| Previous | Next |
| STATUS_PCP_KEY_NOT_FINALIZED | STATUS_PCP_NOT_PCR_BOUND |
STATUS_PCP_ATTESTATION_CHALLENGE_NOT_SET
The attestation workflow is missing challenge material
STATUS_PCP_ATTESTATION_CHALLENGE_NOT_SET means a PCP attestation operation was invoked before its required challenge was supplied. A challenge is not decorative data: it binds evidence to a particular relying-party request and helps prevent replay of an old attestation response.
This is usually an orchestration or API-sequencing problem. A local key may be valid and TPM-backed, yet the provider cannot produce the intended evidence because the caller skipped, lost, or mismatched the challenge exchanged with the verifier.
What to check
- Correlate the challenge issued by the CA or verifier with the key and request that produced the error.
- Check binary encoding, length, lifetime, and whether retry logic accidentally uses a stale challenge from a previous enrollment attempt.
- Do not generate a random replacement challenge locally unless the protocol explicitly makes the caller the verifier.
References
- Microsoft: PCP and TPM error codes
- Microsoft: TPM key attestation
- Trusted Computing Group: TPM 2.0 Library Specification
Looking for a different code? Search another status or error code.