8/10/2019 The Basics of SMB Signing (Covering Both SMB1 and SMB2) - Jose Barreto's Blog - Site Home - TechNet Blogs

1/3

5

The Basics of SMB Signing (covering both SMB1 and SMB2)

Jose Barreto - MSFT 1 Dec 2010 1:0 !M

SMB Signing Overview

Server Message B"oc# (SMB) is the fi"e $rotoco" %ost co%%on"& 'sed b& indos* SMB Signing is a feat're thro'gh

hich co%%'nications 'sing SMB can be digita""& signed at the $ac#et "eve"* Digita""& signing the $ac#ets enab"es the

reci$ient of the $ac#ets to confir% their $oint of origination and their a'thenticit&* This sec'rit& %echanis% in the SMB

$rotoco" he"$s avoid iss'es "i#e ta%$ering of $ac#ets and +%an in the %idd"e, attac#s*

SMB signing is avai"ab"e in a"" c'rrent"& s'$$orted versions of indos b't it.s on"& enab"ed b& defa'"t on Do%ain

/ontro""ers* This is reco%%ended for Do%ain /ontro""ers beca'se SMB is the $rotoco" 'sed b& c"ients to don"oad ro'$

!o"ic& infor%ation* SMB signing $rovides a a& to ens're that the c"ient is receiving gen'ine ro'$ !o"ic&*

SMB signing as introd'ced in indos 2000 (at the ti%e it as a"so $orted bac# to Microsoft indos T *0 and

Microsoft indos 3)* ith the introd'ction of SMB2 in indos 4ista and indos Server 2003 signing as i%$roved

b& 'sing a ne hashing a"gorith% (M6/ S6-257 re$"aced the o"d MD5)* 6t that ti%e the settings ere '$dated to

si%$"if& config'ration and intero$erabi"it& (&o' can find detai"s "ater in the $ost)* 6nother i%$ortant i%$rove%ent in SMB2

signing is $erfor%ance* 8n SMB1 enab"ing signing significant"& decreases $erfor%ance es$ecia""& hen going across a

6* 8n SMB2 there is a"%ost no %eas'rab"e degradation in $erfor%ance a"tho'gh there is sti"" a higher /!9 "oad*

SMB1 Signing Configuration and Defaults

There are to %ain a&s to config're signing for SMB1 c"ients and SMB1 servers* The easier one is set a ro'$ !o"ic& to

config're it* This is for instance ho do%ain contro""ers are config'red b& defa'"t to re'ire signing* The other a& to do

it is 'sing registr& settings* ;n each side (SMB1 c"ient and SMB1 server) SMB1 Signing can be set to be + =nab"ed

=nab"ed

=nab"eSec'rit&Signat're ? 1

Disab"ed

=nab"eSec'rit&Signat're ? 0

8/10/2019 The Basics of SMB Signing (Covering Both SMB1 and SMB2) - Jose Barreto's Blog - Site Home - TechNet Blogs

2/3

8/10/2019 The Basics of SMB Signing (Covering Both SMB1 and SMB2) - Jose Barreto's Blog - Site Home - TechNet Blogs

3/3