We also recommend AES-256 being preferred to AES-128 in Mozilla's modern configuration. From the rationale section: AES256-GCM is prioritized above its 128

We also recommend AES-256 being preferred to AES-128 in Mozilla's modern configuration. From the rationale section: AES256-GCM is prioritized above its 128 bits variant, and ChaCha20 because we assume that most modern devices support AESNI instructions and thus benefit from fast and constant time AES. https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_com...