{"record":{"id":"45c44674a761aa33","repo":"nats-io/nats-server","slug":"unable-to-bind-pcrs-to-auth-policy-v","errorCode":null,"errorMessage":"unable to bind PCRs to auth policy: %v","messagePattern":"unable to bind PCRs to auth policy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/tpm/js_ek_tpm_windows.go","lineNumber":229,"sourceCode":"defer func() {\n\tif sessHandle != tpm2.HandleNull && err != nil {\n\t\tif err := tpm2.FlushContext(rwc, sessHandle); err != nil {\n\t\t\tretErr = fmt.Errorf(\"%v\\nunable to flush session: %v\", retErr, err)\n\t\t}\n\t}\n}()\n\npcrSelection := tpm2.PCRSelection{\n\tHash: tpm2.AlgSHA256,\n\tPCRs: []int{pcr},\n}\nif err := tpm2.PolicyPCR(rwc, sessHandle, nil, pcrSelection); err != nil {\n\treturn sessHandle, nil, fmt.Errorf(\"unable to bind PCRs to auth policy: %v\", err)\n}\nif err := tpm2.PolicyPassword(rwc, sessHandle); err != nil {\n\treturn sessHandle, nil, fmt.Errorf(\"unable to require password for auth policy: %v\", err)\n}","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/tpm/js_ek_tpm_windows.go#L211-L247","documentation":"tpm2.PolicyPCR failed while binding the auth session to the given PCR index: the TPM rejected the PolicyPCR command for the session. This fires when the PCR index is out of range or not allocated in the SHA-256 bank, the session handle is invalid, or the TPM reports a policy/parameter error — the session cannot enforce PCR-based authorization.","triggerScenarios":"tpm2.PolicyPCR(rwc, sessHandle, nil, pcrSelection) errors — invalid PCR selection (bad index or hash alg unsupported), or invalid session handle.","commonSituations":"Configured pcr index not present in the SHA-256 bank; TPM lacking SHA-256 PCR bank (older/edge TPMs); session already flushed due to earlier failure.","solutions":["Verify the configured PCR index exists in the TPM's SHA-256 PCR bank (tpm2_readpcr)","Check the wrapped TPM error code for the exact TPM_RC failure","Use a valid PCR selection consistent with what was used when the key was sealed","Retry after correcting the PCR configuration"],"exampleFix":"// before: hardcoded pcr that may not exist\npcrSelection := tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{pcr}}\n// after: check bank support first\nsels, err := tpm2.ReadPCRs(rwc, tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{pcr}})\nif err != nil {\n\treturn fmt.Errorf(\"PCR %d unavailable in SHA256 bank: %v\", pcr, err)\n}","handlingStrategy":"validation","validationCode":"if pcr < 0 || pcr > 23 {\n\treturn fmt.Errorf(\"PCR %d out of range\", pcr)\n}\nif _, err := tpm2.ReadPCRs(rwc, tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{pcr}}); err != nil {\n\treturn fmt.Errorf(\"PCR %d not in SHA-256 bank: %w\", pcr, err)\n}","typeGuard":null,"tryCatchPattern":"sessHandle, policy, err := policyPCRPasswordSession(rwc, pcr)\nif err != nil && strings.Contains(err.Error(), \"unable to bind PCRs\") {\n\tlog.Printf(\"PCR %d cannot be bound to policy: %v — check SHA-256 PCR bank\", pcr, err)\n\treturn err\n}","preventionTips":["Confirm the TPM exposes the configured PCR index in its SHA-256 bank.","Use PolicyGetCapabilities at startup to enumerate available PCRs.","Prefer widely supported PCRs (0, 7, 16) in configuration."],"tags":["tpm","windows","pcr","policy","go"],"backgroundTag":"tpm-policy-pcr-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}