# 6.5.2 SDSA: three sizes, one strength rule

The SDSA parameter paragraph is replaced. Three sizes are permitted for the main parameter, the hash size and the other parameter follow the security-level table, the hash strength must be at least the second parameter, and the hash comes from the main hash part. The lightweight part is not named here.

## What it asks

Record for each SDSA deployment the main parameter size, the two derived values and the hash. Show that the hash strength is at least the second value, and show that the hash comes from the part the clause names. The difference from KCDSA is deliberate and should be visible in the approved list.

## What the amendment does

Replaces the paragraph under the listing in 6.5.2.

## Who it binds

The owner of each SDSA deployment, with the cryptography reviewer.

## Evidence an auditor samples

- The SDSA parameter record, naming the main size and the derived values (configuration)
- The approved hash list, showing which part each hash belongs to (cryptography standard)
- The test that rejects a hash below the second value (test suite)

## The test you can run

Ask which hash part the SDSA deployment draws on. If the answer is the lightweight part, the clause does not permit it and the finding is recorded.

## Common failures

- The three sizes are treated as a recommendation and other sizes are used.
- The hash rule is copied from the KCDSA row.

## How to close it

Two mechanisms that look alike in the policy have different hash rules. Keep them on separate rows, with the clause citation on each, so that a reviewer cannot apply one rule to both by accident.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.5.2. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.