{"record":{"id":"4c1bce86f29c2013","repo":"gravitational/teleport","slug":"signchallenge-not-implemented-for-tpm-devices-4c1bce","errorCode":null,"errorMessage":"signChallenge not implemented for TPM devices","messagePattern":"signChallenge not implemented for TPM devices","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/devicetrust/native/device_windows.go","lineNumber":60,"sourceCode":")\n\n// deviceStateFolderName starts with a \".\" on Windows for backwards\n// compatibility, but in practice it does not need to.\nconst deviceStateFolderName = \".teleport-device\"\n\nvar windowsDevice = &tpmDevice{\n\tisElevatedProcess: func() (bool, error) {\n\t\treturn windows.GetCurrentProcessToken().IsElevated(), nil\n\t},\n\tactivateCredentialInElevatedChild: activateCredentialInElevatedChild,\n}\n\nfunc enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {\n\treturn windowsDevice.enrollDeviceInit()\n}\n\nfunc signChallenge(chal []byte) (sig []byte, err error) {\n\treturn nil, errors.New(\"signChallenge not implemented for TPM devices\")\n}\n\nfunc getDeviceCredential() (*devicepb.DeviceCredential, error) {\n\treturn windowsDevice.getDeviceCredential()\n}\n\nfunc solveTPMEnrollChallenge(\n\tchal *devicepb.TPMEnrollChallenge,\n\tdebug bool,\n) (*devicepb.TPMEnrollChallengeResponse, error) {\n\treturn windowsDevice.solveTPMEnrollChallenge(chal, debug)\n}\n\nfunc solveTPMAuthnDeviceChallenge(\n\tchal *devicepb.TPMAuthenticateDeviceChallenge,\n) (*devicepb.TPMAuthenticateDeviceChallengeResponse, error) {\n\treturn windowsDevice.solveTPMAuthnDeviceChallenge(chal)\n}","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/devicetrust/native/device_windows.go#L42-L78","documentation":"Sentinel-style unimplemented error returned unconditionally by signChallenge on Windows. Device Trust signing for TPM-backed devices was never implemented: enrollment and activation work via windowsDevice/activateCredentialInElevatedChild, but any attempt to sign a challenge fails here, so TPM-enrolled Windows devices cannot complete device authentication challenges.","triggerScenarios":"Thrown at lib/devicetrust/native/device_windows.go:60 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enroll the device on a supported platform (e.g. macOS)","File an issue with Teleport to request Windows TPM signChallenge support"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}