ASD ISM 0472 Using proper modulus size for Diffie-Hellman keys
What it says
When using DH for agreeing on encryption session keys, a modulus of at least 2048 bits is used, preferably 3072 bits.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure Diffie-Hellman encryption uses at least a 2048 bits modulus for secure key agreements.
When using Diffie-Hellman, a tool that helps computers agree on secret information to stay safe online, you need to make sure it uses a big enough key, at least 2048 bits, to keep communications secure. If the key is too small, hackers could potentially crack the code, leading to stolen data and compromised security.
Free. Save your status, tasks and notes.
Why it matters
Using DH with a weak modulus increases the chance an attacker can derive session keys and decrypt or tamper with traffic, exposing sensitive data.
How to implement
The IT team should review the current Diffie-Hellman settings to ensure that all keys used in encryption are at least 2048 bits long.
They can check this by accessing the encryption settings in their telecommunication or web server software, ensuring compliance with this standard.
Managers should organise regular training sessions for their IT staff, focusing on the importance of encryption standards and the specific requirements for Diffie-Hellman key sizes.
This can be done by inviting a security expert to speak or using online courses that delve into cryptographic best practices.
Procurement officers need to ensure that any new software or systems purchased can support a Diffie-Hellman modulus of at least 2048 bits.
This involves checking product specifications and confirming compliance with vendors before any purchase is made.
IT security administrators should configure system logging to monitor the use of Diffie-Hellman, ensuring that all instances adhere to the key size requirement.
They can do this by setting up alerts in their security information and event management (SIEM) tools for any key usage below 2048 bits.
System owners are responsible for maintaining an inventory of systems that use Diffie-Hellman encryption.
They should verify compliance by running regular audits and documenting their findings, ensuring all systems use keys that meet or exceed the 2048-bit minimum.
Keep it running
Regularly verify DH parameters use ≥2048-bit modulus (prefer 3072-bit). Use scanners/policy checks to detect and remediate weaker cipher suite settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Configuration files or policy settings from the IT department to review the key sizes used in Diffie-Hellman encryption.
Look at
The specific settings that detail the key size, ensuring they meet the 2048-bit minimum.
Good evidence
Would be documentation showing all relevant systems are set to use keys of 2048 bits or more.
- Check 2 of 5What an auditor asks for
Look at
Session contents covering Diffie-Hellman and the importance of correct key sizes.
Good evidence
Would be training logs showing sessions were completed and staff attendance.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of a procurement checklist used for evaluating new software purchases.
Look at
Whether the checklist includes checking for Diffie-Hellman key size compliance.
Good evidence
Is a detailed checklist demonstrating this requirement is considered before procurement decisions.
- Check 4 of 5What an auditor asks for
Look at
The findings related to Diffie-Hellman encryption and the adherence to the required key size standard.
Good evidence
Includes a report detailing checks conducted on all systems and their compliance status.
- Check 5 of 5What an auditor asks for
Ask for
Alert configurations from the IT security team that monitor the key size used in Diffie-Hellman encryptions.
Look at
The alerts in place for identifying key usage below 2048 bits.
Good evidence
Is a SIEM alert system confirming active monitoring and responses to any compliance deviations.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0472 requires that when Diffie-Hellman (DH) is used for session key agreement, the DH modulus is at least 2048 bits (preferably 3072 bits). Annex A 8.24 requires organisations to define and implement rules for cryptography and cryptographic key management, under which minimum parameter strengths (including DH modulus sizes) would typically be specified. Annex A 8.24 is broader because it covers cryptographic governance and key management across algorithms and use cases, while ISM-0472 is a specific technical parameter requirement for DH.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.