I'm using Cloudflare flexible SSL for a website I made, and after investigating certificate properties, I realized different authentication mechanisms are being used.
Chrome 45 for Windows desktop
Chrome 45 for Android
Now, I know that a SSL/TSL session is established by a handshake between server and client - the result of which is the best cipher available.
The thing is, at least according to Cloudflare(https://blog.cloudflare.com/do-the-chacha-better-mobile-performance-with-cryptography/), ChaCha seems to be better than AES, so my question is: why isn't Chrome for desktop also choosing ChaCha instead of AES?
I know I already saw ChaCha encryption in action on Chrome for desktop as well, and I remember Google used it for their sites as well.
Now, I'm not saying that in real life, when it comes to security, AES is better than ChaCha, I'm just curious.
This is a particularly interesting paragraph from Cloudflare article I previously linked:
The new cipher suites we have added include a new symmetric cipher used for the encryption of data (based on the ChaCha20 and Poly1305 algorithms). There are no secure encryption algorithms optimized for mobile browsers and APIs in TLS right now—these new ciphers fill that gap.
So, encryption for mobile browsers isn't asymmetric, but still, as you can see in my Android screenshot, Chrome says that ECDHE_RSA is being used as key exchange mechanism. Odd.