title: SQL Server deprecation announcement of use of RC4 on login, when i'm not using it
body: <p>I noticed that SQL Server Profiler includes an event when I use a deprecated feature:</p>
  
  <blockquote>
    <p>Occurs when you use a feature that will be removed from future version of SQL Server, but will not be removed from the next major release of SQL Server. For greatest longevity of your applications, you should avoid using features that cause the Deprecation Announcement event class or hte Deprecation Final Support event class.</p>
  </blockquote>
  
  <p>I turned it on and just <em>before</em> any Login event is recorded, I get:</p>
  
  <blockquote>
    <p>Deprecated encryption algorithm rc4 will be removed in a future version of SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use it. Use stronger algorithms instead.</p>
  </blockquote>
  
  <p><img src="https://i.stack.imgur.com/2lJWV.png" alt="enter image description here"></p>
  
  <p>But I'm not using RC4! I'm not even using AES. I'm using nothing. I'm just connecting to SQL Server.</p>
  
  <p>Or am i?</p>
  
  <h1>Bonus Chatter</h1>
  
  <blockquote>
    <p><a href="http://technet.microsoft.com/en-us/library/bb510662.aspx" rel="nofollow noreferrer"><strong>SQL Server, Deprecated Features Object</strong></a></p>
    
    <p>Deprecated encryption algorithm</p>
    
    <p>Deprecated encryption algorithm rc4 will be removed in the next version of SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use it. The RC4 algorithm is weak and is only supported for backward compatibility. New material can only be encrypted using RC4 or RC4_128 when the database is in compatibility level 90 or 100. (Not recommended.) Use a newer algorithm such as one of the AES algorithms instead. In SQL Server 2012 material encrypted using RC4 or RC4_128 can be unencrypted in any compatibility level.</p>
  </blockquote>
  
  <h1>Am I even doing anything wrong?</h1>
  
  <p>I'm simply opening a connect to SQL Server:</p>
  
  <pre><code>String connectionString = 
        "Provider=SQLOLEDB;Network Library=DBMSSOCN;Data Source=helium;
         User ID=Contoso;Password=correctbatteryhorsestaple"
  
  var conn = new ADOConnection();
  conn.ConnectionString = connectionString;
  conn.Open()
  </code></pre>
  
  <p>Even though the description of the event says:</p>
  
  <blockquote>
    <p>occurs when you use a feature that...</p>
  </blockquote>
  
  <p>Is it possible it is generated when I'm not using a feature? Is it possible this warning:</p>
  
  <blockquote>
    <p>occurs when anyone logs in regardless of they are using RC4</p>
  </blockquote>
  
  <p>and is actually just an announcement? Another application, an ASP.net MVC ADO-EF (a completely different connection technology) gets the same error.</p>
  
  <p>The documentation of other deprecation warnings give <strong>when</strong> you would see them:</p>
  
  <ul>
  <li><em>Occurs once per compilation.</em></li>
  <li><em>Occurs once per query.</em></li>
  <li><em>Occurs once per use in a DDL statement.</em></li>
  <li><em>Event occurs once per database start and once per collation use.</em></li>
  <li><em>Occurs once per use.</em></li>
  </ul>
  
  <p>Whereas the documentation for this warning doesn't mention when you would see it.</p>
  
  <blockquote>
    <p>Avoid using this feature in new development work, and plan to modify applications that currently use it.</p>
  </blockquote>
  
  <p>How do I avoid RC4 in future work, when I can't figure out where I'm using it now? </p>
  
  <p>Profile your 2008 R2 server. Do you get it? </p>
  
  <ul>
  <li>☒ Yes</li>
  <li>☐ No</li>
  </ul>
  
  <h1>Are SQL Server authentication passwords stored using RC4?</h1>
  
  <p>No. SQL Server passwords are not stored using reversible encryption. The <a href="https://stackoverflow.com/a/18154134/12597">passwords are salted and hashed using SHA-1</a>:</p>
  
  <pre><code>hashBytes = 0x0100 + fourByteSalt + SHA1(utf16EncodedPassword+fourByteSalt)
  </code></pre>
  
  <p>In SQL Server 2012, they switched to SHA2 over SHA-1.      </p>