Finding: SWEET32 (CVE-2016-2183)
The SWEET32 vulnerability affects SSL/TLS protocols that use 64-bit block ciphers, specifically 3DES (Triple DES) and IDEA. These ciphers are susceptible to birthday attacks when large volumes of data are transmitted over a persistent connection, potentially allowing an attacker to recover parts of plaintext traffic. IIS servers with 3DES enabled are affected.
Remediation for IIS on Windows Server 2019
Windows Server 2019 supports TLS 1.2 and 1.3 by default, along with modern AES-based cipher suites. However, 3DES may still be enabled for legacy compatibility and must be disabled to fully remediate SWEET32.
Step 1: Disable 3DES via the Windows Registry
Navigate to the following registry key and create or set the value as below:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168\n\nSet the DWORD value ‘Enabled’ to 0.
Alternatively, create a .reg file with the following content and import it:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168]
“Enabled”=dword:00000000
A system reboot is required for changes to take effect.
Step 2: (Optional) Use IIS Crypto Tool
To simplify cipher and protocol management, use the free Nartac IIS Crypto tool:
• Download from https://www.nartac.com/Products/IISCrypto
• Run the tool on the server
• Select the ‘Best Practices’ template
• Ensure 3DES and TLS 1.0/1.1 are disabled
• Apply the changes and reboot the server
Step 3: Verify Remediation and Confirm SWEET32 Is No Longer Present
After applying the remediation steps and rebooting the server, verify that the SWEET32 vulnerability has been resolved. Use one of the following tools to confirm that 3DES is no longer supported:
- SSL Labs Server Test (recommended for public-facing servers):
Visit https://www.ssllabs.com/ssltest/ and enter the domain name of the affected server.
Review the results to ensure 3DES is not listed among the supported cipher suites. - Nmap (quick CLI-based check):
Run the following command:
nmap –script ssl-enum-ciphers -p 443 [hostname or IP]
Look for 3DES or other 64-bit ciphers in the output. - testssl.sh (thorough internal scan):
Run the following command:
testssl.sh –vulnerable –cipher-per-proto –html customerDomain.com
This generates an HTML report showing all supported ciphers and any related vulnerabilities, including SWEET32.
