Later this year Microsoft will release the \u201cFall Creators Update\u201d for Windows 10. This is similar to the \u201cService Packs\u201d traditionally released as major lifecycle updates for Windows, though Microsoft has eschewed that term recently in favor of more consumer friendly names.<\/p>\n
Usually, when we think of software updates we think of new features – but there are also features being removed or \u201cdeprecated\u201d (or, officially put on notice) in order to keep the OS modern.<\/p>\n
The full list of removals\/deprecations are listed on this Microsoft support page<\/a>, but we have highlighted a few that are relevant to your SSL\/TLS configuration or cryptography work.<\/p>\n The following features are \u201cdeprecated\u201d in the Fall Creators Update, which means they are \u201cnot in active development and might be removed in future releases.\u201d<\/p>\n RC4 – an encryption cipher which has been broken for quite a while – will be disabled by default. Presumably this means the cipher will still be available for \u2018compatibility.\u2019<\/p>\n All modern<\/a> browsers have disabled<\/a> RC4, so it has been unusable on updated machines for some time. Even Cloudflare disabled it network-wide more than 2 years ago<\/a> and at that time only 1 millionth of one percent of requests to their network was using it.<\/p>\n<\/span><\/span>\n The title for this one reads \u201cRSA\/AES Encryption for IIS\u201d and the description says \u201cwe recommend that users use CNG encryption provider.\u201d<\/p>\n This is rather poorly worded and its meaning may not be immediately obvious to those that are not familiar with Windows\u2019 APIs. There is more than one API that can be used to implement crypto functions and in this update some features are being deprecated in an older API.<\/p>\n CAPI, or Crypto API<\/a>, is the aging API where AES\/RSA functionality is being <\/a>discouraged.<\/p>\n CNG (Cryptography API: Next Generation)<\/a> is CAPI\u2019s successor, first introduced in Vista, and recommended if you want to work with RSA or AES.<\/p>\n There are some changes to Windows\u2019 Trusted Platform Module (TPM) management features. TPM is a hardware chip that manages certain cryptographic operations. Windows\u2019 TPM Owner Password Management will be removed, while TPM.msc will be replaced in a future version, and TPM Remote Management will be removed in a future version.<\/p>\n Syskey.exe is the only feature mentioned here which is being entirely removed in the update. It is a legacy application intended to be used as an additional security measure to protect user password information. However it is now severely outdated – using the aforementioned RC4 cipher – and does not provide suffcient security. However it has become a tool used by ransomware and other \u201ctechnical support\u201d scammers<\/a> and is a liability to keep around. Bitlocker is the recommended modern replacement.<\/p>\nTLS RC4 Ciphers Disabled By Default<\/h2>\n
CAPI RSA\/AES Provider Deprecated<\/h2>\n
Other Changes<\/h2>\n
\n