| Previous | Next |
| STATUS_TPM_BAD_MIGRATION | STATUS_TPM_BAD_DATASIZE |
STATUS_TPM_BAD_SCHEME
The selected TPM cryptographic scheme is not permitted
STATUS_TPM_BAD_SCHEME is a Windows NTSTATUS value mapped from the TPM facility. For STATUS_TPM_BAD_SCHEME, in this package the code belongs to TPM 1.2 style command processing, where Windows software, TBS, the TPM driver, and the hardware device all may be visible in the same failure path.
The relevant area is TPM schemes for signing and encryption. The TPM rejected the requested signature or encryption scheme because it is not correct for the key, command, or current situation.
This overlaps with but is not identical to unsupported key properties. A key can exist and be valid while a particular scheme is illegal for a specific command. Diagnose the combination of key usage, algorithm, scheme, padding, and command ordinal.
Diagnostic focus
- Log key usage, algorithm, scheme, and command ordinal as one tuple.
- Check whether the scheme is legal for both the key template and the operation.
- Avoid changing only the padding/scheme field without validating the rest of the key properties.
References for STATUS_TPM_BAD_SCHEME
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: TPM fundamentals
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.