Definition
A cipher suite is a named combination of cryptographic primitives. A typical TLS 1.2 cipher suite name like 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384' encodes four choices: ECDHE for key exchange, RSA for server authentication, AES-256-GCM as the bulk cipher and authenticator, and SHA-384 for the pseudorandom function used during the handshake. TLS 1.3 simplified this by separating key exchange and signature algorithms from the bulk-cipher portion of the suite name.
Why Bundling Matters
The security of a connection is only as strong as its weakest primitive. A fast modern cipher paired with a broken hash function creates a system that an attacker can defeat by attacking the hash. By naming entire suites, protocol designers force administrators to enable or disable known-good combinations as a unit, rather than mixing and matching components in possibly insecure ways.
VPN Practice
OpenVPN, IKEv2, and TLS-based VPNs all negotiate cipher suites at the start of every session. WireGuard takes a different approach: it does not negotiate at all. It hard-codes a single suite (Curve25519, ChaCha20-Poly1305, BLAKE2s, HKDF) and updates the suite by releasing a new protocol version. This eliminates downgrade attacks and configuration mistakes at the cost of flexibility.