| Previous | Next |
| ERROR_GRAPHICS_UAB_NOT_SUPPORTED | ERROR_GRAPHICS_OPM_NO_VIDEO_OUTPUTS_EXIST |
ERROR_GRAPHICS_OPM_INVALID_ENCRYPTED_PARAMETERS
The OPM handshake could not be completed
This code belongs to IOPMVideoOutput::FinishInitialization, before ordinary status queries or protection commands are valid. The application has to combine the driver challenge, a newly generated AES signing key, and independent initial sequence numbers, then encrypt the initialization data with the public key from the driver certificate chain.
A correct buffer size alone is not enough. A stale driver random value, a certificate from a different output object, the wrong public key, non-random starting counters, or an incorrect RSAES-OAEP result all make the session unusable. The data is tied to one initialization exchange and must not be replayed for another output or another session.
What to record and verify
- Log the output identity and the order of
StartInitializationandFinishInitialization, without logging the AES key or plaintext initialization block. - Verify the driver certificate chain before taking its public key, then generate a fresh signing key and fresh starting counters for every OPM object.
- On a topology or driver reset, discard the old OPM object and perform a new handshake instead of reusing cached encrypted parameters.
References
- Microsoft: IOPMVideoOutput::FinishInitialization
- Microsoft: OPM session handshake and request signing
Looking for a different code? Search another status or error code.