# 6.13.4.6 The second part fits a fixed octet length

The second part of the signature is computed from the secret integer, the assignment and the randomizer, reduced modulo the order of the base point, and written little endian in the set length. The clause fixes how many high bits of the final octets are always clear for each set.

## What it asks

Encode the second part in the fixed length and assert that the unused high bits are clear. A decoder that ignores the unused bits will accept two encodings of the same value, which breaks any system that treats the signature bytes as an identifier.

## What the amendment does

Inserts 6.13.4.6.

## Who it binds

The signing implementation owner and any system that stores signatures as identifiers.

## Evidence an auditor samples

- The encoded signature length test for both sets (test suite)
- The assert that unused high bits are clear (source repository)
- The storage schema, showing the signature is not used as a unique key (data model)

## The test you can run

Take a valid signature and set one unused high bit. A verifier that accepts it is not checking the encoding.

## Common failures

- The signature is truncated and the length is not asserted.
- A database uses the signature bytes as a primary key.

## How to close it

Fixed length encodings invite truncation. Assert the length, assert the unused bits, and keep signatures out of primary keys, because two encodings of one value are a duplicate key waiting to happen.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.13.4.6. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.