Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32) - Disabling 3DES in SQL Server host

udhayan d 181 Reputation points
2021-03-22T04:58:18.513+00:00

Hi,

I have couple of Vulnerabilities to be remediated. While the workaround looks simple by disabling it in registry, i wanted to know the impact on SQL Server services running in the node because the scan report shows both the vulnerabilities on port 1433 TCP

SSL/TLS use of weak RC4(Arcfour) cipher
Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32)

Thanks

SQL Server
SQL Server
A family of Microsoft relational database management and analysis systems for e-commerce, line-of-business, and data warehousing solutions.
12,777 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. CathyJi-MSFT 21,096 Reputation points Microsoft Vendor
    2021-03-23T08:52:14.253+00:00

    Hi @udhayan d ,

    SSL/TLS use of weak RC4(Arcfour) cipher. SQL Server use Transport Layer Security (TLS) to encrypt data that is transmitted across a network between an instance of SQL Server and a client application. This increases the security of data transmitted across networks between instances of SQL Server and applications.

    If you disable TLS, it is not security for data transmitted across networks between instances of SQL Server and applications.

    SQL Database, SQL Managed Instance, and Azure Synapse Analytics enforce encryption (SSL/TLS) at all times for all connections. This ensures all data is encrypted "in transit" between the client and server irrespective of the setting of Encrypt or TrustServerCertificate in the connection string. Refer to this MS document.

    By the way, starting with SQL Server 2016 (13.x), Secure Sockets Layer (SSL) has been discontinued. Use Transport Layer Security (TLS) instead.

    If the response is helpful, please click "Accept Answer" and upvote it, thank you.