Cipher Suite

A cipher suite is an entry from the IANA TLS registry, identified by a two-byte code, that fixes which algorithms a connection uses. In TLS 1.2 and earlier, the name spells out key exchange, authentication, bulk cipher and MAC or PRF hash: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 means ECDHE key exchange, RSA signatures, AES-128 in GCM mode and SHA-256. In TLS 1.3 a suite names only the AEAD cipher and hash (for example TLS_AES_128_GCM_SHA256); key exchange and signature algorithms are negotiated separately.

Why it matters

The client offers a list and the server chooses one. Weak suites (RC4, 3DES, NULL, export-grade, or static RSA key exchange) make attacks possible even when the protocol version is fine. If client and server share no suite, the handshake fails, which Chrome reports as ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Libraries also use different names for the same suite: OpenSSL calls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256, and TLS_RSA_WITH_3DES_EDE_CBC_SHA is DES-CBC3-SHA.

Example

Expand an OpenSSL cipher string to see what it actually enables:

openssl ciphers -v 'ECDHE+AESGCM'

Each output line shows the OpenSSL name, minimum protocol, key exchange (Kx), authentication (Au), encryption (Enc) and MAC; AEAD suites show Mac=AEAD.

Common misconceptions

• "A bigger number in the name means a safer suite." AES-128 and AES-256 are both strong. AES256-SHA (static RSA, CBC) is weaker than ECDHE-RSA-AES128-GCM-SHA256 because it lacks forward secrecy and AEAD.
• "An ECDHE-ECDSA suite works with any certificate." In TLS 1.2 the authentication part must match the certificate key type; an RSA certificate can only use RSA-authenticated suites.
• "The server should always force its own order." When every enabled suite is strong, letting clients choose lets devices without AES hardware pick ChaCha20-Poly1305.