Home / The record / Mechanisms based on identities

The clause sets the conditions a domain must meet before an identity based mechanism is safe: chosen domain parameters, a modulus that nobody can factor, identification data with a clear convention, and a trusted copy of the right modulus at every verifier. Those are environmental promises, not implementation switches.

What it asks

Evidence each of the four conditions separately. Show the domain parameters and how they were distributed, the modulus arrangement and who holds the factors, the identification data convention, and how a verifier obtains a trusted modulus. A missing condition is a scope limit, not a documentation gap.

What the revision does

The fourth edition will restate the environmental conditions. The public record does not give the new wording, so the four conditions here are the 2009 baseline. The 2009 wording is therefore superseded at publication.

Who it binds

The domain authority, the verifier operator and the PKI or directory owner.

Evidence an auditor samples

• The domain parameter set, with its distribution record (cryptography standard)
• The modulus and factor custody record (key management)
• The identification data convention, with an example (interface specification)
• The trusted modulus path from directory or certificate to verifier (architecture)

The test you can run

Ask a verifier operator where the trusted modulus came from. If the answer is a local file with no update path, the fourth condition is not met.

Common failures

• The modulus is treated as a configuration value with no custody record.
• Identification data has no agreed convention, so two systems encode it differently.

How to close it

Treat the four conditions as four rows with an owner and a date. Where one is not met, record the compensating control and the scope it limits, rather than marking the whole deployment compliant. Put the domain parameter set, with its distribution record in the register first, then work down the evidence list until every line has a date.

Where it sits against the 2009 edition

The clause exists today as 4.1 in the 2009 edition. The fourth edition replaces it, and the public record stops before the new wording, so the obligation below is the one in force.

For the file, this row closes when the domain parameter set, with its distribution record exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The domain authority, the verifier operator and the PKI or directory owner. owns that answer for 4.1.