Home / The record / Existing mechanisms changed

The last sentence of the second paragraph is replaced with a named list of permitted hashes: SHA-224 and SHA-512/224, SHA-256 and SHA-512/256, SHA-384 and SHA-512, SHA3-224, SHA3-256, SHA3-384 and SHA3-512, and SHAKE-128 at 256 bits and SHAKE-256 at 512 bits. The security level must meet or exceed the level associated with the main parameter.

What it asks

Replace any open hash choice for EC-DSA with the named list, and record for each curve the security level the parameter carries. Where a deployment uses a hash outside the list, record it as a finding with a replacement date rather than a note.

What the amendment does

Replaces the last sentence of the second paragraph of 6.6.1. So the 2018 wording is superseded for this clause.

Who it binds

The owner of each EC-DSA deployment and the approved hash list owner.

Evidence an auditor samples

• The EC-DSA deployment record, naming the curve and the hash (configuration)
• The approved hash list, with the permitted and excluded hashes marked (cryptography standard)
• The replacement plan for any hash outside the list (remediation plan)

The test you can run

List every EC-DSA hash in the estate and compare it with the clause list. An entry outside the list is a finding, even if the hash is strong.

Common failures

• A stronger hash than the list permits is treated as acceptable because it is stronger.
• The list is applied to new systems but not to the installed base.

How to close it

A closed list is a procurement rule as much as a technical one. Add the permitted hashes to the approved product list, and give any exception an end date, so that the installed base converges instead of drifting. The artefact that opens the work is the EC-DSA deployment record, naming the curve and the hash; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the base standard

The base standard carries an earlier version of 6.6.1, and the amendment replaces the paragraph named above. A citation to the base edition alone points at wording that no longer applies, which is the defect this record exists to catch.