Re: [TLS] Windows 2003 TLS 64 ciphersuite limit

[[e-mail] (Martin Rex)]

Martin Rex wrote:
> > > The Windows 2003 TLS stack
> > > ... sometimes chooses 3DES (for which it misimplements CBC padding)
> > > and fails during data transfer, or if that is suppressed or also
> > > too far down the list, just fails the handshake.
> > 
> > I see other TLS implementations interoperate just fine with 
> > Windows 2003 using the DES3-CBC-SHA TLS cipher suite.
> > 
> > I do have installed the AES cipher suites update for schannel
> > on my Windows 2003 machine, but there is no mentioning that
> > it would change (or fix a formerly broken) DES3-CBC-SHA behaviour.
> > 
> >   http://support.microsoft.com/kb/948963

I just installed a Web-Server certificate on another Windows2003 server
that doesn't have the AES ciphersuites Hotfix installed.

Seems to interop fine on the DES3-CBC-SHA (0x00, 0x0a) cipher suite.
(using my own client, openssl-1.0.1c and Firefox 25)

-Martin