Outbreaker wrote:

... "this should not be forced unto users" ...

  I agree, and that is why those reg files are zipped and optional.  Note that undo files are included.

Outbreaker wrote:

... "the second one is also already included in most of the UpdatePacks" ...

  Reference:  http://www.ryanvm.net/forum/viewtopic.p … 414#138414
I don't see it in user_hidden's update packs, nor OnePiece's or even harkaz's Unofficial XP-SP4.

Note that 5eraph's specific SA3009008 solution appears incomplete at best, and perhaps even erroneous.
Look at the last two lines of that post, where TLS 1.0 is "enabled" with a 0x01.  That is apparently incorrect.

Microsoft wrote:

"To allow this cipher algorithm, change the DWORD value data of the Enabled value to 0xffffffff. Or, change the DWORD data to 0x0. If you do not configure the Enabled value, the default is enabled."
     http://support.microsoft.com/kb/245030   see also:  http://support.microsoft.com/kb/187498 & http://support.microsoft.com/kb/811833

Is this not also true for protocols?

Hermann Wolf wrote:

"I also added the key SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56 with Enabled=1 and rebooted again bit the SSLScan.exe output is always the same"
     http://forums.iis.net/t/1187790.aspx

What of the value ""DisabledByDefault"=dword:00000001"?  I don't know which takes precedence.  RC4 128/128 disabling/undo should be included.  Win2k & 2k3 solutions are also missing thusfar.  Can AES work on XP?

  It does highlight the dire need for confirmation via testing.
There is a program that will test supported ciphers (except TLS 1.1 & 1.2).
  http://code.google.com/p/sslscan-win/
Here is some sample output, thanks to Wayne Zimmerman --> http://www.waynezim.com/2011/03/how-to- … rs-in-iis/

  Are there any UpdatePacks that include the full set of solutions?  I haven't seen any so far.  Correct me if i am wrong, please.

Outbreaker wrote:

... "people won't be able to connect to outdated HTTPS servers."

That is apparently actively being encouraged for servers.

Robert Love wrote:

"I advocate disabling SSLv3 support, which breaks Internet Explorer 6 on Windows XP, but prevents a downgrade attack for everyone else. If we're willing to drop support for all versions of Internet Explorer on Windows XP (Which likely just means the addition of IE 7 and 8), we can accomplish two other goals:
     http://blog.rlove.org/2014/04/the-end-o … p-and.html

  Also see:  http://blog.rlove.org/2013/12/strong-ssl-crypto.html

It's a bit of a sticky wicket, and it seems better to include it here as optional, as nobody other than 5eraph seems to have included any solution for NT5.
  I like to be able to confirm that the NULL cipher cannot be used with TLS 1.0 for instance, in my humble opinion.
  SSLScan seems to make that verification a little easier too.

"Here are some security tweaks I include with every install I do. I have had great success with them! Posting them for you all to consider."
   ... "1) This is a GREAT tool, highly recommended: Seconfig XP" [https://seconfig.sytes.net/?sv=1.1] ". Select the "For home" option, then "Apply", reboot!
        2) Been using this for years, nice security tool Windows Worms Doors Cleaner 1.4.1" [http://go4softwares.com/2013/02/02/wind … ner-1-4-1/] " Select options, reboot!
        3) Then add the following manually in to your registry. Some may already be present."
     quoted from:  http://www.ryanvm.net/forum/viewtopic.p … 92e#138610

Updated:
DP_LAN_wnt5_x86-32_1408061.7z - 11.14 MB   D1A8D57E0FEA044E3B4EF5AADB200DF00BBBFC3E