| Previous | Next |
| STATUS_TPM_MA_AUTHORITY | STATUS_TPM_BAD_SIGNATURE |
STATUS_TPM_PERMANENTEK
The endorsement key is permanent and cannot be revoked by this command
STATUS_TPM_PERMANENTEK concerns the TPM endorsement key. TPM designs distinguish platform endorsement identity from ordinary application keys, and some endorsement keys are not revocable through the requested TPM command path.
This status means the caller attempted an EK revocation operation but the EK is permanent according to the TPM implementation or platform policy. That is not the same as a failed key deletion or a missing key handle.
Before attempting remediation, identify whether the platform supports revocable EK behavior at all. Many systems expose EK material as a manufacturer/platform identity anchor and do not allow ordinary software to replace it.
Diagnostic focus
- Check the TPM version, manufacturer, and platform-specific EK policy.
- Do not confuse EK revocation with deleting an application-created storage or signing key.
- Use vendor/platform provisioning documentation before attempting owner or firmware changes.
References
- TCG: TPM 1.2 Main Specification
- TCG: TPM 1.2 Part 1 Design Principles
- TCG: TPM 1.2 Part 2 Structures of the TPM
- TCG: TPM 1.2 Part 3 Commands
- Microsoft: TPM Base Services
- Microsoft: MS-ERREF NTSTATUS values
Looking for a different code? Search another status or error code.