Home / The record / Elliptic curve mechanisms

The environmental clause fixes the curve, the base point, the subgroup and the trust path for the public value. Because the arithmetic is compact, the security of the deployment is almost entirely a property of the parameters and of the point validation the verifier performs.

What it asks

Evidence the curve and base point, their approval and the verifier trust path, and show that the verifier pins the parameters rather than accepting them from the claimant. Record the point validation rule in the test plan, not only in the code.

What the revision does

The fourth edition will restate these conditions. The revised wording is not public. The 2009 wording is therefore superseded at publication.

Who it binds

The domain authority and the verifier operator.

Evidence an auditor samples

• The curve and base point approval record (cryptography standard)
• The verifier configuration that pins the curve (configuration management database)
• The point validation rule in the test plan (test plan)

The test you can run

Ask a verifier whether it would accept a different curve from a claimant. If the answer is yes, the parameters are not pinned.

Common failures

• The curve is a runtime parameter supplied by the peer.
• Validation is implemented but not covered by a test.

How to close it

Pin the curve, the base point and the subgroup order as one configuration object, and test the pin. Three values that only work together should be changed together or not at all. The artefact that opens the work is the curve and base point approval record; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the 2009 edition

9.1 is a 2009 clause that the revision replaces. For 9.1, the 2009 obligation is the one to evidence until publication; after it, this row is rebuilt against the published text.

For the file, this row closes when the curve and base point approval record exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The domain authority and the verifier operator. owns that answer for 9.1.