPM_E_MA_DESTINATION
The state machine behind the code
TPM_E_MA_DESTINATION (0x8028005D) belongs to TPM 1.2 key migration and endorsement policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the certified-migration destination has not been authenticated as required by the TPM 1.2 workflow.
Evidence table
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the certified-migration destination has not been authenticated as required by the TPM 1.2 workflow |
| Which layer owns the result? | The certified-migration, key-policy or EK administrative checkpoint. |
| What must be correlated? | destination public key and digest, migration ticket, authority identity, destination nonce, command sequence, and proof verification |
| What is the controlled comparison? | validate the destination proof independently and test a newly authorized destination key |
A useful this result trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The result timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.
Reproduction plan
The one-variable check is to validate the destination proof independently and test a newly authorized destination key. Record the before/after state that the result command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.
- Capture this result and
0x8028005Dat the first code-specific return boundary. - Decode the result state: key attributes, authority tickets, source and destination identities, signatures and provisioning state.
- Run the result controlled comparison once and preserve both binary transcripts.
- Verify the expected this result output or state transition instead of relying on absence of a UI message.
Contrast with neighboring results
| Comparison code | Built-in distinction |
|---|---|
TPM_E_MA_SOURCE | Migration source incorrect — a separate checkpoint when compared with it. |
TPM_E_MA_TICKET_SIGNATURE | Migration authority signature validation failure — a separate checkpoint when compared with it. |
TPM_E_MA_AUTHORITY | Incorrect migration authority — a separate checkpoint when compared with it. |
It specifically answers whether the certified-migration destination has not been authenticated as required by the TPM 1.2 workflow. In contrast, TPM_E_MA_SOURCE identifies a problem with the source side of the migration relationship.
Confirming remediation
To remediate it, complete destination authentication through the migration authority before creating or applying the migration blob. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.
After correcting it, start with a fresh caller context where the protocol requires one, replay the original intended operation, and confirm that hardware-backed policy remains enforced.
Authoritative references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Certified migration structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Migration commands — source for the checkpoint.
- Microsoft: How Windows uses the TPM — source for the checkpoint.
Looking for a different code? Search another status or error code.