Home / The record / Mechanisms based on integer factorization

The exchange uses the precomputed coupon to keep the claimant cheap, then proves knowledge of the private components against a fresh challenge. The verifier sees a short exchange and does little work, which is the point of the family and also its operational risk.

What it asks

Record the exchange, the coupon consumption point and the verifier checks, and test a consumed coupon, a stale challenge and a wrong component. Show that the verifier does the arithmetic the clause requires rather than trusting a claimant supplied result.

What the revision does

The fourth edition will restate the exchange. The revised sequence is not public, so the 2009 exchange is the baseline here. The 2009 wording is therefore superseded at publication.

Who it binds

The implementer of the claimant and the verifier operator.

Evidence an auditor samples

• The exchange sequence with the coupon consumption point (interface specification)
• The verifier checks, listed one by one (design note)
• The tests for a consumed coupon, a stale challenge and a wrong component (test suite)

The test you can run

Send the same coupon twice. If both exchanges succeed, single use is not enforced.

Common failures

• The verifier accepts a claimant computed result instead of checking it.
• Coupon consumption is recorded after the response, so a crash allows reuse.

How to close it

Make the coupon state change before the response leaves the claimant. The ordering is a one line decision that closes the replay window, and it is easy to test. Put the exchange sequence with the coupon consumption point in the register first, then work down the evidence list until every line has a date.

Where it sits against the 2009 edition

The clause exists today as 5.3 in the 2009 edition. The fourth edition replaces it, and the public record stops before the new wording, so the obligation below is the one in force.

For the file, this row closes when the exchange sequence with the coupon consumption point exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The implementer of the claimant and the verifier operator. owns that answer for 5.3.