Warm tip: This article is reproduced from serverfault.com, please click

Is there a resolution to nmap ssl-enum-ciphers not returning all TLS 1.2 cipher suites?

发布于 2020-12-16 21:54:26

Microsoft lists 36 cipher suites available to TLS 1.2 protocol enabled in a vanilla installation of Windows Server 2016 Build 1607:

Accounting for enabled=false Ciphers and KeyExchangeAlgorithms (registry HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL), and verifying that Cipher Suite Order and Elliptic Curve Order is default (gpedit.msc), the list of enabled cipher suites is reduced to 32.

Why does nmap 7.9.1 return only 10 cipher suites?

nmap --script ssl-enum-ciphers -p3389 TestServerName.domain.tld

results
4 x TLS_DHE_RSA_WITH_AES_*, and
6 x TLS_ECDHE_RSA_WITH_AES_*

The most recent update on nmap.org thread "ssl-enum-ciphers not returning all ciphers" is July 23, 2019: https://seclists.org/nmap-dev/2019/q3/4

Has anyone resolved this issue?

PS There is a difference of TLS version in a single network trace frame (shown below) and I'm not certain if this is part of the issue or unrelated.

NetMon trace results: ClientHello shows two TLS versions

Questioner
EngineeringSQL
Viewed
0
EngineeringSQL 2021-01-08 10:34:00

I have learned that the the ordered set of Cipher Suites that are Enabled on a Windows device is defined in the value data from the Functions value located in the Registry at:

HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002

This can be populated during creation of the Group Policy Object, or locally using Group Policy Editor (i.e. choosing "Enabled" and editing the list and/or order of cipher suites).

If Functions value is absent, then the ordered set of Enabled cipher suites are default for the Edition and Build of Windows: https://docs.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel