Home / The record / Mechanisms based on integer factorization

Key production in this family introduces the adaptation parameter, a public value tied to the modulus, and builds private components from the basic numbers and the prime factors. The parameter is what lets one modulus serve several claimants without giving each of them the factors.

What it asks

Record the adaptation parameter, the basic numbers and the private components for each claimant, and show how the parameter was derived rather than chosen by hand. Keep the prime factors out of every claimant environment, and test that a claimant with the wrong components is rejected.

What the revision does

The fourth edition will restate key production. The public record does not give the new rules, so the 2009 adaptation parameter description is the baseline. The 2009 wording is therefore superseded at publication.

Who it binds

The key management owner and the engineer who provisions claimants.

Evidence an auditor samples

• The adaptation parameter and its derivation (key management)
• The basic numbers per claimant, with their source (key management)
• The provisioning record that shows factors never reached the claimant (build record)
• The negative test with wrong private components (test suite)

The test you can run

Inspect a claimant environment for the prime factors. If they are present, the custody model has failed regardless of the key record.

Common failures

• The adaptation parameter is typed in by hand and never checked.
• The factors are present in a provisioning image for convenience.

How to close it

Automate the derivation and record its inputs and outputs. A hand entered parameter has no provenance, and provenance is the only thing that distinguishes a designed key from a guessed one. The artefact that opens the work is the adaptation parameter and its derivation; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the 2009 edition

5.2 is a 2009 clause that the revision replaces. For 5.2, the 2009 obligation is the one to evidence until publication; after it, this row is rebuilt against the published text.

For the file, this row closes when the adaptation parameter and its derivation exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The key management owner and the engineer who provisions claimants. owns that answer for 5.2.