Skip to content
Cryptography
ASD ISMISM-1762

ASD ISM 1762 Use NIST P-384 curve for ECDH keys

What it says

When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

When using ECDH, utilise the NIST P-384 curve for better encryption security.

This control suggests using a special mathematical tool called the NIST P-384 curve to securely share secret keys over the internet. If this isn't done, sensitive information might be intercepted by hackers, leading to data breaches or financial losses.

Why it matters

If ECDH uses curves other than NIST P-384/P-521, key agreement strength may drop, increasing risk of session key compromise and data exposure.

How to implement

  1. The IT team should ensure they're using the NIST P-384 curve when setting up systems that share encryption keys.

    They can do this by checking the software settings in their encryption tools to confirm the NIST P-384 option is selected.

  2. Managers should ask the IT team for a simple explanation of how the NIST P-384 curve protects the organisation's data.

    This helps everyone understand why this specific curve is important for our online security.

  3. Procurement officers should verify that new software purchases support NIST P-384 encryption.

    They can do this by asking vendors for technical specifications or documentation that lists supported encryption methods.

  4. The IT security coordinator should conduct a training session to explain why NIST P-384 is crucial, ensuring the team is aware of current security practices.

    This session should also cover basic troubleshooting if configurations need adjustments.

  5. System owners should periodically review and update system configurations to maintain compliance with this control.

    They can schedule regular quarterly checks where the team ensures that all systems are still using the recommended encryption settings.

Keep it running

Configure TLS/ECDH settings to prefer NIST P-384 (allow P-521) and disable weaker/unsupported curves; validate via scans and library policy.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The current encryption policy: Check that the document specifies using NIST P-384 for key agreements.

    Good evidence

    Would include explicit instructions about selecting this curve in all related systems.

  2. Check 2 of 5What an auditor asks for

    Look at

    The configuration settings of encryption tools on the organisation's servers. Check for NIST P-384 selection in these settings.

    Good evidence

    Demonstration will show that this setting is in place across all systems.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Software vendor agreements: Review the contracts or product brochures to confirm support for NIST P-384.

    Good evidence

    Is documentation that explicitly mentions compatibility with NIST P-384.

  4. Check 4 of 5What an auditor asks for

    Look at

    Records of recent training sessions covering encryption methods, specifically mentioning NIST P-384. Good evidence would be a session outline with attendance records.

  5. Check 5 of 5What an auditor asks for

    Ask for

    The encryption tool audit logs.

    Look at

    Logs or reports showing active use of NIST P-384 in recent key exchanges.

    Good evidence

    Includes specific log entries that show the algorithm in use.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.