What cipher suites should I support in 2024?

TLS 1.3 suites only for new services: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256. For TLS 1.2 backward compatibility: ECDHE+AESGCM and ECDHE+CHACHA20 suites with SHA256 or SHA384.

What is forward secrecy and why does it matter?

Forward secrecy uses ephemeral session keys that are discarded after the session. Even if the server's long-term private key is later compromised, recorded past sessions cannot be decrypted. This is achieved using ECDHE or DHE key exchange.

TLS Cipher Analyzer | DevTools Surf

DevTools Surf

Example: TLS Cipher Analyzer

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

TLS_AES_128_GCM_SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
AES128-SHA
DES-CBC3-SHA

Output

═══ Summary ═══
Suites analysed: 5
Forward secrecy: 3 of 5
AEAD: 3 of 5
Profile: intermediate (keeps grade A and B)
Grades: A+×1  A×2  D×2
✗ 2 suites fall below the intermediate profile and should be removed.

═══ TLS_AES_128_GCM_SHA256 — grade A+ ═══
IANA name: TLS_AES_128_GCM_SHA256
OpenSSL name: TLS_AES_128_GCM_SHA256
Key exchange: TLS 1.3 — TLS 1.3 always negotiates an ephemeral (EC)DHE group separately from the cipher suite
Authentication: TLS 1.3 — the certificate and signature algorithm are negotiated separately from the cipher suite
Bulk cipher: AES128 (128-bit key)
Mode: GCM — AEAD — encryption and integrity in one pass, no separate MAC, immune to the padding-oracle family
MAC / PRF: SHA256 (hash used for the key schedule; integrity comes from the AEAD tag)
TLS versions: TLS 1.3 only
✓ Forward secrecy — each session gets a fresh ephemeral key.
✓ AEAD — encryption and integrity in a single construction.
✓ TLS 1.3 suite: forward secrecy and AEAD are mandatory, and the key exchange is negotiated separately.

═══ ECDHE-ECDSA-AES256-GCM-SHA384 — grade A ═══
IANA name: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
OpenSSL name: ECDHE-ECDSA-AES256-GCM-SHA384
Key exchange: ECDHE — ephemeral elliptic-curve Diffie-Hellman — a fresh key per connection, so past traffic stays safe if the server key leaks
Authentication: ECDSA — an ECDSA certificate signs the handshake — smaller and faster than RSA at the same strength
Bulk cipher: AES256 (256-bit key)
Mode: GCM — AEAD — encryption and integrity in one pass, no separate MAC, immune to the padding-oracle family
MAC / PRF: SHA384 (hash
…

About TLS Cipher Analyzer

TLS Cipher Analyzer preview - Security / Crypto tool

Grade cipher suites in either spelling and emit a config with the weak ones removed. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Audit a server's cipher suite configuration against current security recommendations before a compliance review.
Identify deprecated ciphers (RC4, DES, 3DES, MD5-based MACs) that should be disabled.
Verify that forward secrecy is enabled across all supported cipher suites.
Check TLS version support to confirm TLS 1.0/1.1 are disabled per PCI DSS 4.0 requirements.

Tips

Prioritize AEAD cipher suites (GCM, CCM, ChaCha20-Poly1305) — they provide authenticated encryption, making padding oracle attacks impossible.
Disable TLS 1.0 and 1.1 — both are deprecated by RFC 8996 (2021) and are required to be disabled for PCI DSS compliance.
Forward secrecy (PFS) cipher suites use ephemeral key exchange (ECDHE, DHE) — ensure these are prioritized over static RSA key exchange, which lacks forward secrecy.

Fun Facts

TLS 1.3, finalized in RFC 8446 (2018), removed support for cipher suites without forward secrecy and AEAD — making it the most secure TLS version by design. Adoption reached 60% of TLS connections by 2023.
The POODLE attack (2014) against SSL 3.0 and the BEAST attack (2011) against TLS 1.0 were the primary catalysts for deprecating these protocol versions — both exploited padding oracle vulnerabilities in CBC mode ciphers.
RC4, once the most widely used stream cipher in TLS, was formally prohibited in TLS by RFC 7465 (2015) after researchers demonstrated practical plaintext recovery attacks requiring only millions of connections.

FAQ

What cipher suites should I support in 2024?: TLS 1.3 suites only for new services: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256. For TLS 1.2 backward compatibility: ECDHE+AESGCM and ECDHE+CHACHA20 suites with SHA256 or SHA384.
What is forward secrecy and why does it matter?: Forward secrecy uses ephemeral session keys that are discarded after the session. Even if the server's long-term private key is later compromised, recorded past sessions cannot be decrypted. This is achieved using ECDHE or DHE key exchange.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder