# 4.2 Key production: exponents, multiplicity and the accreditation exponent

Key production fixes the verification exponent, the pair and exchange multiplicity, the modulus size, the prime factors and the accreditation exponent, then derives the public and private keys from the identification data. Every one of those choices moves the security level, and the clause gives the relationships rather than a single approved set.

## What it asks

Record the exponent, the two multiplicity values and the modulus size for each deployment, and show the arithmetic that links them to the security level you claim. Keep the prime factors under the custody the clause assumes, and show that the private key derivation used the accreditation exponent rather than a shortcut.

## What the revision does

The fourth edition will restate the key production rules. The public record does not give the new text, so this page records the 2009 relationships as the baseline.

## Who it binds

The key management owner and the engineer who generates or loads the keys.

## Evidence an auditor samples

- The key generation record, with exponent, multiplicities and modulus size (key management)
- The security level calculation and the value it produces (design note)
- The custody record for the prime factors (key management)
- The derivation check that the private key matches the public key (test suite)

## The test you can run

Take one key pair and recompute the relationship the clause gives. If the numbers do not close, either the record or the key is wrong.

## Common failures

- The exponent is chosen for speed with no security level calculation.
- The private key is imported without a check that it matches the public key.

## How to close it

Keep the key generation record with the deployment, not with the vendor. The arithmetic is short enough to check, and a checked record is the difference between an assertion and evidence.

## Source

ISO/IEC 9798-5:2009(E), 4.2, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.