# 6.6.1 EC-DSA: the hash list is closed

The last sentence of the second paragraph is replaced with a named list of permitted hashes: SHA-224 and SHA-512/224, SHA-256 and SHA-512/256, SHA-384 and SHA-512, SHA3-224, SHA3-256, SHA3-384 and SHA3-512, and SHAKE-128 at 256 bits and SHAKE-256 at 512 bits. The security level must meet or exceed the level associated with the main parameter.

## What it asks

Replace any open hash choice for EC-DSA with the named list, and record for each curve the security level the parameter carries. Where a deployment uses a hash outside the list, record it as a finding with a replacement date rather than a note.

## What the amendment does

Replaces the last sentence of the second paragraph of 6.6.1.

## Who it binds

The owner of each EC-DSA deployment and the approved hash list owner.

## Evidence an auditor samples

- The EC-DSA deployment record, naming the curve and the hash (configuration)
- The approved hash list, with the permitted and excluded hashes marked (cryptography standard)
- The replacement plan for any hash outside the list (remediation plan)

## The test you can run

List every EC-DSA hash in the estate and compare it with the clause list. An entry outside the list is a finding, even if the hash is strong.

## Common failures

- A stronger hash than the list permits is treated as acceptable because it is stronger.
- The list is applied to new systems but not to the installed base.

## How to close it

A closed list is a procurement rule as much as a technical one. Add the permitted hashes to the approved product list, and give any exception an end date, so that the installed base converges instead of drifting.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.6.1. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.