Mapping OpenSSL Cipher Suite Names to Official Names and RFCs

OpenSSL, and a lot of software that uses it (httpd, nginx etc) have their own cipher suite names. To map from the OpenSSL cipher suite name, such as:

ECDHE-ECDSA-AES256-SHA384

1) Look up the ID

Use the OpenSSL ciphers(1) tool to look up the cryptographic suite selector code (2 hex values used to represent that cipher suite on the wire) for that suite name.

For example with the suite name above:

$ openssl ciphers -V | grep 'ECDHE-ECDSA-AES256-SHA384' | awk '{ print $1 }'

0xC0,0x24

3) Cross reference with IANA list

Look that ID up in the IANA list of TLS parameters.

For the ID above you can find it was defined in RFC5289, and has the name:

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

Notes

The ‘-V’ argument is only available with OpenSSL later than 1.0.0. Check your version with: openssl version
This mapping is also available in the OpenSSL ciphers(1) manual page. See: man ciphers. I prefer the cross referencing to IANA method above as you can easily find the RFC that introduced it.

More Detail On Cipher Suite Names

Official (RFC specified) cipher suite names follow the convention:

TLS_<key exchange and authentication algorithms>_WITH_<bulk cipher and message authentication algorithms>

For example TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 when broken down specifies a cipher suite combining the following:

ECDHE_ECDSA - Key exchange using the Elliptic curve Diffie-Hellman (ECDHE) protocol with authentication provided by Elliptic Curve Digital Signature Algorithm (ECDSA) keys.
AES_256_CBC - Encryption provided by the Advanced Encryption Standard algorithm using 256 bit keys and chained by TLS in cipher-block chaining mode (CBC).
SHA384 - Hash based message authentication code generated using the Secure Hash Algorithm 2 with 384 bits length of hash output.

OpenSSL can also help with this breakdown:

$ openssl ciphers -V | grep 'ECDHE-ECDSA-AES256-SHA384'

0xC0,0x24 - ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384

See the key exchange (kx), authentication (Au), encoding (Enc) and message authentication code (Mac) fields.