9

I have just used www.ssllabs.com and ran a few tests - my server is capped to a B grade because my server accepts RC4

This server accepts the RC4 cipher, which is weak. Grade capped to B.

I've researched and found that to disable RC4 I need to add 3 keys, and set their enabled dword to 0 Link and Link

I have done this for RC4 40/128, RC 56/128 and RC4 64/128

I then restarted my server. When the server was up again, I verified the Registry Changes were done, and they are - all 3 exist and all 3 have their enabled value set to 0.

I return to ssllabs, clear the cache, re-run the test and it returns the same result (capped to B due to RC4 being enabled).

At this stage, I'm not sure what this means - if SSLLabs showing incorrect results (I'm going to assume not), have I disabled RC 4.

How can I tell if I have successfully disabled RC4

Edit

I also saw the KB about this http://support.microsoft.com/kb/2868725?wa=wsignin1.0 so trying now... I've done the same registry changes but, when I try to download the 64 bit version for W2008 R2 Standard, it fails to install with error message

The update is not applicable to your computer

Improve this question
5
  • RC4 is currently safe. If you don't fight security agencies with thousands of servers full of radeon cards, then you have nothing to worry about. The Cypher4's security problems are a pure speculation at this point. Microsoft wants to dump it because they just want new standards in exchange. In a practical sense, even SHA-1 isn't broken yet.
    – Overmind
    Feb 19, 2015 at 11:55
  • I'm lost what MS has to do with this - they are not reporting a fault (unless ssllabs.com are owned by MS)? With SHA-1 are you saying it still works but there are more secure options out there?
    – Dave
    Feb 19, 2015 at 12:19
  • MS is using RC4 on the operating systems and want to move away from it. Yes, SHA-1 was created in '95, of course it has evolved, but the point is it is still secure.
    – Overmind
    Feb 19, 2015 at 13:25
  • The are several reports that RC4 is not safe: blogs.technet.com/b/srd/archive/2013/11/12/…
    – Lizz
    May 18, 2015 at 7:58
  • There is an IETF RFC in the standards track requiring the removal of RC4 proposals from TLS handshakes due to security issues: tools.ietf.org/html/rfc7465
    – the-wabbit
    Sep 9, 2015 at 10:01

1 Answer 1

Reset to default
9

There is a tool to check the cipher order in a GUI. It works for me every time. (Try it on a test machine if you don't trust the exe.)

Microsoft released a security advisory about RC4 where they explain how to disable RC4 on the client and server side. Now it's best practice to disable RC4.

Don't forget to do the Windows Update in the security advisory because there is a schannel update to do before updating the cipher order.

When the update is done, you can use the tool (IISCrypto), the Microsoft advisory patch, or update the windows registry yourself:

(Be careful. Back up your registry first.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000
Improve this answer
3
  • 3
    I didn't even need to run the scan - as soon as I opened it, I saw RC 128/128 which was not listed in the links I cited. Adding RC 128/128 and setting the dword Enabled to 0 has fixed the issue.
    – Dave
    Feb 19, 2015 at 11:53
  • @Dave, could you please add an Answer with the info from your comment? It would be very helpful! :)
    – Lizz
    May 18, 2015 at 8:00
  • @Lizz @Dave, did you mean RC4 128/128 or is there a separate RC 128/128?
    – Michael
    Oct 14, 2015 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.