# Clause 6 Discrete logarithms over a prime modulus

This family works in a group of prime order inside a prime modulus, and its best known member is the Schnorr scheme. It keeps the exchange short and makes the challenge size matter, so the parameter record has to carry the group, the generator and the challenge length together.

## What it asks

Record the prime modulus, the subgroup order, the generator and the challenge length for each deployment, and show that the group was generated rather than copied. Test that a response outside the subgroup is rejected, because that check is where a shortcut implementation usually fails.

## What the revision does

The fourth edition keeps the family and will restate the clause. The public record stops before the revised text.

## Who it binds

The cryptography owner and the engineer who implements the verifier.

## Evidence an auditor samples

- The group parameters per deployment, with their generation record (cryptography standard)
- The challenge length and the workload note behind it (capacity plan)
- The subgroup membership test in the verifier (test suite)

## The test you can run

Send a response outside the subgroup. If the verifier accepts it, the membership check is missing.

## Common failures

- The group is copied from a paper with no generation record.
- The subgroup check is present in the library but disabled by a configuration flag.

## How to close it

Keep the group generation record with the deployment and test the membership check through the deployed configuration, not the library default. The gap between the two is the finding.

## Source

ISO/IEC 9798-5:2009(E), Clause 6, publisher preview; replaced by ISO/IEC DIS 9798-5, stage 40.20. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89516.html

Not legal advice; does not certify.