| Previous | Next |
| STATUS_TPM_NO_ENDORSEMENT | STATUS_TPM_WRONG_ENTITYTYPE |
STATUS_TPM_INVALID_KEYUSAGE
The TPM key usage does not allow this operation
STATUS_TPM_INVALID_KEYUSAGE is a Windows NTSTATUS value mapped from the TPM facility. For STATUS_TPM_INVALID_KEYUSAGE, in this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.
The relevant area is TPM key usage restrictions. TPM keys are created with usage and attribute fields that limit what the key may do. This status means the selected key is real, but its declared usage is not compatible with the command.
This is a policy/attribute mismatch, not a missing key. For example, a key intended for storage or binding should not be reused as if it were a signing key. The durable fix is to select or create a key with the correct usage and scheme.
Diagnostic focus
- Dump the TPM key usage, algorithm, scheme, and command ordinal.
- Check whether parent and child keys are being confused in the call path.
- Create a new key with the intended usage instead of trying to override the existing key attributes.
References for STATUS_TPM_INVALID_KEYUSAGE
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: TPM fundamentals
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.