Method
- Record
- One JSON file
- Sources
- 8
- Refresh
- Fails loudly on a change
- Read
- 2026-10-21
How the record is built, and where it stops
The record has three evidence levels. A public fact is stated and cited. A reading is our interpretation and is labelled. A gap is named and left open. Nothing is filled from memory or from a search snippet.
The three levels
Public fact
The ISO catalogue record, the public preview, the stage dates, the title, the abstract, the definitions and the scope. Stated plainly, with the clause and the retrieval date.
Labelled reading
What a clause implies for a build, an evidence file or a test. Always under "Our reading". It is not the standard's wording and does not claim to be.
Named gap
The normative clauses and annexes that are not in the free public preview. Named in the record and on every affected page. We do not invent a requirement to fill the space.
The sources
| Source | Publisher | Kind | URL |
|---|---|---|---|
| ISO/IEC FDIS 11770-8, ISO catalogue page 87940 | ISO | official record | https://www.iso.org/standard/87940.html |
| ISO OBP public preview of ISO/IEC DIS 11770-8 | ISO | public preview | https://www.iso.org/obp/ui/en/#iso:std:87940:en |
| ISO/IEC DIS 11770-8:2025, public listing | ANSI Webstore | reseller record | https://webstore.ansi.org/standards/iso/ISOIECDIS117702025 |
| BSI draft review 25/30486270 DC, BS ISO/IEC 11770-8 | British Standards Institution, listed by European Standards | national draft review record | https://www.en-standard.eu/25-30486270-dc-bs-iso-iec-11770-8-information-security-key-management-part-8-password-based-key-derivation/ |
| RFC 9106, Argon2 memory-hard function for password hashing and proof-of-work | IETF | public specification | https://www.rfc-editor.org/rfc/rfc9106 |
| RFC 8018, PKCS #5: Password-Based Cryptography Specification Version 2.1 | IETF | public specification | https://www.rfc-editor.org/rfc/rfc8018 |
| RFC 7693, The BLAKE2 Cryptographic Hash and MAC | IETF | public specification | https://www.rfc-editor.org/rfc/rfc7693 |
| RFC 6070, PKCS #5: Password-Based Key Derivation Function 2 (PBKDF2) Test Vectors | IETF | public test vectors | https://www.rfc-editor.org/rfc/rfc6070 |
What is not public
- Clauses 4 to 7 are not in the free public preview: the symbols, the use clause and the two function specifications. ISO sells the text.
- Annexes A to D are not in the free public preview: the identifiers, the compression function, Blake2b and the parameter guidance. The FDIS may add annexes the preview does not list.
- The figures are not in the public preview.
- ISO has recorded no date for stage 50.60, 60.00 or 60.60 and no publication date.
- The FDIS may differ from the DIS preview that this record read.
How the free check is computed
The check is a deterministic rule in the browser. It reads your answers against clause 1, the two functions named in the public introduction, and the evidence list. It returns one of five phrases and never a compliance result. An untouched form returns scope incomplete. The same answers always give the same reading, and the regression table on the check page is tested by the build.
How a change is handled
The refresh script re-downloads the ISO catalogue page and compares the stage, the date, the page count and the title with the stored record. It also compares the public preview's contents with the stored snapshot. A difference exits non-zero, with a diff. A human then reads the source, updates the record and the change date, re-renders every page and the kit, and the watch sends the diff. Nothing changes a page silently.
What this site is not
It is not the standard, not a licence to the text, not a certification, not an audit and not legal advice. The standard is voluntary until a contract, a regulator or an ISMS makes it binding. The reading is written to be checked, not trusted.