Home / The record / Elliptic curve mechanisms

Key production selects the private scalar and derives the public point, and this subclause is also where the verifier coupon strategy appears. That is unusual: it lets a verifier with little power do the checking, and it changes what the verifier has to store and protect.

What it asks

Record the private scalar source, the public point derivation and the coupon arrangement on the verifier. Show that a verifier coupon is used once and that exhaustion is handled, and keep the private scalar under the custody the clause assumes.

What the revision does

The fourth edition will restate key production and the verifier coupon. The public record stops before the new rules. The 2009 wording is therefore superseded at publication.

Who it binds

The key management owner and the verifier operator.

Evidence an auditor samples

• The key record with scalar source and public point (key management)
• The verifier coupon policy, with single use and exhaustion (design note)
• The test that a reused verifier coupon is rejected (test suite)

The test you can run

Ask what the verifier does when its coupon store is empty. If it falls back to a slower path without an alarm, the operational limit is unowned.

Common failures

• Verifier coupons are reused across sessions.
• The scalar source is a general purpose random function with no strength review.

How to close it

Treat the verifier coupon store as a protected asset with a count and an alarm. It is the part of this family that differs from every other, so it deserves its own line in the risk register. Put the key record with scalar source and public point in the register first, then work down the evidence list until every line has a date.

Where it sits against the 2009 edition

The clause exists today as 9.2 in the 2009 edition. The fourth edition replaces it, and the public record stops before the new wording, so the obligation below is the one in force.

For the file, this row closes when the key record with scalar source and public point exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The key management owner and the verifier operator. owns that answer for 9.2.