This article applies to:

• WebDefend - All Versions

Question:

• How do I disable Diffie-Hellman Key Exchange in IIS (Windows web server)?
• Diffie-Hellman key exchange is not supported by WebDefend

Procedure:

To control key exchange algorithms and protocols, you can set values in the Windows Registry.

• Caution: As always, take due care when editing the Registry. Trustwave recommends that you back up the Registry before making any changes.

The settings provided below are for information only. You should confirm the applicability to your environment.

Windows Server 2003, Windows XP, Windows 2000

By default, Diffie-Hellman key exchange is enabled.

To disable Diffie-Hellman key exchange:

1. Run Regedit
2. To access Key Exchange algorithm settings, navigate to the following Registry location:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms
3. For Diffie-Hellman, navigate to the subkey Diffie-Hellman
4. Create, or edit, a DWORD value
   • Name: Enabled
   • Value Data: 0

To re-enable Diffie-Hellman key exchange, set the Hexadecimal value data of "Enabled" to 0xffffffff (or simply delete the "Enabled" value)

Windows Server 2008,Windows Server 2008 R2,Windows Server 2012

By default, Diffie-Hellman key exchange is enabled. (Other default configuration settings are such that this algorithm may never be selected.)

The procedures to disable the algorithm are slightly more complex due to differences in the Registry structure.

To disable Diffie-Hellman key exchange:

1. Run Regedit
2. To access Key Exchange algorithm settings, navigate to the following Registry location:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SChannel\KeyExchangeAlgorithms
3. Create a new sub key named Diffie-Hellman
4. Within the key Diffie-Hellman, create a DWORD value
   • Name: Enabled
   • Value Data: 0

To re-enable Diffie-Hellman key exchange, set the Hexadecimal value data of "Enabled" to 0xffffffff (or simply delete the "Enabled" value)

Notes:

• When you disable any algorithm, you disallow all cipher suites that use that algorithm.
• See also Microsoft Knowledge Base article 245030: How to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll