Day: Tue 8 Apr 2014

Note-to-self: Security Advisory 2868725: Recommendation to disable RC4



In light of recent research into practical attacks on biases in the RC4 stream cipher, Microsoft is recommending that customers enable TLS1.2 in their services and take steps to retire and deprecate RC4 as used in their TLS implementations.

Microsoft recommends TLS1.2 with AES-GCM as a more secure alternative which will provide similar performance.

See also:

TechNet Blogs » Security Research & Defense :

And other interesting reading material referenced in the blog: