| Previous | Next |
| TPM_20_E_RESERVED_BITS | TPM_20_E_EXPIRED |
TPM_20_E_BAD_AUTH
This response means that the TPM rejected a password or HMAC authorization, but the failure does not carry the dictionary-attack consequences of TPM_20_E_AUTH_FAIL. It is still a proof-of-knowledge failure, not evidence that a key, PCR value or TPM driver is corrupt.
What can make a correct secret produce this code
- An HMAC authorization is built from more than the secret: command parameters, handle names, nonces and session state participate in the calculation.
- A client can reuse a session context or nonce after it has changed, or attach a session to the wrong authorizable handle when a command has several handles.
- A policy can require an auth value through a policy command; supplying a policy session without the required proof is a different failure path from merely knowing the object name.
How to diagnose it
Identify whether the caller used a password session, HMAC session or policy session with an auth-value requirement. Trace the command and session state through the same TPM stack that produced the request. Do not switch randomly between empty and non-empty passwords: first check the object public attributes, configured policy and the exact handle being authorized.
TCG: HMAC and password authorization checks · tpm2_startauthsession · tpm2_policypassword
Looking for a different code? Search another status or error code.