Home / The record / Mechanisms based on identities

Key production fixes the verification exponent, the pair and exchange multiplicity, the modulus size, the prime factors and the accreditation exponent, then derives the public and private keys from the identification data. Every one of those choices moves the security level, and the clause gives the relationships rather than a single approved set.

What it asks

Record the exponent, the two multiplicity values and the modulus size for each deployment, and show the arithmetic that links them to the security level you claim. Keep the prime factors under the custody the clause assumes, and show that the private key derivation used the accreditation exponent rather than a shortcut.

What the revision does

The fourth edition will restate the key production rules. The public record does not give the new text, so this page records the 2009 relationships as the baseline. The 2009 wording is therefore superseded at publication.

Who it binds

The key management owner and the engineer who generates or loads the keys.

Evidence an auditor samples

• The key generation record, with exponent, multiplicities and modulus size (key management)
• The security level calculation and the value it produces (design note)
• The custody record for the prime factors (key management)
• The derivation check that the private key matches the public key (test suite)

The test you can run

Take one key pair and recompute the relationship the clause gives. If the numbers do not close, either the record or the key is wrong.

Common failures

• The exponent is chosen for speed with no security level calculation.
• The private key is imported without a check that it matches the public key.

How to close it

Keep the key generation record with the deployment, not with the vendor. The arithmetic is short enough to check, and a checked record is the difference between an assertion and evidence. Start with the key generation record, with exponent, multiplicities and modulus size and let the row close when it exists with a date and a named holder.

Where it sits against the 2009 edition

The 2009 edition carries 4.2, and the fourth edition replaces it. The public record does not give the new wording, so this page records the obligation that stands today and the question the revision has to answer.

For the file, this row closes when the key generation record, with exponent, multiplicities and modulus size exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The key management owner and the engineer who generates or loads the keys. owns that answer for 4.2.