| Previous | Next |
| TPM_E_BAD_PARAM_SIZE | TPM_E_SHA_ERROR |
TPM_E_SHA_THREAD
Interpret the boundary first
TPM_E_SHA_THREAD (0x8028001A) belongs to TPM 1.2 command processing. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the legacy TPM 1.2 SHA-1 streaming state machine was asked to update or complete when no SHA thread was active.
The first producer to identify for it is the TPM 1.2 command decoder and state machine. TPM 1.2 is a command/response device with strict binary structures and stateful resources. Windows may present the device response as an HRESULT, but the diagnostic meaning still belongs to the command field, key, session, PCR, NV index or lifecycle check named by the TPM specification.
Build the command transcript
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | the legacy TPM 1.2 SHA-1 streaming state machine was asked to update or complete when no SHA thread was active |
| Which layer owns the result? | The TPM 1.2 command decoder and state machine. |
| What must be correlated? | the precise sequence of TPM_SHA1Start, TPM_SHA1Update and completion commands, chunk lengths, context identity, and intervening cancellation or reset |
| What is the controlled comparison? | run a single start-update-complete sequence without sharing the context or interleaving a second hash operation |
Record the original command or API call before this result retry logic mutates its nonces, handles, buffers or state. Also retain the full HRESULT as 0x8028001A; signed decimal logging can hide the result TPM/TBS facility and make searches less precise.
Test one hypothesis
- Establish the result baseline with the same device, Windows build, account and TPM generation.
- Perform one narrow experiment: run a single start-update-complete sequence without sharing the context or interleaving a second hash operation.
- Compare raw this result inputs and the first response, not only the final application dialog.
- Stop after the first changed the checkpoint; a later error means this boundary was passed even if the whole workflow still fails.
Do not merge these conditions
| Result | Different diagnostic question |
|---|---|
TPM_E_SHA_ERROR | The calculation is unable to proceed because the existing SHA-1 thread has already encountered an error — a separate checkpoint when compared with this result. |
TPM_E_FAIL | The operation failed — a separate checkpoint when compared with it. |
TPM_E_BADTAG | The tag value sent to for a command is invalid — a separate checkpoint when compared with it. |
The decisive distinction for it is that TPM_E_SHA_ERROR means a thread existed but had already entered an error state. The short platform wording — “There is no existing SHA-1 thread.” — does not supply that differential diagnosis by itself.
A safe recovery path
The corrective direction is to serialize the SHA thread lifecycle and restart from TPM_SHA1Start after any abort or power-state loss. Do not clear ownership, delete keys or reset PCR-related state merely to see whether the message disappears; those actions can destroy the evidence and protected material while leaving serialization or command-order defects unchanged.
A verified it repair reproduces the original request with the same intended security policy and passes this checkpoint. Replacing it with a broader wrapper status, silently falling back to software keys, or suppressing verification is not proof of success.
Technical references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Commands — source for the checkpoint.
- Microsoft: TPM Base Services portal — source for the checkpoint.
Looking for a different code? Search another status or error code.