# What Is Cipher Suite? Definition and Examples

> A cipher suite is a named combination of cryptographic algorithms that a TLS client and server agree on to protect a connection, such as TLS_AES_128_GCM_SHA256.

Source: https://ssl.sh/glossary/cipher-suite/
Last updated: 2026-11-10

A cipher suite is an entry from the IANA TLS registry, identified by a two-byte code, that fixes which algorithms a connection uses. In [TLS 1.2](https://ssl.sh/glossary/tls-1-2/) and earlier, the name spells out key exchange, authentication, bulk cipher and MAC or PRF hash: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 means [ECDHE](https://ssl.sh/glossary/ecdhe/) key exchange, RSA signatures, AES-128 in GCM mode and SHA-256. In [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) a suite names only the AEAD cipher and hash (for example TLS_AES_128_GCM_SHA256); key exchange and signature algorithms are negotiated separately.

## Why it matters
The client offers a list and the server chooses one. Weak suites (RC4, 3DES, NULL, export-grade, or static RSA key exchange) make attacks possible even when the protocol version is fine. If client and server share no suite, the handshake fails, which Chrome reports as ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Libraries also use different names for the same suite: OpenSSL calls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256, and TLS_RSA_WITH_3DES_EDE_CBC_SHA is DES-CBC3-SHA.

## Example
Expand an OpenSSL cipher string to see what it actually enables:

```bash
openssl ciphers -v 'ECDHE+AESGCM'
```

Each output line shows the OpenSSL name, minimum protocol, key exchange (Kx), authentication (Au), encryption (Enc) and MAC; AEAD suites show `Mac=AEAD`.

## Common misconceptions
- **"A bigger number in the name means a safer suite."** AES-128 and AES-256 are both strong. AES256-SHA (static RSA, CBC) is weaker than ECDHE-RSA-AES128-GCM-SHA256 because it lacks forward secrecy and AEAD.
- **"An ECDHE-ECDSA suite works with any certificate."** In TLS 1.2 the authentication part must match the certificate key type; an RSA certificate can only use RSA-authenticated suites.
- **"The server should always force its own order."** When every enabled suite is strong, letting clients choose lets devices without AES hardware pick ChaCha20-Poly1305.

## Related terms

- [TLS 1.2](https://ssl.sh/zh/glossary/tls-1-2/): TLS 1.2 是 2008 年由 RFC 5246 定义的 TLS 版本，引入了基于 SHA-256 的密钥派生和 AES-GCM 等 AEAD 加密算法，至今仍被广泛使用。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。
- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [AES-GCM](https://ssl.sh/zh/glossary/aes-gcm/): AES-GCM 是以伽罗瓦/计数器模式运行的 AES 分组密码，属于 AEAD 算法，用计数器模式加密、用 GHASH 认证标签保证完整性。
- [ChaCha20-Poly1305](https://ssl.sh/zh/glossary/chacha20-poly1305/): ChaCha20-Poly1305 是把 ChaCha20 流密码与 Poly1305 认证算法组合而成的 AEAD 算法，专为纯软件实现时的高速和恒定时间而设计。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。