I recently became aware that following the release of patch KB2992611 in November, Microsoft made available four new cipher suites for schannel (and thus IIS);
I'm also aware that problems were reported with this patch and the above four ciphers, resulting in the patch being temporarily pulled and the above cipher suites left disabled by default.
My question is two-fold;
- Has this now been corrected, and are the above cipher suites safe to use on a web server running IIS 7.5 and above?
Which would be considered 'best' out of the the following two options;
In other words, are the ecliptic curve elements of the second option (ECDHE_RSA) outweighed by the superior version of AES that the first offers (AES_GCM)?
And finally, does the advice here vary at all between 2008 R2, 2012 and 2012 R2?