Home / The record / Mechanisms based on integer factorization

The factorization family derives its security from the difficulty of factoring a modulus, and it allows a coupon strategy in which the claimant precomputes work. That shifts the cost to key production and makes the verifier cheap, which is why the family survives in constrained devices.

What it asks

Record the modulus arrangement, the basic numbers and the coupon policy for each deployment. Show that a coupon is used once, that exhaustion is handled, and that the verifier can still reject a wrong response when the claimant is slow or offline.

What the revision does

The fourth edition keeps the family and will restate its clauses. The revised text is not public. The 2009 wording is therefore superseded at publication.

Who it binds

The owner of the constrained device estate and the key management owner.

Evidence an auditor samples

• The modulus and basic number record per deployment (key management)
• The coupon policy, including single use and exhaustion (design note)
• The test that a reused coupon is rejected (test suite)

The test you can run

Ask what happens when the coupon store is empty. If the answer is a fallback to a weaker path, the operational limit has not been designed.

Common failures

• Coupons are cached across sessions and reused.
• Exhaustion is handled by disabling authentication with no alarm.

How to close it

Treat the coupon store as a consumable with a count, an alarm and a refill procedure. The family is chosen for its cost profile, so the operational limit is part of the security case, not an implementation detail. Put the modulus and basic number record per deployment in the register first, then work down the evidence list until every line has a date.

Where it sits against the 2009 edition

The clause exists today as Clause 5 in the 2009 edition. The fourth edition replaces it, and the public record stops before the new wording, so the obligation below is the one in force.

For the file, this row closes when the modulus and basic number record per deployment exists with a date, a named holder and a pointer, and when the test above has been run and recorded. The owner of the constrained device estate and the key management owner. owns that answer for Clause 5.