Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32)

[Dan_Wentworth]

We have a customer on OnBase 17 (DDS, Encrypted keywords) who has identified  a 'Sweet32' vulnerability.

The customer approach is to  'Disable of Triple DES 168 Cipher through Registry'

Is this an approved approach to Sweet32'?
Will manually disabling this cipher  affect OnBase?

I understand there are other approaches which involve disabling SSL 2.0 and SSL 3.0.

What is Hyland's recommendation?

Dan

[Dan_Wentworth]

This is an Oracle implementation

[Alan_Vidmar]

Dan,

I don't know what Hyland's official recommendation for this might be, but we manage our own protocols and ciphers as we consider IIS as part of our own technological footprint to maintain.

That said, I've found a nice tool to assist with these processes: IIS Crypto  https://www.nartac.com/Products/IISCrypto

This will allow you to see and manage the various protocols, ciphers, and cipher suites you allow on your IIS server.

Please test very carefully though, especially if you use a load balance in front of your web/app servers as you'll need to make sure that the load balancer ciphers match up to what you're setting on IIS.

Alan