| Previous | Next |
| STATUS_TPM_ERROR_MASK | STATUS_TPM_BADINDEX |
STATUS_TPM_AUTHFAIL
The TPM rejected the command authorization
STATUS_TPM_AUTHFAIL is a Windows NTSTATUS value mapped from the TPM facility. For STATUS_TPM_AUTHFAIL, in this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.
The relevant area is authorization sessions and object AuthData. The command reached the TPM path, but the authorization material supplied for an owner, key, sealed blob, NV index, or session did not validate for the entity being used.
This is different from a missing key handle or blocked Windows policy. Reusing a stale authorization session, using the wrong object secret, mixing owner and key authorization, or replaying command parameters after nonce/state changed can all produce this class of TPM response.
Diagnostic focus
- Log which entity required authorization: owner, SRK, loaded key, sealed-data blob, or NV object.
- Check that the session nonce and command parameters are exactly the values used to compute the authorization digest.
- Do not fix this by recreating the TPM device; first verify the caller secret and session lifetime.
References for STATUS_TPM_AUTHFAIL
- TCG: TPM 1.2 Main Specification
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: TPM Base Services
- Microsoft: Using TPM Base Services
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.