# 6.13.3 Key generation, and two different clamping rules

The clause specifies how the signature key and the verification key are produced. A random or pseudo random bit string of the set length is hashed into a buffer, the buffer is clamped by rules that differ between the two sets, the secret integer is taken from the first half, and the verification key is the encoding of the secret integer times the base point.

## What it asks

Generate the key material from a source fit for a long lived signing key, apply the clamping rule of the set in use, and store the secret integer so that it cannot be exported in clear. Test the public key encoding, including the bit that carries the sign of the other coordinate.

## What the amendment does

Inserts 6.13.3.

## Who it binds

The key custodian and the platform owner.

## Evidence an auditor samples

- The key ceremony record, naming the source of randomness and the set (key management)
- The public key encoding test, including the sign bit (test suite)
- The key storage configuration, showing the export control (HSM or key store)

## The test you can run

Export a public key and decode it. If the decoder needs a rule that is not in the clause, or the sign bit is dropped, the encoding is not the one specified.

## Common failures

- One clamping routine is used for both sets.
- The key is generated once in a test environment and copied to production.

## How to close it

Key generation is the step where a small difference between the sets becomes an interoperability failure. Record the set, the clamping rule and the encoding test on one page, and keep it with the ceremony record.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.13.3. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.