Cipher suite

Cipher suite is a concept used in Transport Layer Security (TLS) / Secure Sockets Layer (SSL) . Before TLS version 1.3, a cipher suite is a named combination of authentication, encryption, message authentication code (MAC) and key exchange algorithms used to negotiate the security settings. The format of cipher suites is modified since TLS 1.3. In the current TLS 1.3 draft document, cipher suites are only used to negotiate encryption and HMAC algorithms.

The structure and use of the cipher suite concept is defined in the documents that define the protocol. A reference for named cipher suites is provided in the TLS Cipher Suite Registry.

When a TLS connection is established, a handshaking, known as the TLS Handshake Protocol, occurs. Within this handshake, a client hello (ClientHello) and a server hello (ServerHello) message are passed. First, the client sends a list of the cipher suites that it supports, in order of preference. Then the server replies with the cipher suite that it has selected from the client's list. To test which TLS ciphers a server supports, an SSL/TLS Scanner may be used.

Each named cipher suite, e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, defines a key exchange algorithm, a bulk encryption algorithm, a message authentication code (MAC) algorithm, and a pseudorandom function (PRF).

In TLS 1.3, a cipher suite represents an AEAD encryption algorithm and a hash algorithm used in HKDF. For example, TLS_AES_128_GCM_SHA256 indicates AES_128_GCM is used to encrypt messages, and SHA256 is the underlying hash algorithm in HKDF. Non-AEAD encryption algorithms (such as AES_128_CBC) are not allowed to be used.

...
Wikipedia