gravitational/teleport · error

signChallenge not implemented for TPM devices

Error message

signChallenge not implemented for TPM devices

What it means

Stub on Linux: TPM device enrollment implements ECDH-attestation via activateCredential, but challenge signing with the TPM (used for device authentication) is not implemented on this platform, so signChallenge always fails.

Source

Thrown at lib/devicetrust/native/device_linux.go:64

var linuxDevice = &tpmDevice{
	isElevatedProcess: func() (bool, error) {
		// Always run TPM operations in-process.
		// The Linux impl will selectively escalate, via sudo, if necessary.
		return true, nil
	},
	activateCredentialInElevatedChild: func(encryptedCredential attest.EncryptedCredential, credActivationPath string, debug bool) ([]byte, error) {
		return nil, errors.New("elevated credential activation not implemented for linux")
	},
}

func enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
	init, err := linuxDevice.enrollDeviceInit()
	return init, rewriteTPMPermissionError(err)
}

func signChallenge(chal []byte) (sig []byte, err error) {
	return nil, errors.New("signChallenge not implemented for TPM devices")
}

func getDeviceCredential() (*devicepb.DeviceCredential, error) {
	cred, err := linuxDevice.getDeviceCredential()
	return cred, rewriteTPMPermissionError(err)
}

func solveTPMEnrollChallenge(
	chal *devicepb.TPMEnrollChallenge,
	debug bool,
) (*devicepb.TPMEnrollChallengeResponse, error) {
	// No need to call rewriteTPMPermissionError here, enrollDeviceInit must pass
	// first.
	return linuxDevice.solveTPMEnrollChallenge(chal, debug)
}

func solveTPMAuthnDeviceChallenge(
	chal *devicepb.TPMAuthenticateDeviceChallenge,

View on GitHub (pinned to 1283425b60)

Solutions

1. Enroll the device on a supported platform (e.g. macOS or Windows)
2. File an issue with Teleport to request Linux TPM signChallenge support

When it happens

Trigger: Thrown at lib/devicetrust/native/device_linux.go:64 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/b250b09324012b23. Report an issue: GitHub.