Home / The record / Mechanisms based on identities

This family lets a verifier check that a claimant knows private keys tied to its identification data. It covers the Fiat-Shamir and Guillou-Quisquater schemes, and it is the family whose cost is a short modular exponentiation with a challenge size that has to be chosen rather than inherited.

What it asks

For each identity based deployment, record the scheme, the modulus arrangement and the challenge size, and show that the challenge size was chosen for the workload. A default challenge size copied from a sample is a finding, not a configuration.

What the revision does

The fourth edition keeps the family and will restate its security requirements and key production. The public record does not disclose the clause-level changes. The 2009 wording is therefore superseded at publication.

Who it binds

The owner of the identity platform and the security architect who approved the scheme.

Evidence an auditor samples

• The scheme and challenge size per deployment (configuration management database)
• The workload calculation behind the challenge size (capacity plan)
• The test that shows the verifier rejects a wrong response (test suite)

The test you can run

Ask why the challenge size is what it is. If the answer is that it came with the library, the choice has not been made.

Common failures

• The challenge size is left at a library default with no workload note.
• Two deployments use different schemes under one product name.

How to close it

Write the challenge size, the workload it implies and the date it was reviewed into the deployment record. The number is small; the reasoning is the evidence. The artefact that opens the work is the scheme and challenge size per deployment; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the 2009 edition

Clause 4 is a 2009 clause that the revision replaces. For Clause 4, the 2009 obligation is the one to evidence until publication; after it, this row is rebuilt against the published text.

For the file, this row closes when the scheme and challenge size per deployment exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The owner of the identity platform and the security architect who approved the scheme. owns that answer for Clause 4.