What does HRESULT 0x802800A2 (TPM_20_E_BAD_AUTH) mean?

 
Previous Next
TPM_20_E_RESERVED_BITS TPM_20_E_EXPIRED

TPM_20_E_BAD_AUTH

This response means that the TPM rejected a password or HMAC authorization, but the failure does not carry the dictionary-attack consequences of TPM_20_E_AUTH_FAIL. It is still a proof-of-knowledge failure, not evidence that a key, PCR value or TPM driver is corrupt.

What can make a correct secret produce this code

  • An HMAC authorization is built from more than the secret: command parameters, handle names, nonces and session state participate in the calculation.
  • A client can reuse a session context or nonce after it has changed, or attach a session to the wrong authorizable handle when a command has several handles.
  • A policy can require an auth value through a policy command; supplying a policy session without the required proof is a different failure path from merely knowing the object name.

How to diagnose it

Identify whether the caller used a password session, HMAC session or policy session with an auth-value requirement. Trace the command and session state through the same TPM stack that produced the request. Do not switch randomly between empty and non-empty passwords: first check the object public attributes, configured policy and the exact handle being authorized.

TCG: HMAC and password authorization checks · tpm2_startauthsession · tpm2_policypassword


Looking for a different code? Search another status or error code.