# TLS_GOSTR341112_256_WITH_MAGMA_MGM_S cipher suite

> TLS_GOSTR341112_256_WITH_MAGMA_MGM_S (0xC1,0x06): any (negotiated separately)/any (negotiated separately) · Magma-MGM-S · TLS 1.3. ssl.sh rating: Secure. OpenSSL/GnuTLS names and Nginx/Apache config.

Source: https://ssl.sh/ciphers/tls-gostr341112-256-with-magma-mgm-s/
Last updated: 2026-11-10

TLS_GOSTR341112_256_WITH_MAGMA_MGM_S (0xC1,0x06) is a TLS 1.3 cipher suite: Magma-MGM-S authenticated encryption with GOSTR3411-2012-256 as the HKDF hash. In TLS 1.3 the key exchange and authentication are negotiated separately, so the suite name doesn't contain them. ssl.sh rates it Secure.

| Field | Value |
|---|---|
| IANA | TLS_GOSTR341112_256_WITH_MAGMA_MGM_S |
| Hex code | 0xC1,0x06 |
| OpenSSL | Not available in OpenSSL 3.5 |
| GnuTLS | - |
| Key exchange | any (negotiated separately) |
| Authentication | any (negotiated separately) |
| Encryption | Magma-MGM-S |
| MAC | AEAD |
| TLS versions | TLS 1.3 |
| Rating | Secure |
| IANA "Recommended" | N |
| References | RFC 9367 |

## What each component means

A [cipher suite](https://ssl.sh/glossary/cipher-suite/) names the algorithms a client and server agree on in one handshake. TLS_GOSTR341112_256_WITH_MAGMA_MGM_S combines the Magma-MGM-S AEAD with the GOSTR3411-2012-256 hash. Each part is explained below with its known weaknesses; for the bigger picture see [how cipher suites work](https://ssl.sh/learn/cipher-suites/).

TLS 1.3 suites only describe the symmetric part. The TLS 1.3 specification ([RFC 9846](https://www.rfc-editor.org/rfc/rfc9846)) says its suites specify only the symmetric ciphers and cannot be used with TLS 1.2. Key exchange is negotiated separately through the supported_groups and key_share extensions (for example X25519, P-256 or the hybrid X25519MLKEM768) and is always ephemeral (EC)DHE unless a client resumes in the PSK-only psk_ke mode, so a full handshake always has [forward secrecy](https://ssl.sh/glossary/forward-secrecy/). The certificate signature algorithm (for example RSA-PSS, [ECDSA](https://ssl.sh/glossary/ecdsa/) or Ed25519) is negotiated with signature_algorithms. In TLS_GOSTR341112_256_WITH_MAGMA_MGM_S, GOSTR3411-2012-256 is the hash behind the HKDF key schedule and the handshake transcript hash.

Encryption: Magma, the 64-bit block cipher of GOST R 34.12-2015 (GOST 28147-89 with fixed S-boxes), with a 256-bit key. To limit how much data one key protects, the GOST TLS specifications re-derive record keys from the sequence number with the TLSTREE function.

Mode: MGM (Multilinear Galois Mode, [RFC 9058](https://www.rfc-editor.org/rfc/rfc9058)), the AEAD mode used with the Russian GOST ciphers in TLS 1.3. The _S suffix marks the strong profile: [RFC 9367](https://www.rfc-editor.org/rfc/rfc9367) (2023) divides its suites into _S (strong) and _L (light) types that differ in key-lifetime limits.

## Why this rating

- A TLS 1.3 AEAD suite, but IANA doesn't mark it "Recommended" (truncated tag, national or experimental algorithm, or limited client support).

## Which TLS libraries support it

Support for TLS_GOSTR341112_256_WITH_MAGMA_MGM_S as read from each library's own source code or official documentation on 2026-11-10. “Enabled by default” means the library negotiates it with no configuration; “off by default” means it is implemented but has to be switched on.

| Library | Status | Details |
|---|---|---|
| OpenSSL 3.5 | Not supported | - |
| GnuTLS | Not supported | - |
| BoringSSL | Not supported | - |
| Go crypto/tls | Not supported | - |
| NSS 3.133 | Not supported | - |
| Firefox | Not supported | - |
| Java 21 (SunJSSE) | Not supported | - |
| Windows Schannel (Windows 11 / Server 2022) | Not supported | - |
| rustls 0.23.46 | Not supported | - |

None of the 9 libraries tracked here enables it by default. None of them implements it.

NSS shows the library's own defaults; Firefox switches every NSS suite off at start-up and re-enables only those with a security.ssl3.* or security.tls13.* preference. Java defaults are derived from the jdk.tls.disabledAlgorithms value Oracle documents for JDK 21, which later updates may extend. The OpenSSL and GnuTLS rows only show whether the suite is implemented.

- [BoringSSL — ssl/ssl_cipher.cc (main)](https://boringssl.googlesource.com/boringssl/+/refs/heads/main/ssl/ssl_cipher.cc) (2026-11-10)
- [Go — src/crypto/tls/cipher_suites.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go) (2026-11-10)
- [Go — src/crypto/tls/defaults.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/defaults.go) (2026-11-10)
- [NSS — lib/ssl/ssl3con.c (as vendored in Firefox)](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/lib/ssl/ssl3con.c) (2026-11-10)
- [NSS — TAG-INFO](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/TAG-INFO) (2026-11-10)
- [Firefox — security/manager/ssl/nsNSSComponent.cpp](https://github.com/mozilla-firefox/firefox/blob/main/security/manager/ssl/nsNSSComponent.cpp) (2026-11-10)
- [Firefox — modules/libpref/init/StaticPrefList.yaml](https://github.com/mozilla-firefox/firefox/blob/main/modules/libpref/init/StaticPrefList.yaml) (2026-11-10)
- [Oracle — JDK 21 Providers Documentation: SunJSSE Cipher Suites](https://docs.oracle.com/en/java/javase/21/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2) (2026-11-10)
- [Oracle — JDK 21 JSSE Reference Guide: jdk.tls.disabledAlgorithms](https://docs.oracle.com/en/java/javase/21/security/java-secure-socket-extension-jsse-reference-guide.html) (2026-11-10)
- [Microsoft Learn — TLS Cipher Suites in Windows 11](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11) (2026-11-10)
- [Microsoft Learn — TLS Cipher Suites in Windows Server 2022](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022) (2026-11-10)
- [docs.rs — rustls 0.23.46 crypto::aws_lc_rs (default provider)](https://docs.rs/rustls/0.23.46/src/rustls/crypto/aws_lc_rs/mod.rs.html) (2026-11-10)

## History and standards status

TLS_GOSTR341112_256_WITH_MAGMA_MGM_S (0xC1,0x06) is registered in the IANA TLS Cipher Suites registry with [RFC 9367](https://www.rfc-editor.org/rfc/rfc9367), “GOST Cipher Suites for Transport Layer Security (TLS) Protocol Version 1.3” (February 2023, Informational) as its specification. The registry marks it N, which per [RFC 8447](https://www.rfc-editor.org/rfc/rfc8447) (2018) means it either hasn't been through the IETF consensus process, has limited applicability or is meant only for specific use cases, not necessarily that it is flawed.

## How to test whether a server accepts it

OpenSSL 3.5 cannot offer TLS_GOSTR341112_256_WITH_MAGMA_MGM_S, so openssl s_client can't test it directly; use a scanner that implements the suite itself.

nmap's ssl-enum-ciphers script connects repeatedly, trying one suite at a time, and lists every suite the server accepts with a grade from A to F. Look for TLS_GOSTR341112_256_WITH_MAGMA_MGM_S in its output:

```bash
nmap --script ssl-enum-ciphers -p 443 example.com
```

If your nmap build doesn't print a TLS 1.3 section, rely on the openssl command instead.

To decode a name or hex code, use the [cipher suite lookup](https://ssl.sh/tools/cipher-suite-lookup/); the [SSL checker](https://ssl.sh/tools/ssl-checker/) shows which protocol versions a live server accepts and the cipher suite it negotiates.

## FAQ

### Is TLS_GOSTR341112_256_WITH_MAGMA_MGM_S secure?

Cryptographically, yes: ssl.sh rates it secure. A TLS 1.3 AEAD suite, but IANA doesn't mark it "Recommended" (truncated tag, national or experimental algorithm, or limited client support).

### Can TLS_GOSTR341112_256_WITH_MAGMA_MGM_S be used with TLS 1.3?

Yes. It is a TLS 1.3 suite, so it only works with TLS 1.3; a TLS 1.2 handshake cannot negotiate it. OpenSSL 3.5 doesn't implement it, so stock Nginx and Apache httpd cannot offer it.

### How do I disable TLS_GOSTR341112_256_WITH_MAGMA_MGM_S in Nginx or Apache?

There is nothing to disable: OpenSSL 3.5, which Nginx and Apache httpd normally use, does not implement TLS_GOSTR341112_256_WITH_MAGMA_MGM_S, so they cannot negotiate it.

### Which clients and libraries still support TLS_GOSTR341112_256_WITH_MAGMA_MGM_S?

Not supported: OpenSSL 3.5, GnuTLS, BoringSSL, Go crypto/tls, NSS 3.133, Firefox, Java 21 (SunJSSE), Windows Schannel (Windows 11 / Server 2022) and rustls 0.23.46.