(No Ratings Yet)

Loading...

• Facebook
• Twitter
• LinkedIn
• Mail

July 24, 2017 1

Crypto Changes in Windows 10 Fall Creators Update

in Industry Lowdown

RC4 Disabled and CAPI Features Discouraged

Later this year Microsoft will release the “Fall Creators Update” for Windows 10. This is similar to the “Service Packs” traditionally released as major lifecycle updates for Windows, though Microsoft has eschewed that term recently in favor of more consumer friendly names.

Usually, when we think of software updates we think of new features – but there are also features being removed or “deprecated” (or, officially put on notice) in order to keep the OS modern.

The full list of removals/deprecations are listed on this Microsoft support page, but we have highlighted a few that are relevant to your SSL/TLS configuration or cryptography work.

The following features are “deprecated” in the Fall Creators Update, which means they are “not in active development and might be removed in future releases.”

TLS RC4 Ciphers Disabled By Default

RC4 – an encryption cipher which has been broken for quite a while – will be disabled by default. Presumably this means the cipher will still be available for ‘compatibility.’

All modern browsers have disabled RC4, so it has been unusable on updated machines for some time. Even Cloudflare disabled it network-wide more than 2 years ago and at that time only 1 millionth of one percent of requests to their network was using it.

CAPI RSA/AES Provider Deprecated

The title for this one reads “RSA/AES Encryption for IIS” and the description says “we recommend that users use CNG encryption provider.”

This is rather poorly worded and its meaning may not be immediately obvious to those that are not familiar with Windows’ APIs. There is more than one API that can be used to implement crypto functions and in this update some features are being deprecated in an older API.

CAPI, or Crypto API, is the aging API where AES/RSA functionality is being discouraged.

CNG (Cryptography API: Next Generation) is CAPI’s successor, first introduced in Vista, and recommended if you want to work with RSA or AES.

Other Changes

There are some changes to Windows’ Trusted Platform Module (TPM) management features. TPM is a hardware chip that manages certain cryptographic operations. Windows’ TPM Owner Password Management will be removed, while TPM.msc will be replaced in a future version, and TPM Remote Management will be removed in a future version.

Syskey.exe is the only feature mentioned here which is being entirely removed in the update. It is a legacy application intended to be used as an additional security measure to protect user password information. However it is now severely outdated – using the aforementioned RC4 cipher – and does not provide suffcient security. However it has become a tool used by ransomware and other “technical support” scammers and is a liability to keep around. Bitlocker is the recommended modern replacement.

---

Thanks to Kevin Jones who shared his encyclopedic familiarity with Windows’ cryptography capabilities.

• #Encryption
• #Microsoft