| Previous | Next |
| TPM_20_E_AUTH_MISSING | TPM_20_E_PCR |
TPM_20_E_POLICY
TPM_20_E_POLICY identifies failure of a policy condition itself, rather than failure to bind a completed policy session to an object's authPolicy. The TPM returns it when a policy operation evaluates false, for example when a numeric or bitwise comparison performed by a policy command does not have the required relationship.
Where this commonly originates
TPM2_PolicyNVandTPM2_PolicyCounterTimercompare an operand, offset and operation against TPM-held data.- Policy-ticket and capability operations can also reject an input condition while leaving the policy digest unchanged.
- A trial session can calculate a digest without enforcing the live condition, so a policy may look correct during construction and fail in a real policy session.
Diagnostic approach
Record the precise policy command, current policy session type, operand bytes, offset, comparison operator and TPM values used by the condition. Recreate the policy sequence in a real session, not only a trial session. This differs from TPM_20_E_POLICY_FAIL, which often indicates that an accumulated digest, cpHash or policy requirement does not match at authorization time.
TCG: policy comparison commands · tpm2_startauthsession · tpm2_policysecret
Looking for a different code? Search another status or error code.