self-test show 80280084

[Cunnn]

Hi go-attestation team,

When running ./attest-tool self-test, the log shows FAIL and returns the following error message:

FAIL Error: credential activation failed: failed to generate activate credential: 
NCryptGetProperty returned 80280084 (tpm or subsystem failure: TPM_20_E_VALUE: 
TPM 2.0: Value is out of range or is not correct for the context.) for key activation

The test environment is Windows 11 25H2 (Build 26100.7171), TPM manufacturer is STM, version 9.258, TPM 2.0.
I contacted the vendor, but their response was that they are not aware of the specific operations performed by self-test, so they cannot determine the cause of the failure. Interestingly, when we reworked another STM TPM (version: 1.769.0.0) chip onto the same board, the test result was PASS.

Could you help me clarify this issue?

Thanks.

[liamjm]

Interesting, I have seen a similar log line failed to generate activation challenge: NCryptGetProperty returned 80280084 (The operation completed successfully.) for key activation, for an internal (to Google) machine. In that case the TPM was manufactured by "Nuvoton Technology", not STM in this issue. But Windows is common to both examples.

I noticed in the scenario we have detected that the SHA1 PCR bank was not present. This has caused some issues in the past (eg #404) but most of this focused in linux, so there may very well be some Windows-specific issues.

I have been looking at some other issues on Windows recently, but have not had time to look into this.

Next steps:

• the tool should be a improved a little to be more verbose, as it could help debug this.
• @Cunnn : can you also run attest-tool with the list-pcrs and dump commands. This might shed light on this PCR hypothesis.

Thanks.

[Cunnn]

Hi @liamjm

I ran ./attest-tool list-pcrs and ./attest-tool dump got the following log. Currently, I see the same result on both versions 9.258.0.0 and 1.769.0.0:
Error: failed to read PCRs: failed to read PCRs: failed to read app PCRs, Only read 0

Is there any other way I can provide useful information for your analysis?