ASD ISM 1765 Use RSA with 3072-bit modulus for security
What it says
When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 3072 bits is used, preferably 3072 bits.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure RSA uses at least a 3072-bit size for secure digital signatures and key transport.
This rule says that if you use RSA encryption, you need to make sure the keys are long enough, specifically at least 3072 bits. It matters because shorter keys can be broken by hackers, which means your sensitive information, like digital signatures and data transfers, could be exposed or tampered with.
Free. Save your status, tasks and notes.
Why it matters
Using RSA keys under 3072 bits weakens signatures and session-key transport, increasing risk of forgery or key recovery and loss of trust.
How to implement
IT team: Implement RSA keys of 3072 bits or more.
Use your security software settings to configure the key length to no less than 3072 bits when generating new encryption keys for systems managing sensitive data.
Procurement team: Ensure software purchases support larger RSA key sizes.
Verify with vendors that their products can handle RSA keys of at least 3072 bits to maintain compatibility with your security requirements.
System administrator: Regularly check systems for compliance with RSA key length requirements.
Review security configurations on each system to confirm that at least 3072-bit RSA keys are being used for digital signatures and encryption.
Training coordinator: Educate staff about the importance of secure key sizes.
Develop a brief training session explaining why longer key lengths are needed and how to check their systems ensure compliance.
Security team: Monitor for weak encryption practices.
Use tools that can audit systems and alert you if RSA keys below 3072 bits are found, ensuring immediate corrective action.
Keep it running
Audit certificates and configs to ensure RSA keys are ≥3072 bits for signatures and key transport; block weaker keys and track crypto library defaults.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The key management policy document: Request documentation that describes how encryption keys are generated and managed.
Look at
Sections specifying key length requirements.
Good evidence
Document will clearly state the use of 3072-bit keys or longer for RSA encryption.
- Check 2 of 3What an auditor asks for
Ask for
The IT team to simulate creating a new encryption key on a system. Observe that the interface defaults or enforces a minimum of 3072-bit for RSA keys.
Good evidence
Demonstration shows the process resulting in a properly sized key.
- Check 3 of 3What an auditor asks for
Ask for
A recent security audit report: Request the most recent report that includes encryption key management review.
Look at
Findings on RSA key sizes.
Good evidence
Report will indicate that all systems reviewed comply with the 3072-bit key requirement.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1765 requires that when RSA is used for digital signatures and for transporting encryption session keys, organisations use an RSA modulus of at least 3072 bits. Annex A 8.24 requires rules for effective use of cryptography and cryptographic key management to be defined and implemented, which would typically include approved algorithms and minimum key sizes. ISM-1765 is a specific, prescriptive cryptographic parameter requirement, while Annex A 8.24 is broader and covers governance and lifecycle management beyond RSA key length.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.