Work out cipher suite strength instantly with clear inputs, formula shown and shareable results.
A cipher suite is judged on three axes: the symmetric key size, whether the mode is authenticated encryption, and whether the key exchange is ephemeral. AEAD modes such as GCM and ChaCha20-Poly1305 remove the padding-oracle and MAC-then-encrypt classes of flaw that plague CBC, while ECDHE ensures a stolen server key cannot decrypt recorded traffic. 3DES additionally has a 64-bit block, limiting safe data to tens of megabytes per key.
Suite scoring
score = 45 x (symmetric bits / 256) + 30 if AEAD + 25 if forward secret; 3DES capped for its 64-bit block size
Only where policy or long-term quantum margin demands it. AES-128 has no practical attack, and on hardware without AES-NI the difference in throughput is noticeable.
On devices without AES hardware acceleration, where it is substantially faster and has more consistent timing behaviour than software AES.