# IIS Crypto 3.2 not getting rid of Diffie Hellman algorithms of less than 2048 bits ... or am I missing something?

I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results

I've run

Get-TlsCipherSuite | Format-Table Name, Exchange, Cipher, Hash, Certificate

and I can see

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

......all of which I know to use only 1024 bits

I've run IIS crypto 3.2 and set the DHE minimum Key Length to 2048 and rebooted...but I can still see the 4 cipher suites above when I run the Get-TlsCipherSuite command.... Is IIS crypto actually doing what I want it to do? Am I missing something?..am I misunderstanding something? any help gratefully received

thanks

• This sounds like a question about software configuration. You'll probably have better like in an IIS forum or maybe ServerFault. May 5 at 15:54
• it does say "Cryptography" at the top of this website May 5 at 17:31

## 1 Answer

In the TLS protocol, the group size is not tied to the ciphersuite (in TLS 1.2, whether you use a group at all is; however the size is not). That is, there is no specific reason why insisting on a 2048 bit group size (which is quite sensible) should disable the listed ciphersuites.

Now, it's possible that whatever software you're running does tie them together. However, unless you specifically know that's the case, I wouldn't assume that...

• Hi, do you know of a way that I could prove that I am not still using Diffie -Hellman less than 2048 bits? I've researched the internet , used nmap/zenmap and Diffie-Hellman sizes of 1024 are still showing in there...whether the server is actually using them or not..I just don't know. May 5 at 17:34