Clause 5
- Public status
- The public preview gives the clause title only. The introduction states the design intent: guessing attacks should be made very costly.
- Binding party
- The organisation that derives a cryptographic key from a human-memorised password, and anyone asked to show that its derivation follows this part.
- Evidence
- 4 items
- Read
- 2026-10-21
The register / Clause 5
Use of password-based key derivation functions
Not stated in the public preview. The clause addresses when and how the two functions are used.
Our reading
The clause is where policy lives. Before a team chooses a function it should decide which uses of a password-derived key are allowed, what entropy it assumes, how salts are generated, what cost floor applies, when parameters are re-derived, and who accepts the residual risk. Those decisions are ours to make and to record; the standard cannot make them for us.
The fifth clause sits between notation and the two function specifications. Its title says it is about use, and the introduction supplies the design intent. A password can be guessed, so the derivation must make each guess expensive. The clause is the bridge between that intent and the two named functions.
The governance questions are familiar to anyone who has run a cryptography review. Which products may derive a key from a password at all? Is a user-chosen password acceptable for a key that protects regulated data, or must the password be generated? What is the minimum length and the assumed entropy? How is the salt generated and stored? What cost floor applies on the weakest device you support? When a device is replaced, how is the key re-derived without losing the data?
None of those answers can be read off a clause title. They are decisions the organisation makes, and they are exactly what an assessor will ask to see. A team that can show a decision record, a cost floor and a re-derivation plan is in a much stronger position than a team that can only show a library call.
The clause also invites a boundary test. A password-derived key that protects a backup is different from one that protects a live session, because the recovery path and the attacker access differ. Write the use case down before the parameters. The same function can be right in one case and wrong in the other.
The use decision is where a security team and a product team often disagree. The security team wants a high cost floor and a narrow list of allowed uses. The product team wants the derivation to finish before the user gives up. Write both constraints into the same record, with an owner for each, or the argument repeats at every release.
The mistake to avoid
Choosing a function before writing down the use case, the attacker and the recovery path.
Evidence to keep
- An approved use-case register with the attacker, the protected asset and the recovery path for each entryThe clause is about use, so the use decision is the primary evidence.
- The entropy assumption and the minimum password rules for each use caseLinks the weak secret to the cost parameters.
- A cost floor per supported device class, with the benchmark dateShows the floor is real on the weakest hardware.
- A re-derivation and rotation plan for parameter changes and device replacementThe practical failure mode is being unable to re-derive after a change.
Test it
For each password-derived key, name the attacker, the data it protects and the recovery path if the password is lost. If any answer is blank, the use case is not approved.
Dates
| Date | What | Basis |
|---|---|---|
| 2026-11-16 | FDIS ballot closes, calculated | Eight weeks from the stage 50.20 date of 2026-09-21. ISO has not recorded the close date. |
Source
https://www.iso.org/standard/87940.html
Read on 2026-10-21. The public preview gives the clause title only. The introduction states the design intent: guessing attacks should be made very costly. ISO free public preview carries the foreword, the introduction, clauses 1 to 3 and the table of contents. It is the DIS, not the FDIS, and the FDIS may differ. Clauses 4 to 7, annexes A to D, the figures and the object identifiers are not in the free preview; ISO sells the text. This site does not reproduce it and does not invent it.