ASD ISM 0994 Use ECDH for secure key exchanges
What it says
ECDH is used in preference to DH.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishECDH is preferred over DH for secure data exchanges.
This control means using a type of secure digital handshake called Elliptic Curve Diffie-Hellman (ECDH) instead of an older version called Diffie-Hellman (DH) for exchanging sensitive data. It's important because ECDH is more secure, making it harder for hackers to intercept and steal information, helping to protect your business or organisation from data breaches.
Free. Save your status, tasks and notes.
Why it matters
If ECDH is not used in preference to DH, key exchange may be weaker or misconfigured, increasing the risk of session key compromise and data exposure.
How to implement
The IT team should ensure that all new systems or services use ECDH for secure data exchanges.
They can do this by updating or configuring the encryption settings to use ECDH instead of older methods like DH.
Procurement should work with IT to make sure any new software or hardware includes ECDH support.
This involves checking product specifications and confirming with vendors before purchase.
The IT manager should organise training sessions for staff handling encryption to explain why ECDH is preferred and how to properly implement it.
Use real-life scenarios to demonstrate the benefits of using ECDH.
System administrators should review existing systems to identify where DH is currently used.
Create a plan to migrate those systems to ECDH, prioritising sensitive areas like financial transactions or personal data.
Compliance officers should keep up-to-date with Australian Cyber Security Centre (ACSC) guidelines.
They should regularly check that ECDH remains part of the organisation's approved cryptography practices, meeting required standards.
Keep it running
Confirm TLS/VPN profiles negotiate ECDHE (not DHE) and disable DH cipher suites/groups; periodically scan configs and endpoints to detect regression.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of systems and applications using ECDH: Request documentation from the IT department showing which systems have implemented ECDH.
Look at
Dates of implementation and any software updates.
Good evidence
A clear list showing ECDH has been applied with recent update logs.
- Check 2 of 5What an auditor asks for
Ask for
Vendor product specifications: Ensure procurement has vendor documentation confirming ECDH support in new purchases. Check specifications for security features.
Good evidence
Documents explicitly stating ECDH compatibility as a security measure.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request attendance records and materials from ECDH training sessions.
Look at
Who attended and the content covered.
Good evidence
Records showing relevant staff attended and understood the importance and implementation of ECDH.
- Check 4 of 5What an auditor asks for
Ask for
Migration plans: Check migration documents showing the shift from DH to ECDH.
Look at
Timelines, affected systems, and risk assessments.
Good evidence
Detailed plans demonstrating progress and outlining future steps.
- Check 5 of 5What an auditor asks for
Ask for
To see policy and procedure documents: Verify that ECDH use is outlined in security policies. Check for references to ACSC guidelines and internal audits.
Good evidence
Policies clearly integrating ECDH as a preferred cryptographic method.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0994 requires organisations to use ECDH in preference to classical DH for secure key exchange. Annex A 8.24 requires rules for the effective use of cryptography, including cryptographic key management, to be defined and implemented, which would typically include approved key exchange mechanisms for protocols such as TLS and IPsec. ISM-0994 is a specific algorithm/method selection within the broader cryptography governance and key management expectations of Annex A 8.24.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.