Advanced › Module 7 › Lesson 2
Cipher Suites
Cipher suite literacy — AEAD preference, deprecated algorithms, TLS 1.3 suites — read negotiated suite on example.com.
Visual · t28_cipher_suites
Cipher suites = named algorithm tuples. Defender hygiene. $CRYPTO_LAB. Original Cyberlium.
Opening
The negotiated cipher suite is the crypto contract — name strong vs deprecated choices on YOUR lab read, never weaponize weak suites on production.
Cipher suite literacy: naming (TLS_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256), key exchange (ECDHE forward secrecy), bulk cipher (AES-GCM AEAD), hash/MAC role in TLS 1.2 vs KDF in 1.3, deprecated entries (RC4, 3DES, export suites, NULL encryption). Defenders harden server configs — analysts read openssl s_client cipher line on example.com or $CRYPTO_LAB server. Cyberlium teaches preference order and hygiene — NOT BEAST/POODLE exploit reproduction on production, NOT downgrading stranger sites. Lab row: five suite components (KEX, auth, bulk, integrity, PRF/KDF) with one deprecated example each.
1. Suite anatomy
Key exchange + authentication + bulk cipher + integrity — four tuple literacy for TLS 1.2 class.
TLS 1.3 uses AEAD suites with simplified negotiation — note in output.
Command guide
Try these commands — Suite anatomy
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
TLS cipher suites — https://www.rfc-editor.org/rfc/rfc8446#section-9.1 NIST TLS guidance — https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines Let's Encrypt — https://letsencrypt.org/docs/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates
cat > "$CRYPTO_LAB/notes/tls-handshake-literacy.txt" <<'EOF'
TLS handshake literacy (example.com public host):
1. ClientHello — SNI, cipher suites, supported groups
2. ServerHello + certificate chain
3. Key exchange → encrypted application data
lab: s_client output review — never intercept stranger HTTPS
EOFCommand — copy this
grep -E 'ClientHello|never intercept' "$CRYPTO_LAB/notes/tls-handshake-literacy.txt"
Primary tools to practice this lesson: openssl, grep. Reference sites: TLS cipher suites (https://www.rfc-editor.org/rfc/rfc8446#section-9.1); NIST TLS guidance (https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines); Let's Encrypt (https://letsencrypt.org/docs/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Hygiene priorities
Prefer ECDHE + AEAD (GCM/ChaCha20-Poly1305); disable RC4/3DES/export/NULL.
Forward secrecy requires ephemeral key exchange — document in server review rows.
3. Refused
No live downgrade/BEAST/POODLE drills on production without written RoE.
Suite literacy supports config hardening — not unauthorized attack scripts.
4. What you ship: cipher suite hygiene table
Five components + deprecated examples + AEAD preference note + scope line.
5. What you record before the next lesson
Cipher suite hygiene table path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run POODLE script against production site without authorization.
Right
Cipher suite hygiene table from example.com read. Next: Cert Pin Hygiene.
Mission: cipher suite hygiene table
1) Name four suite components. 2) List three deprecated algorithms. 3) One AEAD preference note. 4) Write NEVER prod downgrade line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ECDHE — why forward secrecy?”
Knowledge Check
APPLY: Modern hygiene prefers:
Multiple choice
Knowledge Check
APPLY: True or False: POODLE on production without RoE is lab.
True or False
Knowledge Check
APPLY: Forward secrecy requires:
Multiple choice