I have two questions;

  1. I need an explanation for the differences of below two cipher suites.
  2. How do they work with SSL/TLS protocol? (my main concern first one doesn't have 'ecdhe_rsa' part )



  • 1
    $\begingroup$ What product are you using that supports those cipher suites? $\endgroup$ – Artjom B. Oct 6 '18 at 14:31
  • $\begingroup$ @ArtjomB. i examine those two when connect to two web site $\endgroup$ – uma Oct 6 '18 at 14:32
  • 2
    $\begingroup$ I guess the first one is for TLS 1.3 0-RTT. $\endgroup$ – Artjom B. Oct 6 '18 at 14:33
  • 1
    $\begingroup$ That's a pretty good guess :) $\endgroup$ – Maarten Bodewes Oct 6 '18 at 14:40

The difference is that tls_aes_128_gcm_sha256 is TLS 1.3 and tls_ecdhe_rsa_with_aes_128_gcm_sha256 is used for the older TLS 1.2. The first cipher suite doesn't specify the key agreement algorithm and the authentication mechanism. Those are likely used, but they are specified / configured elsewhere in the TLS handshake.

TLS 1.3 is basically TLS-done-right; the two protocols aren't compatible, even if the last part of the cipher suite matches. It can however use the same key agreement and authentication mechanisms (and thus the same server certificate and key).

To quote OpenSSL:

SSL_CTX_set_ciphersuites() is used to configure the available TLSv1.3 cipher suites for ctx. This is a simple colon (":") separated list of TLSv1.3 cipher suite names in order of preference. Valid TLSv1.3 cipher suite names are:


OK, so we're talking TLS 1.3 here, let's look there:

Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined differently, only specifying the symmetric ciphers, and cannot be used for TLS 1.2. Similarly, cipher suites for TLS 1.2 and lower cannot be used with TLS 1.3.

So we have two cipher suites that are largely identical to the message encryption / authentication used. However, one is for TLS 1.2 and also specifies the key agreement and the other is specific to TLS 1.3 and only specifies the message encryption / authentication.

For TLS 1.3 the reason why the other components are not specified is that they are negotiated during the handshake. This makes TLS 1.3 more flexible as it doesn't seem to specify all possible combinations in the cipher suite. However, you should remind yourself that the cipher suite is far from the only configuration parameter.

From TLS 1.3, section 4.1.1, Cryptographic Negotiation:


In TLS, the cryptographic negotiation proceeds by the client offering the following four sets of options in its ClientHello:

  • A list of cipher suites which indicates the AEAD algorithm/HKDF hash pairs which the client supports.

  • A "supported_groups" (Section 4.2.7) extension which indicates the (EC)DHE groups which the client supports and a "key_share" (Section 4.2.8) extension which contains (EC)DHE shares for some or all of these groups.

  • A "signature_algorithms" (Section 4.2.3) extension which indicates the signature algorithms which the client can accept. A "signature_algorithms_cert" extension (Section 4.2.3) may also be added to indicate certificate-specific signature algorithms.


so basically the ECDHE option is now in supported_groups (DH is required for TLS 1.3) and RSA is in signature_algorithms, if present.

Short explanation of the components in the cipher suite:

  • tls : the protocol;
  • ecdhe : ephemeral-ephemeral elliptic curve diffie hellman for key agreement, which brings forward security;
  • rsa : signature algorithm when certificate authentication is used (for the server);
  • aes-128-gcm : block cipher & cipher mode to keep the messages confidential & authenticated;
  • sha256 : hash algorithm used for the PRF (used for key derivation).

Note that TLS 1.3 uses HKDF instead of a proprietary HMAC based mechanism in TLS 1.2 for the PRF. So although the TLS 1.2 and 1.3 cipher suites you mention may use the same primitives, the protocols differ somewhat (as explained in the initial section of this answer).

  • $\begingroup$ If I've understood correctly, the GCM in tls_ecdhe_rsa_with_aes_128_gcm_sha256 is encryption mode (e.g. it could be CBC) but it's true that GCM encryption mode is part of family called authenticated encryption algoritm. For more details, see en.wikipedia.org/wiki/Galois/Counter_Mode $\endgroup$ – Mikko Rantalainen Sep 19 '19 at 13:47
  • $\begingroup$ That was truly not that clear, so I changed the description of AES and GCM, thanks. $\endgroup$ – Maarten Bodewes Sep 21 '19 at 0:16
  1. tls_aes_128_gcm_sha256

    1. TLS: protocol
    2. Authenticated Encryption with Associated Data (AEAD) cipher mode : AES with 128 key GCM.
    3. Hashed Message Authentication Code (HMAC)-based key derivation function (HKDF), HKDF algorithm SHA256;
  2. tls_ecdhe_rsa_with_aes_128_gcm_sha256

    1. TLS: protocol
    2. Key Exchange: ECDHE :
    3. Authentication : RSA
    4. AEAD Cipher Mode: AES_128_GCM
    5. PRF Hash Algorithm : SHA256

As far as I know, DHE-RSA is Diffie Hellman with RSA signature. ECDH is Elliptic-curve Diffie–Hellman


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.