What causes "unable to require password for auth policy: %v" in nats-io/nats-server?

Check the wrapped TPM error code for the exact TPM_RC failure

unable to require password for auth policy: %v

Error message

unable to require password for auth policy: %v

What it means

tpm2.PolicyPassword failed while asserting the PolicyPassword (PW) command on the policy session, which requires a password on subsequent authorization. The TPM rejected the command — typically an invalid session handle or TPM parameter error — so the policy cannot require password auth and sealing/unsealing is aborted.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:232

pcrSelection := tpm2.PCRSelection{
	Hash: tpm2.AlgSHA256,
	PCRs: []int{pcr},
}
if err := tpm2.PolicyPCR(rwc, sessHandle, nil, pcrSelection); err != nil {
	return sessHandle, nil, fmt.Errorf("unable to bind PCRs to auth policy: %v", err)
}
if err := tpm2.PolicyPassword(rwc, sessHandle); err != nil {
	return sessHandle, nil, fmt.Errorf("unable to require password for auth policy: %v", err)
}
policy, err = tpm2.PolicyGetDigest(rwc, sessHandle)
if err != nil {
	return sessHandle, nil, fmt.Errorf("unable to get policy digest: %v", err)
}
return sessHandle, policy, nil

View on GitHub (pinned to 3a66a489d2)

Solutions

Check the wrapped TPM error code for the exact TPM_RC failure
Verify the session handle is still valid (not flushed or expired)
Retry the policy session creation after the TPM recovers
Confirm TPM firmware supports the PolicyPassword command

Example fix

// before: partial retry of single policy step
// after: retry whole session creation
var sessHandle tpmutil.Handle
var policy []byte
for i := 0; i < 3; i++ {
	sessHandle, policy, err = policyPCRPasswordSession(rwc, pcr)
	if err == nil {
		break
	}
}

Defensive patterns

Strategy: retry

Type guard

func isPolicyPasswordError(err error) bool {
	return err != nil && strings.Contains(err.Error(), "unable to require password for auth policy")
}

Try / catch

sessHandle, policy, err := policyPCRPasswordSession(rwc, pcr)
if err != nil && isPolicyPasswordError(err) {
	// policy commands are atomic as a group; retry the whole session
	sessHandle, policy, err = policyPCRPasswordSession(rwc, pcr)
}

Prevention

Retry the entire session creation, never individual policy steps.
Avoid concurrent TPM operations that could invalidate the session.
Check TPM lockout state after repeated auth failures.

When it happens

Trigger: tpm2.PolicyPassword(rwc, sessHandle) returns error — invalid session handle (already flushed/terminated) or TPM communication failure.

Common situations: Session died between PolicyPCR and PolicyPassword (connection drop); TPM in lockout; rare TPM firmware quirks.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/5e721e310f622492. Report an issue: GitHub.