Look at this cipher: ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD

It uses AES-GCM for encryption and data origin authentication (according to RFC-5288), so no separate MAC is required. That is why OpenSSL reports it uses AEAD (Authenticated Encryption) for message authentication.

My question is: what does SHA256 mean here? Why do I need hash function if my MAC is already implemented as part of ENC?


1 Answer 1


The hash is used as part of the PRF, i.e. the function used to expand the shared secret (from the key exchange) into the encryption keys. After the handshake, it is no longer used.

  • Thanks. So, meaning of hash part of cipher suite depends on cipher, am I right? In ancient `` RC4-MD5`` MD5 is used for HMAC since RC4 is not AEAD, correct?
    – user996142
    Feb 24, 2016 at 12:44
  • 1
    Yes. Also, you may consider the AES-CCM cipher suites, distinct from GCM, and defined in RFC 6655. The symbolic name does not define a hash function at all (e.g. "TLS_DHE_PSK_WITH_AES_128_CCM") and yet a hash function is used for the PRF (it is SHA-256, specified at the end of section 3 of RFC 6655). Feb 24, 2016 at 14:32

Not the answer you're looking for? Browse other questions tagged .