Configure Strict TLS Cipher Suites Using Regedit

Enforcing strict cryptographic cipher suites for Transport Layer Security (TLS) ensures that your Windows system only negotiates secure, modern encryption algorithms, significantly reducing vulnerabilities like downgrade attacks and eavesdropping. This guide outlines how to use the Windows Registry Editor (Regedit) to manually specify, order, and restrict the cipher suites used by the Windows Schannel security support provider.

Step 1: Open the Registry Editor

  1. Press Win + R to open the Run dialog box.
  2. Type regedit and press Enter.
  3. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.
  4. (Recommended) Back up your registry by clicking File > Export, selecting All under Export range, and saving the file.

Step 2: Navigate to the Cryptographic Configuration Key

Navigate to the registry key that controls default TLS cipher suites:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\Default\00010002

Step 3: Modify the Cipher Suites Order

  1. Locate the multi-string value named Functions in the right pane.
  2. Double-click Functions to open the Edit Multi-String dialog.
  3. Replace the existing list with your desired strict cipher suites, ordered from most secure to least secure (top to bottom).

Recommended Strict Cipher Suites List:

TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  1. Ensure that any weak ciphers (such as those using RC4, 3DES, CBC mode, or MD5/SHA-1 hashing) are entirely removed from this list.
  2. Click OK to save the changes.

Step 4: Disable Deprecated Ciphers and Hashes in Schannel

To prevent fallback to insecure legacy algorithms, explicitly disable them in the Schannel registry branch:

  1. Navigate to:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers

  2. For any weak cipher you want to disable (e.g., DES 56/56, Triple DES 168, RC4 128/128):

    • Right-click Ciphers, select New > Key, and name it after the cipher.
    • Inside the new key, right-click and select New > DWORD (32-bit) Value.
    • Name the value Enabled and leave its data set to 0.

  3. Apply the same process under SCHANNEL\Hashes to disable insecure hash functions such as MD5 and SHA (SHA-1):

    • Create the key under SCHANNEL\Hashes (e.g., MD5).
    • Create a DWORD named Enabled with a value of 0.

Step 5: Restart the System

Registry modifications to the cryptographic providers take effect only after a complete system reboot. Restart your Windows machine to enforce the configured cipher suite policy across all native applications and services.