| Previous | Next |
| STATUS_INVALID_SIGNATURE | STATUS_AUTH_TAG_MISMATCH |
STATUS_HMAC_NOT_SUPPORTED
The provider does not expose the requested HMAC mode
HMAC combines a secret key with a cryptographic hash to authenticate data. This status means the provider selected for the request cannot supply that construction in the requested configuration. It is different from an HMAC comparison failure: no valid tag was computed or checked because the algorithm capability was unavailable.
On Windows, algorithm providers can expose different operations, properties, key formats, and policy restrictions. A hash algorithm that is available for ordinary digest generation is not automatically usable as HMAC through every provider. The caller should negotiate a supported provider and algorithm rather than silently substituting a different primitive.
What to inspect
- Record the algorithm identifier, provider name, open flags, key type, and requested output length.
- Confirm that the provider was opened for HMAC rather than for an unkeyed hash operation.
- Check FIPS or product security policy for restrictions on the selected hash and provider.
- Treat algorithm substitution as a protocol change; both producer and verifier must agree on it.
References
- Microsoft Open Specifications: NTSTATUS values
- IETF RFC 2104: HMAC
- Microsoft: BCryptOpenAlgorithmProvider
- Microsoft Windows SDK metadata: ntstatus.h
Looking for a different code? Search another status or error code.