HRESULT 0x80280125 (TPM_20_E_AUTH_MISSING): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the TPM command omitted an authorization session required for one of its handles.

Previous	Next
TPM_20_E_AUTH_TYPE	TPM_20_E_POLICY

TPM_20_E_AUTH_MISSING

This is a command-shape failure before credential verification. The command needs an authorization session for at least one authorizable handle, but the authorization area does not contain a matching session. It can occur when the command tag says that no sessions are present, or when one of several required handle authorizations is absent.

What to inspect

Check whether the command was sent with TPM_ST_SESSIONS rather than a no-session tag.
Map every authorizable handle in the command schematic to a corresponding TPMS_AUTH_COMMAND entry, preserving the required order.
Distinguish authorization sessions from auxiliary sessions used only for parameter encryption, response encryption or audit.

Why an empty password is not the same as no session

An entity may have an empty authorization value, yet the command can still require the authorization area and a session entry. Conversely, adding a session only to encrypt a parameter does not satisfy a missing authorization for a protected handle. Capture the command tag, authorization size and the list of session handles before changing policy or credentials.

TCG: command tags and authorization area · tpm2_startauthsession · tpm2-tools session syntax

Looking for a different code? Search another status or error code.