AES128-GCM-SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
AES128-GCM-SHA256 (RSA key exchange) uses static RSA to encrypt the session key. There is no forward secrecy – if the server's RSA private key is ever compromised, all past sessions can be decrypted. This cipher suite should be disabled in favor of ECDHE variants. It is weak due to the lack of forward secrecy.
Key Exchange
RSA
Authentication
RSA
Encryption
AES-128-GCM
MAC / Integrity
SHA-256 (AEAD – integrated)
Details
Static RSA key exchange encrypts the session key with the server's RSA public key. If the private key is compromised (certificate revocation, server breach, legal compulsion), an attacker who captured the encrypted traffic can decrypt all past sessions. ECDHE is the solution – each session uses an ephemeral key that is discarded after use. TLS 1.3 removed static RSA key exchange entirely for this reason.