• Article

Security Advisory

Microsoft Security Advisory 2854544

Updates to Improve Cryptography and Digital Certificate Handling in Windows

Published: June 11, 2013 | Updated: November 12, 2013

Version: 1.3

General Information

Executive Summary

Microsoft is announcing the availability of updates as part of ongoing efforts to improve cryptography and digital certificate handling in Windows. Microsoft will continue to announce additional updates via this advisory, all aimed at bolstering the Windows cryptography and certificate handling infrastructure in response to an evolving threat environment.

Available Updates and Release Notes

The update released on November 12, 2013:

  • Microsoft released an update (2868725) for all supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT to address known weaknesses in RC4. The update is offered via automatic updating and through the Microsoft Update service for all affected software. The update is also available on the Download Center as well as the Microsoft Update Catalog for all affected software except Windows RT. The update supports the removal of RC4 as an available cipher on affected systems through registry settings. It also allows developers to remove RC4 in individual applications through the use of the SCH_USE_STRONG_CRYPTO flag in the SCHANNEL_CRED structure. These options are not enabled by default. After applying the update, Microsoft recommends that customers test any new settings for disabling RC4 prior to implementing them in their environments. For more information, see Microsoft Security Advisory 2868725.
  • Microsoft announced a policy change to the Microsoft Root Certificate Program for the deprecation of the SHA-1 hashing algorithm in X.509 digital certificates. The new policy will no longer allow root certificate authorities to issue X.509 certificates using the SHA-1 hashing algorithm for the purposes of SSL and code signing after January 1, 2016. Microsoft recommends that customers replace their SHA-1 certificates with SHA-2 certificates at the earliest opportunity. For more information, see Microsoft Security Advisory 2880823.

The updates released on August 13, 2013:

  • Microsoft released an update (2862966) for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT. The update is offered via automatic updating and through the Microsoft Update service for all affected software. The update is also available on the Download Center as well as the Microsoft Update Catalog for all affected software except for Windows RT. The update provides a framework to help improve management of certificates that use specific cryptographic and hashing algorithms in Microsoft Windows. This update does not restrict the use of certificates by itself, but may be a prerequisite for later updates that do restrict the use of certificates. For more information and for currently known issues that customers may experience when installing this update, see Microsoft Knowledge Base Article 2862966.
  • Microsoft released an update (2862973) for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT. At this time the update is available only from the Download Center and the Microsoft Update Catalog for all affected software except for Windows RT. The update restricts the use of certificates with MD5 hashes. For more information, see Microsoft Security Advisory 2862973. The 2862966 update is a prerequisite for this update.

The update released on June 11, 2013:

  • Microsoft released an update (2813430) for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT. The update is available on the Download Center as well as the Microsoft Update Catalog for all affected software except for Windows RT. It is also offered via automatic updating and through the Microsoft Update service. The update for Windows RT is available via Windows Update. The update enables administrators to update trusted and disallowed CTLs without having access to the Windows Update site. For more information, see Microsoft Knowledge Base Article 2813430.

Frequently Asked Questions

What is a Certificate Trust List (CTL)?
A trust must exist between the recipient of a signed message and the signer of the message. One method of establishing this trust is through a certificate, an electronic document verifying that entities or persons are who they claim to be. A certificate is issued to an entity by a third party that is trusted by both of the other parties. So, each recipient of a signed message decides if the issuer of the signer's certificate is trustworthy. CryptoAPI has implemented a methodology to allow application developers to create applications that automatically verify certificates against a predefined list of trusted certificates or roots. This list of trusted entities (called subjects) is called a certificate trust list (CTL). For more information, please see the MSDN article, Certificate Trust Verification.

What is a digital certificate?
In public key cryptography, one of the keys, known as the private key, must be kept secret. The other key, known as the public key, is intended to be shared with the world. However, there must be a way for the owner of the key to tell the world who the key belongs to. Digital certificates provide a way to do this. A digital certificate is an electronic credential used to certify the online identities of individuals, organizations, and computers. Digital certificates contain a public key packaged together with information about it - who owns it, what it can be used for, when it expires, and so forth.

What is the purpose of a digital certificate?
Digital certificates are used primarily to verify the identity of a person or device, authenticate a service, or encrypt files. Normally you won't have to think about certificates at all. You might, however, see a message telling you that a certificate is expired or invalid. In such cases you should follow the instructions in the message.

What is a certification authority (CA)?
Certification authorities are the organizations that issue certificates. They establish and verify the authenticity of public keys that belong to people or other certification authorities, and they verify the identity of a person or organization that asks for a certificate.

Other Information

Feedback

Support

  • Customers in the United States and Canada can receive technical support from Security Support. For more information about available support options, see Microsoft Help and Support.
  • International customers can receive support from their local Microsoft subsidiaries. For more information about how to contact Microsoft for international support issues, visit International Support.
  • Microsoft TechNet Security provides additional information about security in Microsoft products.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

  • V1.0 (June 11, 2013): Advisory published.
  • V1.1 (August 13, 2013): Added the 2862966 and 2862973 updates to the Available Updates and Release Notes section.
  • V1.2 (August 27, 2013): Revised advisory to announce that the 2862973 update is available from the Microsoft Update Catalog.
  • V1.3 (November 12, 2013): Added the 2868725 update and Root Certificates Policy announcement to the Available Updates and Release Notes section.

Built at 2014-04-18T13:49:36Z-07:00