The tokendb.allowedTransitions currently contains the following token state transitions by default:

• UNINITIALIZED -> TEMP_LOST
• TEMP_LOST -> ACTIVE

This allows an UNINITIALIZED token to become ACTIVE without going through enrollment process.

The TPS should only allow a temporarily lost token to go back to the previous state:

• UNINITIALIZED -> TEMP_LOST -> UNINITIALIZED
• ACTIVE -> TEMP_LOST -> ACTIVE

Option #1: Remove TEMP_LOST -> ACTIVE from tokendb.allowedTransitions. The TPS will dynamically allow TEMP_LOST -> UNINITIALIZED if the token has no certificates, or TEMP_LOST -> ACTIVE if the token has certificates.

Option #2: Remove UNINITIALIZED -> TEMP_LOST from tokendb.allowedTransitions so only an active token can be temporarily lost. If an uninitialized token is temporarily lost, it may be considered irrelevant to TPS since it doesn't contain certificates, so it can remain UNINITIALIZED. If the uninitialized token becomes permanently lost, it can be changed from UNINITIALIZED -> PERM_LOST directly.

Option #3: Create separate UNINITIALIZED_TEMP_LOST and ACTIVE_TEMP_LOST states.