page_title: Cipher suite
section_title: TLS 1.0–1.2 handshake
hierarchical_section_title: Cipher suite / Full handshake: coordinating cipher suites / TLS 1.0–1.2 handshake
caption_attribution_description: English: Visual representation of how a client and server operating on TLS 1.3 coordinate on which cipher suite to use.
context_page_description: A cipher suite is a set of algorithms that help secure a network connection that uses Transport Layer Security or its now-deprecated predecessor Secure Socket Layer. The set of algorithms that cipher suites usually contain include: a key exchange algorithm, a bulk encryption algorithm, and a message authentication code algorithm.
  The key exchange algorithm is used to exchange a key between two devices. This key is used to encrypt and decrypt the messages being sent between two machines. The bulk encryption algorithm is used to encrypt the data being sent. The MAC algorithm provides data integrity checks to ensure that the data sent does not change in transit. In addition, cipher suites can include signatures and an authentication algorithm to help authenticate the server and or client.
  Overall, there are hundreds of different cipher suites that contain different combinations of these algorithms. Some cipher suites offer better security than others.
  The structure and use of the cipher suite concept are defined in the TLS standard document. TLS 1.2 is the most prevalent version of TLS. The next version of TLS includes additional requirements to cipher suites.
context_section_description: This client starts the process by sending a clientHello message to the server that includes the version of TLS being used and a list of cipher suites in the order of the client’s preference. In response, the server sends a serverHello message that includes the chosen cipher suite and the session ID. Next the server sends a digital certificate to verify its identity to the client. The server may also request a client’s digital certification if needed.
  If the client and server are not using pre-shared keys, the client then sends an encrypted message to the server that enables the client and the server to be able to compute which secret key will be used during exchanges.
  After successfully verifying the authentication of the server and, if needed, exchanging the secret key, the client sends a finished message to signal that it is done with the handshake process. After receiving this message, the server sends a finished message that confirms that the handshake is complete. Now the client and the server are in agreement on which cipher suite to use to communicate with each other.
caption: Visual representation of how a client and server operating on TLS 1.3 coordinate which cipher suite to use
exif: {}