Home / The record / Asymmetric encryption systems

The environmental clause ties the mechanism to the properties of the encryption system, including its key pair, its padding or encoding and the trust a verifier places in the public key. A sound encryption system used with the wrong encoding can still fail the mechanism.

What it asks

Evidence the encryption system, its parameter set, its encoding and the public key trust path, and show that the encoding is the one the clause assumes. Where a library supplies a default encoding, record it and review it rather than leaving it implicit.

What the revision does

The fourth edition will restate these conditions. No public copy of the revised wording exists. The 2009 wording is therefore superseded at publication.

Who it binds

The cryptography owner and the PKI owner.

Evidence an auditor samples

• The encryption system and parameter set per deployment (cryptography standard)
• The encoding in use, with its review (design note)
• The public key trust path to the verifier (architecture)

The test you can run

Ask which encoding the mechanism uses. If the answer is the library default, the condition has not been evidenced.

Common failures

• The encoding is left at a default that the clause does not assume.
• The public key is trusted because it is in a local store.

How to close it

Write the encryption system, the parameters and the encoding on one line of the deployment record. Three values that are chosen together should be reviewed together. Start with the encryption system and parameter set per deployment and let the row close when it exists with a date and a named holder.

Where it sits against the 2009 edition

The 2009 edition carries 8.1, and the fourth edition replaces it. The public record does not give the new wording, so this page records the obligation that stands today and the question the revision has to answer.

For the file, this row closes when the encryption system and parameter set per deployment exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The cryptography owner and the PKI owner. owns that answer for 8.1.