I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures.
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 1980 Handshake Protocol: Server Key Exchange Handshake Type: Server Key Exchange (12) Length: 361 EC Diffie-Hellman Server Params Curve Type: named_curve (0x03) Named Curve: secp384r1 (0x0018) Pubkey Length: 97 Pubkey: Signature Hash Algorithm: 0x0201 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: RSA (1) Signature Length: 256 Signature:
I've tested the clients with other servers and found SHA2 was chosen in many cases so it seems to be my server (not clients) forcing the use of SHA1 for some reason.
I've also tested another 2012 R2 VM I have as well as 2016 TP5 and again with both, SHA1 is chosen for ECDHE.
- The certificate chain is signed using SHA2 and the HMAC chosen in this case was SHA384 so the server doesn't seem to have any problem using SHA2 signatures in other cases.
Could this be misconfiguration on my part? I haven't found any way to effect the (EC)DHE signature algorithm in Windows either accidently or intentionally.
Could this just be a known trait of Schannel in server 2012? (If someone has a similar setup and could confirm by capturing a handshake, I'd appreciate it.)
In any case, is there any risk in SHA1 being used here?