Security Advances in Windows 2003

What network security improvements does Windows Server 2003 offer over Windows 2000 Server?

In my opinion, security improvements—especially in Internet communications—are the major advantage of Windows 2003. Security over IP is stronger out of the box, thanks to the safer browsing and downloading controls of Microsoft Internet Explorer (IE) 6.0. Windows 2003 also offers better filtering capabilities for IP Security (IPSec). For example, you can create a filter that specifies any IP address as the source or destination address.

But perhaps the most interesting boost to security is the 2048-bit Diffie-Hellman Internet Key Exchange (IKE) group. The Diffie-Hellman key exchange lets two users exchange a secret key over an insecure medium (the Internet) without the use of prior secrets. Basically, both users generate a random private number. A series of computations use these private numbers and the protocol's two public parameters to generate a shared secret key.

Windows 2003's Diffie-Hellman Group 3 option provides 2048 bits of key strength and doubles the key strength of Diffie-Hellman Group 2, which was the strongest encryption available on pre-Windows 2003 OSs. You can read more about Diffie-Hellman key exchange at http://www.rsasecurity.com/rsalabs/node.asp?id=2248. Given all the risks with Internet communications, this is a much-needed security enhancement.

—Bob Chronister