Skip to content
Cryptography
ASD ISMISM-1994

ASD ISM 1994 Use correct hashing for ML-DSA pre-hashed variants

What it says

When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-384 and SHA-512 respectively are used for pre-hashing.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure stronger hashes like SHA-384 or SHA-512 are used with ML-DSA digital signatures for added security.

This control is about making sure your digital signatures are extra secure by using strong hashing methods like SHA-384 or SHA-512 before signing. By doing this, you protect sensitive data from being tampered with or faked, which is crucial in maintaining trust and preventing fraud.

Why it matters

If ML-DSA-65/87 pre-hashed variants use weaker than SHA-384/SHA-512, signature forgery and integrity failures become more likely.

How to implement

  1. The IT team should review all current digital signature processes to ensure they include pre-hashing with SHA-384 or SHA-512.

    This means verifying the algorithms used for hashing are up to the latest standards for security.

  2. Managers responsible for data security should conduct regular training for staff on the importance of secure digital signatures.

    This could involve practical demonstrations on how strong hashing protects data.

  3. Procurement teams should ensure that any new software involving digital signatures supports SHA-384 or SHA-512 hashing.

    This involves checking technical specifications before purchase and consulting with IT for verification.

  4. The IT team should update systems and software to the latest versions if they currently do not support SHA-384 or SHA-512.

    They can do this by implementing patches or reaching out to vendors for software updates.

  5. Data security officers should document the hashing algorithm used for digital signatures in internal policies.

    This can be achieved by maintaining a security policy document that includes the requirement for SHA-384 or SHA-512 hashing.

Keep it running

Verify configurations and libraries: ML-DSA-65 pre-hash uses SHA-384 and ML-DSA-87 pre-hash uses SHA-512; test during updates.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of algorithms used in digital signature processes.

    Look at

    Whether SHA-384 or SHA-512 is included and being used as per the policy.

    Good evidence

    Will be a clear mention of these algorithms in use.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Training records that cover secure digital signature practices.

    Look at

    The frequency and comprehensiveness of training on hashing methods. Good training records will have recent dates and attendance lists.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Procurement checklists or specs for digital signature tools.

    Look at

    Whether SHA-384 or SHA-512 compatibility was a requirement.

    Good evidence

    Will have documented evidence of this criterion being checked.

  4. Check 4 of 5What an auditor asks for

    Ask for

    System update logs showing recent updates to support secure hashing.

    Look at

    The dates and descriptions of these updates.

    Good evidence

    Log will show relevant updates applied and verified by IT staff.

  5. Check 5 of 5What an auditor asks for

    Ask for

    The organisation's documented security policy on digital signatures.

    Look at

    Whether it references the use of specific strong hashing algorithms.

    Good evidence

    Policy will have these algorithms clearly stated.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.