Home / The record / The amendment frame

One normative reference is added, ISO/IEC 29192-5, the lightweight cryptography part on hash functions. A normative reference is not a suggestion. Where a mechanism clause points at the hash list, the lightweight part is now part of the approved supply, and the hash inventory is the evidence.

What it asks

Add the lightweight hash part to the set of hash standards your approved list may draw on, and show for each mechanism whether it draws on it. Where a mechanism clause names only the main hash part, that narrower list still governs, and the new reference does not widen it.

What the amendment does

Adds one entry to Clause 2. So this is new text rather than a change to wording.

Who it binds

The owner of the approved cryptographic product list, with procurement.

Evidence an auditor samples

• The approved hash list, showing both hash parts and their status (cryptography standard)
• The mechanism to hash mapping, one row per mechanism (design note)
• The supplier statement for each hash implementation in use (procurement file)

The test you can run

Pick a mechanism that now names the lightweight part. Ask which hash implementation satisfies it. If the answer is a product not on the approved list, the reference is not operational.

Common failures

• The reference is added to the bibliography of a policy but never to the approved product list.
• A lightweight hash is approved for a mechanism whose clause does not name it.

How to close it

Treat each normative reference as a procurement line. The reference exists so that a hash implementation can be named, so the record should name one, with a version and a supplier. Put the approved hash list, showing both hash parts and their status in the register first, then work down the evidence list until every line has a date.

Where it sits against the base standard

The base standard does not carry this text. The amendment adds it, so an estate working from the 2018 edition alone will not find it. The citation has to name the amendment, and the record for Clause 2 is the only place a reader can see it.