# 5.3 The unilateral exchange with precomputed work

The exchange uses the precomputed coupon to keep the claimant cheap, then proves knowledge of the private components against a fresh challenge. The verifier sees a short exchange and does little work, which is the point of the family and also its operational risk.

## What it asks

Record the exchange, the coupon consumption point and the verifier checks, and test a consumed coupon, a stale challenge and a wrong component. Show that the verifier does the arithmetic the clause requires rather than trusting a claimant supplied result.

## What the revision does

The fourth edition will restate the exchange. The revised sequence is not public, so the 2009 exchange is the baseline here.

## Who it binds

The implementer of the claimant and the verifier operator.

## Evidence an auditor samples

- The exchange sequence with the coupon consumption point (interface specification)
- The verifier checks, listed one by one (design note)
- The tests for a consumed coupon, a stale challenge and a wrong component (test suite)

## The test you can run

Send the same coupon twice. If both exchanges succeed, single use is not enforced.

## Common failures

- The verifier accepts a claimant computed result instead of checking it.
- Coupon consumption is recorded after the response, so a crash allows reuse.

## How to close it

Make the coupon state change before the response leaves the claimant. The ordering is a one line decision that closes the replay window, and it is easy to test.

## Source

ISO/IEC 9798-5:2009(E), 5.3, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.