Cipher Suites
Negotiate encryption.
Cipher Suites is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is a Cipher Suite?
A cipher suite is a named combination of cryptographic algorithms that a TLS connection uses together.
During the handshake, client and server negotiate which suite to use from a shared list.
Anatomy of a Suite Name
A TLS 1.2 suite name packs several algorithms together.
For example: ECDHE_RSA_WITH_AES_128_GCM_SHA256.
- ECDHE = key exchange
- RSA = authentication
- AES_128_GCM = bulk encryption
- SHA256 = message authentication / PRF
Key Exchange Component
The key exchange algorithm decides how the shared secret is established.
- ECDHE and DHE provide forward secrecy.
- Static RSA key exchange (old, removed in TLS 1.3) does not.
Authentication Component
The authentication algorithm proves the server's identity, tied to its certificate's key type.
- RSA certificates use RSA signatures.
- ECDSA certificates use elliptic-curve signatures, which are smaller and faster.
Bulk Encryption
The bulk cipher encrypts the actual application data.
- AES-GCM and ChaCha20-Poly1305 are modern AEAD ciphers.
- Older CBC modes are weaker and being phased out.
AEAD Ciphers
AEAD (Authenticated Encryption with Associated Data) ciphers like AES-GCM provide encryption and integrity in one step.
TLS 1.3 requires AEAD, eliminating a class of padding-related attacks from older modes.
TLS 1.3 Simplified Suites
TLS 1.3 cipher suites are much shorter because key exchange and authentication are negotiated separately.
Example: TLS_AES_128_GCM_SHA256 only names the bulk cipher and hash.
Listing Available Suites
You can list the cipher suites your OpenSSL build supports.
openssl ciphers -v 'HIGH:!aNULL:!MD5'Negotiation Order
The server usually picks the suite. With server cipher preference enabled, it chooses the strongest mutually supported suite rather than letting the client decide.
This prevents a client from steering toward weak crypto.
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';Choosing Secure Suites
Best practice for a secure configuration:
- Require forward secrecy (ECDHE/DHE).
- Use AEAD ciphers (GCM or ChaCha20).
- Disable RC4, 3DES, and CBC legacy ciphers.
- Prefer TLS 1.2 and 1.3 only.
Testing Your Configuration
Test what a server actually negotiates, including which suites it accepts or rejects.
nmap --script ssl-enum-ciphers -p 443 example.comQuick Check
In the suite ECDHE_RSA_WITH_AES_128_GCM_SHA256, which part provides forward secrecy?
Recap
You learned that a cipher suite bundles key exchange, authentication, bulk encryption, and a hash.
- ECDHE brings forward secrecy.
- AEAD ciphers like AES-GCM secure data and integrity together.
- TLS 1.3 uses simplified suite names.
Next, we focus on validating the server's certificate.
Frequently asked questions
Is the “Cipher Suites” lesson free?
Yes — the full text of “Cipher Suites” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Cipher Suites”?
Negotiate encryption. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Cipher Suites” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.