| Previous | Next |
| TPM_E_MA_DESTINATION | TPM_E_MA_AUTHORITY |
TPM_E_MA_SOURCE
Which layer owns this HRESULT
TPM_E_MA_SOURCE (0x8028005E) belongs to TPM 1.2 key migration and endorsement policy. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the source identity or source binding in the certified-migration workflow is inconsistent.
The first producer to identify for this HRESULT is the certified-migration, key-policy or EK administrative checkpoint. TPM 1.2 migration policy is encoded when a key is created and reinforced by signed authority tickets and source/destination bindings. Migration errors therefore require the original binary artifacts and key attributes, not only the user-visible key name.
The result value 0x8028005E should remain attached to the symbolic name. Some this result logs store the value as a negative signed integer; others expose only a generic CNG, WMI, BitLocker or enrollment message. Neither substitution identifies the source identity or source binding in the certified-migration workflow is inconsistent as precisely as it.
Diagnostic record
- Producer for this HRESULT: the certified-migration, key-policy or EK administrative checkpoint.
- Rejected invariant: the source identity or source binding in the certified-migration workflow is inconsistent.
- Decisive capture: source key and digest, original CMK attributes, authority ticket, destination data, parent relationship, and migration command.
- Safe comparison: reconstruct the migration package from the original source key and compare all source identifiers.
How to verify the distinction
Build the result minimal case around the original command contract. Use a disposable object when the request can write NV data, advance a counter, change authorization state or consume a lock transition. The comparison is valid only when the caller, TPM generation and security policy remain the same.
| Question | Evidence for this HRESULT |
|---|---|
| What exact state was rejected? | the source identity or source binding in the certified-migration workflow is inconsistent |
| Which layer owns the result? | The certified-migration, key-policy or EK administrative checkpoint. |
| What must be correlated? | source key and digest, original CMK attributes, authority ticket, destination data, parent relationship, and migration command |
| What is the controlled comparison? | reconstruct the migration package from the original source key and compare all source identifiers |
Common false equivalences
| Constant | Checkpoint represented by its standard message |
|---|---|
TPM_E_MA_AUTHORITY | Incorrect migration authority — a separate checkpoint when compared with this result. |
TPM_E_MA_DESTINATION | Migration destination not authenticated — a separate checkpoint when compared with this result. |
TPM_E_PERMANENTEK | Attempt to revoke the EK and the EK is not revocable — a separate checkpoint when compared with it. |
The codes above may appear in the same workflow, but they are not aliases. TPM_E_MA_DESTINATION concerns authentication of the target rather than the source.
What a real fix looks like
Use the actual originating cmk and issue a new authority-approved migration package. Do not edit a signed ticket, migration blob or opaque private-key structure. Binary normalization, JSON conversion or base64 line handling can invalidate the authority and integrity relationships.
Proof for this HRESULT consists of a successful replay plus validation of the intended key, PCR, NV, context, event-log, provider or service result. A software fallback or a newly provisioned blank TPM answers a different question than it.
Source material
- TCG: TPM 1.2 Main Specification — source for the checkpoint.
- TCG: TPM 1.2 Part 2 — Certified migration structures — source for the checkpoint.
- TCG: TPM 1.2 Part 3 — Migration commands — source for the checkpoint.
- Microsoft: How Windows uses the TPM — source for the checkpoint.
Looking for a different code? Search another status or error code.