Skip to content
Cryptography
ASD ISMISM-0999

ASD ISM 0999 Use DH or ECDH for secure key establishment

What it says

DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random ECP group, 3072-bit MODP Group or 4096-bit MODP Group.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

For IPsec connections, use DH/ECDH methods to securely establish keys with specific group sizes for better security.

When you're connecting computers over the internet using IPsec, which is just a way to make sure the data stays private and secure, it's crucial to use specific methods called Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman (ECDH). These methods help set up a secure key to lock your data. It's important because, without the right protection, your sensitive information could be intercepted by someone else while it's being transmitted.

Why it matters

Weak/non-recommended DH/ECDH groups in IPsec key exchange can enable MitM or decryption, exposing sensitive traffic.

How to implement

  1. IT team: Use appropriate methods for securing IP connections by selecting Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman (ECDH).

    To implement, configure your systems to use strong group sizes like a 384-bit random elliptic curve or a 3072/4096-bit modular group to make sure the data is secure against potential attacks.

  2. System administrators: Regularly update the configurations of IPsec protocols to ensure they're using the latest security standards.

    You can do this by reviewing the current setup and upgrading to the recommended group sizes for DH or ECDH, which helps to secure data effectively.

  3. IT security managers: Train your IT staff on the importance of using DH or ECDH methods for key establishment.

    Hold regular training sessions that cover why specific group sizes matter and provide step-by-step guides on setting up these protocols correctly.

  4. Procurement officers: When acquiring new network equipment or software, ensure they support DH and ECDH for secure key establishment.

    Check product specifications or ask vendors directly if their solutions are compliant with the recommended 384-bit or 3072/4096-bit group sizes.

  5. Management: Allocate budget and resources to ensure your IT infrastructure supports these secure configurations.

    Discuss with your IT and finance teams about the costs involved in upgrading systems and maintaining these security standards.

Keep it running

Regularly confirm IPsec uses approved DH/ECDH groups (e.g., 384-bit ECP, 3072/4096-bit MODP) after changes/upgrades.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The configuration files of IPsec connections: Request to see the configuration details set up for secure key establishment.

    Look at

    The group sizes used for DH or ECDH, ensuring they match the recommended specifications.

    Good evidence

    It should show compliance with 384-bit ECP or 3072/4096-bit MODP groups.

  2. Check 2 of 5What an auditor asks for

    Ask for

    A report on network security protocols: Request documentation that outlines the current security protocols your organisation uses for IPsec.

    Look at

    Detailed explanations of how DH or ECDH methods are implemented.

    Good evidence

    Clear integration of recommended group sizes and regular review dates should be included.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Evidence of staff training on secure protocols: Request records or agendas of training sessions that cover IPsec security updates.

    Look at

    The frequency and content of these training sessions.

    Good evidence

    Evidence of regular training programs that specifically include DH and ECDH methods.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Vendor compliance documentation: Request proof from vendors that their equipment supports the security requirements.

    Look at

    Statements of compliance with DH and ECDH standards.

    Good evidence

    Documentation explicitly stating support for 384-bit and 3072/4096-bit groups.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Network equipment specifications: Request the technical specifications of currently used network devices.

    Look at

    Whether they list support for recommended DH or ECDH group sizes.

    Good evidence

    Specifications should reflect compatibility with the specified secure key establishment methods.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.