Annex D
- Public status
- The annex title is in the public contents. The guidance text is not in the free public preview.
- Binding party
- The organisation that derives a cryptographic key from a human-memorised password, and anyone asked to show that its derivation follows this part.
- Evidence
- 4 items
- Read
- 2026-10-21
The register / Annex D
Guidance on parameter choice
Not stated in the public preview. The annex gives guidance on choosing parameters for the two functions.
Our reading
Parameter choice is where most real failures happen, and it is the part an assessor can test. A defensible choice is calibrated on the target hardware, written down with a date, reviewed on a schedule, and re-tested when the hardware or the threat changes. The exact recommended numbers are not in the free public preview, and we will not invent them.
Annex D is the operational heart of the document for most readers. The two function clauses define what the functions are. The guidance annex addresses how to choose the cost. Parameters decide whether a correct implementation is actually expensive to attack.
A defensible method has five steps. Identify the weakest hardware that must run the derivation. Set a target delay that users will tolerate and attackers will not enjoy. Measure memory, iterations and parallelism on that hardware. Write the numbers down with the date, the library version and the benchmark method. Set a review date and a trigger for re-testing when hardware or the threat changes.
Two failure modes are common. The first is copying parameters from a blog or another product without measuring. The second is measuring once and never again. Both produce a parameter record that looks complete and proves nothing. An assessor who understands the subject will ask when the numbers were measured and on what.
The guidance annex is also where the trade between the two functions becomes concrete. Memory-hard settings consume memory that a server may need for other work, and a high memory setting on a shared host can become a denial-of-service lever. The answer is not a universal number. It is a documented trade, reviewed by someone who owns the availability risk as well as the confidentiality risk.
Re-benchmark when the device class changes, when the library changes and when the threat model changes. A calendar review alone misses the phone that replaced the laptop as the weakest device. The review trigger should name the events, not only the month. A review that cannot name the hardware is a calendar reminder, not a control.
The mistake to avoid
Copying a parameter set from another organisation and calling it a benchmark.
Evidence to keep
- A benchmark log with hardware, library version, target delay and the measured resultThe only credible basis for a parameter choice.
- A decision record that names the availability and confidentiality tradeHigh memory settings have a denial-of-service edge that someone must own.
- A review date and the triggers that force a re-testParameters age. The review trigger is the control.
- The residual risk acceptance for the weakest supported deviceThe floor is set by the weakest hardware, which is a business decision.
Test it
Show the benchmark log, the hardware it ran on, and the date. If the log is missing, the parameter choice is unproven.
Dates
| Date | What | Basis |
|---|---|---|
| 2027-02-16 | Latest sensible date to have the parameter record reviewed before publication, an estimate | Key date minus 0 days. The publication date is an estimate and creates no legal deadline. |
Cross references
- Clause 5, use of the functions
- Clause 6, Argon2i
- Clause 7, PBKDF2
Source
https://www.iso.org/standard/87940.html
Read on 2026-10-21. The annex title is in the public contents. The guidance text is not in the free public preview. ISO free public preview carries the foreword, the introduction, clauses 1 to 3 and the table of contents. It is the DIS, not the FDIS, and the FDIS may differ. Clauses 4 to 7, annexes A to D, the figures and the object identifiers are not in the free preview; ISO sells the text. This site does not reproduce it and does not invent it.