Cipher suite

A cipher suite is a named combination of cryptographic algorithms that a Transport Layer Security (TLS) session uses for key exchange, authentication, bulk encryption, and message authentication. A typical TLS 1.2 cipher suite such as TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 specifies ephemeral elliptic-curve Diffie-Hellman for key exchange, RSA for authentication, AES-256 in GCM mode for encryption, and SHA-384 for integrity. The negotiation of a cipher suite during the TLS handshake is a critical trust decision: the server and client must agree on algorithms that both support and that provide adequate security margins. The history of deprecated cipher suites — including those using MD5, SHA-1, or export-grade cryptography — demonstrates that algorithm agility is a necessary but dangerous feature of protocol design.