Hi, my security team has recommended turning off all CBC cipher as they are considered weak. After removing them all, I am faced with error 80072EFE when trying to perform a windows update. After some trial and error, I came to realise that I am unable to remove "TLS_ECHDE_RSA_WITH_AES_256_CBC_SHA384".
OS in question is 2012 R2 Standard. I have been trying to find documentation on the ciphers requirements for communication with Microsoft cloud for OS updates but couldn't find any. Any advise from the community would be appreciated, Thanks!
It depend on your client OS. Please see
Cipher Suites in TLS/SSL (Schannel SSP)
To quote another
answer
, you can see that for Windows Update Cipher that it support;
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH secp384r1 (eq. 7680 bits RSA) FS 256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH x25519 (eq. 3072 bits RSA) FS 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH secp384r1 (eq. 7680 bits RSA) FS WEAK 256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH x25519 (eq. 3072 bits RSA) FS WEAK 128
Thanks for the quick response! I have enabled the following ciphers according to this documentation for Server 2012 R2:
https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-8-1
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384
But am still getting error 80072EFE. Is there anything I am not getting here?
The doc seem incomplete, as like the other state, you would need TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 or
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
The objective here is to depreciate the use of weak CBC ciphers..
If I am understanding
this doc for Server 2012 R2 ciphers
correctly, any one of the listed ciphers will still enable me to communicate with Microsoft for updates, right?
I am still unable to find any mention within the docs where the following CBC ciphers are necessary for the communication:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
I can't find the doc either so it's hard to give a full answer, but the two named with CBC is in the list if you want to use O365 out of 8 others, and it's listed in the top 3 for strenght. (
https://learn.microsoft.com/en-us/microsoft-365/compliance/technical-reference-details-about-encryption?view=o365-worldwide
). If O365 still use them, I guess Windows Update still use them
