When is AES chosen instead of a stream Cipher (e.g., RC4) during an SSL connection? During an SSL handshake, the browser sends a list of cipher suites to the server, from which the server selects one option. 

For data encryption, two of the several possibilities for the ciphers in this suite are AES (a block cipher) and RC4 (a stream cipher). 

I understand that AES would be a better choice for applications where all the data is available at once, permitting the use of large blocks. RC4 on the other hand is more suited for applications where  continuous data (that may not be available all at once) is to be encrypted (e.g., real-time data).

My question is: By the time the cipher suites are negotiated (the very first steps of the handshake),  the server is not yet aware of what kind of data the browser is going to ask for. For example, by this time, the server does not know whether the browser will be downloading some large file (suited for AES than RC4).

As a result, the server may select a poor cipher for the process. Can anyone give me some idea on how SSL handles this challenge (of choosing the optimal cipher for the task at hand)?
I understand that AES would be a better choice for applications where all the data is available at once, permitting the use of large blocks. RC4 on the other hand is more suited for applications where continuous data (that may not be available all at once) is to be encrypted (e.g., real-time data).


No, this is not accurate. The block size of AES is just 128 bits. It makes no difference with practical data sizes on the web, since at most you add 16 bytes to ciphertext size.

And anyway, many modes of operation, like GCM which is one of the more common choices with modern servers and browsers, turn AES into a stream cipher.