For example (from openssl ciphers -v), for AES128, the output:

AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256

is given. Does Enc=AES(128) imply AES(128)-CBC? I am inclined to believe so as no mode is mentioned and the output from openssl list-cipher-algorithms shows AES128 => AES-128-CBC.

  • 2
    This is already answered here - you can get the modes of operation on the openssl man page
    – Joe
    May 4, 2018 at 15:47

1 Answer 1


Yes. The OpenSSL names are slightly different to the standard names. The man page here has the mapping:


In particular see this:

TLS_RSA_WITH_AES_128_CBC_SHA            AES128-SHA

So the OpenSSL name AES128-SHA corresponds to the standard ciphersuite using RSA and AES-128 in CBC mode.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .