# Clause 5 Integer factorization, and the cost that falls on the claimant

The factorization family derives its security from the difficulty of factoring a modulus, and it allows a coupon strategy in which the claimant precomputes work. That shifts the cost to key production and makes the verifier cheap, which is why the family survives in constrained devices.

## What it asks

Record the modulus arrangement, the basic numbers and the coupon policy for each deployment. Show that a coupon is used once, that exhaustion is handled, and that the verifier can still reject a wrong response when the claimant is slow or offline.

## What the revision does

The fourth edition keeps the family and will restate its clauses. The revised text is not public.

## Who it binds

The owner of the constrained device estate and the key management owner.

## Evidence an auditor samples

- The modulus and basic number record per deployment (key management)
- The coupon policy, including single use and exhaustion (design note)
- The test that a reused coupon is rejected (test suite)

## The test you can run

Ask what happens when the coupon store is empty. If the answer is a fallback to a weaker path, the operational limit has not been designed.

## Common failures

- Coupons are cached across sessions and reused.
- Exhaustion is handled by disabling authentication with no alarm.

## How to close it

Treat the coupon store as a consumable with a count, an alarm and a refill procedure. The family is chosen for its cost profile, so the operational limit is part of the security case, not an implementation detail.

## Source

ISO/IEC 9798-5:2009(E), Clause 5, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.