Question

I have created a WCF service which is using the basicHttpBinding with security mode set to “Transport”, binded a cert to the port. So clients are able to consume the service through https.

Now, manager asks me to use AES128 in https, which i have no idea how. How to make that https channel encrypted by AES? Is it possible or does it even make sense?

Johnny

Answer 1

HTTPS Transport security is actually handled outside of WCF itself, either in IIS (if hosted in there), or when you bind a certificate to a port.

HTTPS (SSL or TLS) supports a number of cipher algorithms (e.g. AES, 3DES, RC4) and the client and server will negotiate which one to use for the HTTPS connection depending on what each support (full list of ciphers http://msdn.microsoft.com/en-us/library/windows/desktop/aa374757(v=vs.85).aspx).

IIS (and I assume when binding a certificate to a port) uses the Schannel security provider to handle HTTPS. Unfortunately, there isn’t any built-in setting in IIS or web.config that is available to control which ciphers are allowed.

So, if you want to force only AES128, you’ll have to edit the Windows Registry and disable Schannel from using other ciphers (http://support.microsoft.com/kb/245030).

This means going to the registry location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel\Ciphers

And disabling all the Ciphers in there (setting the ‘Enabled’ REG_DWORD to 0x00000000), while only leaving the one for ‘AES 128/128’ enabled (if it’s missing, add in the ‘AES 128/128’ subkey, and add the Enabled DWORD with value 0xffffffff)