# 5.2 Key production with an adaptation parameter

Key production in this family introduces the adaptation parameter, a public value tied to the modulus, and builds private components from the basic numbers and the prime factors. The parameter is what lets one modulus serve several claimants without giving each of them the factors.

## What it asks

Record the adaptation parameter, the basic numbers and the private components for each claimant, and show how the parameter was derived rather than chosen by hand. Keep the prime factors out of every claimant environment, and test that a claimant with the wrong components is rejected.

## What the revision does

The fourth edition will restate key production. The public record does not give the new rules, so the 2009 adaptation parameter description is the baseline.

## Who it binds

The key management owner and the engineer who provisions claimants.

## Evidence an auditor samples

- The adaptation parameter and its derivation (key management)
- The basic numbers per claimant, with their source (key management)
- The provisioning record that shows factors never reached the claimant (build record)
- The negative test with wrong private components (test suite)

## The test you can run

Inspect a claimant environment for the prime factors. If they are present, the custody model has failed regardless of the key record.

## Common failures

- The adaptation parameter is typed in by hand and never checked.
- The factors are present in a provisioning image for convenience.

## How to close it

Automate the derivation and record its inputs and outputs. A hand entered parameter has no provenance, and provenance is the only thing that distinguishes a designed key from a guessed one.

## Source

ISO/IEC 9798-5:2009(E), 5.2, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.