HOWTO: Disabling Diffie-Hellman Key Exchange in IIS

Expand / Collapse
 

HOWTO: Disabling Diffie-Hellman Key Exchange in IIS


This article applies to:

  • WebDefend - All Versions

Question:

  • How do I disable Diffie-Hellman Key Exchange in IIS (Windows web server)?
  • Diffie-Hellman key exchange is not supported by WebDefend

Procedure:

To control key exchange algorithms and protocols, you can set values in the Windows Registry.

  • Caution: As always, take due care when editing the Registry. Trustwave recommends that you back up the Registry before making any changes.

The settings provided below are for information only. You should confirm the applicability to your environment.

Windows Server 2003, Windows XP, Windows 2000

By default, Diffie-Hellman key exchange is enabled.

To disable Diffie-Hellman key exchange:

  1. Run Regedit
  2. To access Key Exchange algorithm settings, navigate to the following Registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms
  3. For Diffie-Hellman, navigate to the subkey Diffie-Hellman
  4. Create, or edit, a DWORD value
    • Name: Enabled
    • Value Data: 0

To re-enable Diffie-Hellman key exchange, set the Hexadecimal value data of "Enabled" to 0xffffffff (or simply delete the "Enabled" value)

Windows Server 2008,Windows Server 2008 R2,Windows Server 2012

By default, Diffie-Hellman key exchange is enabled. (Other default configuration settings are such that this algorithm may never be selected.)

The procedures to disable the algorithm are slightly more complex due to differences in the Registry structure.

To disable Diffie-Hellman key exchange:

  1. Run Regedit
  2. To access Key Exchange algorithm settings, navigate to the following Registry location:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SChannel\KeyExchangeAlgorithms
  3. Create a new sub key named Diffie-Hellman
  4. Within the key Diffie-Hellman, create a DWORD value
    • Name: Enabled
    • Value Data: 0

To re-enable Diffie-Hellman key exchange, set the Hexadecimal value data of "Enabled" to 0xffffffff (or simply delete the "Enabled" value)

Notes:

  • When you disable any algorithm, you disallow all cipher suites that use that algorithm.
  • See also Microsoft Knowledge Base article 245030How to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll

To contact Trustwave about this article or to request support:


Rate this Article:
     

Related Articles



Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.

Details
Article ID: 14784
Last Modified: 10/16/2013
Type: HOWTO
Rated 5 stars based on 1 vote
Article has been viewed 11,490 times.
Options