Skip to content
Cryptography
ASD ISMISM-0475

ASD ISM 0475 Use P-384 curve for secure digital signatures

What it says

When using ECDSA for digital signatures, a base point order and key size of at least 224 bits is used, preferably the P-384 curve.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure stronger digital signature security by using ECDSA with a key size of at least 224 bits, ideally the P-384 curve.

This control is about using a specific method for signing digital documents to ensure they are authentic and haven't been altered. It's important because if digital signatures aren't strong, someone could fake documents, leading to security breaches and potential fraud.

Why it matters

Using ECDSA with too-small keys or weaker curves can enable signature forgery, undermining integrity and trust in signed data and documents.

How to implement

  1. IT managers should ensure that their systems use the P-384 curve for digital signatures.

    Do this by reviewing the system settings or consulting with a trusted IT provider to confirm that this curve is used and correctly configured.

  2. System administrators should regularly update their cryptographic libraries to ensure they support the P-384 curve.

    This can involve downloading the latest updates from your software provider or checking with the vendor for upgrade instructions.

  3. IT security consultants should conduct an annual audit of the company's digital signature processes to verify the use of the P-384 curve.

    This involves examining software settings and configurations in use across all systems.

  4. Training coordinators should conduct training for relevant staff on why using secure digital signatures is crucial.

    Create materials explaining the risks of not using the P-384 curve, and demonstrate how to check if systems are compliant.

Keep it running

Regularly verify that ECDSA uses at least a 224-bit key, aiming for P-384, to maintain signature strength and stay compliant.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    System configuration files that specify digital signature algorithms.

    Look at

    The details indicating the use of the P-384 curve.

    Good evidence

    Will show settings explicitly mentioning the P-384 curve being applied.

  2. Check 2 of 5What an auditor asks for

    Look at

    The technical specifications to confirm P-384 curve support.

    Good evidence

    Includes documentation from the vendor detailing compliance with the P-384 curve requirement.

  3. Check 3 of 5What an auditor asks for

    Ask for

    To see records of security audits conducted on digital signature processes.

    Look at

    The auditor's findings and recommendations.

    Good evidence

    Will include an audit report stating that the P-384 curve is in use and adequately implemented.

  4. Check 4 of 5What an auditor asks for

    Look at

    Entries that describe upgrades or fixes to digital signature tools.

    Good evidence

    Will have records showing regular updates supporting P-384 curve compliance.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Training records for staff involved in the digital signature process.

    Look at

    Details on training sessions that covered signature security and P-384 use.

    Good evidence

    Is a training schedule or completion certificates for staff showing they understand the importance of using the P-384 curve.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.