Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

You can configure Windows to use only certain cipher suites during things like Remote Desktop sessions. Cipher suites such as RC4 56 bit, RC4 128 bit, Triple DES 168 bit, etc.

SSL/TLS is not in play here so I'm talking about RDP encryption.

You can see what I'm talking about here.

I thought to run a packet capture using Wireshark or Network Monitor while I connected to a computer across the network, but I cannot see anywhere in the packet capture the bits I need to verify exactly which cipher suite it is using.

share|improve this question
    
wiki.wireshark.org/RDP mught help. –  John Deters Nov 21 '13 at 18:48

1 Answer 1

up vote 2 down vote accepted

Enable SCHANNEL logging;

http://support.microsoft.com/kb/260729

The following will log everything;

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000007

You will then have events in the SYSTEM log for example;

An SSL client handshake completed successfully. The negotiated cryptographic parameters are as follows.

Protocol: TLS 1.0 CipherSuite: 0x2f Exchange strength: 1024

Google the resulting cipher suite.

FAWC

When using Elliptic Curve certificates you will also get something like the following as the certificates are exchanged;

An SSL server handshake completed successfully. The negotiated cryptographic parameters are as follows.

Protocol: TLS 1.0 CipherSuite: 0xc009 Exchange strength: 256

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.