Home / The record / Asymmetric encryption systems
8.2
The unilateral exchange built on encryption
The unilateral exchange uses the encryption system to carry or protect the values the verifier checks. The claimant proves knowledge of the private operation, and the verifier must be sure that what it decrypted or checked came from this exchange and not from an earlier one.
- What it asks
- Record the exchange and the binding between the encrypted material and the exchange context, and test a replayed message and a message from another session. Show that the verifier checks the context rather than only the plaintext.
- What the revision does
- The fourth edition will restate the exchange. The public record stops before the revised sequence. The 2009 wording is therefore superseded at publication.
- Who it binds
- The implementer and the tester.
- Evidence an auditor samples
- The exchange sequence and the context binding (interface specification)
- The replay test and its output (test report)
- The cross session test and its output (test report)
- The test you can run
- Replay a captured message in a new session. If it is accepted, the context is not bound.
- Common failures
- The encrypted payload carries no session identifier.
- The verifier checks the plaintext but not the context.
- How to close it
- Bind the exchange context into the protected material and test the binding by replay. The test is short, and it is the one that distinguishes a mechanism from a message format. The artefact that opens the work is the exchange sequence and the context binding; the row is only closed when that artefact is dated and has a person against it.
- Where it sits against the 2009 edition
- 8.2 is a 2009 clause that the revision replaces. For 8.2, the 2009 obligation is the one to evidence until publication; after it, this row is rebuilt against the published text.
For the file, this row closes when the exchange sequence and the context binding exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The implementer and the tester. owns that answer for 8.2.