Prefer specific key exchange algorithms for TLS
This policy configures Microsoft Edge to prioritize certain key agreement algorithms (supported groups) in TLS 1.3 based on compliance requirements. If you set this policy to 'cnsa2', Microsoft Edge prefers the algorithms required for the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). If you leave this policy unset or set it to 'default', the browser uses its standard key exchange order. This policy does not guarantee negotiation of a specific algorithm. It is designed to help server operators distinguish clients with compliance requirements and apply higher-strength, non-default algorithms only when appropriate. This policy applies only to TLS 1.3 and QUIC. The default cryptography used by Microsoft Edge already provides strong security, but enabling this policy may reduce performance when accessing websites. Policy options mapping: * CNSA2.0 (cnsa2) = Prefer key exchange methods satisfying the requirements of CNSA 2.0 * Default (default) = Use Microsoft Edge's default supported groups Use the preceding information when configuring this policy. Example value: cnsa2
Policy Details
- Policy Name
- PreferSlowKexAlgorithms
- Registry Key
- Software\Policies\Microsoft\Edge
- Supported On
- Microsoft Edge version 146, Windows 7 or later
- Available Languages
- en-us
Configuration Elements
Prefer specific key exchange algorithms for TLS
Type: enum
- cnsa2 Prefer key exchange methods satisfying the requirements of CNSA 2.0
- default Use Microsoft Edge's default supported groups