Home / The record / Discrete logarithm mechanisms

Key production selects the private exponent, derives the public value from the generator and records the pair against the domain parameters. The clause is short, and the common failure is a private exponent generated with a random source that was not fit for key material.

What it asks

Record the generator, the private exponent source and the public value for each key, and show that the random source meets the strength the key needs. Store the private exponent under the custody the clause assumes and test that a public value from a different group is rejected.

What the revision does

The fourth edition will restate key production. The public record does not give the new rules, so the 2009 description is the baseline. The 2009 wording is therefore superseded at publication.

Who it binds

The key management owner and the platform engineer who generates keys.

Evidence an auditor samples

• The key record, with generator, public value and generation date (key management)
• The random source and its strength evidence (platform baseline)
• The negative test with a public value from another group (test suite)

The test you can run

Ask which random source generated the last key. If the answer is the language default, the strength has not been shown.

Common failures

• The private exponent is generated from a predictable seed.
• A public value is accepted without checking it belongs to the group.

How to close it

Record the random source next to the key, not in a platform document nobody opens. The source is the part of key production that fails quietly, and it is the first thing a competent reviewer asks about. Put the key record, with generator, public value and generation date in the register first, then work down the evidence list until every line has a date.

Where it sits against the 2009 edition

The clause exists today as 6.2 in the 2009 edition. The fourth edition replaces it, and the public record stops before the new wording, so the obligation below is the one in force.

For the file, this row closes when the key record, with generator, public value and generation date exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The key management owner and the platform engineer who generates keys. owns that answer for 6.2.