The register, to the edge of what is public

The clauses and annexes in the public contents, each with the citation, the public status, the requirement where the record proves one, our reading where it does not, the evidence to keep and a test. Every row carries a source pointer.

Annex A is not a control set

The build brief expected an Annex A control list. This part has none. Annex A assigns object identifiers for the algorithms, so this register has no control rows to audit against and says so rather than inventing them.

Clause 1ScopeA one-page scope memo that names each password-derived key and the algorithm or store it protects, A list of password...Public text

Clause 2Normative referencesA reference register with the three citations, their editions and the date checked, A note on the undated 20009-4...Public text

Clause 3Terms and definitionsA project glossary mapped to the five defined terms and to the inherited 11770-1 vocabulary, A review note that...Public text

Clause 4SymbolsA symbol-to-code mapping table with type, unit and permitted range, The version of the standard the mapping was made...Title only

Clause 5Use of password-based key derivation functionsAn approved use-case register with the attacker, the protected asset and the recovery path for each entry, The entropy...Title only

Clause 6Argon2iA parameter record with memory, iterations, parallelism, salt length and output length, and the benchmark that chose...Title only

Clause 7PBKDF2The iteration count, salt length, pseudorandom function and output length, with the benchmark date, A migration note...Title only

Annex AObject identifiersAn identifier register with the value, the function, the parameters and the systems that must agree, The source of each...Title only

Annex BThe compression function GThe library name, version and provenance for the compression function, A stored test-vector output from the exact...Title only

Annex CBlake2bA dependency record with the hash library, version, digest length and approval status, A test-vector result for the...Title only

Annex DGuidance on parameter choiceA benchmark log with hardware, library version, target delay and the measured result, A decision record that names the...Title only

Where it sits in each market

The part is international and voluntary. The evidence it asks for usually lives inside a local regime. A scan of our held graph for the four markets returned no held framework for this technical subject, so nothing below is stated as an obligation. The regimes are named only, in market order.

Market	Named, not held	What a buyer may be asked
United States	NIST SP 800-132; FIPS 140-3	Password-based derivation guidance, and module approval where a validated module is required.
European Union	GDPR Article 32; NIS2 where the entity is in scope	Security of processing and key management as part of the technical and organisational measures.
United Kingdom	UK GDPR Article 32; NCSC cryptography guidance	The same security-of-processing duty, with national guidance on algorithm and key choices.
Australia	Privacy Act 1988 APP 11; ACSC Essential Eight	Security of personal information, and the maturity model many buyers are asked to report against.

None of these regimes is quoted here. Where a market's instrument is not held in our graph, the page names it and does not state its text. Ask your adviser which one binds you.

How to read a unit page

Requirement is the obligation in our words, and only where the public record proves it. Our reading is interpretation, always labelled. Evidence to keep is what a reviewer is likely to ask for. Test it is one check you can run this week. Every page ends with its source and the date it was read.

What is missing from this register

Clauses 4 to 7 and annexes A to D are not in the free public preview. Their pages give the title, the structure from the public contents, and our reading of the public specifications the draft names. They do not state the normative wording, and they say so in a stamp at the top. The FDIS may add annexes the preview does not list. When ISO publishes the text, the watch sends the diff and the register is rebuilt from it.

Check whether the register reaches you