Is a comma necessary before "for which"?

A comma is either necessary or forbidden, depending on the meaning. For example, here is a context that would require a comma:

A previous version of this standard used sender codes, which offered some protection against unauthenticated messages, but were vulnerable to replay attacks if the same sender could send multiple messages. To address this, we make several improvements in the current version. Most importantly, we define message codes, for which security is well defined.

and here is a context that would not permit one:

It is important to select message codes carefully, since it is all too easy to create message codes whose security cannot be asserted. In this chapter, we define message codes for which security is well defined. We will refer to these throughout the remainder of the book.

The key factor is that the version with the comma implies that "security is well defined" is a property of all message codes, whereas the version without the comma implies that "security is well defined" is a property only of some message codes.

For more information, see https://en.wikipedia.org/wiki/Restrictiveness.