Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I developed an ASP.NET web application which handles sensitive data. I would really like to use 256 bit SSL encryption, but it seems that IIS only supports 128 bit.

Is it somehow possible to get 256bit encryption?
If not, why not and will it be possible in IIS 7.5 or 8.0?

Thanks for help

share|improve this question

This may be possible on win7/2008 with a bit of reg hacking.

share|improve this answer

Don't switch from AES-128 to AES-256. An attack has been found on the latter, that reduces the complexity to an equivalent of 119 bits:

Nevertheless, both algorithms are insanely strong for today's standards. There are probably other attack scenarios that are much more likely than a fault on the crypto itself.

share|improve this answer

Don't worry about the AES-256 attack. It's a related key attack and thus not applicable to HTTPS.

But the commenter is correct that both are sufficiently strong that you shouldn't worry.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.