ASD ISM 1629 Select correct modulus for Diffie-Hellman encryption
What it says
When using DH for agreeing on encryption session keys, a modulus and associated parameters are selected according to NIST SP 800-56A Rev. 3.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse NIST guidelines to choose secure parameters for Diffie-Hellman encryption to safely agree on session keys.
When it comes to discussing using Diffie-Hellman encryption, we're talking about a method to securely agree on a secret code or "key" to keep digital communications safe. Choosing the right numbers-known as a modulus and other parameters-is like making sure you have a safe with a strong lock. If you choose poorly, it's easier for someone to open that lock without a key and see your secrets.
Free. Save your status, tasks and notes.
Why it matters
Incorrect modulus selection in Diffie-Hellman can enable weak-key attacks, allowing decryption of sessions and exposure of sensitive data and communications.
How to implement
The IT team should consult the NIST (National Institute of Standards and Technology) guidelines to select the appropriate modulus and other parameters for Diffie-Hellman encryption.
This involves using their published standards, which offer parameters proven to be secure against current threats. It's like following a reliable recipe to ensure the security 'soup' you make is safe to consume.
The IT manager should set up a procedure where these security parameters are reviewed annually.
This can be done by scheduling a yearly technology audit where these parameters are checked against the latest guidelines, ensuring they still offer optimal security.
Organisations should keep detailed records of the chosen parameters and the decision process.
The IT team should document why these specific choices were made and store these documents in a secure but accessible place, like a dedicated folder that is regularly backed up.
The IT team should train staff in understanding the basics of why these parameters matter.
Make a short, simple training session or video explaining the importance in everyday language, thereby building a culture of compliance and security awareness.
The organisation should benchmark their parameters against those used in peer organisations.
This can involve liaising with other businesses or industry groups to compare notes in a way that doesn't compromise security.
Keep it running
Verify DH modulus size and domain parameters match NIST SP 800-56A Rev. 3 approved groups; restrict configs to those groups and record periodic checks and any changes.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
The documentation of selected Diffie-Hellman parameters.
Look at
The dates and justification for parameter selection, ensuring they align with NIST guidelines. Good evidence shows a clear adherence to standard protocols with up-to-date records.
- Check 2 of 2What an auditor asks for
Ask for
The training materials used to educate staff about Diffie-Hellman security. Check if the materials simplify the concept while effectively communicating its importance. Good training content will be easy to understand and focused on the specific control requirements.
Look at
How these are organised, named, and dated to verify easy traceability in decision-making. A well-maintained record system will have clear, consistent filing conventions and accessible documentation.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1629 requires that when Diffie-Hellman (DH) is used to agree encryption session keys, the modulus and associated parameters are selected in accordance with NIST SP 800-56A Rev. 3. Annex A 8.24 requires an organisation to define and implement rules for effective cryptography use and cryptographic key management, which would include setting approved DH parameter standards. Annex A 8.24 is broader and policy/governance-focused across all cryptography and key management, while ISM-1629 is a specific technical parameter-selection requirement for DH.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.