Cipher Suites

## What a cipher suite is A **cipher suite** is a named bundle of algorithm choices that both peers agree on once, during the handshake, and then use for the life of the connection. The client offers a list of them; the server picks one and echoes it back. On the wire a suite is a **two-octet code point** — the long underscore-separated token is only the human-readable label the registry gives that number, which is why the same suite looks like a word in a configuration file and like two bytes in a capture. In TLS 1.2 (`RFC 5246`) that label packs **four independent decisions** into one token, in a fixed order. Knowing the order is the whole skill: the token is positional, and an element read in the wrong position turns a hash into a cipher. ## Reading the token left to right For `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`: 1. **`TLS_`** — the namespace prefix every registered suite carries. 2. **`ECDHE`** — the **key exchange**: how the two sides arrive at a shared secret. `E` for ephemeral, so a fresh value per connection. 3. **`RSA`** — the **authentication**: the signature algorithm, and therefore the kind of key in the server's end-entity certificate, that proves the exchange was run by the party named in that certificate. 4. **`WITH_`** — the separator. Everything before it is about *agreeing and proving*; everything after it is about *protecting bytes*. 5. **`AES_128_CBC`** — the **bulk cipher**: algorithm, symmetric key length in bits, and mode of operation. 6. **`SHA256`** — the trailing **hash**. | Element | In this suite | Selects | |---|---|---| | Key exchange | `ECDHE` | How the shared secret is agreed | | Authentication | `RSA` | The signature that binds the exchange to the certificate | | Bulk cipher | `AES_128_CBC` | Algorithm, key size, mode for application data | | Hash | `SHA256` | The record MAC hash, or the pseudorandom function hash | ## The trailing hash does two different jobs This is where candidates slip. In a **CBC** suite the record's integrity comes from a separate **HMAC**, and the trailing element names the hash inside it. In an **AEAD** suite — one whose bulk cipher element ends in `GCM` or `CCM` — there is **no separate MAC element at all**, because the mode produces the authentication tag itself; the trailing hash instead names the hash the key-derivation pseudorandom function uses. So `..._AES_128_CBC_SHA256` and `..._AES_128_GCM_SHA256` end in the same four characters that mean two different things. A suite whose first element stands alone, with no second algorithm before `WITH_`, names one algorithm doing both jobs: the same key both transports the secret and authenticates the server, so there is nothing ephemeral in the exchange. ## What the token does not tell you - **Not the named group or curve.** `ECDHE` says the exchange is ephemeral elliptic-curve; *which* group is negotiated separately, in `supported_groups(10)`. - **Not which certificate will be presented.** `RSA` constrains the key type; the signature scheme actually used is negotiated in `signature_algorithms(13)`. - **Not the protocol version.** A suite is only valid for the versions it was registered for, and the negotiated version is decided before the suite is. - **Not how each record's nonce is built**, nor how many records one key may protect. ## Reading one off a commissioning record A fleet of fixed-function hospital pharmacy dispensing cabinets has its suite list written once at commissioning and read years later by someone auditing it who did not choose it. That reader's whole job is this decomposition: for every token on the list, is the exchange ephemeral, is the authentication element the key type the deployed certificate actually has, is the bulk cipher an authenticated mode, and is the trailing hash a MAC hash or a derivation hash? A list that looks uniform at a glance often is not — two entries can share a bulk cipher and differ in whether anything ephemeral happens at all, and that difference is invisible unless you read position by position. The practical habit: never quote a suite by its middle. Quote the whole token, because the token is only meaningful whole.