Cipher suites are preconfigured sets of cryptographic parameters that allow two devices to negotiate a common method for securing communications. They define the algorithms used for encryption, key exchange, authentication, and data integrity.
Cipher Suites
When two devices are communicating back and forth, there's a lot of different ways they can set up secure communication. There's a lot of different ways they can encrypt data, there's different ciphers out there, there's different key lengths, there's also different modes of encryption. When it comes to the integrity piece, there's different hashing algorithms, and when it comes to the key exchange, there's different ways they can exchange the keys. Not all devices have the same capabilities, so how do we establish a common set of capabilities? Well, we do that through cipher suites.
In TLS, the bulk of our communication is going to be encrypted, and it's going to be encrypted with this application data for the content type. So in this example right here, we're using the cipher AES, we're using a key length of 256, and we're using the mode of GCM. For our integrity piece we're using SHA-256. But there are a lot of different combinations that we have out there, and that's where our cipher suite comes into play. When two devices are talking back and forth, they're going to decide on some of the parameters of how they're going to secure the communication, and they do that through the use of cipher suites.
Here are some of the parameters that need to be established. One of those is going to be our encryption, and specifically it's going to be our symmetrical encryption. We may use asymmetrical encryption for things like key exchange, but the problem is that's very resource intensive and very slow, and so we'll want to transition to start using symmetrical encryption. That's what this specifies right here. We're going to choose a cipher to use, there's going to be a key size, and there's going to be a mode for that. We also want that integrity check, so then we have our hashing algorithm. Here we have the key exchange, like I mentioned, and then we also have that authentication piece.
There are a lot of different options that we can choose. For instance, with the key exchange maybe we choose one of the Diffie-Hellman, or maybe it's going to be RSA, or maybe it's going to be Pass key. For the authentication piece maybe we choose something like RSA. For the session cipher maybe we choose AES 256 with GCM, and then for the hashing algorithm perhaps we're going to choose SHA-384 or 256. So we're going to choose different options with this.
What cipher suites are is preconfigured sets of these options. For instance, we may have a Diffie-Hellman with RSA, AES 256 GCM and SHA-256 is going to be one of our cipher suites that we can choose. So it's a preconfigured set of these options.
What the client will do is it will send a list of the cipher suites that the client can support. So now the server has all the cipher suites that the client can handle, and the server is going to match that up with its own set of capabilities and choose probably the best, most secure way of communicating, and then communicate that back to the client and say, this is how we're going to communicate, this is the cipher suite that we're going to use.
Here's a packet that was captured going from a client to a server, and the client's telling the server what its capabilities are. So we see in here the different cipher suites it will support, a total of 16 suites, and we can see a list of them right here. If we want to look more deeply, let's just take a look at this one right here. This one right here is saying that it is capable of supporting, for a key exchange, the Diffie-Hellman. It's capable, for the authenticity or authentication piece, it supports RSA. It will use AES 256 GCM for that session cipher and encryption, and then for the integrity piece it's going to use the hashing algorithm of SHA-384.
One of the things that happens over time is that these cipher suites will change. They will discontinue the use of them because there's found some sort of security issues, or it has some sort of security concerns. So TLS 1.3 doesn't have all support for a lot of the different ciphers. As an example, Triple DES is one of those things that it's not going to support, because it's not considered one of the more secure methods of communication.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →