HRESULT 0x8028008E (TPM_20_E_AUTH_FAIL): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the TPM authorization HMAC or password failed for a dictionary-attack protected entity.

Previous	Next
TPM_20_E_RANGE	TPM_20_E_NONCE

TPM_20_E_AUTH_FAIL

This is the dictionary-attack-accounted authorization failure. The TPM reached the HMAC or password verification step for an object or NV index that is subject to DA protection and rejected the supplied proof. It is not a generic TPM transport error: the failed authorization can change the TPM failedTries state and eventually lead to lockout.

Why retrying blindly is unsafe

The issue can be a wrong authValue, but it can also be a stale HMAC caused by a different command code, handle name, nonce, session attribute or encrypted parameter.
DA protection applies when the object does not have noDA set, or when an NV index does not have TPMA_NV_NO_DA set.
Repeated failures can make later, correct authorizations fail with TPM_20_E_LOCKOUT.

Evidence worth collecting

Record the TPM command code, authorized handle, session type, session attributes and the response before retrying. Preserve the public area or NV attributes that determine DA protection, but do not log secrets, HMAC values or plaintext authorization data. Compare this status with TPM_20_E_BAD_AUTH: that code is also an authorization failure, but does not have DA implications.

TCG: TPM authorization checks · tpm2_startauthsession · tpm2-tools authorization formats

Looking for a different code? Search another status or error code.