# Clause 4 Identity based mechanisms, the FS and GQ1 schemes

This family lets a verifier check that a claimant knows private keys tied to its identification data. It covers the Fiat-Shamir and Guillou-Quisquater schemes, and it is the family whose cost is a short modular exponentiation with a challenge size that has to be chosen rather than inherited.

## What it asks

For each identity based deployment, record the scheme, the modulus arrangement and the challenge size, and show that the challenge size was chosen for the workload. A default challenge size copied from a sample is a finding, not a configuration.

## What the revision does

The fourth edition keeps the family and will restate its security requirements and key production. The public record does not disclose the clause-level changes.

## Who it binds

The owner of the identity platform and the security architect who approved the scheme.

## Evidence an auditor samples

- The scheme and challenge size per deployment (configuration management database)
- The workload calculation behind the challenge size (capacity plan)
- The test that shows the verifier rejects a wrong response (test suite)

## The test you can run

Ask why the challenge size is what it is. If the answer is that it came with the library, the choice has not been made.

## Common failures

- The challenge size is left at a library default with no workload note.
- Two deployments use different schemes under one product name.

## How to close it

Write the challenge size, the workload it implies and the date it was reviewed into the deployment record. The number is small; the reasoning is the evidence.

## Source

ISO/IEC 9798-5:2009(E), Clause 4, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.