Clause 4
- Public status
- The public preview gives the clause title only. The symbols themselves are in the normative text, which is not in the free public preview.
- Binding party
- The organisation that derives a cryptographic key from a human-memorised password, and anyone asked to show that its derivation follows this part.
- Evidence
- 3 items
- Read
- 2026-10-21
The register / Clause 4
Symbols
Not stated in the public preview. The clause fixes the symbols used by the functions and the annexes.
Our reading
A symbol table is maintenance evidence. When the standard is published, map each symbol to the constant or variable that carries it in your code, and keep that map with the parameter record. Teams that skip this step produce parameter records that cannot be compared with the text.
The contents list shows a short symbols clause between the definitions and the use clause. That order is conventional and useful: the document defines its terms, fixes its notation, and only then describes how the functions are used. The public preview stops before the notation is shown.
We will not invent the symbols. What can be said is what the structure implies. Clauses 6 and 7 describe two functions with input values and parameters, and the annexes describe a compression function and a hash function. A notation clause in that position usually fixes the names for the password, the salt, the output length and the cost parameters, and it usually distinguishes bit strings from integers.
For an implementation team the practical task is a mapping table. On the left, the symbol as published. On the right, the identifier in the code, its unit, its type and its permitted range. That table is the difference between a parameter record that an assessor can follow and a screenshot of a configuration screen.
Until the text is published, record the placeholders you already use and mark the mapping as provisional. Then replace the placeholders with the published symbols and re-run the test vectors. Do not let a provisional name become the name in a policy document.
Notation drifts when a policy document and a code review use different names for the same value. A short mapping table, versioned with the parameter record, stops that drift. It also gives a new engineer a way in without reading a paywalled clause. Review the table when the text is published and replace every provisional name. A provisional name in a policy is a future inconsistency.
The mistake to avoid
Publishing a parameter record that uses internal variable names which cannot be traced to the standard.
Evidence to keep
- A symbol-to-code mapping table with type, unit and permitted rangeMakes the parameter record auditable against the published notation.
- The version of the standard the mapping was made againstNotation can change between editions.
- The test-vector run that used the mapped parametersProves the mapping describes the code that actually ran.
Test it
Take the parameter record and try to match every line to a symbol in the published text. Any line that cannot be matched is a documentation gap.
Source
https://www.iso.org/standard/87940.html
Read on 2026-10-21. The public preview gives the clause title only. The symbols themselves are in the normative text, which is not in the free public preview. ISO free public preview carries the foreword, the introduction, clauses 1 to 3 and the table of contents. It is the DIS, not the FDIS, and the FDIS may differ. Clauses 4 to 7, annexes A to D, the figures and the object identifiers are not in the free preview; ISO sells the text. This site does not reproduce it and does not invent it.