# What is the last value in a cipher suite?

I understand that a cipher suite should contain the MAC algorithm at the end.

So ECDHE-RSA-AES128-SHA256 should use SHA256 in HMAC for the MAC.

But what about the PRF? From the RFC this is what I understand: new cipher suites need to include the PRF at the end. The only "new" cipher suites I can think of is AES-GCM: ECDHE-ECDSA-AES128-GCM-SHA256 and here if I understand correctly, since no MAC is used SHA256 refers to the PRF p_SHA256?

I'm confused

• Yes, although there is no such thing as HMAC_256. There is only HMAC_SHA256. HMAC requires a specific hash (you could for instance also construct HMAC_SHA3_256 although the HMAC construction isn't really required for SHA-3. In other words, the hash is the configuration parameter, not the output size. – Maarten Bodewes Mar 7 '16 at 20:43