# 6.13.5.2 Decode, range check, then verify

The verifier retrieves the witness and the second part, decodes the verification key and the witness to curve points, and decodes the second part to an integer in range. If a decoding fails or a value is out of range, the signature is rejected. The decode happens before the group equation.

## What it asks

Decode the three values, range check them and reject before doing any group arithmetic. Record the rejection cases as named tests, including a non canonical point, a point not on the curve, a value at the order and a value above it. This is the clause that decides whether a malformed signature can be treated as valid.

## What the amendment does

Inserts 6.13.5.2.

## Who it binds

The verifier owner and the test owner.

## Evidence an auditor samples

- The named rejection tests, one per case (test suite)
- The verifier code path, showing rejection before the equation (source repository)
- The fuzz run that found no accepted malformed input (security testing)

## The test you can run

Present a point that is not on the curve, a non canonical encoding and a value at the order. All three must be rejected.

## Common failures

- The decode error is caught and the signature is treated as valid for legacy compatibility.
- A value at the order is accepted because the check uses a strict less than in one place and not another.

## How to close it

This clause is the one an attacker reads first. Make the rejection path a single function with named cases, test it directly rather than through the full verify, and keep a fuzz corpus that grows with every finding.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.13.5.2. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.