3

A SSL Report from SSL Labs for a domain of mine indicates that ECDH key-reuse (ECDH public server param reuse) is happening on the IIS 10 (Windows Server 2016) with TLS 1.2. I have verified it with TestSSLServer and testssl.sh.

I am not able to find a solution on the big Internet to disable the ECDH key-reuse on IIS 10. It does not seem to work with MaximumCacheSize nor ServerCacheTime.

Can anyone of you help with a solution to disable the ECDH key-reuse? (The web server do not reuse DH keys, even though some cipher suites with DHE have been activated.)

Thank you!

Improve this question
1
  • This is apparently a million dollar question no one I have asked so far have an answer for.. If you can answer this one, I owe you one hour of work.
    – Crypto Johnny
    Commented May 31, 2023 at 9:04

1 Answer 1

Reset to default
6

You can disable this via Registry Editor. Just go to HKLM\System\CurrentControlSet\Control\SecurityProviders\Schannel\KeyExchangeAlgorithms\ECDH create a value (DWORD (32-bit)) named EphemKeyReuseTime and set it to 0.

Microsoft tends to cache the key and regenerate it periodically.

Improve this answer
1
  • "Could you provide us with some support information, such as a reference please?"
    – djdomi
    Commented Mar 8 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .