Home / The record / The general model

The opening of Clause 6 is replaced. It now counts twelve certificate-based mechanisms and groups them by arithmetic: a multiplicative group, an additive group of elliptic curve points, or an additive group of twisted Edwards curve points. A second insertion names the two EdDSA curves and points at 6.13.

What it asks

Classify every certificate-based mechanism in the estate by its arithmetic setting, because the setting drives key sizes, point encodings and the verification code path. Where a system claims a mechanism but cannot say which setting it uses, the inventory is not complete enough to answer the amendment.

What the amendment does

Replaces the first paragraph and adds a sentence to the second paragraph of 6.1. So the 2018 wording is superseded for this clause.

Who it binds

The security architect and the inventory owner.

Evidence an auditor samples

• The mechanism inventory, with an arithmetic setting column (configuration management database)
• The curve or group parameters for each inventory row (design note)
• The sign-off that the inventory covers every signing and verifying system (risk register)

The test you can run

Pick three inventory rows at random and ask which setting each uses. If the answer needs a search of the code, the inventory is a list of names rather than a record.

Common failures

• The inventory lists product names rather than mechanisms.
• A mechanism is recorded without the curve or group it runs on.

How to close it

The setting is the useful column. It tells a reader whether to look for a key length, a curve name or a twisted Edwards parameter set, and it is the column that turns a list of products into something an engineer can act on. The artefact that opens the work is the mechanism inventory, with an arithmetic setting column; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the base standard

The base standard carries an earlier version of 6.1, and the amendment replaces the paragraph named above. A citation to the base edition alone points at wording that no longer applies, which is the defect this record exists to catch.