Answers
Five questions
Short, sourced
- Format
- A 40 to 60 word answer, then the detail
- Source
- The public record and the public function specifications
- Updated
- 2026-10-21
The questions buyers ask, answered short
Five questions that come up before a purchase or a review. Each answer is written to be read in half a minute and checked against a source in a minute more.
01What is password-based key derivation?Password-based key derivation turns a human-memorised password into a cryptographic key by running it through...Answer
02Argon2i or PBKDF2: which should you use?Neither is a universal default. ISO/IEC 11770-8 names both. Argon2i is memory-hard and its access pattern...Answer
03Does ISO/IEC 27001 require ISO/IEC 11770-8?Not by name. The 2022 cryptography control requires a policy and a key management approach, and it does not...Answer
04What changes when ISO/IEC 11770-8 is published?A named route appears for password-derived keys: two functions, an identifier annex and parameter guidance...Answer
05How do you record KDF parameters for an auditor?One row per use: the function and variant, the salt source and length, the cost parameters, the pseudorandom...Answer
Why these five
They map to the sequence a buyer follows: what the thing is, which function to use, whether their existing management system already covers it, what publication changes, and how to evidence it. A sixth question, whether the standard is any good, is not one this site can answer.