ASD ISM 0476 Ensuring strong RSA modulus for digital security
What it says
When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 2048 bits is used, preferably 3072 bits.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a minimum 2048-bit RSA modulus for better security in digital signatures and key transport.
This control is about making sure your digital communications and important data are kept secure by using strong keys for encryption. Imagine if the lock on your front door was weak and easily breakable; similarly, a weak encryption key makes it easier for hackers to steal your information. By using a 2048-bit RSA modulus or, even better, a 3072-bit, you're essentially adding a strong lock to your digital data.
Free. Save your status, tasks and notes.
Why it matters
Using RSA keys under 2048 bits for signatures or session key transport can be factored, allowing forgery, decryption of session keys and data compromise.
How to implement
IT team should assess current encryption practices: The IT team needs to review all current systems where RSA is used to make sure the encryption keys are at least 2048 bits.
They can do this by checking system configurations and discussing key lengths with software vendors.
Procurement should require strong modulus standards: When purchasing new software or systems that involve encryption, procurement officers should include a requirement for at least 2048-bit RSA modulus in their contracts.
They can do this by adding specific language to purchase agreements and contracts.
System administrators need to configure settings: System administrators should change settings in the systems they manage to ensure that RSA keys are at least 2048 bits in length.
This would involve going into system security settings and adjusting any predefined key lengths.
Security officers should provide training: Security officers should organise training sessions for IT staff about the importance of strong RSA moduli and how to implement them.
This can be done through workshops or online training modules.
IT team should monitor compliance: Assign a member of the IT team to regularly check systems for compliance with the 2048-bit requirement.
They can do this by setting reminders to perform periodic reviews of encryption practices and documenting any changes.
Keep it running
Inventory RSA use (signing and session key transport), enforce ≥2048-bit modulus (prefer 3072), and rotate/replace any keys below this threshold.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Encryption policy documents: Request the organisational policy that details encryption standards, including the minimum RSA modulus size.
Look at
Whether it specifically mandates at least a 2048-bit RSA modulus.
Good evidence
Is a policy document that clearly states this requirement with recent review dates.
- Check 2 of 5What an auditor asks for
Look at
Settings that indicate key length and ensure these are set to 2048 bits or higher.
Good evidence
Is screenshot evidence or logs showing compliance with this key length.
- Check 3 of 5What an auditor asks for
Ask for
Procurement documentation that outlines the encryption requirements for new software purchases.
Look at
Standards that specify RSA key lengths must be at least 2048 bits.
Good evidence
Is a checklist or requirement list that includes this specification.
- Check 4 of 5What an auditor asks for
Look at
The content to ensure it covers RSA modulus standards and implementation.
Good evidence
Includes dated training materials and attendance records.
- Check 5 of 5What an auditor asks for
Ask for
Recent monitoring or audit reports that check compliance with the RSA modulus requirement.
Look at
Consistent checks and actions taken to address non-compliance.
Good evidence
Is a detailed report showing regular reviews and outcomes.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0476 requires that RSA used for digital signatures and key transport uses a modulus of at least 2048 bits (preferably 3072 bits) to maintain cryptographic strength. Annex A 8.24 requires an organisation to define and implement rules for the effective use of cryptography and cryptographic key management, under which minimum RSA key sizes would be set as an approved standard. ISM-0476 is a specific technical parameter within the broader governance and standards expectation of Annex A 8.24.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.