Skip to content
Cryptography
ASD ISMISM-1763

ASD ISM 1763 Use NIST P-384 curve for ECDSA signatures

What it says

When using ECDSA for digital signatures, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

When signing digitally, prefer using the NIST P-384 curve for better security.

When you're signing documents digitally, it's like putting your unique signature on paper. This control suggests using a specific type of digital 'signature' method, called the NIST P-384 curve, which is known for being very secure. If you don't use this, your digital signatures might get easier to forge, potentially leading to unauthorised access or fraud.

Why it matters

Using weaker or non-approved ECDSA curves instead of NIST P-384 can reduce signature strength, increasing the chance of forged signatures and unauthorised actions.

How to implement

  1. IT team should review current digital signing methods: Check what algorithms are currently being used.

    Ensure that NIST P-384 curve is included as an option for digital signatures and update software if necessary.

  2. Procurement should specify security requirements: When purchasing software or services that involve digital signatures, ensure contracts specify that they support the NIST P-384 curve for ECDSA signatures.

    Clarify this during vendor negotiation.

  3. IT security manager should run awareness sessions: Educate team members about the importance of using recommended algorithms.

    Use simple examples to explain why the NIST P-384 curve is preferred for security.

  4. System owner should coordinate upgrade plans: If the required software does not support the NIST P-384 curve, collaborate with IT to plan and prioritise an upgrade.

    Create a timeline for implementing this change.

  5. Policy manager should update documentation: Ensure internal security policies reflect the use of the NIST P-384 curve for digital signatures.

    This ensures everyone knows it's the standard and follows it.

Keep it running

Confirm ECDSA implementations are restricted to NIST P-256/P-384/P-521 and prefer P-384; audit certificate keys and signing libraries to prevent weaker curves.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of algorithms used for digital signatures: Request documentation from the IT team detailing current algorithms.

    Look at

    NIST P-384 in the list.

    Good evidence

    Includes NIST P-384 listed with implementation notes.

  2. Check 2 of 5What an auditor asks for

    Look at

    Clauses in contracts that mention supported curves.

    Good evidence

    Confirms NIST P-384 inclusion or future update commitments.

  3. Check 3 of 5What an auditor asks for

    Ask for

    IT awareness session records: Review attendance and materials from training sessions.

    Look at

    Evidence that the NIST P-384 curve's importance was covered.

    Good evidence

    Includes clear session agendas and participant feedback.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Upgrade timelines: Request a project plan or timeline for software upgrades.

    Look at

    Steps detailing migration to or support for NIST P-384.

    Good evidence

    Includes a specific timeline and responsible parties.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see updated security policies: Review new policies set by the policy manager.

    Look at

    Clear mention of NIST P-384 as preferred.

    Good evidence

    Includes explicit statements about using NIST P-384.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.