0

I'm trying to stop a server using Diffie Hellman key exchanges of less than 2048 bits, but I'm getting confusing results.

I've run

Get-TlsCipherSuite | Format-Table Name, Exchange, Cipher, Hash, Certificate

and I can see

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

......all of which are known to use only 1024 bits

I've run IIS crypto 3.2 and set the DHE minimum key length to 2048 and rebooted...but I can still see the 4 cipher suites above when I run the Get-TlsCipherSuite command. Is IIS crypto actually doing what I want it to do?

By the way, my regedit looks like this: What IIS Crypto Changed in the registry

Am I misunderstanding something?

Improve this question
2
  • Yes you are misunderstanding. The ciphersuite (through TLS1.2 only, 1.3 is different) controls whether DHE is used at all, but not the parameter size for it, which for Windows and more specifically schannel (which you didn't actually specify) is controlled separately exactly as you show.
    – dave_thompson_085
    May 6, 2022 at 1:03
  • Hi, thanks for that @dave_thompson_085 .....one thing is still confusing, I use nmap and it says TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A I'm assuming that the (dh1024) means that the cipher mentioned is 1024 bits in length..or is this just some peculiarity of nmap?
    – Mick8695
    May 7, 2022 at 8:18

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy