Cipher suite
A cipher suite is the specific combination of cryptographic algorithms a client and server agree to use for a TLS connection. TLS 1.3, defined in RFC 8446, simplified this: a cipher suite now names only an AEAD algorithm for protecting record data, such as AES-128-GCM, paired with a hash function used with HKDF for key derivation and handshake authentication, such as SHA-256, written together as TLS_AES_128_GCM_SHA256. This replaces TLS 1.2's longer names, which bundled a key-exchange and authentication method into the same string, since TLS 1.3 negotiates those separately. During the handshake, a client's ClientHello lists every cipher suite it supports, and the server's ServerHello picks one from that list; a server limited to outdated suites with known weaknesses exposes every connection to that weakness even when its certificate itself is completely valid.
By AdminKit team, Netbase JSC · Updated