| Previous | Next |
| TPM_E_TOOMANYCONTEXTS | TPM_E_MA_DESTINATION |
TPM_E_MA_TICKET_SIGNATURE
Technical interpretation
TPM_E_MA_TICKET_SIGNATURE (0x8028005C) belongs to TPM 1.2 key migration and endorsement policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the certified-migration authority ticket signature does not verify against the expected authority key.
The first producer to identify for this HRESULT is the certified-migration, key-policy or EK administrative checkpoint. TPM 1.2 migration policy is encoded when a key is created and reinforced by signed authority tickets and source/destination bindings. Migration errors therefore require the original binary artifacts and key attributes, not only the user-visible key name.
Inputs and state to capture
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the certified-migration authority ticket signature does not verify against the expected authority key |
| Which layer owns the result? | The certified-migration, key-policy or EK administrative checkpoint. |
| What must be correlated? | ticket bytes, signature algorithm, authority public key and digest, destination and source identities, and canonical encoding |
| What is the controlled comparison? | verify the ticket signature independently with the exact authority key before submitting the migration command |
A useful this result trace links three code-specific timelines: the application call, the local TBS/provider or firmware event, and the raw command/response exchange. The result timestamps should describe one attempt; combining data from separate retries is particularly misleading for authorization sessions, context counters, DAA stages and lockout state.
Validate without broad changes
The one-variable check is to verify the ticket signature independently with the exact authority key before submitting the migration command. Record the before/after state that the result command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.
- Capture this result and
0x8028005Cat the first code-specific return boundary. - Decode the result state: key attributes, authority tickets, source and destination identities, signatures and provisioning state.
- Run the result controlled comparison once and preserve both binary transcripts.
- Verify the expected this result output or state transition instead of relying on absence of a UI message.
Neighboring response codes
| Comparison code | Built-in distinction |
|---|---|
TPM_E_MA_DESTINATION | Migration destination not authenticated — a separate checkpoint when compared with it. |
TPM_E_BAD_MIGRATION | The migration properties of this key are incorrect — a separate checkpoint when compared with it. |
TPM_E_MA_SOURCE | Migration source incorrect — a separate checkpoint when compared with it. |
It specifically answers whether the certified-migration authority ticket signature does not verify against the expected authority key. In contrast, TPM_E_BAD_SIGNATURE concerns a CMK ticket signature more generally, while this code names the migration-authority ticket.
Fix and verify
To remediate it, obtain a correctly signed migration ticket and preserve the binary ticket without text or transport rewriting. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.
After correcting it, start with a fresh caller context where the protocol requires one, replay the original intended operation, and confirm that hardware-backed policy remains enforced.
Authoritative references
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Certified migration structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Migration commands — source for the checkpoint.
- Microsoft: How Windows uses the TPM — source for the checkpoint.
Looking for a different code? Search another status or error code.