Down the rabbit hole, TLS/RSA AES 128 and 256 SHA support for Windows Server 2003

 I had an interesting customer ask today, and learned some useful stuff to share about adding TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA and TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA support to Windows Server 2003.

In 2008, Microsoft published KB948963, described here Improving cipher security in Windows Server 2003 SP2 - Microsoft Support, a hotfix that added support for these ciphers to Windows 2003.  This hotfix is no longer available from Microsoft. 

This hotfix contains just two files, Rsaenh.dll and Schannel.dll plus Wrsaenh.dll and Wschannel.dll for the 64-bit versions.  This will be important later.

Installing this update, as mentioned before, adds the new cipher support, but it breaks the systems so they won't be able to get client certificates from a Server 2008 CA if that CA has a SHA2 256 cert.  That is fixed in another hotfix, KB968730, which is also not available from Microsoft.  The KB968730 hotfix contains just two files, Crypt32.dll and Wcrypt32.dll.

So, all told, we want updates for (at least) these six files.

• Rsaenh.dll
• Wrsaenh.dll
• Schannel.dll
• Wschannel.dll
• Crypt32.dll
• Wcrypt32.dll

I wasn't able to find any subsequent updates that touch the first two files, the Microsoft Enhanced Cryptographic Provider for RSA 32 and 64-bit versions.  Those will need to come from the original hotfix.  It is not available from Microsoft, but I found it at this third-party site.

x86:
WindowsServer2003-KB948963-x86-ENU.exe - English Windows Server 2003 Hotfix Downloads - The Hotfix Share

x64:
WindowsServer2003.WindowsXP-KB948963-x64-ENU.exe - Server 2003 Hotfix Support Topics - The Hotfix Share

IMPORTANT! Whenever downloading hotfixes or patches from a third-party site, always confirm the file is digitally signed by Microsoft with a valid signature to confirm it has not been modified or faked.

The second two files make up the Secure Channel API and have been updated a number of times.  The most recent one I found was MS15-055: Vulnerability in Schannel could allow information disclosure: May 12, 2015 - Microsoft Support.  The download for this is KB3061518, available here: Microsoft Update Catalog KB3061518.

The last two files, Crypt32.dll and Wcrypt32 dll (64-bit), are the Crypto API and have also been updated lots of times.  The most recent one I found was in MS15-074.  The current KB article MS15-074: Vulnerability in Windows Installer service could allow elevation of privilege: July 14, 2015 - Microsoft Support has had most of the Server 2003 references ripped out of it, but still contains the file information for Server 2003.  The download for those is KB3072630 and is available in the Microsoft Update Catalog here: Microsoft Update Catalog KB3072630.

That's it.  One hotfix and two updates should enable AES128 and 256 for Windows Server 2003 SP2.

Sidebar: If you've ever wondered what life was like before cumulative updates, this is it.  Picking-and-choosing specific security and non-security updates created a patchwork of different configurations and literally millions of different possible installed and not-installed combinations.  It was awful, and I could not be happier that they moved to cumulative updates.  Yes, the updates are bigger, but it is worth it not to have to deal with this.

Reminder: Windows 2003 is extremely very absolutely out of support.  If you call Microsoft and ask them to help you fix it, they can't and won't.  Take a snapshot first and be prepared for the worst.  Even if it doesn't immediately fail, running unsupported software is a material security risk, and nothing mentioned above changes that.  <Sales pitch>Part of my work is helping get ancient software running on new operating systems.  If you need help with that, please reach out. </sales pitch>

I hope this helps someone else.  Good luck.