| Previous | Next |
| STATUS_TPM_PERMANENTEK | STATUS_TPM_NOCONTEXTSPACE |
STATUS_TPM_BAD_SIGNATURE
The CMK ticket signature failed validation
STATUS_TPM_BAD_SIGNATURE in this TPM range is tied to certified migratable key ticket validation. The TPM checked a signature associated with the migration ticket and found that it did not validate.
This is narrower than a general cryptographic failure. The signature may be computed over the wrong ticket fields, use the wrong authority key, or refer to a different key/destination pair.
Keep the signed data, signature algorithm, authority key, and raw command buffer. Without those values it is hard to distinguish a broken signature from a mismatched migration transcript.
Diagnostic focus
- Verify exactly which bytes were signed for the CMK ticket.
- Check that the authority key is the one expected by the migrated key policy.
- Look for canonicalization or byte-order changes between ticket generation and submission.
References
- TCG: TPM 1.2 Main Specification
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: TPM Base Services
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.