cipher suite
termcryptographysecurity
The specific set of algorithms a TLS connection agrees to use for key exchange, encryption, and integrity.
A cipher suite names the combination, how keys are exchanged, which cipher encrypts the data, and how integrity is checked, that both sides settle on during the handshake. Which suites a server allows determines how strong and modern its connections are.
A cipher suite is the negotiated answer to four separate questions: how the two sides agree on a key, how the server proves its identity, how the bulk data is encrypted, and how integrity is checked. Reading one is a matter of knowing which part is which, and older suite names spell all four out in order, which is why they look intimidating and are actually self-describing.
TLS 1.3 changed the shape deliberately. Key exchange and authentication were pulled out of the suite name, leaving only the bulk cipher and hash, and the entire catalogue was cut to a handful of options. The reason was not elegance. Most protocol attacks of the previous decade exploited weak or obsolete choices that remained available for compatibility, so removing the choices removed the attacks.
In operations the practical work is deciding which suites to allow. Too permissive and you keep vulnerable options alive for clients that should have been upgraded years ago; too strict and you lock out real users on old devices. That trade is why cipher string syntax exists on load balancers and proxies, and why expanding a string into the actual resulting list before deploying it is worth the thirty seconds it takes.
Also known as: cipher-suite, ciphersuite