SSL ciphers – pros and cons

Cipher Suite	Current Usage	Pros	Cons
AES-128-GCM	Widely used	Modern cipher with good performance and security	Not as strong as AES-256-GCM
AES-256-GCM	Recommended for most websites	Strongest cipher available, providing maximum protection against brute-force attacks	May have slower performance than AES-128-GCM on older devices
ECDHE-ECDSA-AES128-GCM-SHA256	Considered secure and efficient	Uses elliptical curve cryptography (ECC) for faster key exchange and smaller key sizes	Not as widely supported as other ciphers
ECDHE-ECDSA-AES256-GCM-SHA384	Considered the most secure cipher	Combines the strength of AES-256 with the efficiency of ECC	May have slower performance than other ciphers
ECDHE-RSA-AES128-GCM-SHA256	Still used but considered less secure	Uses RSA for key exchange, which is slower than ECC	Not as strong as ECC-based ciphers
ECDHE-RSA-AES256-GCM-SHA384	Still used but considered less secure	Combines RSA with AES-256 for security, but RSA is slower	Not as strong as ECC-based ciphers
DHE-RSA-AES128-GCM-SHA256	Considered less secure and deprecated by some browsers	Uses Diffie-Hellman key exchange (DHE), which is less secure than ECDHE	Not as strong as ECC-based ciphers
DHE-RSA-AES256-GCM-SHA384	Considered less secure and deprecated by some browsers	Combines DHE with AES-256 for security, but DHE is less secure	Not as strong as ECC-based ciphers
RC4	Deprecated and should not be used	Old and insecure cipher	Susceptible to various attacks, including the FREAK attack
3DES	Still used but considered less secure	Older cipher with longer key sizes	Not as strong as modern ciphers like AES

drive_spreadsheetExport to Sheets

Recommendations

For the most secure connections, it is recommended to use cipher suites with the following characteristics:

• Use the stronger versions of AES, such as AES-256-GCM.
• Use ECC-based cipher suites like ECDHE-ECDSA-AES256-GCM-SHA384.
• Avoid using deprecated ciphers like DHE-RSA and RC4.

Additional Considerations

• The specific ciphers that are supported and preferred by web browsers and servers can vary. It is important to check the latest recommendations for the most secure configurations.
• The performance of different ciphers can also vary depending on the capabilities of the server, client, and network. It is important to choose ciphers that provide a balance between security and performance.
• It is also important to consider compatibility when choosing ciphers. Some older devices may not support the strongest ciphers.

By carefully selecting the appropriate cipher suites, website owners can ensure that their users are protected from the latest security threats and enjoy secure and private online communications.