HRESULT 0x80280119 (TPM_20_E_HMAC): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

a TPM command HMAC verification failed outside the dictionary-attack authorization result.

Previous	Next
TPM_20_E_PRIVATE	TPM_20_E_DISABLED

TPM_20_E_HMAC

TPM_20_E_HMAC is the TPM's generic HMAC-validation response. It indicates that an HMAC-bearing command input or protocol field did not verify, but it does not by itself establish that an object's authorization value was wrong or that the dictionary-attack counter changed.

Separate the layers

For a protected handle authorization, compare this response with TPM_20_E_AUTH_FAIL and TPM_20_E_BAD_AUTH; those are the authorization-check outcomes described for HMAC or password proof.
For a command-specific HMAC, identify the command structure and the exact key, nonce and marshaled bytes expected by that command.
Do not conflate a host TLS, HTTP or Windows cryptography HMAC with the TPM command HMAC; TPM sessions use their own command serialization and nonce state.

What to capture safely

Keep the TPM command code, session handles, session attributes, nonce lengths and transport or TSS trace, while excluding secrets and raw HMAC values from ordinary logs. Recreate the failing command in the same stack and TPM state. A generic host-side HMAC test cannot validate that the TPM received the same marshaled command bytes.

TCG: command authorization processing · tpm2_startauthsession · tpm2-tools authorization formats

Looking for a different code? Search another status or error code.