| Previous | Next |
| TPM_E_REQUIRES_SIGN | TPM_E_AUTH_CONFLICT |
TPM_E_KEY_NOTSUPPORTED
Meaning beyond the built-in message
TPM_E_KEY_NOTSUPPORTED (0x8028003A) belongs to TPM 1.2 nonvolatile-storage policy. This result means the caller tried to load or use a key form that the TPM 1.2 NV operation does not support.
The first producer to identify is the TPM 1.2 NV permission and lifecycle checks. TPM 1.2 NV indices combine permissions, authorization mode, locality masks and lock semantics. Two indices of the same size can behave differently because those attributes were fixed when each index was defined.
Decode the relevant state
Preserve these items before changing anything:
- This result and
0x8028003A, the exact returning method or command, and the first nested status. - key type and usage, NV command, blob origin, parent, algorithm parameters, and whether the key is an ordinary TPM key or the special form expected by the operation.
- Record the TPM generation, manufacturer/firmware revision, Windows build, caller identity, and TBS/provider state.
- The complete opaque request artifacts, redacting authorization secrets but not rewriting structure boundaries.
One-variable test
Run this focused check: repeat with a key explicitly created for the documented NV-key role and compare public attributes. Do not combine the test with firmware updates, TPM clearing, account changes, key recreation and policy edits in the same trial; such a result cannot isolate this boundary.
| Stage | Pass condition |
|---|---|
| the caller tried to load or use a key form that the TPM 1.2 NV operation does not support | The original command reaches the next defined state without returning it. |
| Security behavior | Verification still uses the intended TPM, authorization, locality and policy. |
| Output integrity | The object, digest, event log or state transition produced after it validates independently. |
Differential diagnosis
| Related result | Separate meaning |
|---|---|
TPM_E_AUTH_CONFLICT | NV_LoadKey blob requires both owner and blob authorization. |
TPM_E_REQUIRES_SIGN | The operation requires a signed command. |
TPM_E_AREA_LOCKED | The NV area is locked and not writtable. |
The practical distinction is that TPM_E_BAD_KEY_PROPERTY rejects a key template generally, while it is specific to the operation’s supported key class.
Supported corrective direction
The supported direction is to select the supported key class and regenerate dependent blobs; changing only the handle does not change key semantics. Do not undefine a production NV index until its public attributes and authorization policy have been recorded. NV policy is established at definition time, and destructive recreation can remove counters, certificates or provisioning state.
Technical references
- TCG: TPM 1.2 Main Specification — source for this result.
- TCG: TPM 1.2 Part 2 — NV structures and permissions — source for this result.
- TCG: TPM 1.2 Part 3 — NV commands — source for this result.
- Microsoft: Win32_Tpm class — source for this result.
Looking for a different code? Search another status or error code.