Prefer specific key exchange algorithms for TLS

What it does

This policy configures Google Chrome to order its preferred key agreement algorithms (supported groups) in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime. Setting this policy does not guarantee that any specific algorithms will be negotiated. This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them. Setting the policy to 'cnsa2' configures Google Chrome to prefer key exchange methods required for compliance with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). Not setting the policy, or setting it to 'default', configures Google Chrome to use its default key exchange methods. Setting this policy is not required for security. The default cryptography used by Google Chrome is strong enough to withstand a brute force attack using the entire power of the Sun. Setting this policy will cause Google Chrome to be slower when accessing websites. This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS. This policy can be set for the machine and for the user. If set for the user, this policy only affects network requests initiated by the user profile, and may not affect network requests made by Google Chrome to carry out browser-wide background tasks; those are controlled by the machine-level value. If this policy is set at both the machine level and the user level, the machine-level value applies, unless the policy precedence order has been changed by the CloudUserPolicyOverridesCloudMachinePolicy policy. For versions 155 and below, this policy is machine-wide only. Example value: cnsa2

What it writes

Hive

HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER

Registry key

Software\Policies\Google\Chrome

Options

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome]
"PreferSlowKexAlgorithms"="cnsa2"

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Prefer specific key exchange algorithms for TLS
# Name: PreferSlowKexAlgorithms
# Scope: Machine
# State: Enabled
# Source: chrome.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome' -Name 'PreferSlowKexAlgorithms' -PropertyType 'String' -Value 'cnsa2'

./Device/Vendor/MSFT/Policy/Config/ADMX_chrome/PreferSlowKexAlgorithms

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' {
            $actualBits = if ($actual -is [uint64]) { $actual } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$actual), 0) }
            $expectedBits = if ($Expected -is [uint64]) { $Expected } else { [BitConverter]::ToUInt64([BitConverter]::GetBytes([int64]$Expected), 0) }
            return $actualBits -eq $expectedBits
        }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Prefer specific key exchange algorithms for TLS
# Name: PreferSlowKexAlgorithms
# Scope: Machine
# State: Enabled
# Source: chrome.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome' -Name 'PreferSlowKexAlgorithms' -Kind 'String' -Expected 'cnsa2'
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\PreferSlowKexAlgorithms') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Prefer specific key exchange algorithms for TLS
# Name: PreferSlowKexAlgorithms
# Scope: Machine
# State: Enabled
# Source: chrome.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome' -Name 'PreferSlowKexAlgorithms' -PropertyType 'String' -Value 'cnsa2'

History 6 retained releases

1. 156.0.8078.4826 Oct 2026
   Registry key: Software\Policies\Google\Chrome · Value name: Not specified
   • Description … TLS 1.3 and QUIC; it does not affect earlier versions of TLS. [added: This policy can be set for the machine and for the user. If set for the user, this policy only affects network requests initiated by the user profile, and may not affect network requests made by Google Chrome to carry out browser-wide background tasks; those are controlled by the machi…]Example value: cnsa2
     Whole description, marked

     This policy configures Google Chrome to order its preferred key agreement algorithms (supported groups) in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime. Setting this policy does not guarantee that any specific algorithms will be negotiated. This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them. Setting the policy to 'cnsa2' configures Google Chrome to prefer key exchange methods required for compliance with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). Not setting the policy, or setting it to 'default', configures Google Chrome to use its default key exchange methods. Setting this policy is not required for security. The default cryptography used by Google Chrome is strong enough to withstand a brute force attack using the entire power of the Sun. Setting this policy will cause Google Chrome to be slower when accessing websites. This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS. [added: This policy can be set for the machine and for the user. If set for the user, this policy only affects network requests initiated by the user profile, and may not affect network requests made by Google Chrome to carry out browser-wide background tasks; those are controlled by the machine-level value. If this policy is set at both the machine level and the user level, the machine-level value applies, unless the policy precedence order has been changed by the CloudUserPolicyOverridesCloudMachinePolicy policy. For versions 155 and below, this policy is machine-wide only. ]Example value: cnsa2

2. 155.0.8059.8519 Oct 2026
   Registry key: Software\Policies\Google\Chrome · Value name: Not specified
   • Already present in the first release ChangeIntel keeps.

4 later releases left it unchanged.

Template

Internal name

PreferSlowKexAlgorithms

Namespace

Google.Policies.Chrome

Template file

chrome.admx

Release

Google Chrome 157.0.8103.79 · file set 6e824af7f6d85cb6…

<policy class="Both" displayName="$(string.PreferSlowKexAlgorithms)" explainText="$(string.PreferSlowKexAlgorithms_Explain)" key="Software\Policies\Google\Chrome" name="PreferSlowKexAlgorithms" presentation="$(presentation.PreferSlowKexAlgorithms)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies.Chrome:CryptographyCompliance" />
      <supportedOn ref="Google.Policies.Chrome:SUPPORTED_WIN7" />
      <elements>
        <enum id="PreferSlowKexAlgorithms" valueName="PreferSlowKexAlgorithms">
          <item displayName="$(string.PreferSlowKexAlgorithms_CNSA2_0)">
            <value>
              <string>cnsa2</string>
            </value>
          </item>
          <item displayName="$(string.PreferSlowKexAlgorithms_Default)">
            <value>
              <string>default</string>
            </value>
          </item>
        </enum>
      </elements>
    </policy>

<presentation id="PreferSlowKexAlgorithms" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"><dropdownList refId="PreferSlowKexAlgorithms">Prefer specific key exchange algorithms for TLS</dropdownList></presentation>

Google.Policies.Chrome:category:CryptographyCompliance
<category displayName="$(string.CryptographyCompliance_group)" name="CryptographyCompliance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies.Chrome:googlechrome" />
    </category>
Google.Policies.Chrome:category:googlechrome
<category displayName="$(string.googlechrome)" name="googlechrome" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies:Cat_Google" />
    </category>
Google.Policies.Chrome:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Google.Policies:category:Cat_Google
<category displayName="$(string.google)" name="Cat_Google" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Google.Policies.Chrome:category:CryptographyCompliance
<category displayName="$(string.CryptographyCompliance_group)" name="CryptographyCompliance" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies.Chrome:googlechrome" />
    </category>
<strings><string id="Google.Policies.Chrome:CryptographyCompliance_group">Cryptography compliance policies</string></strings>
Google.Policies.Chrome:category:googlechrome
<category displayName="$(string.googlechrome)" name="googlechrome" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies:Cat_Google" />
    </category>
<strings><string id="Google.Policies.Chrome:googlechrome">Google Chrome</string></strings>
Google.Policies.Chrome:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Google.Policies.Chrome:SUPPORTED_WIN7">Microsoft Windows 7 or later</string></strings>
Google.Policies:category:Cat_Google
<category displayName="$(string.google)" name="Cat_Google" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Google.Policies:google">Google</string></strings>