Improving cipher security in Windows Server 2003 SP2

Summary

This article describes how to add support for stronger Advanced Encryption Standard (AES) cipher suites in Windows Server 2003 Service Pack 2 (SP2) and how to disable weaker ciphers.

More Information

Step 1: To add support for stronger AES cipher suites in Windows Server 2003 SP2, apply the update that is described in the following article in the Microsoft Knowledge Base:

948963 An update is available to add support for the TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA and TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA AES cipher suites in Windows Server 2003

Step 2: To disable weak ciphers (including EXPORT ciphers) in Windows Server 2003 SP2, follow these steps.

ImportantThis section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows


To edit these registry values, follow these steps:

  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following subkey in the registry:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\
  3. On the Edit menu, point to New, and then click Key. Type the name of the key according to the following cipher names:

    DES 56/56
    NULL
    RC2 40/128
    RC2 56/128
    RC2 56/56
    RC4 40/128
    RC4 56/128
    RC4 64/128
  4. On the Edit menu, point to New, and then click DWORD Value.
  5. Type Enabled for the name of the DWORD, and then press ENTER.
  6. Right-click Enabled, and then click Modify.
  7. In the Value data box, type 00000000, and then click OK.
  8. On the File menu, click Exit to quit Registry Editor.
Note Repeat these steps to disable each weak cipher.

In order of preference, the cipher suites that are available after you successfully follow these steps are as follows:
  • TLS_RSA_WITH_AES_128_CBC_SHA
  • TLS_RSA_WITH_AES_256_CBC_SHA
  • TLS_RSA_WITH_RC4_128_MD5
  • TLS_RSA_WITH_RC4_128_SHA
  • TLS_RSA_WITH_3DES_EDE_CBC_SHA
  • TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
Properties

Article ID: 3050509 - Last Review: 24 Mar 2015 - Revision: 1

Feedback