Clause 2
- Public status
- The reference list is in the public preview. The editions and the dated or undated treatment are shown below.
- Binding party
- The implementer and the assessor, because the references decide which vocabulary and which prior mechanisms are indispensable.
- Evidence
- 3 items
- Read
- 2026-10-21
The register / Clause 2
Normative references
Three documents are indispensable: ISO/IEC 11770-1:2010, ISO/IEC 11770-4:2017, and ISO/IEC 20009-4. The first two are dated, so only those editions apply. The third is undated, so its latest edition, including amendments, applies.
Our reading
A dated reference freezes the edition. An undated reference moves. That means a future edition of 20009-4 can change what this part points to without any change to Part 8 itself, which is exactly the kind of drift a change watch should catch.
The reference list is short and unusually informative. It tells you which older parts of the series the new part leans on, and it tells you how firmly. ISO/IEC 11770-1:2010 supplies the framework and the vocabulary that the definitions inherit. ISO/IEC 11770-4:2017 supplies the treatment of weak secrets, which is the technical home of the password problem. ISO/IEC 20009-4 supplies the anonymous entity authentication mechanisms built on weak secrets.
The dated and undated distinction is the practical point. The 2010 framework and the 2017 weak-secret part are pinned. If either is revised, this part still points at the pinned edition until it is itself amended. The 20009-4 reference is not pinned, so the latest edition applies as soon as it exists. A conformity statement that names a 20009-4 edition should say which one it read.
There is a gap worth naming. The definitions cite ISO/IEC 11770-6 for the key derivation function term, but Part 6 is not in the normative reference list. That does not make Part 6 applicable by reference. It means the term was borrowed, with its source recorded. Do not turn a definition source into an obligation.
For a procurement or audit file, keep the exact citations as they appear and keep the date you checked them. When a national adoption adds a preface or a national annex, record that too. The reference list is where an assessor starts when they want to know whether your reading is current.
A reference list is also a procurement list. If a supplier says its product follows this part, ask which edition of the framework and the weak-secret part it read, and whether its conformity statement names the undated reference as a latest edition. That question separates a real mapping from a logo on a datasheet.
The mistake to avoid
Assuming every standard named anywhere in the document is a normative reference. A source note under a definition is not an obligation.
Evidence to keep
- A reference register with the three citations, their editions and the date checkedThe starting point for any review of whether the reading is current.
- A note on the undated 20009-4 reference and the edition in force when the assessment was doneShows the moving reference was handled rather than ignored.
- The national adoption preface if one applies in your marketNational bodies can add conditions that the ISO text does not contain.
Test it
Open the conformity statement and check that each of the three references is named with its edition or marked as the latest edition.
Cross references
- ISO/IEC 11770-1:2010
- ISO/IEC 11770-4:2017
- ISO/IEC 20009-4 (undated reference)
Source
https://www.iso.org/standard/87940.html
Read on 2026-10-21. The reference list is in the public preview. The editions and the dated or undated treatment are shown below. ISO free public preview carries the foreword, the introduction, clauses 1 to 3 and the table of contents. It is the DIS, not the FDIS, and the FDIS may differ. Clauses 4 to 7, annexes A to D, the figures and the object identifiers are not in the free preview; ISO sells the text. This site does not reproduce it and does not invent it.