| Previous | Next |
| TPM_E_MA_SOURCE | TPM_E_PERMANENTEK |
TPM_E_MA_AUTHORITY
Meaning beyond the built-in message
TPM_E_MA_AUTHORITY (0x8028005F) belongs to TPM 1.2 key migration and endorsement policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the certified-migration authority named by the request is not the authority authorized for this key or ticket.
The first producer to identify for it is the certified-migration, key-policy or EK administrative checkpoint. TPM 1.2 migration policy is encoded when a key is created and reinforced by signed authority tickets and source/destination bindings. Migration errors therefore require the original binary artifacts and key attributes, not only the user-visible key name.
Decode the relevant state
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | the certified-migration authority named by the request is not the authority authorized for this key or ticket |
| Which layer owns the result? | The certified-migration, key-policy or EK administrative checkpoint. |
| What must be correlated? | authority digest and public key, CMK migration-authority list, ticket chain, source and destination data, and key creation attributes |
| What is the controlled comparison? | compare the authority identifier embedded in the CMK policy with the signer of a newly issued ticket |
A useful this result trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The result timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.
One-variable test
The one-variable check is to compare the authority identifier embedded in the CMK policy with the signer of a newly issued ticket. Record the before/after state that the result command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.
- Capture this result and
0x8028005Fat the first code-specific return boundary. - Decode the result state: key attributes, authority tickets, source and destination identities, signatures and provisioning state.
- Run the result controlled comparison once and preserve both binary transcripts.
- Verify the expected this result output or state transition instead of relying on absence of a UI message.
Differential diagnosis
| Comparison code | Built-in distinction |
|---|---|
TPM_E_PERMANENTEK | Attempt to revoke the EK and the EK is not revocable — a separate checkpoint when compared with it. |
TPM_E_MA_SOURCE | Migration source incorrect — a separate checkpoint when compared with it. |
TPM_E_BAD_SIGNATURE | Bad signature of CMK ticket — a separate checkpoint when compared with it. |
It specifically answers whether the certified-migration authority named by the request is not the authority authorized for this key or ticket. In contrast, TPM_E_MA_TICKET_SIGNATURE means the authority may be right but its ticket signature does not validate.
Supported corrective direction
To remediate it, use the authorized migration authority or create a new key under the intended authority policy. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.
After correcting it, start with a fresh caller context where the protocol requires one, replay the original intended operation, and confirm that hardware-backed policy remains enforced.
Authoritative references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Certified migration structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Migration commands — source for the checkpoint.
- Microsoft: How Windows uses the TPM — source for the checkpoint.
Looking for a different code? Search another status or error code.