Update to add support for TLS 1.1 and TLS 1.2 in Windows Embedded Compact 7

TLS 1.1

The following subkey controls the use of TLS 1.1:

HKEY_LOCAL_MACHINE\Comm\SecurityProviders\SCHANNEL\Protocols\TLS 1.1

To disable the TLS 1.1 protocol, you must create the Enabled DWORD entry in the appropriate subkey, and then change the DWORD value to 0. To re-enable the protocol, change the DWORD value to 1. By default, this entry does not exist in the registry.

Note To enable and negotiate TLS 1.1, you must create the DisabledByDefault DWORD entry in the appropriate subkey (Client, Server), and then change the DWORD value to 0.

TLS 1.2

The following subkey controls the use of TLS 1.2:

HKEY_LOCAL_MACHINE\Comm\SecurityProviders\SCHANNEL\Protocols\TLS 1.2

To disable the TLS 1.2 protocol, you must create the Enabled DWORD entry in the appropriate subkey, and then change the DWORD value to 0. To re-enable the protocol, change the DWORD value to 1. By default, this entry does not exist in the registry.

Note To enable and negotiate TLS 1.2, you must create the DisabledByDefault DWORD entry in the appropriate subkey (Client, Server), and then change the DWORD value to 0.

Additional notes

• The DisabledByDefault value in the registry keys under the Protocols key does not take precedence over the grbitEnabledProtocols value that is defined in the SCHANNEL_CRED structure that contains the data for an Schannel credential.

• Per the Request for Comments (RFC), the design implementation does not allow SSL2 and TLS 1.2 to be enabled at the same time.

grbitEnabledProtocols

(Optional) This DWORD contains a bit string that represents protocols that have the following condition:

• Supported by connections that are made by having credentials that are acquired by using this structure

The following table shows the additional possible flags that the member can contain.

BufferType

This set of bit flags indicates the type of buffer. The following table shows the additional available flags for TLS 1.2.

dwProtocol

This designates the protocol that is used to establish this connection. The following table shows additional valid constants for this member.

aiCipher

This is the algorithm identifier (ALG_ID) for the bulk encryption cipher that is used by this connection. The following table shows the additional valid constants for this member.

Syntax (C++)

typedef struct _SecPkgContext_SupportedSignatures {

  WORD cSignatureAndHashAlgorithms;

  WORD *pSignatureAndHashAlgorithms;

} SecPkgContext_SupportedSignatures, *PSecPkgContext_SupportedSignatures;

Members

• cSignatureAndHashAlgorithms
  
  This is the number of elements in the pSignatureAndHashAlgorithms array.

• pSignatureAndHashAlgorithms
  
  This is an array of values that specify the supported algorithms.
  
  The upper byte can be one of the following values that specifies a signature algorithm.
  

  Value	Meaning
  0	Anonymous signature algorithm
  1	The RSA signature algorithm
  2	The DSA signature algorithm
  3	The ECDSA signature algorithm
  255	Reserved

  
  The lower byte can be one of the following values that specifies a hash algorithm.
  

  Value	Meaning
  0	None
  1	The MD5 hash algorithm
  2	The SHA1 hash algorithm
  3	The SHA-224 hash algorithm
  4	The SHA-256 hash algorithm
  5	The SHA-384 hash algorithm
  6	The SHA-512 hash algorithm
  255	Reserved

  
  
  Requirements
  

  Header

  Schannel.h

ulAttribute

This is a pointer to a buffer that contains attributes of the context that is to be retrieved. The following table shows the possible values.

Prerequisites

This update is supported only if all previously issued updates for this product have also been installed.

Restart requirement

After you apply this update, you must perform a clean build of the whole platform. To do this, use one of the following methods:

• On the Build menu, select Clean Solution, and then select Build Solution.

• On the Build menu, select Rebuild Solution.

You do not have to restart the computer after you apply this software update.

Update replacement information

This update does not replace any other updates.