Skip to content
Cryptography
ASD ISMISM-0474

ASD ISM 0474 Using secure elliptic curve Diffie-Hellman encryption

What it says

When using ECDH for agreeing on encryption session keys, a base point order and key size of at least 224 bits is used, preferably the NIST P-384 curve.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use ECDH with a base point order and key size of at least 224 bits, preferably NIST P-384, for secure key agreements.

This control is about using a method called Elliptic Curve Diffie-Hellman (ECDH) to ensure that when confidential information is exchanged, it's done securely. Imagine if two people are sending secret messages to each other; this method helps keep their communication private. Without this, sensitive information could be exposed to unauthorised people, which might lead to data breaches or financial losses.

Why it matters

Weak ECDH parameters (e.g., <224-bit or wrong base point order) can enable key recovery, allowing decryption and compromise of secure sessions, leading to data breaches and financial loss.

How to implement

  1. The IT manager should consult a cyber security expert to choose the right elliptic curve for encryption.

    They should ensure the expert specifically recommends using at least a 224-bit curve, with a preference for the NIST P-384 curve, as it provides stronger security.

  2. System administrators should configure the software used for encryption to support the NIST P-384 curve.

    This involves updating the software settings or installing updates to ensure compliance with current security recommendations.

  3. The IT team should test existing communication systems to check if they support the NIST P-384 curve.

    This can be done by using diagnostic tools and consulting the software's documentation to ensure it can handle secure key exchanges.

  4. Procurement should ensure that any new software purchased has support for the recommended elliptic curve sizes.

    This should be a specific requirement in the tender documents and contracts with vendors.

  5. Cyber security awareness training sessions conducted by the IT department should include information on why using strong encryption like ECDH with NIST P-384 is important.

    This helps to ensure everyone understands its role in protecting the organisation's data.

Keep it running

Validate ECDH uses a base point order and key size of at least 224 bits; prefer NIST P-384. Regularly check crypto libraries/configs and test negotiated groups to prevent weak-curve use.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The configuration documentation of encryption systems: Request written proof of the encryption settings used by the organisation.

    Look at

    Clear mention of the use of at least 224-bit curves, ideally specifying NIST P-384.

    Good evidence

    Is a dated document showing these specific settings have been applied and verified.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Vendor agreements regarding encryption capabilities. Review those agreements to ensure they stipulate support for ECDH with NIST P-384.

    Good evidence

    Shows specific contract clauses or vendor assurances that these encryption measures are supported.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Evidence of system testing: Request test reports or logs that show systems were tested for compatibility with NIST P-384.

    Look at

    Logs that indicate successful tests for these curves.

    Good evidence

    Is a test report with successful results clearly documented.

  4. Check 4 of 5What an auditor asks for

    Ask for

    The organisation's cyber security training material.

    Look at

    Whether it includes information on elliptic curves and secure encryption practices.

    Good evidence

    Would be a presentation or document with sections covered on ECDH and its importance.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see the IT team's meeting notes where encryption standards are discussed.

    Look at

    Specific mentions of elliptic curve encryption, particularly discussions on NIST P-384.

    Good evidence

    Includes a recent meeting record discussing these encryption settings.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.