be used with either the Counter Mode (CTR) for low bandwidth traffic or the Galois/Counter Mode (GCM) mode of operation for high bandwidth traffic (see Block cipher modes of operation) — symmetric encryption Elliptic Curve Digital Signature Algorithm (ECDSA) — digital signatures Elliptic Curve Diffie–Hellman (ECDH) — key agreement Secure Hash Algorithm 2 (SHA-256 and SHA-384) — message digest Per CNSSP-15, the 256-bit elliptic curve (specified in FIPS 186-2), SHA-256, and AES with 128-bit keys are sufficient for protecting classified information up to the Secret level, while the 384-bit elliptic curve (specified in FIPS 186-2), SHA-384, and AES with 256-bit keys are necessary for the protection of Top Secret information. Certifications Note that certain certifications have received serious negative criticism from people who are actually involved in them. Key exchange algorithms (certificate-only) This section lists the certificate verification functionality available in the various implementations. Key exchange algorithms (alternative key-exchanges) Certificate verification methods Encryption algorithms Notes Obsolete algorithms Notes Supported elliptic curves This section lists the supported elliptic curves by each implementation. Defined curves in RFC 8446 (for TLS 1.3) and RFC 8422, 7027 (for TLS 1.2 and earlier) Proposed curves Deprecated curves in RFC 8422 Notes Data integrity Compression Note the CRIME security exploit takes advantage of TLS compression, so conservative implementations do not enable compression at the TLS level. HTTP compression is unrelated and unaffected by this exploit, but is exploited by the related BREACH attack. Extensions In this section the extensions each implementation supports are listed. Note that the Secure Renegotiation extension is critical for HTTPS client security . TLS clients not implementing it are vulnerable to attacks, irrespective of whether the client implements TLS renegotiation. Assisted cryptography This section lists the known ability of an implementation to take advantage of CPU instruction sets that optimize encryption, or utilize system specific devices that allow access to underlying cryptographic hardware for acceleration or for data separation. System-specific backends This section lists the ability of an implementation to take advantage of the available operating system specific backends, or even the backends provided by another implementation. Cryptographic module/token support Code dependencies Development environment API Portability concerns See also SCTP — with DTLS support DCCP — with DTLS support SRTP — with DTLS support (DTLS-SRTP) and Secure Real-Time Transport Control Protocol (SRTCP) References Cryptographic software TLS implementations