ASD ISM 2165 Fresh EAP-TLS authentication for each new connectivity association key
What it says
When using EAP-TLS, each device performs a fresh EAP-TLS authentication each time a new Connectivity Association Key is required.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDevices using EAP-TLS for MACsec Key Agreement (MKA) must re-authenticate with a fresh EAP-TLS exchange whenever they need a new Connectivity Association Key, rather than reusing an old session or key.
A Connectivity Association Key (CAK) is the master key that MACsec Key Agreement (MKA) uses to protect a MACsec link between two devices. Where EAP-TLS is used to establish that key, each device proves its identity with a certificate and the key material is derived from the resulting authentication. This control says the derivation must not be a one-off. Every time a device needs a new CAK (for example, when the existing one is due to be replaced), that device must go through a complete, fresh EAP-TLS authentication. It must not simply reuse a previous authentication, resume an old TLS session (for example through EAP-TLS fast reconnect or TLS session resumption), or roll the key forward from earlier material without re-authenticating. Why it matters: if a new CAK is produced without a fresh authentication, the link continues to trust a device on the strength of an identity check that may be stale. A certificate that has since been revoked, a device that has since been compromised, or a session that has been hijacked would keep receiving new keys. Forcing a fresh EAP-TLS authentication each time ties every new key to a current, verified identity and limits how long any single authentication remains useful to an attacker.
Free. Save your status, tasks and notes.
Why it matters
If devices obtain new Connectivity Association Keys without performing a fresh EAP-TLS authentication, key rollover stops being a security checkpoint. A device whose certificate has been revoked, or which has been compromised since it last authenticated, can keep receiving new keys and keep participating in the protected link. Key material may also be derived from old session state, weakening the independence of each new key. The organisation loses confidence that every key on the link belongs to a currently authorised device, and the compromise window extends across multiple key lifetimes instead of ending at the next rollover.
How to implement
Network engineers configure each device that uses EAP-TLS to derive its Connectivity Association Key from a fresh EAP-TLS authentication, and disable EAP-TLS fast reconnect, TLS session resumption and any other option that lets the device reuse a previous authentication or cached session when a new CAK is required.
Network engineers set the CAK rollover parameters on each device so that the request for a new CAK triggers a complete EAP-TLS exchange, and record the configured rollover trigger and the expected authentication behaviour in the device build standard.
The authentication server administrator configures the EAP-TLS policy on the RADIUS server that serves MACsec devices to treat every CAK-related authentication as a full authentication, with fast reconnect and TLS session resumption disabled so that each new CAK is tied to a complete certificate-based exchange.
The network team tests the behaviour on a representative device by forcing a new CAK and confirming, from both the device log and the authentication server log, that a fresh EAP-TLS authentication was performed before the new key was used.
The change manager adds a check to the change process for network devices and authentication servers so that firmware upgrades, template changes and server updates are verified to keep the fresh-authentication-per-CAK behaviour before they are approved.
Keep it running
In day-to-day operation this control shows up as configuration on the devices and the authentication server rather than as a manual task. Network engineers need to confirm that the EAP-TLS and key management settings on each participating device require a full authentication when a new CAK is needed, and that nothing in the configuration allows the device to skip that step by reusing a cached session or a prior authentication result.
Operations teams should expect to see an EAP-TLS authentication event on the authentication server that lines up with each CAK change on each device. Where those events are missing, or the count of authentications is lower than the count of key changes, the configuration should be checked. Certificate expiry and revocation handling also matter here, because a fresh authentication is only useful if the server is checking current certificate status. Changes to device firmware, authentication server software, or key rollover settings should be reviewed to make sure the fresh-authentication behaviour is preserved.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the running configuration or configuration template for a sample of devices that use EAP-TLS to establish Connectivity Association Keys.
Look at
Look at the EAP-TLS and key management settings to see whether a new CAK requires a full EAP-TLS authentication, and whether any setting (such as EAP-TLS fast reconnect or TLS session resumption) permits session reuse or cached authentication.
Good evidence
The configuration shows that each new CAK is tied to a fresh EAP-TLS authentication, with no session-reuse or cached-authentication options enabled.
- Check 2 of 5What an auditor asks for
Ask for
Ask for authentication server logs covering a period in which CAK rollovers occurred on the sampled devices.
Look at
Compare the timestamps of CAK changes on the devices with EAP-TLS authentication events on the server for the same device identities.
Good evidence
Every CAK change on each sampled device is matched by a fresh EAP-TLS authentication event immediately beforehand.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the device build standard or design document that describes how EAP-TLS and CAK management are configured.
Look at
Check that the document states the fresh-authentication requirement for each new CAK and that the standard matches what is actually configured.
Good evidence
The standard explicitly requires a fresh EAP-TLS authentication for every new CAK and the sampled configurations match it.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the results of the most recent test in which a new CAK was forced on a device.
Look at
Review the device and server log extracts captured during the test to see whether a complete EAP-TLS exchange preceded the new key.
Good evidence
The test record shows a full EAP-TLS authentication occurred before the new CAK was used, and the test is repeated after relevant changes.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the RADIUS server configuration for the EAP-TLS policy applied to MACsec devices.
Look at
Look for EAP-TLS fast reconnect, TLS session resumption or session caching settings that would let a device obtain a new CAK on a resumed session instead of a full authentication.
Good evidence
Fast reconnect and session resumption are disabled for the MACsec policy, so every CAK-related authentication is a complete EAP-TLS exchange. Certificate revocation checking, assessed under its own ISM controls, then applies to each of those exchanges.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-2165 mandates that EAP-TLS sessions are not reused for CAK establishment by requiring a fresh EAP-TLS authentication whenever a new CAK is needed. ISO/IEC 27001:2022 Annex A 5.15 requires organisations to establish and implement access control rules and procedures, under which network access controls can specify when re-authentication is required and how session/key renegotiation is handled. Annex A 5.15 provides the governance mechanism to mandate such rules, whereas ISM-2165 specifies one particular technical rule that would sit under those procedures.
This control partially meets A.8.5.
ISM-2165 requires a specific behaviour for 802.1X EAP-TLS: each device must perform a fresh EAP-TLS authentication every time a new Connectivity Association Key (CAK) is required, preventing reuse of prior authentication state for key establishment. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented in line with access restrictions, which can include enforcing re-authentication and robust key establishment for network access. Annex A 8.5 is technology-agnostic and policy-driven, while ISM-2165 is a concrete, protocol-level requirement tied to CAK generation/rekeying events.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.