A 'Cipher Suite' is not a single algorithm, but a bundle of four different cryptographic tools. When a client and server agree on a suite, they are agreeing on how to exchange keys, how to prove identity, how to encrypt data, and how to ensure integrity.
Take the common suite: `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`. It breaks down as follows: - **TLS**: The protocol. - **ECDHE**: The Key Exchange (Elliptic Curve Diffie-Hellman Ephemeral). - **RSA**: The Authentication (The server uses an RSA certificate). - **AES_128_GCM**: The Bulk Encryption (AES 128-bit in GCM mode). - **SHA256**: The MAC/Hashing algorithm for the PRF (Pseudo-Random Function).
Crucial: The 'RSA' in the middle of a suite refers to the **Certificate/Identity**, not the key exchange. If you see `TLS_RSA_WITH...`, that is the dangerous static RSA key exchange.
In the output above, the `TLS_RSA_WITH_AES_128_CBC_SHA` suite is flagged as weak because it uses static RSA for key exchange (no PFS) and CBC mode (padding oracles).
TLS 1.3 radically simplified cipher suites. Because it mandates Ephemeral DH and AEAD ciphers, the 'Key Exchange' and 'Authentication' parts were removed from the suite name. A TLS 1.3 suite looks like: `TLS_AES_256_GCM_SHA384`. It only specifies the symmetric cipher and the hash.
💡 By removing the complex combinations, TLS 1.3 eliminates the possibility of a administrator accidentally choosing a 'weak' combination of a strong cipher and a weak key exchange.
| Component | Secure Choice | Insecure Choice | Reason |
|---|---|---|---|
| Key Exchange | ECDHE / X25519 | Static RSA | Lack of Forward Secrecy |
| Authentication | ECDSA / RSA-PSS | RSA-PKCS1v1.5 | Vulnerable to padding attacks |
| Encryption | AES-GCM / ChaCha20 | AES-CBC | Padding Oracle Attacks |
| Hashing | SHA-256 / SHA-384 | SHA-1 / MD5 | Collision Vulnerabilities |
When hardening a server, the goal is to implement 'Cipher Suite Order'. The server should be configured to ignore the client's preference and always enforce the strongest mutually supported suite. This prevents 'Bidding Down' attacks.
Beware of 'Null' ciphers (`TLS_RSA_WITH_NULL_SHA`). These provide no encryption at all, sending data in plaintext while still performing a handshake. This is sometimes used for debugging but is catastrophic in production.
Verify exercises to earn ★ 170 XP and unlock next lab level.