Cybersecurity glossary
What is a Cipher Suite?
Learn what a TLS cipher suite is, how cipher suite names encode key exchange, authentication, encryption, and integrity, why TLS 1.3 simplified suites, and which weak suites to disable.
Definition
A cipher suite is a named set of cryptographic algorithms a TLS client and server negotiate for a connection; in TLS 1.2 and earlier it commonly identifies key exchange, authentication, bulk encryption, and message authentication choices, while TLS 1.3 reduces the suite name to the AEAD cipher and hash.
Why cipher suites matter
A cipher suite is the menu item TLS chooses before encrypted application data starts flowing. It answers a practical question: which cryptographic algorithms will this client and server use for this connection?
Old TLS configurations often accumulated long suite lists to support every client. Modern configurations do the opposite: prefer TLS 1.3, keep a short TLS 1.2 fallback set, and remove suites whose algorithms or negotiation behavior are no longer trustworthy.
What a TLS 1.2 cipher suite name contains
TLS 1.2 and earlier suite names often read like compressed configuration strings. A suite such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 tells you how keys are established, how the server authenticates, how records are encrypted, and which hash is tied into the handshake.
Key exchange
Algorithms such as ECDHE or DHE establish shared keys; ephemeral variants provide forward secrecy.
Authentication
RSA, ECDSA, or similar labels identify how the certificate key authenticates the endpoint during the handshake.
Bulk encryption
AES-GCM, ChaCha20-Poly1305, AES-CBC, or older ciphers protect application records after the handshake.
Integrity / MAC
AEAD suites integrate integrity with encryption; older CBC suites pair encryption with a separate HMAC.
Decoding a suite name
Start with the protocol prefix
`TLS_` marks the registry family. It does not mean the suite is automatically modern or safe.
Read the key exchange
`ECDHE` means elliptic-curve Diffie-Hellman ephemeral key exchange, which enables forward secrecy.
Read the authentication algorithm
`RSA` in a TLS 1.2 suite normally means the certificate's RSA key authenticates the server.
Read the record cipher
`AES_128_GCM` means AES with a 128-bit key in Galois/Counter Mode, an AEAD construction.
Read the hash label carefully
`SHA256` is used by the handshake/PRF in this AEAD suite; it is not a separate per-record HMAC.
TLS 1.2 versus TLS 1.3 naming
TLS 1.3 intentionally made cipher suites less overloaded. The suite TLS_AES_128_GCM_SHA256 only describes the AEAD cipher and hash. Key exchange groups, signature algorithms, certificate authentication, and key schedule details are negotiated through other TLS 1.3 extensions and handshake messages.
| Area | TLS 1.2 naming | TLS 1.3 naming |
|---|---|---|
| Example | `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` | `TLS_AES_128_GCM_SHA256` |
| Key exchange | Often embedded, such as ECDHE, DHE, or static RSA | Negotiated separately with supported groups and key shares |
| Authentication | Often embedded, such as RSA or ECDSA | Negotiated separately with signature algorithms and certificates |
| Record protection | Bulk cipher plus MAC or AEAD mode | AEAD cipher only: AES-GCM, AES-CCM, or ChaCha20-Poly1305 |
| Legacy risk | Can include CBC, static RSA, SHA1, 3DES, RC4, or export-era baggage | Legacy algorithms were removed from the protocol |
Suites to disable
Weak suites usually fail for one of three reasons: they do not provide confidentiality, they use broken or obsolete primitives, or they block forward secrecy. Disable the risky families rather than trying to rank individual legacy names by nostalgia or compatibility pressure.
- Disable NULL, anonymous, and unauthenticated suites.
- Disable export-grade suites and any suite retained for SSL 2.0, SSL 3.0, TLS 1.0, or TLS 1.1.
- Disable RC4, DES, 3DES, IDEA, SEED, and other obsolete bulk ciphers.
- Disable MD5 and avoid SHA1-based CBC suites unless a tightly scoped legacy exception is documented.
- Disable static RSA key exchange and static DH suites because they do not provide forward secrecy.
- Prefer TLS 1.3 suites first, then modern TLS 1.2 ECDHE + AEAD fallback suites.
- Keep the offered suite list small enough that audits and scanner findings are understandable.
- Retest after load balancer, CDN, ingress, Java, OpenSSL, or operating system upgrades.
Practical configuration guidance
For most public web services, let a maintained profile generate the exact syntax for your server stack. Mozilla's SSL Configuration Generator is a good starting point because the correct string differs between nginx, Apache, HAProxy, Envoy, Java, and cloud load balancers.
As a baseline, enable TLS 1.3, keep TLS 1.2 only where client support requires it, and offer ECDHE suites using AES-GCM or ChaCha20-Poly1305. Treat scanner results as regression tests: a surprise RC4, 3DES, static RSA, or CBC-only fallback is usually a deployment drift problem, not just a documentation issue.
The practical takeaway
Cipher suites are TLS negotiation shorthand. In TLS 1.2 they describe a bundle of key exchange, authentication, encryption, and integrity choices; in TLS 1.3 they are deliberately narrower. Secure configurations favor TLS 1.3, ephemeral key exchange, AEAD record protection, and a short denylist-free fallback set for older but still supported clients.
Related security terms
TLS 1.2
The TLS version where cipher suite names still bundle key exchange, authentication, encryption, and MAC details.
TLS 1.3
The modern TLS version that simplifies cipher suites and negotiates key exchange separately.
Authenticated Encryption with Associated Data (AEAD)
Modern TLS suites use AEAD ciphers to combine confidentiality and integrity.
Forward Secrecy
A property of ephemeral key exchange that protects old sessions if a long-term key leaks later.
SSL/TLS
The transport security protocol family where cipher suites are negotiated.
Frequently asked questions
What is a cipher suite in TLS?
A cipher suite is the named combination of algorithms that protects a TLS session. In TLS 1.2 it can identify key exchange, certificate authentication, symmetric encryption, and MAC or AEAD behavior.
How do you read TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256?
ECDHE is the ephemeral key exchange, RSA is the certificate authentication algorithm, AES_128_GCM is the AEAD bulk cipher, and SHA256 is the handshake hash/PRF label rather than a separate record MAC for GCM.
Why are TLS 1.3 cipher suites shorter?
TLS 1.3 removed legacy key exchange modes and negotiates supported groups and signature algorithms outside the cipher suite, so suite names only list the AEAD cipher and hash, such as TLS_AES_128_GCM_SHA256.
Which cipher suites should be disabled?
Disable NULL, anonymous, export, DES, 3DES, RC4, MD5, static RSA key exchange, static DH, weak CBC/SHA1 combinations, and any suite required only for obsolete SSL or TLS versions.
Do server cipher suite preferences still matter?
Yes, especially for TLS 1.2 and mixed-client environments. Prefer TLS 1.3, offer a small modern TLS 1.2 fallback set, and continuously test for regressions.
Are all AES-GCM suites equally safe?
No. AES-GCM is a strong AEAD mode, but the full suite and protocol settings still matter. Prefer ephemeral ECDHE key exchange, valid certificate authentication, TLS 1.2 or newer, and patched libraries.
References
Explore authoritative guidance and frameworks related to cipher suite.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.