First published on TechNet on Nov 13, 2017
Hello all! Nathan Penn here to help with some of those pesky security questions that have lingered for years. Recently I have been fielding several questions on "How do I make sure that I am only using the TLS 1.2 protocol?", "Can you disable 3DES and the legacy ciphers?", and the "I just got back from a security class and they talked about Diffie-Hellman, am I using it?".
The basics
Before we can start to answer any of that we have to build up some basics. An SSL session always begins with an exchange of messages called the SSL handshake. The handshake allows the server to authenticate itself to the client by using public-key techniques, and then allows the client and the server to cooperate in the creation of symmetric keys used for rapid encryption, decryption, and tamper detection during the session that follows. Optionally, the handshake also allows the client to authenticate itself to the server. Secure Channel, or Schannel, is used to negotiate this security handshake between systems and applications. To perform this function, Schannel leverages the below set of security protocols, ciphers, hashing algorithms, and key exchanges that provide identity authentication and secure, private communication through encryption.
| Protocols | Key Exchanges | Ciphers | Hashing Algorithms |
| Multi-Protocol Unified Hello | Diffie-Hellman | NULL | MD5 |
| PCT 1.0 | PKCS | DES 56-bit | SHA |
| SSL 2.0 | ECDH | RC2 40-bit | SHA256 |
| SSL 3.0 | RC2 56-bit | SHA384 | |
| TLS 1.0 | RC2 128-bit | SHA512 | |
| TLS 1.1 | RC4 40-bit | ||
| TLS 1.2 | RC4 56-bit | ||
| RC4 64-bit | |||
| RC4 128-bit | |||
| 3DES 168-bit | |||
| AES 128-bit | |||
| AES 256-bit |
While all of the options above are available to the operating systems and Schannel, they are not offered up in an a-la carte manner. Each Windows operating system maintains a pre-defined list of combinations, referred to as the cipher suite, which are approved for communications. The list is prioritized, with the top/first cipher suite being the most preferred. Below is the default cipher suites included in Windows 10 v1703:
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 |
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
| TLS_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_RSA_WITH_AES_256_CBC_SHA256 |
| TLS_RSA_WITH_AES_128_CBC_SHA256 |
| TLS_RSA_WITH_AES_256_CBC_SHA |
| TLS_RSA_WITH_AES_128_CBC_SHA |
| TLS_RSA_WITH_3DES_EDE_CBC_SHA |
| TLS_RSA_WITH_RC4_128_SHA |
| TLS_RSA_WITH_RC4_128_MD5 |
| TLS_RSA_WITH_NULL_SHA256 |
| TLS_RSA_WITH_NULL_SHA |
Dissecting the cipher suite, we can see the protocol, key exchange, cipher, and hashing algorithm as illustrated below. 
What is the system using?
Now that we have a basic understanding of a cipher suite and the components that make it up, how do you identify what the system is using? Enter Schannel logging which is written into the Windows System log. Schannel only logs basic information by default, however, we can turn the diagnostic logging up to include the detailed SSL handshake information by configuring the following registry key:
-
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
-
EventLogging (DWORD)
- 1 (Basic)
- 7 (Verbose)
-
Enabling verbose logging of Schannel has the potential to generate quite a few events pretty quickly, so use sparingly as you are testing/evaluating, and turn it back to basic when you are done. Taking a look into the System log we may want to filter for Event ID 36880 - SSL (client or server) Handshake Completed Successfully. Review of these entries will detail all the Schannel connections to/from the system. 
So, you want to manage it yourself...
Now that we know what Schannel is composed of, what it is used for, and can identify the cipher suites we are using, we all agree we should leave it alone and let the system manage it right? Hmmmm... Well then, let's get to breaking it (ahem... I mean tuning it). If we want to limit the cipher suite to only particular protocols, key exchanges, ciphers, or hashing algorithms we have two methods: Define a custom cipher suite priority, or disable the individual components. Before we get into it, I do want to call out one more time - Warning: Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
Method 1 - Defining a custom cipher suite
To define a custom cipher suite list, we will need to provide a comma separated list of the ciphers suites we want the system restricted to (remember the cipher suites must be in priority order). Additionally, there is a character limitation of 1023 characters, so choose your cipher suites wisely. That said, taking the predefined cipher suites in Windows 10 v1703 from the table above and converting it into a comma separated list would look like this:
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 |
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
| TLS_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_RSA_WITH_AES_256_CBC_SHA256 |
| TLS_RSA_WITH_AES_128_CBC_SHA256 |
| TLS_RSA_WITH_AES_256_CBC_SHA |
| TLS_RSA_WITH_AES_128_CBC_SHA |
| TLS_RSA_WITH_3DES_EDE_CBC_SHA |
| TLS_RSA_WITH_RC4_128_SHA |
| TLS_RSA_WITH_RC4_128_MD5 |
| TLS_RSA_WITH_NULL_SHA256 |
| TLS_RSA_WITH_NULL_SHA |
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 |
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
| TLS_RSA_WITH_AES_256_GCM_SHA384 |
| TLS_RSA_WITH_AES_128_GCM_SHA256 |
| TLS_RSA_WITH_AES_256_CBC_SHA256 |
| TLS_RSA_WITH_AES_128_CBC_SHA256 |
| TLS_RSA_WITH_AES_256_CBC_SHA |
| TLS_RSA_WITH_AES_128_CBC_SHA |
| TLS_RSA_WITH_3DES_EDE_CBC_SHA |
| TLS_RSA_WITH_RC4_128_SHA |
| TLS_RSA_WITH_RC4_128_MD5 |
| TLS_RSA_WITH_NULL_SHA256 |
| TLS_RSA_WITH_NULL_SHA |
Method 2 - Disable the Individual Components
So maintaining a list of cipher suites isn't your thing, but you need to disable a particular component and disallow all the system configured cipher suites from using them. Unfortunately, there is no built-in group policy administrative template to help us this this time. The individual security protocols, ciphers, hashing algorithms, and key exchanges are all enabled on Windows by default, and to disable them requires a registry change. This change is done by adding the "Enabled" value to the associated component registry subpath that you want disabled and setting the value to "0" as illustrated below: 
| Cipher | Registry SubPath |
| NULL | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL\ |
| DES 56-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56 |
| RC2 40-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128 |
| RC2 56-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128 |
| RC2 128-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128 |
| RC4 40-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128 |
| RC4 56-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128 |
| RC4 64-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128 |
| RC4 128-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128 |
| 3DES 168-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168 |
| AES 128-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128 |
| AES 256-bit | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256 |
| Hash | Registry SubPath |
| MD5 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5 |
| SHA | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA |
| SHA256 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA256 |
| SHA384 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA384 |
| SHA512 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA512 |
| Key Exchange | Registry SubPath |
| Diffie-Hellman | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman |
| PKCS | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS |
| ECDH | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\ECDH |
| Protocol | Registry SubPath |
| Multi-Protocol Unified Hello | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Client |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server | |
| PCT 1.0 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Client |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server | |
| SSL 2.0 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server | |
| SSL 3.0 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server | |
| TLS 1.0 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server | |
| TLS 1.1 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server | |
| TLS 1.2 | HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client |
| HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server |
I hope all this helps clear things up and gives you an understanding of Schannel.
Additional Resources:
Supported cipher suites by Windows operating systems: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374757(v=vs.85).aspx Types of events that Schannel can produce: https://technet.microsoft.com/en-us/library/dn786445(v=ws.11).aspx Schannel SSP registry entries: https://technet.microsoft.com/en-us/library/dn786418(v=ws.11).aspx