ASD ISM 1759 Ensure strong encryption with Diffie-Hellman
What it says
When using DH for agreeing on encryption session keys, a modulus of at least 3072 bits is used, preferably 3072 bits.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a minimum 3072-bit modulus for secure Diffie-Hellman key exchanges.
This control is about using strong encryption to keep our private information safe when it's being shared online. Imagine you're sending a secret message in a locked box; this is like ensuring the lock on that box is really difficult to pick. If we don't use strong enough encryption, it's like using a weak lock, and someone could intercept and read our message, exposing sensitive data or personal information.
Free. Save your status, tasks and notes.
Why it matters
Using weak Diffie-Hellman keys invites attackers to decrypt sensitive communications, risking data breaches and loss of confidential information.
How to implement
IT team should ensure that all systems using Diffie-Hellman for key exchanges have a minimum 3072-bit modulus.
This is done by configuring the encryption settings in your system's security protocols to use the specific 3072-bit standard. It's like setting a password; just make sure it meets the minimum strength requirement.
The IT manager should review current encryption policies to include instructions on using at least 3072-bit Diffie-Hellman moduli.
Check existing documentation and update if necessary, ensuring all staff are aware and trained on these standards. This involves coordinating an information session or a training workshop for the relevant staff.
Procurement teams should verify that all new software and services purchased adhere to this minimum encryption standard.
When negotiating with vendors, request specifications that show adherence to the 3072-bit minimum requirement. This prevents introducing weak points through new software acquisitions.
System administrators should conduct regular checks and updates on the system's cryptographic settings to ensure compliance.
This involves using tools to audit the strength of encryption methods in use and applying updates as required. Schedule these audits quarterly to maintain security integrity.
Audit teams should include checks for this strong encryption standard in their routine security audits.
Develop a checklist that specifically identifies if the 3072-bit modulus is being used where needed. This ensures ongoing compliance and quick identification of vulnerabilities.
Keep it running
Regularly verify DH groups use a minimum 3072-bit modulus in TLS/VPN configs, and update cryptographic libraries when standards change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The encryption policy document: Request the official policy that outlines encryption standards used within the organisation.
Look at
The section concerning key exchange protocols, specifically Diffie-Hellman, to see if 3072-bit is specified.
Good evidence
Includes a clear policy that states 3072-bit modulus as a minimum for Diffie-Hellman exchanges.
- Check 2 of 5What an auditor asks for
Ask for
System configuration reports: Request reports that show current cryptographic settings for systems using Diffie-Hellman.
Look at
The settings for key exchange moduli sizes in these reports.
Good evidence
Is a report that clearly shows a 3072-bit minimum and has recent verification dates.
- Check 3 of 5What an auditor asks for
Ask for
Vendor compliance records: Request the records or contracts from vendors confirming their adherence to the 3072-bit modulus standard.
Look at
Clauses in contracts or vendor attestations outlining adherence to this standard.
Good evidence
Contains explicit mentions of using at least 3072-bit Diffie-Hellman exchanges.
- Check 4 of 5What an auditor asks for
Ask for
Internal audit results: Request the most recent internal audit documentation related to encryption standards.
Look at
The checklist results and any noted discrepancies in adhering to the 3072-bit standard.
Good evidence
Shows completed audits with no major findings or resolutions for any issues found.
- Check 5 of 5What an auditor asks for
Ask for
IT security training records: Request records of training sessions conducted on encryption standards.
Look at
Participant lists, training content, and feedback or assessments.
Good evidence
Includes recent training sessions covering the importance and procedures for implementing at least 3072-bit security.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1759 requires that when Diffie-Hellman is used to agree encryption session keys, a modulus of at least 3072 bits is used. This relates directly to Annex A 8.24 because it is a concrete cryptographic-rule requirement that would sit within an organisation's broader cryptography and key management rules. Annex A 8.24 is wider in scope (covering selection, use and lifecycle management of cryptography and keys), whereas ISM-1759 is a specific parameter constraint for one key agreement method.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.