Home / The record / The revision frame

The scope names five families: identity based mechanisms, integer factorization, discrete logarithms over prime or composite moduli, asymmetric encryption systems, and discrete logarithms on elliptic curves. It also says the mechanisms follow zero-knowledge principles without being zero-knowledge for every parameter choice.

What it asks

State which of the five families your estate uses, and do not describe any of them as fully zero-knowledge. The qualification in the scope is the sentence a security review will quote, so the design note should carry it rather than a stronger claim.

What the revision does

The fourth edition carries the same five families and the same qualification. The public record does not give the revised clause text. The 2009 wording is therefore superseded at publication.

Who it binds

The author of the cryptography standard and anyone who describes the mechanism to a customer or auditor.

Evidence an auditor samples

• The mechanism family list, with the systems in each (cryptography standard)
• The design note sentence that carries the zero-knowledge qualification (architecture)
• The customer statement that avoids a stronger claim (sales collateral)

The test you can run

Search the customer documents for the phrase zero knowledge. If it appears without the qualification the scope makes, the claim is stronger than the text supports.

Common failures

• Marketing describes the mechanism as zero knowledge with no qualification.
• The scope is quoted from the 2009 edition without naming the edition.

How to close it

Copy the qualification into every place that describes the mechanism. It is one sentence, it is defensible, and it prevents the review finding that the organisation claimed more than the standard says. The artefact that opens the work is the mechanism family list, with the systems in each; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the 2009 edition

Clause 1 is a 2009 clause that the revision replaces. For Clause 1, the 2009 obligation is the one to evidence until publication; after it, this row is rebuilt against the published text.

For the file, this row closes when the mechanism family list, with the systems in each exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The author of the cryptography standard and anyone who describes the mechanism to a customer or auditor. owns that answer for Clause 1.