Cipher
A cipher is the algorithm that turns readable data into ciphertext and back again using a key. Network encryption today pairs the cipher with authentication, so the receiver can also tell whether anything was changed in transit. These combined algorithms are called AEAD ciphers, short for authenticated encryption with associated data.
Ciphers in Managed Nebula
Section titled “Ciphers in Managed Nebula”| Job | Algorithm |
|---|---|
| Encrypting traffic between hosts | AES-256-GCM |
| Agreeing on session keys | Curve25519 or NIST P-256 |
| Hashing during the handshake | SHA-256 |
| Signing certificates | Ed25519 or ECDSA P-256 |
Two hosts agree on fresh session keys during each handshake, then encrypt everything they send each other with AES-256-GCM. The session keys come from new ephemeral keys every time, so traffic recorded today can’t be decrypted later even if a host’s long-term key is stolen.
AES-256-GCM is fast because most current processors, including servers, laptops and the Raspberry Pi 5, have hardware instructions for AES. Encryption costs little CPU even at gigabit speeds. GCM also authenticates every packet, so a tampered packet is rejected rather than decrypted into garbage. It’s one of the most heavily studied ciphers in use.
Relays and the networks in between only ever see ciphertext. The Security page has more on how traffic and keys are protected.