Controls such as tamper detection and dual control stop keys or components from being disclosed without authorisation while they are generated. In particular: any clear-text output of key generation is under dual control, so that a custodian sees the clear text only of the components or shares assigned to them and never the whole key; at no stage of generation can a single person work out or get hold of any portion of a key in clear text, or every one of its components; full-length components and shares produced by a recognised secret-sharing scheme do not count as key parts; a device that outputs clear-text components is switched off when idle or demands fresh authentication each time generation is started, and a logically partitioned device used at the same time for other work has key generation disabled while that other work runs; before use, key-generation equipment that outputs clear-text components is examined for tampering, such as unfamiliar cables, and for any tap placed between the generator and the receiving device or medium; physical controls keep unauthorised people out of the area whenever clear-text keying material is being handled, and nobody can view the material directly or through a camera.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.