# 6.3.2 KCDSA: the pair, the hash and the strength

The KCDSA parameter paragraph is replaced. The size pair must follow the security-level table, the hash may come from the main hash part or the lightweight part, and the hash strength must meet or exceed the strength of the pair. Two typical pairs are given as examples.

## What it asks

For each KCDSA deployment, record the pair, the hash and the hash strength, and show that the hash strength is at least the strength associated with the pair. A pair recorded without its hash is the common gap, and it is the gap the clause now makes testable.

## What the amendment does

Replaces the penultimate paragraph of 6.3.2.

## Who it binds

The owner of each KCDSA deployment, with the cryptography reviewer.

## Evidence an auditor samples

- The parameter record for each deployment, naming the pair and the hash (configuration)
- The security-level table extract that ties the pair to a strength (design note)
- The test that rejects a hash weaker than the pair (test suite)

## The test you can run

Take one KCDSA deployment and ask for its pair, its hash and the strength of that hash. If any of the three is missing, the clause cannot be evidenced.

## Common failures

- The pair is recorded but the hash is assumed from a library default.
- The hash strength is stated in bits without the table that gives it meaning.

## How to close it

Put the pair and the hash in one configuration record, with the table reference, so that a reviewer reads one line and sees the whole rule satisfied. A pair alone is half the requirement.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.3.2. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.