What does HRESULT 0x8028005C (TPM_E_MA_TICKET_SIGNATURE) mean?

TPM_E_MA_TICKET_SIGNATURE

Technical interpretation

TPM_E_MA_TICKET_SIGNATURE means the certified-migration authority ticket signature does not verify against the expected authority key.

The first producer to identify is the certified-migration, key-policy or EK administrative checkpoint. TPM 1.2 migration policy is encoded when a key is created and reinforced by signed authority tickets and source/destination bindings. Migration errors therefore require the original binary artifacts and key attributes, not only the user-visible key name.

Inputs and state to capture

A useful trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.

Validate without broad changes

The one-variable check is to verify the ticket signature independently with the exact authority key before submitting the migration command. Record the before/after state that the command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.

1. Capture this result and 0x8028005C at the first code-specific return boundary.
2. Decode the relevant state: key attributes, authority tickets, source and destination identities, signatures and provisioning state.
3. Run the controlled comparison once and preserve both binary transcripts.
4. Verify the expected output or state transition instead of relying on absence of a UI message.

Neighboring response codes

It specifically answers whether the certified-migration authority ticket signature does not verify against the expected authority key. In contrast, TPM_E_BAD_SIGNATURE concerns a CMK ticket signature more generally, while this code names the migration-authority ticket.

Fix and verify

To remediate it, obtain a correctly signed migration ticket and preserve the binary ticket without text or transport rewriting. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.

Authoritative references

• TCG: TPM 1.2 Main Specification.
• TCG: TPM 1.2 Part 2 — Certified migration structures.
• TCG: TPM 1.2 Part 3 — Migration commands.
• Microsoft: How Windows uses the TPM.