What causes "unable to bind PCRs to auth policy: %v" in nats-io/nats-server?

Verify the configured PCR index exists in the TPM's SHA-256 PCR bank (tpm2_readpcr)

unable to bind PCRs to auth policy: %v

Error message

unable to bind PCRs to auth policy: %v

What it means

tpm2.PolicyPCR failed while binding the auth session to the given PCR index: the TPM rejected the PolicyPCR command for the session. This fires when the PCR index is out of range or not allocated in the SHA-256 bank, the session handle is invalid, or the TPM reports a policy/parameter error — the session cannot enforce PCR-based authorization.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:229

defer func() {
	if sessHandle != tpm2.HandleNull && err != nil {
		if err := tpm2.FlushContext(rwc, sessHandle); err != nil {
			retErr = fmt.Errorf("%v\nunable to flush session: %v", retErr, err)
		}
	}
}()

pcrSelection := tpm2.PCRSelection{
	Hash: tpm2.AlgSHA256,
	PCRs: []int{pcr},
}
if err := tpm2.PolicyPCR(rwc, sessHandle, nil, pcrSelection); err != nil {
	return sessHandle, nil, fmt.Errorf("unable to bind PCRs to auth policy: %v", err)
}
if err := tpm2.PolicyPassword(rwc, sessHandle); err != nil {
	return sessHandle, nil, fmt.Errorf("unable to require password for auth policy: %v", err)
}

View on GitHub (pinned to 3a66a489d2)

Solutions

Verify the configured PCR index exists in the TPM's SHA-256 PCR bank (tpm2_readpcr)
Check the wrapped TPM error code for the exact TPM_RC failure
Use a valid PCR selection consistent with what was used when the key was sealed
Retry after correcting the PCR configuration

Example fix

// before: hardcoded pcr that may not exist
pcrSelection := tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{pcr}}
// after: check bank support first
sels, err := tpm2.ReadPCRs(rwc, tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{pcr}})
if err != nil {
	return fmt.Errorf("PCR %d unavailable in SHA256 bank: %v", pcr, err)
}

Defensive patterns

Strategy: validation

Validate before calling

if pcr < 0 || pcr > 23 {
	return fmt.Errorf("PCR %d out of range", pcr)
}
if _, err := tpm2.ReadPCRs(rwc, tpm2.PCRSelection{Hash: tpm2.AlgSHA256, PCRs: []int{pcr}}); err != nil {
	return fmt.Errorf("PCR %d not in SHA-256 bank: %w", pcr, err)
}

Try / catch

sessHandle, policy, err := policyPCRPasswordSession(rwc, pcr)
if err != nil && strings.Contains(err.Error(), "unable to bind PCRs") {
	log.Printf("PCR %d cannot be bound to policy: %v — check SHA-256 PCR bank", pcr, err)
	return err
}

Prevention

Confirm the TPM exposes the configured PCR index in its SHA-256 bank.
Use PolicyGetCapabilities at startup to enumerate available PCRs.
Prefer widely supported PCRs (0, 7, 16) in configuration.

When it happens

Trigger: tpm2.PolicyPCR(rwc, sessHandle, nil, pcrSelection) errors — invalid PCR selection (bad index or hash alg unsupported), or invalid session handle.

Common situations: Configured pcr index not present in the SHA-256 bank; TPM lacking SHA-256 PCR bank (older/edge TPMs); session already flushed due to earlier failure.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/45c44674a761aa33. Report an issue: GitHub.