ASD ISM 1772 Use secure pseudorandom functions for IPsec connections
What it says
PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, preferably PRF_HMAC_SHA2_512.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse secure methods for IPsec connections to ensure data integrity and security.
This control is about making sure the way we secure our Internet data links is as strong as possible. If we don't use the best methods for securing these data links, which are recommended by experts, our sensitive information may be exposed to cyber threats or data breaches.
Free. Save your status, tasks and notes.
Why it matters
Using weak or non-approved IPsec PRFs can allow key derivation attacks, reducing tunnel integrity/confidentiality and risking data exposure.
How to implement
IT Managers should ensure that the organisation's network configuration uses the recommended secure methods for IPsec connections.
This involves checking the configurations for IPsec to verify that PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384, or PRF_HMAC_SHA2_512 is being used, preferably opting for PRF_HMAC_SHA2_512.
Network Administrators need to update the IPsec settings to the highest level of security available.
They should access the network settings, locate the IPsec configuration section, and select PRF_HMAC_SHA2_512 as the pseudorandom function where applicable.
IT Security Officers should review and update security policies regarding IPsec to align with the latest guidance.
They need to look at the current policies, identify any outdated practices, and update them to reflect the use of improved pseudorandom functions such as PRF_HMAC_SHA2_512.
System Owners should conduct regular training sessions to keep their IT staff informed about the importance of using secure pseudorandom functions for IPsec.
Organise workshops or training days where the significance of these security measures and their impact on organisational security is clearly explained.
Procurement Officers should include specifications that require the use of secure pseudorandom functions in any new contract for network equipment or services.
They need to ensure that the contracts emphasise the necessity for IPsec configurations to support the preferred options like PRF_HMAC_SHA2_512.
Keep it running
Verify IPsec proposals use PRF_HMAC_SHA2_256/384/512 (prefer 512); reject weaker PRFs and regularly audit configuration drift.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network configuration documentation: Request detailed records of the current IPsec setup. Look to see if the documentation specifies the use of PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384, or preferably PRF_HMAC_SHA2_512.
Good evidence
Is clear documentation showing the implemented pseudorandom function and its effective date.
- Check 2 of 5What an auditor asks for
Ask for
The IT policy documents: Request the policy documents related to network security and IPsec implementation.
Look at
Sections that outline the use of secure pseudorandom functions, mentioning the types PRF_HMAC_SHA2_256, 384, or 512.
Good evidence
Includes a policy document that is up-to-date and specifically mandates these secure functions.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of staff training on IPsec security: Request records of recent training sessions related to IPsec and secure techniques.
Look at
Attendance records, session content, and training materials.
Good evidence
Would be materials that explicitly cover pseudorandom functions and attendance lists showing staff participation.
- Check 4 of 5What an auditor asks for
Ask for
To see recent purchase agreements for network equipment: Request contract or purchase documents for network hardware or services.
Look at
Terms that require IPsec implementations to support PRF_HMAC_SHA2_512.
Good evidence
Would include contracts specifying secure configuration requirements before purchase.
- Check 5 of 5What an auditor asks for
Ask for
The system logs: Request access to logs that monitor the IPsec connections.
Look at
Log entries to verify the use of secure algorithm settings such as PRF_HMAC_SHA2_512.
Good evidence
Is logs clearly showing the application of these settings on current connections.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
Annex A 8.20 requires networks to be secured, including the protection of communications and inter-network connections. ISM-1772 supports this by mandating strong pseudorandom functions for IPsec connections, strengthening cryptographic protection for network tunnels and reducing risk of compromise of protected traffic. Annex A 8.20 is broader because it covers overall network/device security and management, while ISM-1772 is a specific IPsec cryptographic parameter requirement.
This control partially meets A.8.24.
ISM-1772 mandates the use of approved, strong PRFs for IPsec connections (PRF_HMAC_SHA2_256/384/512) to ensure robust cryptographic operation during key derivation and related integrity protections. Annex A 8.24 requires the organisation to define and implement rules for the effective use of cryptography and cryptographic key management, under which selecting strong algorithms/parameters for protocols like IPsec is a common requirement. ISM-1772 is a specific algorithm-parameter rule for one protocol, whereas Annex A 8.24 spans cryptographic policy, algorithm selection, and key management across the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.