Skip to content
Cryptography
ASD ISMISM-0477

ASD ISM 0477 Separate RSA key pairs for different functions

What it says

When using RSA for digital signatures, and for transporting encryption session keys (and similar keys), a different key pair is used for digital signatures and transporting encryption session keys.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use separate RSA key pairs for signing and key transportation to enhance security.

This guideline is about using different sets of RSA keys for different tasks like signing messages and exchanging encryption keys. It's important because using the same key for multiple purposes can make your system vulnerable to attacks, where someone could fake messages or improperly access secure information.

Why it matters

Using the same RSA keys for multiple functions increases the risk of key compromise, allowing attackers to forge signatures or decrypt sensitive communications.

How to implement

  1. IT team should assign different RSA keys for signing and key transportation.

    Ensure that the two tasks don't share the same keys to avoid overlapping uses that could lead to security breaches.

  2. System administrators need to review key management policies.

    They should update documentation to clearly state which keys are used for which task and ensure that these keys are stored and accessed separately.

  3. Cyber security leads should conduct training sessions.

    These sessions will educate relevant staff about the importance of using separate RSA keys and how mishandling keys can lead to security vulnerabilities.

  4. IT team should implement software checks.

    Use software that verifies whether keys are being correctly used for their specific functions, providing alerts if keys are misapplied.

  5. Regular audits should be conducted by the IT security officer.

    Schedule these checks periodically to ensure that keys are correctly utilised according to the guidelines and policies set forth.

Keep it running

Audit RSA key usage to ensure separate key pairs are dedicated to signing vs key transport; label keys by purpose and prevent reuse across functions.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Documentation of RSA key assignments: Request listings showing which keys are used for signing and which are for key transportation.

    Look at

    Clear differentiation in tasks for each key.

    Good evidence

    Includes distinct keys being used for separate functions.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Includes up-to-date policies reflecting these practices.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training session records: Request documentation or logs of training sessions held for staff on RSA key usage. Look if these sessions included content on key separation and proper usage.

    Good evidence

    Is dated training material that covers key separation.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Reports or logs that show how keys are being utilised in practice.

    Look at

    Any alerts or incidents where keys might have been used incorrectly.

    Good evidence

    Is logs showing no misused keys.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Outcomes of recent key usage audits: Request audit reports concerning RSA key management.

    Look at

    The findings related to key usage compliance.

    Good evidence

    Includes no unresolved discrepancies or recommendations regarding this control.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.