mjhjmtu

I am working to secure our iDRAC controllers against attacks such as BEAST, POODLE, Heartbleed, etc after getting told by management that we needed them secured.

While looking through the settings in an xml export of one of the controllers, I noticed a setting which I am unsure exactly what it does.

<Attribute Name="WebServer.1#LowerEncryptionBitLength">Enabled</Attribute>
<Attribute Name="VNCServer.1#LowerEncryptionBitLength">Disabled</Attribute>

For reference, these are the other related settings:

<Attribute Name="WebServer.1#Enable">Enabled</Attribute>
<Attribute Name="WebServer.1#HttpPort">80</Attribute>
<Attribute Name="WebServer.1#HttpsPort">443</Attribute>
<Attribute Name="WebServer.1#Timeout">1800</Attribute>
<Attribute Name="WebServer.1#LowerEncryptionBitLength">Enabled</Attribute>
<Attribute Name="WebServer.1#HttpsRedirection">Enabled</Attribute>
<Attribute Name="WebServer.1#SSLEncryptionBitLength">256-Bit or higher</Attribute>
<Attribute Name="WebServer.1#TLSProtocol">TLS 1.2 Only</Attribute>
<Attribute Name="VNCServer.1#Port">5901</Attribute>
<Attribute Name="VNCServer.1#LowerEncryptionBitLength">Disabled</Attribute>
<Attribute Name="VNCServer.1#Timeout">300</Attribute>
<Attribute Name="VNCServer.1#SSLEncryptionBitLength">256-Bit or higher</Attribute>

So, if SSLEncryptionBitLength is 256-Bit or Higher, and TLS Protocol is 1.2 Only, what does this "LowerEncryptionBitLength" do?

Logically speaking, it sounds like it allows (or maybe forces) a smaller encryption key, but I all of my google searches only turned up Dell sites that have virtually no explanation of the setting other than what values it accepts (0 for Disabled, and 1 for Enabled)