What does HRESULT 0x80280149 (TPM_20_E_NV_AUTHORIZATION) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The authorization path selected for a TPM NV command does not satisfy that index's access policy.

Previous	Next
TPM_20_E_NV_LOCKED	TPM_20_E_UNINITIALIZED

TPM_20_E_NV_AUTHORIZATION

TPM_20_E_NV_AUTHORIZATION is an NV access-control result. The index exists, but the command's selected authorization path does not satisfy the read or write policy for that command. NV access can be authorized by the index itself, an owner or platform hierarchy, platform-authorization conditions, or a policy session, depending on the index attributes.

What to compare

The operation being requested: read, write, increment, extend, set bits, or lock commands may have different authorization rules.
The index public attributes, including the read or write authorization flags and any policy requirement.
The command's authorization handle and session type. A valid password or HMAC for one hierarchy is not automatically valid for an NV index or a policy session.

Why this is not simply a bad password

TPM_20_E_AUTH_FAIL and TPM_20_E_BAD_AUTH describe authorization verification failures at the session level. TPM_20_E_NV_AUTHORIZATION instead says that the completed command action is not authorized for the NV index under its defined access rules.

Useful checks

Use tpm2_nvreadpublic to retrieve the exact public definition before choosing an authorization handle.
Verify that the policy digest or hierarchy authorization used by the client matches the index definition created during provisioning.
Do not weaken attributes or replace a policy merely to make a failing command succeed; the error may be enforcing the intended security model.

References: TCG TPM 2.0 Library Part 3: Commands, tpm2_nvread, and tpm2_nvwrite.

Looking for a different code? Search another status or error code.