search account_circle

policyASD ISM

Guidelines for cryptography

72 controls in this part of theInformation Security Manual (ISM). Each control links to plain-English guidance, audit tips and cross-framework mappings.

Cryptographic algorithms

Use Only High Assurance Cryptographic Algorithms

Ensure cryptographic tools use only ASD-approved or high-assurance algorithms for security.

Using Proper Modulus Size for Diffie-Hellman Keys

Ensure Diffie-Hellman encryption uses at least a 2048 bits modulus for secure key agreements.

Using Secure Elliptic Curve Diffie-Hellman Encryption

Use ECDH with a base point order and key size of at least 224 bits, preferably NIST P-384, for secur

Use P-384 Curve for Secure Digital Signatures

Ensure stronger digital signature security by using ECDSA with a key size of at least 224 bits, idea

Ensuring Strong RSA Modulus for Digital Security

Use a minimum 2048-bit RSA modulus for better security in digital signatures and key transport.

Separate RSA Key Pairs for Different Functions

Use separate RSA key pairs for signing and key transportation to enhance security.

Avoid Using ECB Mode for Symmetric Encryption

Symmetric encryption should not use ECB mode as it is less secure.

Use ECDH for Secure Key Exchanges

ECDH is preferred over DH for secure data exchanges.

Use Approved Elliptic Curves for Encryption

Ensure secure cryptography by using NIST-approved elliptic curves for encryption.

Select Correct Modulus for Diffie-Hellman Encryption

Use NIST guidelines to choose secure parameters for Diffie-Hellman encryption to safely agree on ses

Ensure Strong Encryption with Diffie-Hellman

Use a minimum 3072-bit modulus for secure Diffie-Hellman key exchanges.

Use NIST Curves for ECDH Encryption

Use specific NIST curves for secure encryption key exchanges, with P-384 preferred.

Use NIST P-384 Curve for ECDH Keys

When using ECDH, utilise the NIST P-384 curve for better encryption security.

Use NIST P-384 Curve for ECDSA Signatures

When signing digitally, prefer using the NIST P-384 curve for better security.

Use NIST P-384 Curve for ECDSA Signatures

Use the NIST P-384 or P-521 curves, preferably P-384, for secure digital signatures.

Use RSA with 3072-bit Modulus for Security

Ensure RSA uses at least a 3072-bit size for secure digital signatures and key transport.

Ensure Secure Hashing with SHA-2 Algorithm

Use at least 224-bit SHA-2 hash, with SHA-384 or SHA-512 being preferred, to ensure strong security.

Use SHA-2 with Minimum 256-bit Output

When using SHA-2, ensure the hash is at least 256 bits for better security.

Use Appropriate SHA-2 Output Size for Hashing

Use SHA-2 with at least 384-bit output for secure data hashing.

Using AES Encryption with Strong Key Lengths

Use AES encryption with a strong key length, preferably AES-256, for enhanced security.

Utilise Strong AES Encryption Algorithms

When encrypting with AES, use stronger versions like AES-192 or preferably AES-256 for better securi

Support Post-Quantum Cryptographic Algorithms by 2030

New cryptographic tools must support specific secure algorithms by 2030 to be ready for future quant

Enforcing Separation of Mobile Apps and Data

Ensure that work and personal apps and data are kept separate on mobile devices.

Implement ML-DSA for Enhanced Digital Signature Security

Use ML-DSA algorithms, preferring ML-DSA-87, for secure digital signatures.

Using Hedged Variant of ML-DSA for Digital Signatures

Use the more secure version of ML-DSA for digital signatures to minimise risks.

Use Pre-Hashed ML-DSA Variants Only When Necessary

Only use alternate ML-DSA signatures if the standard version is too slow.

Use Correct Hashing for ML-DSA Pre-hashed Variants

Ensure stronger hashes like SHA-384 or SHA-512 are used with ML-DSA digital signatures for added sec

Use ML-KEM for Secure Key Encapsulation

Ensure encryption keys are protected using recommended ML-KEM-768 or ML-KEM-1024 methods.

Using Hybrid Schemes for Secure Encryption

Ensure at least one encryption method is approved for strong protection against future quantum threa

Develop a Post-Quantum Cryptography Transition Plan

Create and maintain a plan to move to cryptographic methods that are secure against quantum computin

Cryptographic Algorithms

Use AACA or High Assurance Algorithms for Data Encryption

Ensure that data at rest is encrypted using strong cryptographic algorithms like AACA for high secur

Cryptographic fundamentals

Report Cryptographic Equipment Compromises Promptly

Notify security officers quickly if cryptographic equipment or keys might be compromised.

Enable Data Recovery for Encrypted Data

Ensure encrypted data can be accessed if the encryption key is lost or damaged.

Use Evaluated Crypto for Sensitive Data Encryption

Use approved cryptographic tools to encrypt sensitive or protected data to ensure security.

Use HACE for Encrypting Sensitive Media

HACE ensures the encryption of media with SECRET or TOP SECRET data is secure.

Managing Encryption Access for IT Equipment and Media

IT systems are treated according to their original sensitivity when accessed using encryption.

Use Evaluated Cryptographic Tools for Sensitive Data

Use evaluated cryptographic tools to protect sensitive data on insecure or public networks.

Using HACE for Secure Communication of Data

Use HACE to secure SECRET and TOP SECRET data on less secure networks.

Ensure Compliance with ASD Communication Security Policies

Follow ASD's security rules for operating and managing communication systems safely.

Transport of Keyed Cryptographic Equipment

Cryptographic equipment is moved securely depending on the sensitivity of its keys.

Develop and Maintain Cryptographic Key Management Processes

Ensure systems have established processes for managing cryptographic keys securely and efficiently.

Change Keying Material When Compromised

Change encryption keys if they are compromised to maintain security.

Operate Approved High Assurance Cryptographic Equipment

Use approved high-security cryptographic tools according to Australian guidelines.

Cryptographic protocols

Ensure Use of High Assurance Cryptographic Protocols

Ensure only approved secure cryptographic protocols are used in equipment and software.

Cryptographic Protocols

Use Approved Cryptographic Protocols When Encrypting Data In Transit

When data moves across networks, encrypt it using an approved (AACP) or high assurance cryptographic

Internet Protocol Security

Use of IPsec Tunnel and Transport Modes

IPsec connections should use tunnel mode; if using transport mode, ensure an IP tunnel is used.

Use ESP Protocol for Secure IPsec Connections

ESP protocol is needed to securely encrypt and authenticate IPsec connections.

Ensure Short Lifetimes for IPsec Associations

IPsec connections should expire in less than four hours to maintain security.

Using Integrity Algorithms for IPsec Connections

Use specific algorithms for authenticating IPsec connections, preferring none if AES-GCM is used.

Use DH or ECDH for Secure Key Establishment

For IPsec connections, use DH/ECDH methods to securely establish keys with specific group sizes for

Utilising Perfect Forward Secrecy for IPsec

Use PFS to ensure past IPsec keys can't be used if current ones are compromised.

Use IKE Version 2 for IPsec Key Exchange

Ensure secure IPsec connection by using IKE version 2 for exchanging keys.

Use AES Encryption for IPsec Connections

AES encryption, especially ENCR_AES_GCM_16, is recommended for securing internet protocol connection

Use Secure Pseudorandom Functions for IPsec Connections

Use secure methods for IPsec connections to ensure data integrity and security.

Secure Shell

Configure SSH for Secure Server Access

Ensure SSH settings enhance security by limiting access, disabling risky features, and ensuring safe

Use Public Key Authentication for SSH Access

Ensure SSH connections use public key authentication for enhanced security.

Disable Certain Features for Passwordless SSH Logins

When logging in without a password via SSH, certain access features like port forwarding and X11 are

Use Forced Commands for SSH Without Passwords

Ensure SSH without passwords uses specific commands and checks parameters for security.

SSH-Agent Key Expiry and Screen Lock Requirements

SSH-agent caches must be used on systems with screen locks and expire after 4 hours of inactivity.

Protect SSH Private Keys with Passwords or Encryption

Ensure SSH keys have a password or are encrypted to prevent unauthorised access.

Disable SSH Version 1 for Security

SSH version 1 is turned off to improve security for SSH connections.

Secure/Multipurpose Internet Mail Extension

Ensure S/MIME 3.0 or Later is Used

Only use S/MIME version 3.0 or later for secure email communications.

Transport Layer Security

Require Latest Version of TLS for Security

Ensure only the latest TLS version is used to secure connections.

Ensure TLS Connections Use AES-GCM Encryption

Use AES-GCM to securely encrypt information sent over TLS connections.

Ensure Only Server-Initiated TLS Renegotiation

Only the server can start secure renegotiation for TLS connections to maintain security.

Secure Key Establishment Using DH or ECDH in TLS

Use DH or ECDH methods to securely establish keys for encrypted internet connections.

Ensure TLS Connections do not use Anonymous DH

Do not use Anonymous Diffie-Hellman for secure connections to prevent security vulnerabilities.

Use SHA-2 Certificates for Secure TLS Connections

Use secure certificates to prevent eavesdropping on data sent over the internet.

Use SHA-2 for Secure TLS Connections

TLS connections must use SHA-2 for better security, acting as a key and message verifier.

Use Ephemeral DH or ECDH for TLS Key Establishment

Use temporary DH or ECDH keys for secure TLS connections.

Ensure PFS is Enabled for TLS Connections

TLS connections must be set up to protect past data even if the server's private key is compromised.

Disable TLS Compression for Security

TLS connections should not use compression to prevent security risks.

Back to the full ACSC ISM control list, or browse the complete control library.