# 6.1 Twelve mechanisms, three arithmetic settings

The opening of Clause 6 is replaced. It now counts twelve certificate-based mechanisms and groups them by arithmetic: a multiplicative group, an additive group of elliptic curve points, or an additive group of twisted Edwards curve points. A second insertion names the two EdDSA curves and points at 6.13.

## What it asks

Classify every certificate-based mechanism in the estate by its arithmetic setting, because the setting drives key sizes, point encodings and the verification code path. Where a system claims a mechanism but cannot say which setting it uses, the inventory is not complete enough to answer the amendment.

## What the amendment does

Replaces the first paragraph and adds a sentence to the second paragraph of 6.1.

## Who it binds

The security architect and the inventory owner.

## Evidence an auditor samples

- The mechanism inventory, with an arithmetic setting column (configuration management database)
- The curve or group parameters for each inventory row (design note)
- The sign-off that the inventory covers every signing and verifying system (risk register)

## The test you can run

Pick three inventory rows at random and ask which setting each uses. If the answer needs a search of the code, the inventory is a list of names rather than a record.

## Common failures

- The inventory lists product names rather than mechanisms.
- A mechanism is recorded without the curve or group it runs on.

## How to close it

The setting is the useful column. It tells a reader whether to look for a key length, a curve name or a twisted Edwards parameter set, and it is the column that turns a list of products into something an engineer can act on.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.1. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.