Home / The record / The amendment frame

The note that warns about key substitution is reworded. Four elliptic curve mechanisms are named as possibly exposed, and EdDSA is described as carrying protection in its design because the verification key enters the hash. The practical effect is a risk line per mechanism, not a blanket warning.

What it asks

Assess key substitution exposure mechanism by mechanism. Where the mechanism is one the note names, record the mitigation you rely on, such as binding the public key into the signed data. Where the mechanism is EdDSA, record that the design includes the binding instead of assuming every implementation is safe.

What the amendment does

Rewords Note 5 in the Introduction. So the 2018 wording is superseded for this clause.

Who it binds

The security architect who signs off the mechanism choice, with the PKI owner.

Evidence an auditor samples

• The mechanism risk note, with a line per mechanism and the mitigation named (architecture)
• The signed data format, showing whether the public key is inside the signed bytes (interface specification)
• The review that accepted the residual risk, with a date and an owner (risk register)

The test you can run

Take one signature and ask what a verifier would accept under a second public key. If nobody can answer without reading the code, the risk line is not evidenced.

Common failures

• The warning is copied into the risk register without naming which mechanisms it applies to.
• A library is assumed to bind the key because the mechanism is EdDSA, with no test of that assumption.

How to close it

For each mechanism, write one sentence that names the attack, the mitigation and the test that shows the mitigation is present. If the sentence needs a paragraph, the estate is relying on a mechanism nobody has characterised. The artefact that opens the work is the mechanism risk note, with a line per mechanism and the mitigation named; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the base standard

The base standard carries an earlier version of Introduction, Note 5, and the amendment replaces the paragraph named above. A citation to the base edition alone points at wording that no longer applies, which is the defect this record exists to catch.