# Introduction, Note 5 The key substitution warning is reworded

The note that warns about key substitution is reworded. Four elliptic curve mechanisms are named as possibly exposed, and EdDSA is described as carrying protection in its design because the verification key enters the hash. The practical effect is a risk line per mechanism, not a blanket warning.

## What it asks

Assess key substitution exposure mechanism by mechanism. Where the mechanism is one the note names, record the mitigation you rely on, such as binding the public key into the signed data. Where the mechanism is EdDSA, record that the design includes the binding instead of assuming every implementation is safe.

## What the amendment does

Rewords Note 5 in the Introduction.

## Who it binds

The security architect who signs off the mechanism choice, with the PKI owner.

## Evidence an auditor samples

- The mechanism risk note, with a line per mechanism and the mitigation named (architecture)
- The signed data format, showing whether the public key is inside the signed bytes (interface specification)
- The review that accepted the residual risk, with a date and an owner (risk register)

## The test you can run

Take one signature and ask what a verifier would accept under a second public key. If nobody can answer without reading the code, the risk line is not evidenced.

## Common failures

- The warning is copied into the risk register without naming which mechanisms it applies to.
- A library is assumed to bind the key because the mechanism is EdDSA, with no test of that assumption.

## How to close it

For each mechanism, write one sentence that names the attack, the mitigation and the test that shows the mitigation is present. If the sentence needs a paragraph, the estate is relying on a mechanism nobody has characterised.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, Introduction, Note 5. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.