I'm not sure what you mean by 'AES-256 _or_ AES-GCM' (since you can use 128 or 256 bit key sizes in either CBC or GCM mode), but the problem with GCM mode in ge

I'm not sure what you mean by 'AES-256 _or_ AES-GCM' (since you can use 128 or 256 bit key sizes in either CBC or GCM mode), but the problem with GCM mode in general is that no clients support it... I'm the web guy for Silent Circle. We run in-house analytics on our 'marketing' sites (we don't run any analytics (or even log remote IP addresses or user agents) on any site that a user can authenticate (and therefore identify themselves) to)(I'm not a Lisper... honest...). We recently upgraded the server that hosts the analytics to a sufficiently recent version of OpenSSL that it now supports TLS 1.1+ and GCM mode ciphers. I was curious how many connections actually used GCM ciphers, so I started logging the TLS version and cipher suite for each connection. I only did this a couple days ago, so I don't have a ton of data yet, but the short answer is... Almost no one supports GCM. GCM ciphers are highest priority in our cipher list (and server ciphers are preferred), and yet I've seen almost no GCM connections. Far and away the most common cipher suite is ECDHE-RSA-AES256-SHA (~75% of connections). Note: This is for our marketing sites, not the site our customers actually authenticate to, so the results might differ a bit when it comes to our actual customers...