Windows XP Professional Security

[Dan]

I was wondering if Internet Explorer 7 in Windows XP Professional will be
upgraded to support encryption standards beyond 128 cipher strength. Windows
Vista Internet Explorer supports stronger cipher strength as well as Mozilla
Firefox 2.0.x. Mozilla Firefox 2.0.x can support 256 bit AES and 168 bit
cipher strengths. I think Windows Vista Internet Explorer can also support
the 256 bit AES cipher strength but what about users that use Windows XP
Professional that is still in full support by Microsoft and only retired
selling XP to stores as of June 30, 2008.

 

[Steve Riley [MSFT]]

IE relies on SCHANNEL.DLL (the the operating system's cryptography engine)
for SSL/TLS. Supported symmetric algorithms in Windows XP and Windows Server
2003 are documented in
http://technet2.microsoft.com/windowsserver/en/library/3f98fdd9-ed64-49f7-9c20-a2d4581dfbea1033.mspx.

Windows Vista and Server 2008 add AES and ECC ciphers. Details at
http://technet2.microsoft.com/WindowsVista/en/library/9c0e0f73-6bb7-4b8d-b86c-6862660ad9861033.mspx.
There are no plans to add AES or ECC to Windows XP or Server 2003.

 

[Dan]

Thank you for the information, Steve. My concern for Microsoft is that with
Mozilla Firefox gathering more market share with their web browser because of
its security and the nice ability to customize Firefox with so many
extensions, how can Microsoft hope to counter Firefox if even with Microsoft
Windows 98 Second Edition and of course Wndows XP, a user can have 256 AES
encryption standard when the user uses Mozilla Fireofox and if the web site
suports that cipher strength. I do indeed like the ease of use of ActiveX
within IE that Firefox does not have but ActiveX can indeed present security
issues because some people can be mean and take advantage of the average
computer user.