A Beginner’s Guide to TLS Cipher Suites

If you have a website, you likely have an SSL certificate (if you don’t, be sure to remedy that immediately). You probably know what an SSL does in a broad sense. Using the TLS (Transport Layer Security) protocol, SSL certificates ensure that the connection between your site and a user’s browser is secure and cannot be compromised by any third party. This is known as encryption. It’s less likely that you know what happens behind the scenes when an SSL certificate creates this connection. 

That’s why today, we’re going to focus on a key aspect of the encryption process — cipher suites. By the end of this article, you should have a better idea of how SSL certificates work in relation to ciphers and cipher suites. 

Read on to learn more!

What is a cipher suite?

Before we dive into cipher suites, we should take a moment to explain what a cipher is. In cryptography, a cipher is an algorithm that lays out the general principles of securing a network through TLS (the security protocol used by modern SSL certificates). A cipher suite comprises several ciphers working together, each having a different cryptographic function, such as key generation and authentication. 

While the acts of encryption and decryption themselves are performed by keys, cipher suites outline the set of steps that the keys must follow to do so and the order in which these steps are executed. There are numerous cipher suites out there, each one with varying instructions on the encryption and decryption process. The cipher suites used are dictated by the version of TLS that’s configured on your server (we’ll talk more about that in a little bit).

So what exactly does a cipher suite look like in action? As you may already know, when someone visits a website with an SSL, their browser will connect to the server where the website is hosted to form an encrypted connection. This connection is negotiated through a process known as the SSL handshake. Cipher suites play an integral role in the handshake process.

Cipher suites and the SSL/TLS handshake

We won’t be delving too deeply into the finer details of the TLS handshake as it’s a very complicated, technical process. In the most simple terms, it’s a series of messages exchanged between the browser (client) and website (server) wherein the server’s public key and SSL certificate is authenticated, culminating in the creation of a session key, which is what encrypts the connection between the client and the server.

Cipher suites dictate how the entire process plays out. The client sends the server a list of the cipher suites it supports, and the server will choose a mutually supported cipher suite that it deems most secure. Depending on the version of TLS being used, this may happen before the handshake or in the very first step. 

A closer look at what makes up a cipher suite

As we mentioned earlier, a cipher suite looks different depending on which version of the TLS protocol is being used. The current standards are TLS 1.2 and 1.3. While 1.3 is the newer and more secure version, 1.2 is still widely used. The difference between these two versions is evident from the number of Ciphers they use and the length of their cipher suites. There are 37 ciphers for TLS 1.2, while TLS 1.3 only has five. Take a look at these two cipher suite examples:

• TLS 1.2 cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS 1.3 cipher suite: TLS_AES_256_GCM_SHA384

As you can see, the TLS 1.3 suite is a lot shorter, but why is that better? To explain, let’s go through what some of those letters and numbers mean. 

In TLS 1.2, a cipher suite is made up of four ciphers: 

1. A key exchange algorithm: This is represented by ECDHE (Elliptic Curve Diffie Hellman) in the example above. This outlines how keys will be exchanged by the client and the server. Other key exchange algorithms include RSA and DH.
2. An authentication algorithm: This is represented by ECDSA (Elliptic Curve Digital Signature Algorithm) in the example above. It is a digital signature that shows the type of certificate and helps the client verify that the website’s SSL is legitimate. Other authentication algorithms include RSA and DSA.
3. Bulk Data Encryption: This cipher ensures that data is transferred between the client and server securely. It’s represented by AES_256_GCM in the example above. 
4. A message authentication code (MAC) algorithm: This is represented by SHA384 in the example above. This is a hashing algorithm that both authenticates messages and ensures data integrity.

In comparison, a TLS 1.3 cipher suite only has two ciphers: Bulk data encryption and the MAC algorithm. How is it more secure if it uses two rather than four? It’s because there’s no need to display the type of key exchange algorithm and, by extension, authentication algorithm, as there is only one accepted type of key exchange algorithm, which is the ephemeral Diffie-Hellman method.

This cuts down the number of messages exchanged during the TLS handshake from two round trips in TLS 1.2 to one round trip in 1.3, simplifying the entire process. In addition, the 37 cipher suites supported by TLS 1.2 can vary in quality, with some being weaker than others. TLS 1.3 cipher suites are more robust in comparison. All in all, this adds up to reduced latency and faster, more secure connections.

Can you choose your preferred cipher suites?

Yes, you can. To do this, you will need to have access to your server settings. Contrary to common belief, the version of TLS used is not dictated by the SSL certificate you use, but your server configurations. The cipher suites you can choose are dependent on which TLS version is enabled on your server. You can check which TLS protocol and cipher suites are supported on your server by using this free online service.

You can change your cipher suites with the help of this handy tool from Mozilla. It shows templates of server configurations that will help you more easily edit the configuration of your domain’s Virtual Host. You just need to choose your server from the list of options and the security level you would like (modern, intermediate, or old). You will be given an example of the Virtual Host setting you can use to edit the configurations.

Wrap up

While this has been a very basic overview of cipher suites and what they do, hopefully you come away with a better understanding of the TLS protocol and the website encryption process. To ensure your website uses the most up-to-date cipher suites, ensure that your server supports TLS 1.3 and update the configurations to your preferred cipher suites.