| Previous | Next |
| STATUS_TPM_NOSRK | STATUS_TPM_OWNER_SET |
STATUS_TPM_NOTSEALED_BLOB
The blob is not valid TPM-sealed data
STATUS_TPM_NOTSEALED_BLOB is a Windows NTSTATUS value mapped from the TPM facility. For STATUS_TPM_NOTSEALED_BLOB, in this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.
The relevant area is sealed storage blob validation. Sealed storage binds protected data to TPM keys and optional PCR conditions. This status means the blob supplied to an unseal-style operation is not recognized as a valid sealed-data blob created for this TPM path.
This is a format/provenance problem, not simply a policy mismatch. Wrong PCR values, changed ownership, incorrect parent key, corruption, or passing an ordinary encrypted blob to a sealed-data command can produce different evidence. Preserve the blob bytes and the parent-key identity when diagnosing.
Diagnostic focus
- Verify that the blob was produced by a TPM seal command and not by application encryption alone.
- Check parent key, SRK/ownership state, and TPM version compatibility.
- If PCR binding is involved, validate the blob structure before comparing live PCR values.
References for STATUS_TPM_NOTSEALED_BLOB
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: TPM fundamentals
- UAPI Group: Linux TPM PCR Registry
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.