So my understanding of TLS is that it uses asymmetric cryptography such as DH to perform a key exchange, once this has occurred it then used an symmetric algorithm for the data exchange. (Obviously I am missing a lot of detail here and it may be slightly inaccurate but I think thats generally the high level idea?)

My question is once the key exchanged has taken place what symmetric algo is used? AES? Or is it implementation specific? Or developers preference???


My question is once the key exchanged has taken place what symmetric algo is used?

Well, that is negotiated between the client and the server (and that negotiation takes place along with the key exchange).

TLS 1.2 had a rather long list of symmetric algorithms that the client and server could choose from; in TLS 1.3, they trimmed it back significantly, currently the options are AES-GCM, ChaCha20/Poly1305 and AES-CCM.

  • $\begingroup$ Actually, the symmetric algorithm list is not that big, RC4,DES,3DES, IDEA, AES, Camellia, and ChaCha20. The cipher suits list are huge OpenSSL due to mode of operation and key exchange combinations, etc. $\endgroup$ – kelalaka Mar 2 at 21:15
  • 2
    $\begingroup$ @kelalaka: actually, in TLS 1.2, you also have RC2, SEED, SM4, ARIA, KUZNYECHIK, MAGMA, 28147 (whatever that is); at least, IANA has defined cipher suites assigned to them. In addition, you would need to include the MAC options (HMAC-MD5 vs HMAC-SHA1 vs HMAC-SHA256), as those are certainly symmetric algorithms. In addition, I would personally distinguish between AES-CBC and AES-GCM $\endgroup$ – poncho Mar 2 at 21:31
  • $\begingroup$ Yes, the IANA's suites. Whatever is the GHOST :) $\endgroup$ – kelalaka Mar 2 at 21:39
  • 1
    $\begingroup$ @kelalaka+ GOST (no H) is a set of formerly Soviet now Russian standards; GOST # is like ISO # or ANSI L# (US industry) or FIPS # (US govt) or DIN # or JIS # (Japan). (German). GOST 28147 is a block cipher $\endgroup$ – dave_thompson_085 Mar 3 at 4:27

The stream or block algorithm to use as cipher for keeping messages confidential is negotiated during the TLS handshake. It is part of the so called cipher suite. A list of cipher suites are send during the "Client Hello" message of the handshake, after which the server chooses one of them during the "Server Hello" initial message.

Nowadays they are generally used in an authenticated mode of operation such as AES-GCM (where AES is the block cipher and GCM mode defines how it is used and how the messages are authenticated) or ChaCha20/Poly1305 (where ChaCha20 is a stream cipher and Poly1305 indicates how the authentication tag is calculated).

It depends on the TLS protocol version what the cipher suite string looks like; for instance you'd have TLS_ECDHE_RSA_AES_256_GCM_SHA384 for TLS 1.2 and TLS_AES_256_GCM_SHA384 for TLS 1.3 for comparable operation. Note that in reality these cipher suites are indicated using two bytes in the handshake itself; the cipher suite strings are generally only used as constants in applications or as configuration options of applications.

Note that the AES_256 is obviously the same as AES-256, i.e. AES with a 256 bit key size (and 14 rounds of operation). Also note that OpenSSL unfortunately also allows their own cipher suite strings to identify the same cipher suites.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.