Merge branch 'maint'

Conflicts:
	lib/ssl/src/ssl_cipher.erl

15 files changed, 1856 insertions, 2047 deletions

diff --git a/lib/ssl/src/Makefile b/lib/ssl/src/Makefile
index 1db18d4e5a..f96a3032ce 100644
--- a/lib/ssl/src/Makefile
+++ b/lib/ssl/src/Makefile
@@ -44,8 +44,6 @@ BEHAVIOUR_MODULES= \
 
 MODULES= \
 	ssl \
-	tls \
-	dtls \
 	ssl_alert \
 	ssl_app \
 	ssl_sup \
@@ -64,6 +62,7 @@ MODULES= \
 	ssl_certificate\
 	ssl_pkix_db\
 	ssl_cipher \
+	ssl_cipher_format \
 	ssl_srp_primes \
 	tls_connection \
 	dtls_connection \
diff --git a/lib/ssl/src/dtls.erl b/lib/ssl/src/dtls.erl
deleted file mode 100644
index cd705152a8..0000000000
--- a/lib/ssl/src/dtls.erl
+++ /dev/null
@@ -1,113 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 1999-2016. All Rights Reserved.
-%%
-%% Licensed under the Apache License, Version 2.0 (the "License");
-%% you may not use this file except in compliance with the License.
-%% You may obtain a copy of the License at
-%%
-%%     http://www.apache.org/licenses/LICENSE-2.0
-%%
-%% Unless required by applicable law or agreed to in writing, software
-%% distributed under the License is distributed on an "AS IS" BASIS,
-%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-%% See the License for the specific language governing permissions and
-%% limitations under the License.
-%%
-%% %CopyrightEnd%
-%%
-
-%%
-
-%%% Purpose : Reflect DTLS specific API options (fairly simple wrapper at the moment)
-%% First implementation will support DTLS connections only in a "TLS/TCP like way"
-
--module(dtls).
-
--include("ssl_api.hrl").
--include("ssl_internal.hrl").
-
--export([connect/2, connect/3, listen/2, accept/1, accept/2,
-	 handshake/1, handshake/2, handshake/3]).
-
-%%--------------------------------------------------------------------
-%%
-%% Description: Connect to a DTLS server.
-%%--------------------------------------------------------------------
-
--spec connect(host() | port(), [connect_option()]) -> {ok, #sslsocket{}} |
-					      {error, reason()}.
-
-connect(Socket, Options) when is_port(Socket) ->
-    connect(Socket, Options, infinity).
-
--spec connect(host() | port(), [connect_option()] | inet:port_number(),
-	      timeout() | list()) ->
-		     {ok, #sslsocket{}} | {error, reason()}.
-
-connect(Socket, SslOptions, Timeout)  when is_port(Socket) ->
-    DTLSOpts = [{protocol, dtls} | SslOptions],
-    ssl:connect(Socket, DTLSOpts, Timeout);
-connect(Host, Port, Options) ->
-    connect(Host, Port, Options, infinity).
-
--spec connect(host() | port(), inet:port_number(), list(), timeout()) ->
-		     {ok, #sslsocket{}} | {error, reason()}.
-
-connect(Host, Port, Options, Timeout) ->
-    DTLSOpts = [{protocol, dtls} | Options],
-    ssl:connect(Host, Port, DTLSOpts, Timeout).
-
-%%--------------------------------------------------------------------
--spec listen(inet:port_number(), [listen_option()]) ->{ok, #sslsocket{}} | {error, reason()}.
-
-%%
-%% Description: Creates an ssl listen socket.
-%%--------------------------------------------------------------------
-listen(Port, Options) ->
-    DTLSOpts = [{protocol, dtls} | Options],
-    ssl:listen(Port, DTLSOpts).
-
-%%--------------------------------------------------------------------
-%%
-%% Description: Performs transport accept on an ssl listen socket
-%%--------------------------------------------------------------------
--spec accept(#sslsocket{}) -> {ok, #sslsocket{}} |
-					{error, reason()}.
-accept(ListenSocket) ->
-    accept(ListenSocket, infinity).
-
--spec accept(#sslsocket{}, timeout()) -> {ok, #sslsocket{}} |
-						   {error, reason()}.
-accept(Socket, Timeout) ->
-    ssl:transport_accept(Socket, Timeout).
-
-%%--------------------------------------------------------------------
-%%
-%% Description: Performs accept on an ssl listen socket. e.i. performs
-%%              ssl handshake.
-%%--------------------------------------------------------------------
-
--spec handshake(#sslsocket{}) -> ok | {error, reason()}.
-
-handshake(ListenSocket) ->
-    handshake(ListenSocket, infinity).
-
-
--spec handshake(#sslsocket{} | port(), timeout()| [ssl_option()
-						    | transport_option()]) ->
-			ok | {ok, #sslsocket{}} | {error, reason()}.
-
-handshake(#sslsocket{} = Socket, Timeout) ->
-    ssl:ssl_accept(Socket, Timeout);
-
-handshake(ListenSocket, SslOptions)  when is_port(ListenSocket) ->
-    handshake(ListenSocket, SslOptions, infinity).
-
-
--spec handshake(port(), [ssl_option()| transport_option()], timeout()) ->
-			{ok, #sslsocket{}} | {error, reason()}.
-
-handshake(Socket, SslOptions, Timeout) when is_port(Socket) ->
-    ssl:ssl_accept(Socket, SslOptions, Timeout).
diff --git a/lib/ssl/src/dtls_handshake.erl b/lib/ssl/src/dtls_handshake.erl
index 35c213a182..3f70eaec8a 100644
--- a/lib/ssl/src/dtls_handshake.erl
+++ b/lib/ssl/src/dtls_handshake.erl
@@ -194,7 +194,7 @@ handle_client_hello(Version,
 		no_suite ->
 		    ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY);
 		_ ->
-		    #{key_exchange := KeyExAlg} = ssl_cipher:suite_definition(CipherSuite),
+		    #{key_exchange := KeyExAlg} = ssl_cipher_format:suite_definition(CipherSuite),
 		    case ssl_handshake:select_hashsign(ClientHashSigns, Cert, KeyExAlg, 
 						       SupportedHashSigns, TLSVersion) of
 			#alert{} = Alert ->
diff --git a/lib/ssl/src/dtls_v1.erl b/lib/ssl/src/dtls_v1.erl
index df687f579b..b365961a6a 100644
--- a/lib/ssl/src/dtls_v1.erl
+++ b/lib/ssl/src/dtls_v1.erl
@@ -27,22 +27,22 @@
 
 -define(COOKIE_BASE_TIMEOUT, 30000).
 
--spec suites(Minor:: 253|255) -> [ssl_cipher:cipher_suite()].
+-spec suites(Minor:: 253|255) -> [ssl_cipher_format:cipher_suite()].
 
 suites(Minor) ->
     lists:filter(fun(Cipher) -> 
-                         is_acceptable_cipher(ssl_cipher:suite_definition(Cipher)) 
+                         is_acceptable_cipher(ssl_cipher_format:suite_definition(Cipher)) 
                  end,
                  tls_v1:suites(corresponding_minor_tls_version(Minor))).
 all_suites(Version) ->
     lists:filter(fun(Cipher) -> 
-                         is_acceptable_cipher(ssl_cipher:suite_definition(Cipher)) 
+                         is_acceptable_cipher(ssl_cipher_format:suite_definition(Cipher)) 
                  end,
                  ssl_cipher:all_suites(corresponding_tls_version(Version))).
 
 anonymous_suites(Version) ->
     lists:filter(fun(Cipher) -> 
-                         is_acceptable_cipher(ssl_cipher:suite_definition(Cipher)) 
+                         is_acceptable_cipher(ssl_cipher_format:suite_definition(Cipher)) 
                  end, 
                  ssl_cipher:anonymous_suites(corresponding_tls_version(Version))).
                  
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index 9679ea4687..a98fda7abd 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -21,8 +21,6 @@
 	       dtls_listener_sup,
 	       %% API
 	       ssl,  %% Main API		  
-	       tls,  %% TLS specific
-	       dtls, %% DTLS specific 
 	       ssl_session_cache_api,
 	       %% Both TLS/SSL and DTLS
 	       ssl_config,
@@ -30,6 +28,7 @@
 	       ssl_handshake,
 	       ssl_record,
 	       ssl_cipher,
+               ssl_cipher_format,
 	       ssl_srp_primes,
 	       ssl_alert,
 	       ssl_listen_tracker_sup, %% may be used by DTLS over SCTP	
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 09953908ce..84551fb10b 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -448,29 +448,29 @@ negotiated_protocol(#sslsocket{pid = Pid}) ->
     ssl_connection:negotiated_protocol(Pid).
 
 %%--------------------------------------------------------------------
--spec cipher_suites() -> [ssl_cipher:old_erl_cipher_suite()] | [string()].
+-spec cipher_suites() -> [ssl_cipher_format:old_erl_cipher_suite()] | [string()].
 %%--------------------------------------------------------------------
 cipher_suites() ->
     cipher_suites(erlang).
 %%--------------------------------------------------------------------
 -spec cipher_suites(erlang | openssl | all) -> 
-                           [ssl_cipher:old_erl_cipher_suite() | string()].
+                           [ssl_cipher_format:old_erl_cipher_suite() | string()].
 %% Description: Returns all supported cipher suites.
 %%--------------------------------------------------------------------
 cipher_suites(erlang) ->
-    [ssl_cipher:erl_suite_definition(Suite) || Suite <- available_suites(default)];
+    [ssl_cipher_format:erl_suite_definition(Suite) || Suite <- available_suites(default)];
 
 cipher_suites(openssl) ->
-    [ssl_cipher:openssl_suite_name(Suite) ||
+    [ssl_cipher_format:openssl_suite_name(Suite) ||
         Suite <- available_suites(default)];
 
 cipher_suites(all) ->
-    [ssl_cipher:erl_suite_definition(Suite) || Suite <- available_suites(all)].
+    [ssl_cipher_format:erl_suite_definition(Suite) || Suite <- available_suites(all)].
 
 %%--------------------------------------------------------------------
 -spec cipher_suites(default | all | anonymous, tls_record:tls_version() | dtls_record:dtls_version() |
                     tls_record:tls_atom_version() |  dtls_record:dtls_atom_version()) -> 
-                           [ssl_cipher:erl_cipher_suite()].
+                           [ssl_cipher_format:erl_cipher_suite()].
 %% Description: Returns all default and all supported cipher suites for a
 %% TLS/DTLS version
 %%--------------------------------------------------------------------
@@ -483,12 +483,12 @@ cipher_suites(Base, Version)  when Version == 'dtlsv1.2';
                                    Version == 'dtlsv1'->
     cipher_suites(Base, dtls_record:protocol_version(Version));                   
 cipher_suites(Base, Version) ->
-    [ssl_cipher:suite_definition(Suite) || Suite <- supported_suites(Base, Version)].
+    [ssl_cipher_format:suite_definition(Suite) || Suite <- supported_suites(Base, Version)].
 
 %%--------------------------------------------------------------------
--spec filter_cipher_suites([ssl_cipher:erl_cipher_suite()], 
+-spec filter_cipher_suites([ssl_cipher_format:erl_cipher_suite()], 
                            [{key_exchange | cipher | mac | prf, fun()}] | []) -> 
-                                  [ssl_cipher:erl_cipher_suite()].
+                                  [ssl_cipher_format:erl_cipher_suite()].
 %% Description: Removes cipher suites if any of the filter functions returns false
 %% for any part of the cipher suite. This function also calls default filter functions
 %% to make sure the cipher suite are supported by crypto.
@@ -505,10 +505,10 @@ filter_cipher_suites(Suites, Filters0) ->
                 prf_filters => add_filter(proplists:get_value(prf, Filters0), PrfF)},
     ssl_cipher:filter_suites(Suites, Filters).
 %%--------------------------------------------------------------------
--spec prepend_cipher_suites([ssl_cipher:erl_cipher_suite()] | 
+-spec prepend_cipher_suites([ssl_cipher_format:erl_cipher_suite()] | 
                             [{key_exchange | cipher | mac | prf, fun()}],
-                            [ssl_cipher:erl_cipher_suite()]) -> 
-                                   [ssl_cipher:erl_cipher_suite()].
+                            [ssl_cipher_format:erl_cipher_suite()]) -> 
+                                   [ssl_cipher_format:erl_cipher_suite()].
 %% Description: Make <Preferred> suites become the most prefered
 %%      suites that is put them at the head of the cipher suite list
 %%      and remove them from <Suites> if present. <Preferred> may be a
@@ -523,10 +523,10 @@ prepend_cipher_suites(Filters, Suites) ->
     Preferred = filter_cipher_suites(Suites, Filters), 
     Preferred ++ (Suites -- Preferred).
 %%--------------------------------------------------------------------
--spec append_cipher_suites(Deferred :: [ssl_cipher:erl_cipher_suite()] | 
+-spec append_cipher_suites(Deferred :: [ssl_cipher_format:erl_cipher_suite()] | 
                                        [{key_exchange | cipher | mac | prf, fun()}],
-                           [ssl_cipher:erl_cipher_suite()]) -> 
-                                  [ssl_cipher:erl_cipher_suite()].
+                           [ssl_cipher_format:erl_cipher_suite()]) -> 
+                                  [ssl_cipher_format:erl_cipher_suite()].
 %% Description: Make <Deferred> suites suites become the 
 %% least prefered suites that is put them at the end of the cipher suite list
 %% and removed them from <Suites> if present.
@@ -794,12 +794,12 @@ tls_version({254, _} = Version) ->
 
 
 %%--------------------------------------------------------------------
--spec suite_to_str(ssl_cipher:erl_cipher_suite()) -> string().
+-spec suite_to_str(ssl_cipher_format:erl_cipher_suite()) -> string().
 %%
 %% Description: Return the string representation of a cipher suite.
 %%--------------------------------------------------------------------
 suite_to_str(Cipher) ->
-    ssl_cipher:suite_to_str(Cipher).
+    ssl_cipher_format:suite_to_str(Cipher).
 
 
 %%--------------------------------------------------------------------
@@ -1379,10 +1379,10 @@ binary_cipher_suites(Version, []) ->
     %% not require explicit configuration
     default_binary_suites(Version);
 binary_cipher_suites(Version, [Map|_] = Ciphers0) when is_map(Map) ->
-    Ciphers = [ssl_cipher:suite(C) || C <- Ciphers0],
+    Ciphers = [ssl_cipher_format:suite(C) || C <- Ciphers0],
     binary_cipher_suites(Version, Ciphers);
 binary_cipher_suites(Version, [Tuple|_] = Ciphers0) when is_tuple(Tuple) ->
-    Ciphers = [ssl_cipher:suite(tuple_to_map(C)) || C <- Ciphers0],
+    Ciphers = [ssl_cipher_format:suite(tuple_to_map(C)) || C <- Ciphers0],
     binary_cipher_suites(Version, Ciphers);
 binary_cipher_suites(Version, [Cipher0 | _] = Ciphers0) when is_binary(Cipher0) ->
     All = ssl_cipher:all_suites(Version) ++ 
@@ -1397,11 +1397,11 @@ binary_cipher_suites(Version, [Cipher0 | _] = Ciphers0) when is_binary(Cipher0)
     end;
 binary_cipher_suites(Version, [Head | _] = Ciphers0) when is_list(Head) ->
     %% Format: ["RC4-SHA","RC4-MD5"]
-    Ciphers = [ssl_cipher:openssl_suite(C) || C <- Ciphers0],
+    Ciphers = [ssl_cipher_format:openssl_suite(C) || C <- Ciphers0],
     binary_cipher_suites(Version, Ciphers);
 binary_cipher_suites(Version, Ciphers0)  ->
     %% Format: "RC4-SHA:RC4-MD5"
-    Ciphers = [ssl_cipher:openssl_suite(C) || C <- string:lexemes(Ciphers0, ":")],
+    Ciphers = [ssl_cipher_format:openssl_suite(C) || C <- string:lexemes(Ciphers0, ":")],
     binary_cipher_suites(Version, Ciphers).
 
 default_binary_suites(Version) ->
diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index 07ec823829..863e7e4b3d 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -33,43 +33,23 @@
 -include("ssl_alert.hrl").
 -include_lib("public_key/include/public_key.hrl").
 
--export([security_parameters/2, security_parameters/3, suite_definition/1,
-	 erl_suite_definition/1,
+-export([security_parameters/2, security_parameters/3, 
 	 cipher_init/3, decipher/6, cipher/5, decipher_aead/6, cipher_aead/6,
-	 suite/1, suites/1, all_suites/1,  crypto_support_filters/0,
+	 suites/1, all_suites/1,  crypto_support_filters/0,
 	 chacha_suites/1, anonymous_suites/1, psk_suites/1, psk_suites_anon/1, 
          srp_suites/0, srp_suites_anon/0,
-	 rc4_suites/1, des_suites/1, rsa_suites/1, openssl_suite/1, openssl_suite_name/1, 
+	 rc4_suites/1, des_suites/1, rsa_suites/1, 
          filter/3, filter_suites/1, filter_suites/2,
 	 hash_algorithm/1, sign_algorithm/1, is_acceptable_hash/2, is_fallback/1,
 	 random_bytes/1, calc_mac_hash/4,
-         is_stream_ciphersuite/1, suite_to_str/1]).
-
--export_type([cipher_suite/0,
-	      erl_cipher_suite/0, old_erl_cipher_suite/0, openssl_cipher_suite/0,
-	      hash/0, key_algo/0, sign_algo/0]).
-
--type cipher()            :: null |rc4_128 | des_cbc | '3des_ede_cbc' | aes_128_cbc |  aes_256_cbc | aes_128_gcm | aes_256_gcm | chacha20_poly1305.
--type hash()              :: null | md5 | sha | sha224 | sha256 | sha384 | sha512.
--type sign_algo()         :: rsa | dsa | ecdsa.
--type key_algo()          :: null | rsa | dhe_rsa | dhe_dss | ecdhe_ecdsa| ecdh_ecdsa | ecdh_rsa| srp_rsa| srp_dss | psk | dhe_psk | rsa_psk | dh_anon | ecdh_anon | srp_anon.
--type erl_cipher_suite()  :: #{key_exchange := key_algo(),
-                               cipher := cipher(),
-                               mac    := hash() | aead,
-                               prf    := hash() | default_prf %% Old cipher suites, version dependent
-                              }.  
--type old_erl_cipher_suite() :: {key_algo(), cipher(), hash()} % Pre TLS 1.2 
-                                %% TLS 1.2, internally PRE TLS 1.2 will use default_prf
-                              | {key_algo(), cipher(), hash(), hash() | default_prf}. 
--type cipher_suite()      :: binary().
--type cipher_enum()        :: integer().
--type openssl_cipher_suite()  :: string().
-
+         is_stream_ciphersuite/1]).
 
 -compile(inline).
 
+-type cipher_enum()        :: integer().
+
 %%--------------------------------------------------------------------
--spec security_parameters(cipher_suite(), #security_parameters{}) ->
+-spec security_parameters(ssl_cipher_format:cipher_suite(), #security_parameters{}) ->
 				 #security_parameters{}.
 %% Only security_parameters/2 should call security_parameters/3 with undefined as
 %% first argument.
@@ -79,7 +59,8 @@ security_parameters(?TLS_NULL_WITH_NULL_NULL = CipherSuite, SecParams) ->
     security_parameters(undefined, CipherSuite, SecParams).
 
 %%--------------------------------------------------------------------
--spec security_parameters(ssl_record:ssl_version() | undefined, cipher_suite(), #security_parameters{}) ->
+-spec security_parameters(ssl_record:ssl_version() | undefined, 
+                          ssl_cipher_format:cipher_suite(), #security_parameters{}) ->
 				 #security_parameters{}.
 %%
 %% Description: Returns a security parameters record where the
@@ -87,7 +68,7 @@ security_parameters(?TLS_NULL_WITH_NULL_NULL = CipherSuite, SecParams) ->
 %%-------------------------------------------------------------------
 security_parameters(Version, CipherSuite, SecParams) ->
     #{cipher := Cipher, mac := Hash, 
-      prf := PrfHashAlg} = suite_definition(CipherSuite),
+      prf := PrfHashAlg} = ssl_cipher_format:suite_definition(CipherSuite),
     SecParams#security_parameters{
       cipher_suite = CipherSuite,
       bulk_cipher_algorithm = bulk_cipher_algorithm(Cipher),
@@ -309,7 +290,7 @@ aead_decipher(Type, #cipher_state{key = Key, iv = IV} = CipherState,
     end.
 
 %%--------------------------------------------------------------------
--spec suites(ssl_record:ssl_version()) -> [cipher_suite()].
+-spec suites(ssl_record:ssl_version()) -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of supported cipher suites.
 %%--------------------------------------------------------------------
@@ -334,7 +315,8 @@ all_suites({3, _} = Version) ->
 all_suites(Version) ->
     dtls_v1:all_suites(Version).
 %%--------------------------------------------------------------------
--spec chacha_suites(ssl_record:ssl_version() | integer()) -> [cipher_suite()].
+-spec chacha_suites(ssl_record:ssl_version() | integer()) ->
+                           [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns list of the chacha cipher suites, only supported
 %% if explicitly set by user for now due to interop problems, proably need
@@ -348,7 +330,8 @@ chacha_suites(_) ->
     [].
 
 %%--------------------------------------------------------------------
--spec anonymous_suites(ssl_record:ssl_version() | integer()) -> [cipher_suite()].
+-spec anonymous_suites(ssl_record:ssl_version() | integer()) ->
+                              [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the anonymous cipher suites, only supported
 %% if explicitly set by user. Intended only for testing.
@@ -384,7 +367,7 @@ anonymous_suites(N)  when N == 0;
         ].
 
 %%--------------------------------------------------------------------
--spec psk_suites(ssl_record:ssl_version() | integer()) -> [cipher_suite()].
+-spec psk_suites(ssl_record:ssl_version() | integer()) -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the PSK cipher suites, only supported
 %% if explicitly set by user.
@@ -406,7 +389,7 @@ psk_suites(_) ->
      ?TLS_RSA_PSK_WITH_RC4_128_SHA].
 
 %%--------------------------------------------------------------------
--spec psk_suites_anon(ssl_record:ssl_version() | integer()) -> [cipher_suite()].
+-spec psk_suites_anon(ssl_record:ssl_version() | integer()) -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the anonymous PSK cipher suites, only supported
 %% if explicitly set by user.
@@ -441,7 +424,7 @@ psk_suites_anon(_) ->
 	 ?TLS_DHE_PSK_WITH_RC4_128_SHA,
 	 ?TLS_PSK_WITH_RC4_128_SHA].
 %%--------------------------------------------------------------------
--spec srp_suites() -> [cipher_suite()].
+-spec srp_suites() -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the SRP cipher suites, only supported
 %% if explicitly set by user.
@@ -455,7 +438,7 @@ srp_suites() ->
      ?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA].
 
 %%--------------------------------------------------------------------
--spec srp_suites_anon() -> [cipher_suite()].
+-spec srp_suites_anon() -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the SRP anonymous cipher suites, only supported
 %% if explicitly set by user.
@@ -466,7 +449,8 @@ srp_suites_anon() ->
      ?TLS_SRP_SHA_WITH_AES_256_CBC_SHA].
 
 %%--------------------------------------------------------------------
--spec rc4_suites(Version::ssl_record:ssl_version() | integer()) -> [cipher_suite()].
+-spec rc4_suites(Version::ssl_record:ssl_version() | integer()) -> 
+                        [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the RSA|(ECDH/RSA)| (ECDH/ECDSA) 
 %% with RC4 cipher suites, only supported if explicitly set by user. 
@@ -487,7 +471,7 @@ rc4_suites(N) when N =< 4 ->
      ?TLS_ECDH_RSA_WITH_RC4_128_SHA].
 
 %%--------------------------------------------------------------------
--spec des_suites(Version::ssl_record:ssl_version()) -> [cipher_suite()].
+-spec des_suites(Version::ssl_record:ssl_version()) -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the cipher suites
 %% with DES cipher, only supported if explicitly set by user. 
@@ -505,7 +489,7 @@ des_suites(_)->
     ].
 
 %%--------------------------------------------------------------------
--spec rsa_suites(Version::ssl_record:ssl_version() | integer()) -> [cipher_suite()].
+-spec rsa_suites(Version::ssl_record:ssl_version() | integer()) -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Returns a list of the RSA key exchange 
 %% cipher suites, only supported if explicitly set by user. 
@@ -529,1720 +513,8 @@ rsa_suites(N) when N =< 4 ->
     ].
 
 %%--------------------------------------------------------------------
--spec suite_definition(cipher_suite()) -> erl_cipher_suite().
-%%
-%% Description: Return erlang cipher suite definition.
-%% Note: Currently not supported suites are commented away.
-%% They should be supported or removed in the future.
-%%-------------------------------------------------------------------
-%% TLS v1.1 suites
-suite_definition(?TLS_NULL_WITH_NULL_NULL) ->
-    #{key_exchange => null,
-      cipher => null, 
-      mac => null, 
-      prf => null};
-%% RFC 5746 - Not a real cipher suite used to signal empty "renegotiation_info" extension
-%% to avoid handshake failure from old servers that do not ignore
-%% hello extension data as they should.
-suite_definition(?TLS_EMPTY_RENEGOTIATION_INFO_SCSV) ->
-    #{key_exchange => null,
-      cipher => null, 
-      mac => null,
-      prf => null};
-suite_definition(?TLS_RSA_WITH_RC4_128_MD5) ->	
-    #{key_exchange => rsa,
-      cipher => rc4_128, 
-      mac => md5, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_WITH_RC4_128_SHA) ->
-    #{key_exchange => rsa,
-      cipher => rc4_128,
-      mac => sha,
-      prf => default_prf};
-suite_definition(?TLS_RSA_WITH_DES_CBC_SHA) ->
-    #{key_exchange => rsa,
-      cipher => des_cbc,
-      mac => sha,
-      prf => default_prf};
-suite_definition(?TLS_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => rsa,
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_DSS_WITH_DES_CBC_SHA) ->
-    #{key_exchange => dhe_dss, 
-      cipher => des_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => dhe_dss, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_RSA_WITH_DES_CBC_SHA) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => des_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-%%% TSL V1.1 AES suites
-suite_definition(?TLS_RSA_WITH_AES_128_CBC_SHA) -> 
-    #{key_exchange => rsa,
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => dhe_dss, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA) -> 
-    #{key_exchange => rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => dhe_dss, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-%% TLS v1.2 suites
-%% suite_definition(?TLS_RSA_WITH_NULL_SHA) ->
-%%     {rsa, null, sha, default_prf};
-suite_definition(?TLS_RSA_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA256) ->
-    #{key_exchange => rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => dhe_dss, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256) ->
-    #{key_exchange => dhe_dss, 
-      cipher => aes_256_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-%% not defined YET:
-%%   TLS_DH_DSS_WITH_AES_128_CBC_SHA256      DH_DSS       AES_128_CBC  SHA256
-%%   TLS_DH_RSA_WITH_AES_128_CBC_SHA256      DH_RSA       AES_128_CBC  SHA256
-%%   TLS_DH_DSS_WITH_AES_256_CBC_SHA256      DH_DSS       AES_256_CBC  SHA256
-%%   TLS_DH_RSA_WITH_AES_256_CBC_SHA256      DH_RSA       AES_256_CBC  SHA256
-%%% DH-ANON deprecated by TLS spec and not available
-%%% by default, but good for testing purposes.
-suite_definition(?TLS_DH_anon_WITH_RC4_128_MD5) ->
-    #{key_exchange => dh_anon, 
-      cipher => rc4_128, 
-      mac => md5, 
-      prf => default_prf};
-suite_definition(?TLS_DH_anon_WITH_DES_CBC_SHA) ->
-    #{key_exchange => dh_anon, 
-      cipher => des_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => dh_anon, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => dh_anon, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => dh_anon, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => dh_anon, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA256) ->
-    #{key_exchange => dh_anon, 
-      cipher => aes_256_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-%%% PSK Cipher Suites RFC 4279
-suite_definition(?TLS_PSK_WITH_RC4_128_SHA) ->
-    #{key_exchange => psk, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => psk, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_PSK_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => psk, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_PSK_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => psk, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_RC4_128_SHA) ->
-    #{key_exchange => dhe_psk, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => dhe_psk, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => dhe_psk, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => dhe_psk, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_RC4_128_SHA) ->
-    #{key_exchange => rsa_psk, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => rsa_psk, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => rsa_psk, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => rsa_psk, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-%%% PSK NULL Cipher Suites RFC 4785
-suite_definition(?TLS_PSK_WITH_NULL_SHA) ->
-    #{key_exchange => psk, 
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA) ->
-    #{key_exchange => dhe_psk,
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA) ->
-    #{key_exchange => rsa_psk,
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};  
-%%% TLS 1.2 PSK Cipher Suites RFC 5487
-suite_definition(?TLS_PSK_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => psk, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_PSK_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => psk, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_DHE_PSK_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => dhe_psk, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_DHE_PSK_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => dhe_psk, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_RSA_PSK_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => rsa_psk, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_RSA_PSK_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => rsa_psk, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_PSK_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => psk, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_PSK_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => psk, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => dhe_psk, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => dhe_psk, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => rsa_psk, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => rsa_psk, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => default_prf};
-suite_definition(?TLS_PSK_WITH_NULL_SHA256) ->
-    #{key_exchange => psk, 
-      cipher => null, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_PSK_WITH_NULL_SHA384) ->
-    #{key_exchange => psk, 
-      cipher => null, 
-      mac => sha384, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA256) ->
-    #{key_exchange => dhe_psk, 
-      cipher => null, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA384) ->
-    #{key_exchange => dhe_psk, 
-      cipher => null, 
-      mac => sha384, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA256) ->
-    #{key_exchange => rsa_psk, 
-      cipher => null, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA384) ->
-    #{key_exchange => rsa_psk, 
-      cipher => null, 
-      mac => sha384, 
-      prf => default_prf};
-%%% ECDHE PSK Cipher Suites RFC 5489
-suite_definition(?TLS_ECDHE_PSK_WITH_RC4_128_SHA) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => '3des_ede_cbc',
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_PSK_WITH_NULL_SHA256) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => null, 
-      mac => sha256, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_PSK_WITH_NULL_SHA384) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => null, mac => sha384, 
-      prf => default_prf};
-%%% ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites, draft-ietf-tls-ecdhe-psk-aead-05
-suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => aes_128_gcm, 
-      mac => null, 
-      prf => sha256};
-suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => ecdhe_psk, 
-      cipher => aes_256_gcm, 
-      mac => null, 
-      prf => sha384};
-%% suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256) ->
-%%     #{key_exchange => ecdhe_psk, 
-%%       cipher => aes_128_ccm, 
-%%       mac => null, 
-%%       prf =>sha256};
-%% suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256) ->
-%%     #{key_exchange => ecdhe_psk, 
-%%       cipher => aes_256_ccm, 
-%%       mac => null, 
-%%       prf => sha256};
-%%% SRP Cipher Suites RFC 5054
-suite_definition(?TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => srp_anon, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => srp_rsa, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => srp_dss, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => srp_anon, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => srp_rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => srp_dss, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => srp_anon, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => srp_rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => srp_dss, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-%% RFC 4492 EC TLS suites
-suite_definition(?TLS_ECDH_ECDSA_WITH_NULL_SHA) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_ECDSA_WITH_RC4_128_SHA) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_NULL_SHA) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_RSA_WITH_NULL_SHA) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_RSA_WITH_RC4_128_SHA) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_RSA_WITH_NULL_SHA) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_RSA_WITH_RC4_128_SHA) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_anon_WITH_NULL_SHA) ->
-    #{key_exchange => ecdh_anon, 
-      cipher => null, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_anon_WITH_RC4_128_SHA) ->
-    #{key_exchange => ecdh_anon, 
-      cipher => rc4_128, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA) ->
-    #{key_exchange => ecdh_anon, 
-      cipher => '3des_ede_cbc', 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_anon_WITH_AES_128_CBC_SHA) ->
-    #{key_exchange => ecdh_anon, 
-      cipher => aes_128_cbc, 
-      mac => sha, 
-      prf => default_prf};
-suite_definition(?TLS_ECDH_anon_WITH_AES_256_CBC_SHA) ->
-    #{key_exchange => ecdh_anon, 
-      cipher => aes_256_cbc, 
-      mac => sha, 
-      prf => default_prf};
-%% RFC 5289 EC TLS suites
-suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => sha256};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => sha384};
-suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => sha256};
-suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => sha384};
-suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => sha256};
-suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => sha384};
-suite_definition(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => aes_128_cbc, 
-      mac => sha256, 
-      prf => sha256};
-suite_definition(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => aes_256_cbc, 
-      mac => sha384, 
-      prf => sha384};
-%% RFC 5288 AES-GCM Cipher Suites
-suite_definition(?TLS_RSA_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => rsa, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_RSA_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => rsa, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_DH_RSA_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => dh_rsa, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_DH_RSA_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => dh_rsa, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => dhe_dss, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => dhe_dss, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_DH_DSS_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => dh_dss, 
-      cipher => aes_128_gcm, 
-      mac => null, 
-      prf => sha256};
-suite_definition(?TLS_DH_DSS_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => dh_dss, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_DH_anon_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => dh_anon, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_DH_anon_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => dh_anon, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-%% RFC 5289 ECC AES-GCM Cipher Suites
-suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => ecdh_ecdsa, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-suite_definition(?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => aes_128_gcm, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384) ->
-    #{key_exchange => ecdh_rsa, 
-      cipher => aes_256_gcm, 
-      mac => aead, 
-      prf => sha384};
-%% draft-agl-tls-chacha20poly1305-04 Chacha20/Poly1305 Suites
-suite_definition(?TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) ->
-    #{key_exchange => ecdhe_rsa, 
-      cipher => chacha20_poly1305, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) ->
-    #{key_exchange => ecdhe_ecdsa, 
-      cipher => chacha20_poly1305, 
-      mac => aead, 
-      prf => sha256};
-suite_definition(?TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256) ->
-    #{key_exchange => dhe_rsa, 
-      cipher => chacha20_poly1305, 
-      mac => aead, 
-      prf => sha256}.
-
-%%--------------------------------------------------------------------
--spec erl_suite_definition(cipher_suite() | erl_cipher_suite()) -> old_erl_cipher_suite().
-%%
-%% Description: Return erlang cipher suite definition. Filters last value
-%% for now (compatibility reasons).
-%%--------------------------------------------------------------------
-erl_suite_definition(Bin) when is_binary(Bin) ->
-    erl_suite_definition(suite_definition(Bin));    
-erl_suite_definition(#{key_exchange := KeyExchange, cipher := Cipher,
-                       mac := Hash, prf := Prf}) ->
-    case Prf of
-        default_prf ->
-	    {KeyExchange, Cipher, Hash};
-	_ ->
-            {KeyExchange, Cipher, Hash, Prf}
-    end.
-
-%%--------------------------------------------------------------------
--spec suite(erl_cipher_suite()) -> cipher_suite().
-%%
-%% Description: Return TLS cipher suite definition.
-%%--------------------------------------------------------------------
-%% TLS v1.1 suites
-suite(#{key_exchange := rsa, 
-        cipher := rc4_128, 
-        mac := md5}) ->
-    ?TLS_RSA_WITH_RC4_128_MD5;
-suite(#{key_exchange := rsa, 
-        cipher := rc4_128, 
-        mac := sha}) ->
-    ?TLS_RSA_WITH_RC4_128_SHA;
-suite(#{key_exchange := rsa, 
-        cipher := des_cbc, 
-        mac := sha}) ->
-    ?TLS_RSA_WITH_DES_CBC_SHA; 
-suite(#{key_exchange := rsa, 
-        cipher :='3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_RSA_WITH_3DES_EDE_CBC_SHA; 
-suite(#{key_exchange := dhe_dss,  
-        cipher:= des_cbc, 
-        mac := sha}) ->
-    ?TLS_DHE_DSS_WITH_DES_CBC_SHA;
-suite(#{key_exchange := dhe_dss, 
-        cipher:= '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := dhe_rsa, 
-        cipher:= des_cbc,
-        mac := sha}) ->
-    ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
-suite(#{key_exchange := dhe_rsa, 
-        cipher:= '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA; 
-suite(#{key_exchange := dh_anon, 
-        cipher:= rc4_128,
-        mac := md5}) ->
-    ?TLS_DH_anon_WITH_RC4_128_MD5;
-suite(#{key_exchange := dh_anon, 
-        cipher:= des_cbc,  
-        mac := sha}) ->
-    ?TLS_DH_anon_WITH_DES_CBC_SHA;
-suite(#{key_exchange := dh_anon, 
-        cipher:= '3des_ede_cbc',
-        mac := sha}) ->
-    ?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
-%%% TSL V1.1 AES suites
-suite(#{key_exchange := rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_RSA_WITH_AES_128_CBC_SHA; 
-suite(#{key_exchange := dhe_dss, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA; 
-suite(#{key_exchange := dhe_rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := dh_anon, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_DH_anon_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := rsa, 
-        cipher := aes_256_cbc,  
-        mac := sha}) ->
-    ?TLS_RSA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := dhe_dss, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := dhe_rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := dh_anon, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_DH_anon_WITH_AES_256_CBC_SHA;
-%% TLS v1.2 suites
-suite(#{key_exchange := rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha256}) ->
-    ?TLS_RSA_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha256}) ->
-    ?TLS_RSA_WITH_AES_256_CBC_SHA256;
-suite(#{key_exchange := dhe_dss, 
-        cipher := aes_128_cbc, 
-        mac := sha256}) ->
-    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := dhe_rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha256}) ->
-    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := dhe_dss, 
-        cipher := aes_256_cbc, 
-        mac := sha256}) ->
-    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256;
-suite(#{key_exchange := dhe_rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha256}) ->
-    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
-suite(#{key_exchange := dh_anon, 
-        cipher := aes_128_cbc, 
-        mac := sha256}) ->
-    ?TLS_DH_anon_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := dh_anon, 
-        cipher := aes_256_cbc, 
-        mac := sha256}) ->
-    ?TLS_DH_anon_WITH_AES_256_CBC_SHA256;
-%%% PSK Cipher Suites RFC 4279
-suite(#{key_exchange := psk, 
-        cipher := rc4_128,
-        mac := sha}) ->
-    ?TLS_PSK_WITH_RC4_128_SHA;
-suite(#{key_exchange := psk, 
-        cipher := '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_PSK_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := psk, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_PSK_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := psk, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_PSK_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := dhe_psk, 
-        cipher := rc4_128, 
-        mac := sha})  ->
-    ?TLS_DHE_PSK_WITH_RC4_128_SHA;
-suite(#{key_exchange := dhe_psk, 
-        cipher := '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := dhe_psk, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_DHE_PSK_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := dhe_psk, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_DHE_PSK_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := rsa_psk, 
-        cipher := rc4_128, 
-        mac := sha}) ->
-    ?TLS_RSA_PSK_WITH_RC4_128_SHA;
-suite(#{key_exchange := rsa_psk, 
-        cipher := '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := rsa_psk, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := rsa_psk, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA;
-%%% PSK NULL Cipher Suites RFC 4785
-suite(#{key_exchange := psk, 
-        cipher := null, 
-        mac := sha}) ->
-    ?TLS_PSK_WITH_NULL_SHA;
-suite(#{key_exchange := dhe_psk, 
-        cipher := null, 
-        mac := sha}) ->
-    ?TLS_DHE_PSK_WITH_NULL_SHA;
-suite(#{key_exchange := rsa_psk, 
-       cipher := null, 
-       mac := sha}) ->
-    ?TLS_RSA_PSK_WITH_NULL_SHA;
-%%% TLS 1.2 PSK Cipher Suites RFC 5487
-suite(#{key_exchange := psk, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_PSK_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := psk, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_PSK_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := dhe_psk, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_DHE_PSK_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := dhe_psk, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_DHE_PSK_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := rsa_psk, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_RSA_PSK_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := rsa_psk, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_RSA_PSK_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := psk, 
-        cipher := aes_128_cbc, 
-        mac := sha256}) ->
-    ?TLS_PSK_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := psk, 
-        cipher := aes_256_cbc, 
-        mac := sha384}) ->
-    ?TLS_PSK_WITH_AES_256_CBC_SHA384;
-suite(#{key_exchange := dhe_psk, 
-        cipher := aes_128_cbc, 
-        mac := sha256}) ->
-    ?TLS_DHE_PSK_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := dhe_psk, 
-        cipher := aes_256_cbc, 
-        mac := sha384}) ->
-    ?TLS_DHE_PSK_WITH_AES_256_CBC_SHA384;
-suite(#{key_exchange := rsa_psk, 
-        cipher := aes_128_cbc, 
-        mac := sha256}) ->
-    ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := rsa_psk, 
-        cipher := aes_256_cbc, 
-        mac := sha384}) ->
-    ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA384;
-suite(#{key_exchange := psk, 
-        cipher := null, 
-        mac := sha256}) ->
-    ?TLS_PSK_WITH_NULL_SHA256;
-suite(#{key_exchange := psk, 
-        cipher := null,
-        mac := sha384}) ->
-    ?TLS_PSK_WITH_NULL_SHA384;
-suite(#{key_exchange := dhe_psk, 
-        cipher := null, 
-        mac := sha256}) ->
-    ?TLS_DHE_PSK_WITH_NULL_SHA256;
-suite(#{key_exchange := dhe_psk, 
-        cipher := null, 
-        mac := sha384}) ->
-    ?TLS_DHE_PSK_WITH_NULL_SHA384;
-suite(#{key_exchange := rsa_psk, 
-        cipher := null,  
-        mac := sha256}) ->
-    ?TLS_RSA_PSK_WITH_NULL_SHA256;
-suite(#{key_exchange := rsa_psk, 
-       cipher := null, 
-       mac := sha384}) ->
-    ?TLS_RSA_PSK_WITH_NULL_SHA384;
-%%% ECDHE PSK Cipher Suites RFC 5489
-suite(#{key_exchange := ecdhe_psk, 
-        cipher := rc4_128,
-        mac := sha}) ->
-    ?TLS_ECDHE_PSK_WITH_RC4_128_SHA;
-suite(#{key_exchange := ecdhe_psk, 
-        cipher :='3des_ede_cbc',
-        mac := sha}) ->
-    ?TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := ecdhe_psk, 
-        cipher := aes_128_cbc,
-        mac := sha}) ->
-    ?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := ecdhe_psk, 
-        cipher := aes_256_cbc,
-        mac := sha}) ->
-    ?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := ecdhe_psk, 
-       cipher := aes_128_cbc, 
-       mac := sha256}) ->
-    ?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := ecdhe_psk, 
-       cipher := aes_256_cbc, 
-       mac := sha384}) ->
-    ?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384;
-suite(#{key_exchange := ecdhe_psk, 
-       cipher := null, 
-       mac := sha256}) ->
-    ?TLS_ECDHE_PSK_WITH_NULL_SHA256;
-suite(#{key_exchange := ecdhe_psk, 
-       cipher := null, 
-       mac := sha384}) ->
-    ?TLS_ECDHE_PSK_WITH_NULL_SHA384;
-%%% ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites, draft-ietf-tls-ecdhe-psk-aead-05
-suite(#{key_exchange := ecdhe_psk, 
-       cipher := aes_128_gcm, 
-       mac := null, 
-       prf := sha256}) ->
-    ?TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := ecdhe_psk, 
-       cipher := aes_256_gcm, 
-       mac := null, 
-       prf := sha384}) ->
-    ?TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384;
- %% suite(#{key_exchange := ecdhe_psk, 
- %%        cipher := aes_128_ccm, 
- %%        mac := null, 
- %%        prf := sha256}) ->
- %%    ?TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256;
- %% suite(#{key_exchange := ecdhe_psk, 
- %%         cipher := aes_256_ccm, 
- %%         mac := null, 
- %%         prf := sha256}) ->
- %%    ?TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256;
-%%% SRP Cipher Suites RFC 5054
-suite(#{key_exchange := srp_anon, 
-        cipher := '3des_ede_cbc',
-        mac :=  sha}) ->
-    ?TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := srp_rsa, 
-        cipher := '3des_ede_cbc',
-        mac := sha}) ->
-    ?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := srp_dss, 
-        cipher := '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := srp_anon, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_SRP_SHA_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := srp_rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := srp_dss, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := srp_anon, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_SRP_SHA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := srp_rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := srp_dss, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA;
-%%% RFC 4492 EC TLS suites
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := null, 
-        mac := sha}) ->
-    ?TLS_ECDH_ECDSA_WITH_NULL_SHA;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := rc4_128,  
-        mac := sha})  ->
-    ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := null, 
-        mac := sha}) ->
-    ?TLS_ECDHE_ECDSA_WITH_NULL_SHA;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := rc4_128, 
-        mac := sha}) ->
-    ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := null, 
-        mac := sha}) ->
-    ?TLS_ECDH_RSA_WITH_NULL_SHA;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := rc4_128, 
-        mac := sha}) ->
-    ?TLS_ECDH_RSA_WITH_RC4_128_SHA;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := '3des_ede_cbc', mac := sha}) ->
-    ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := null, 
-        mac := sha}) ->
-    ?TLS_ECDHE_RSA_WITH_NULL_SHA;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := rc4_128, 
-        mac := sha}) ->
-    ?TLS_ECDHE_RSA_WITH_RC4_128_SHA;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := '3des_ede_cbc', 
-        mac := sha}) ->
-    ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;
-suite(#{key_exchange := ecdh_anon, 
-        cipher := null, 
-        mac := sha}) ->
-    ?TLS_ECDH_anon_WITH_NULL_SHA;
-suite(#{key_exchange := ecdh_anon, 
-        cipher := rc4_128, 
-        mac := sha}) ->
-    ?TLS_ECDH_anon_WITH_RC4_128_SHA;
-suite(#{key_exchange := ecdh_anon, 
-        cipher := '3des_ede_cbc', 
-        mac :=  sha}) ->
-    ?TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA;
-suite(#{key_exchange := ecdh_anon, 
-        cipher := aes_128_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDH_anon_WITH_AES_128_CBC_SHA;
-suite(#{key_exchange := ecdh_anon, 
-        cipher := aes_256_cbc, 
-        mac := sha}) ->
-    ?TLS_ECDH_anon_WITH_AES_256_CBC_SHA;
-%%% RFC 5289 EC TLS suites
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := aes_128_cbc, 
-        mac:= sha256, 
-        prf := sha256}) ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := aes_256_cbc, 
-        mac := sha384, 
-        prf := sha384}) ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := aes_128_cbc, 
-        mac := sha256, 
-        prf := sha256}) ->
-    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := aes_256_cbc, 
-        mac := sha384, 
-        prf := sha384}) ->
-    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha256, 
-        prf := sha256}) ->
-    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha384, 
-        prf := sha384}) ->
-    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := aes_128_cbc, 
-        mac := sha256, 
-        prf := sha256}) ->
-    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := aes_256_cbc, 
-        mac := sha384, 
-        prf := sha384}) ->
-    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384;
-%% RFC 5288 AES-GCM Cipher Suites
-suite(#{key_exchange := rsa, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_RSA_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := rsa, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_RSA_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := dhe_rsa, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := dhe_rsa, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := dh_rsa, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_DH_RSA_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := dh_rsa, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_DH_RSA_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := dhe_dss, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := dhe_dss, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := dh_dss, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_DH_DSS_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := dh_dss, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_DH_DSS_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := dh_anon, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_DH_anon_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := dh_anon, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_DH_anon_WITH_AES_256_GCM_SHA384;
-%% RFC 5289 ECC AES-GCM Cipher Suites
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := ecdh_ecdsa, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := aes_128_gcm, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256;
-suite(#{key_exchange := ecdh_rsa, 
-        cipher := aes_256_gcm, 
-        mac := aead, 
-        prf := sha384}) ->
-    ?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384;
-%% draft-agl-tls-chacha20poly1305-04 Chacha20/Poly1305 Suites
-suite(#{key_exchange := ecdhe_rsa, 
-        cipher := chacha20_poly1305,  
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256;
-suite(#{key_exchange := ecdhe_ecdsa, 
-        cipher := chacha20_poly1305, 
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256;
-suite(#{key_exchange := dhe_rsa, 
-        cipher := chacha20_poly1305,  
-        mac := aead, 
-        prf := sha256}) ->
-    ?TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
-
-
-%%--------------------------------------------------------------------
--spec suite_to_str(erl_cipher_suite()) -> string().
-%%
-%% Description: Return the string representation of a cipher suite.
-%%--------------------------------------------------------------------
-suite_to_str(#{key_exchange := null,
-               cipher := null,
-               mac := null,
-               prf := null}) ->
-    "TLS_EMPTY_RENEGOTIATION_INFO_SCSV";
-suite_to_str(#{key_exchange := Kex,
-               cipher := Cipher,
-               mac := aead,
-               prf := PRF}) ->
-    "TLS_" ++ string:to_upper(atom_to_list(Kex)) ++
-        "_WITH_" ++  string:to_upper(atom_to_list(Cipher)) ++
-        "_" ++ string:to_upper(atom_to_list(PRF));
-suite_to_str(#{key_exchange := Kex,
-               cipher := Cipher,
-               mac := Mac}) ->
-    "TLS_" ++ string:to_upper(atom_to_list(Kex)) ++
-        "_WITH_" ++  string:to_upper(atom_to_list(Cipher)) ++
-        "_" ++ string:to_upper(atom_to_list(Mac)).
-
-
-%%--------------------------------------------------------------------
--spec openssl_suite(openssl_cipher_suite()) -> cipher_suite().
-%%
-%% Description: Return TLS cipher suite definition.
-%%--------------------------------------------------------------------
-%% translate constants <-> openssl-strings
-openssl_suite("DHE-RSA-AES256-SHA256") ->
-    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
-openssl_suite("DHE-DSS-AES256-SHA256") ->
-    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256;
-openssl_suite("AES256-SHA256") ->
-    ?TLS_RSA_WITH_AES_256_CBC_SHA256;
-openssl_suite("DHE-RSA-AES128-SHA256") ->
-    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
-openssl_suite("DHE-DSS-AES128-SHA256") ->
-    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256;
-openssl_suite("AES128-SHA256") ->
-    ?TLS_RSA_WITH_AES_128_CBC_SHA256;
-openssl_suite("DHE-RSA-AES256-SHA") ->
-    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
-openssl_suite("DHE-DSS-AES256-SHA") ->
-    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
-openssl_suite("AES256-SHA") ->
-    ?TLS_RSA_WITH_AES_256_CBC_SHA;
-openssl_suite("EDH-RSA-DES-CBC3-SHA") ->
-    ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("EDH-DSS-DES-CBC3-SHA") ->
-    ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("DES-CBC3-SHA") ->
-    ?TLS_RSA_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("DHE-RSA-AES128-SHA") ->
-    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
-openssl_suite("DHE-DSS-AES128-SHA") ->
-    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA;
-openssl_suite("AES128-SHA") ->
-    ?TLS_RSA_WITH_AES_128_CBC_SHA;
-openssl_suite("RC4-SHA") ->
-    ?TLS_RSA_WITH_RC4_128_SHA;
-openssl_suite("RC4-MD5") -> 
-    ?TLS_RSA_WITH_RC4_128_MD5;
-openssl_suite("EDH-RSA-DES-CBC-SHA") ->
-    ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
-openssl_suite("DES-CBC-SHA") ->
-    ?TLS_RSA_WITH_DES_CBC_SHA;
-
-%%% SRP Cipher Suites RFC 5054
-
-openssl_suite("SRP-DSS-AES-256-CBC-SHA") ->
-    ?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA;
-openssl_suite("SRP-RSA-AES-256-CBC-SHA") ->
-    ?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA;
-openssl_suite("SRP-DSS-3DES-EDE-CBC-SHA") ->
-    ?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("SRP-RSA-3DES-EDE-CBC-SHA") ->
-    ?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("SRP-DSS-AES-128-CBC-SHA") ->
-    ?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA;
-openssl_suite("SRP-RSA-AES-128-CBC-SHA") ->
-    ?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA;
-
-%% RFC 4492 EC TLS suites
-openssl_suite("ECDH-ECDSA-RC4-SHA") ->
-    ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA;
-openssl_suite("ECDH-ECDSA-DES-CBC3-SHA") ->
-    ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("ECDH-ECDSA-AES128-SHA") ->
-    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA;
-openssl_suite("ECDH-ECDSA-AES256-SHA") ->
-    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA;
-
-openssl_suite("ECDHE-ECDSA-RC4-SHA") ->
-    ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA;
-openssl_suite("ECDHE-ECDSA-DES-CBC3-SHA") ->
-    ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("ECDHE-ECDSA-AES128-SHA") ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA;
-openssl_suite("ECDHE-ECDSA-AES256-SHA") ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA;
-
-openssl_suite("ECDHE-RSA-RC4-SHA") ->
-    ?TLS_ECDHE_RSA_WITH_RC4_128_SHA;
-openssl_suite("ECDHE-RSA-DES-CBC3-SHA") ->
-    ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("ECDHE-RSA-AES128-SHA") ->
-    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;
-openssl_suite("ECDHE-RSA-AES256-SHA") ->
-    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;
-
-openssl_suite("ECDH-RSA-RC4-SHA") ->
-    ?TLS_ECDH_RSA_WITH_RC4_128_SHA;
-openssl_suite("ECDH-RSA-DES-CBC3-SHA") ->
-    ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA;
-openssl_suite("ECDH-RSA-AES128-SHA") ->
-    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA;
-openssl_suite("ECDH-RSA-AES256-SHA") ->
-    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA;
-
-%% RFC 5289 EC TLS suites
-openssl_suite("ECDHE-ECDSA-AES128-SHA256") ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
-openssl_suite("ECDHE-ECDSA-AES256-SHA384") ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;
-openssl_suite("ECDH-ECDSA-AES128-SHA256") ->
-    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256;
-openssl_suite("ECDH-ECDSA-AES256-SHA384") ->
-    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384;
-openssl_suite("ECDHE-RSA-AES128-SHA256") ->
-    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
-openssl_suite("ECDHE-RSA-AES256-SHA384") ->
-    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;
-openssl_suite("ECDH-RSA-AES128-SHA256") ->
-    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256;
-openssl_suite("ECDH-RSA-AES256-SHA384") ->
-    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384;
-
-%% RFC 5288 AES-GCM Cipher Suites
-openssl_suite("AES128-GCM-SHA256") ->
-    ?TLS_RSA_WITH_AES_128_GCM_SHA256;
-openssl_suite("AES256-GCM-SHA384") ->
-    ?TLS_RSA_WITH_AES_256_GCM_SHA384;
-openssl_suite("DHE-RSA-AES128-GCM-SHA256") ->
-    ?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256;
-openssl_suite("DHE-RSA-AES256-GCM-SHA384") ->
-    ?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384;
-openssl_suite("DH-RSA-AES128-GCM-SHA256") ->
-    ?TLS_DH_RSA_WITH_AES_128_GCM_SHA256;
-openssl_suite("DH-RSA-AES256-GCM-SHA384") ->
-    ?TLS_DH_RSA_WITH_AES_256_GCM_SHA384;
-openssl_suite("DHE-DSS-AES128-GCM-SHA256") ->
-    ?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256;
-openssl_suite("DHE-DSS-AES256-GCM-SHA384") ->
-    ?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384;
-openssl_suite("DH-DSS-AES128-GCM-SHA256") ->
-    ?TLS_DH_DSS_WITH_AES_128_GCM_SHA256;
-openssl_suite("DH-DSS-AES256-GCM-SHA384") ->
-    ?TLS_DH_DSS_WITH_AES_256_GCM_SHA384;
-
-%% RFC 5289 ECC AES-GCM Cipher Suites
-openssl_suite("ECDHE-ECDSA-AES128-GCM-SHA256") ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
-openssl_suite("ECDHE-ECDSA-AES256-GCM-SHA384") ->
-    ?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
-openssl_suite("ECDH-ECDSA-AES128-GCM-SHA256") ->
-    ?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256;
-openssl_suite("ECDH-ECDSA-AES256-GCM-SHA384") ->
-    ?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384;
-openssl_suite("ECDHE-RSA-AES128-GCM-SHA256") ->
-    ?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
-openssl_suite("ECDHE-RSA-AES256-GCM-SHA384") ->
-    ?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;
-openssl_suite("ECDH-RSA-AES128-GCM-SHA256") ->
-    ?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256;
-openssl_suite("ECDH-RSA-AES256-GCM-SHA384") ->
-    ?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384.
-
-%%--------------------------------------------------------------------
--spec openssl_suite_name(cipher_suite()) -> openssl_cipher_suite() | erl_cipher_suite().
-%%
-%% Description: Return openssl cipher suite name if possible
-%%-------------------------------------------------------------------
-openssl_suite_name(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
-    "DHE-RSA-AES256-SHA";
-openssl_suite_name(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA) ->
-    "DHE-DSS-AES256-SHA";
-openssl_suite_name(?TLS_RSA_WITH_AES_256_CBC_SHA) ->
-    "AES256-SHA";
-openssl_suite_name(?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    "EDH-RSA-DES-CBC3-SHA";
-openssl_suite_name(?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) ->
-    "EDH-DSS-DES-CBC3-SHA";
-openssl_suite_name(?TLS_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    "DES-CBC3-SHA";
-openssl_suite_name( ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA) ->
-    "DHE-RSA-AES128-SHA";
-openssl_suite_name(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA) ->
-    "DHE-DSS-AES128-SHA";
-openssl_suite_name(?TLS_RSA_WITH_AES_128_CBC_SHA) ->
-    "AES128-SHA";
-openssl_suite_name(?TLS_RSA_WITH_RC4_128_SHA) ->
-    "RC4-SHA";
-openssl_suite_name(?TLS_RSA_WITH_RC4_128_MD5) -> 
-    "RC4-MD5";
-openssl_suite_name(?TLS_DHE_RSA_WITH_DES_CBC_SHA) ->
-    "EDH-RSA-DES-CBC-SHA";
-openssl_suite_name(?TLS_RSA_WITH_DES_CBC_SHA) ->
-    "DES-CBC-SHA";
-openssl_suite_name(?TLS_RSA_WITH_NULL_SHA256) ->
-    "NULL-SHA256";
-openssl_suite_name(?TLS_RSA_WITH_AES_128_CBC_SHA256) ->
-    "AES128-SHA256";
-openssl_suite_name(?TLS_RSA_WITH_AES_256_CBC_SHA256) ->
-    "AES256-SHA256";
-openssl_suite_name(?TLS_DH_DSS_WITH_AES_128_CBC_SHA256) ->
-    "DH-DSS-AES128-SHA256";
-openssl_suite_name(?TLS_DH_RSA_WITH_AES_128_CBC_SHA256) ->
-    "DH-RSA-AES128-SHA256";
-openssl_suite_name(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256) ->
-    "DHE-DSS-AES128-SHA256";
-openssl_suite_name(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) ->
-    "DHE-RSA-AES128-SHA256";
-openssl_suite_name(?TLS_DH_DSS_WITH_AES_256_CBC_SHA256) ->
-    "DH-DSS-AES256-SHA256";
-openssl_suite_name(?TLS_DH_RSA_WITH_AES_256_CBC_SHA256) ->
-    "DH-RSA-AES256-SHA256";
-openssl_suite_name(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256) ->
-    "DHE-DSS-AES256-SHA256";
-openssl_suite_name(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) ->
-    "DHE-RSA-AES256-SHA256";
-
-%%% PSK Cipher Suites RFC 4279
-
-openssl_suite_name(?TLS_PSK_WITH_AES_256_CBC_SHA) ->
-    "PSK-AES256-CBC-SHA";
-openssl_suite_name(?TLS_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    "PSK-3DES-EDE-CBC-SHA";
-openssl_suite_name(?TLS_PSK_WITH_AES_128_CBC_SHA) ->
-    "PSK-AES128-CBC-SHA";
-openssl_suite_name(?TLS_PSK_WITH_RC4_128_SHA) ->
-    "PSK-RC4-SHA";
-
-%%% SRP Cipher Suites RFC 5054
-
-openssl_suite_name(?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    "SRP-RSA-3DES-EDE-CBC-SHA";
-openssl_suite_name(?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA) ->
-    "SRP-DSS-3DES-EDE-CBC-SHA";
-openssl_suite_name(?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) ->
-    "SRP-RSA-AES-128-CBC-SHA";
-openssl_suite_name(?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA) ->
-    "SRP-DSS-AES-128-CBC-SHA";
-openssl_suite_name(?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) ->
-    "SRP-RSA-AES-256-CBC-SHA";
-openssl_suite_name(?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA) ->
-    "SRP-DSS-AES-256-CBC-SHA";
-
-%% RFC 4492 EC TLS suites
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_RC4_128_SHA) ->
-    "ECDH-ECDSA-RC4-SHA";
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
-    "ECDH-ECDSA-DES-CBC3-SHA";
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA) ->
-    "ECDH-ECDSA-AES128-SHA";
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA) ->
-    "ECDH-ECDSA-AES256-SHA";
-
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) ->
-    "ECDHE-ECDSA-RC4-SHA";
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
-    "ECDHE-ECDSA-DES-CBC3-SHA";
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) ->
-    "ECDHE-ECDSA-AES128-SHA";
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) ->
-    "ECDHE-ECDSA-AES256-SHA";
-
-openssl_suite_name(?TLS_ECDH_RSA_WITH_RC4_128_SHA) ->
-    "ECDH-RSA-RC4-SHA";
-openssl_suite_name(?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    "ECDH-RSA-DES-CBC3-SHA";
-openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA) ->
-    "ECDH-RSA-AES128-SHA";
-openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA) ->
-    "ECDH-RSA-AES256-SHA";
-
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_RC4_128_SHA) ->
-    "ECDHE-RSA-RC4-SHA";
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    "ECDHE-RSA-DES-CBC3-SHA";
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) ->
-    "ECDHE-RSA-AES128-SHA";
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) ->
-    "ECDHE-RSA-AES256-SHA";
-
-%% RFC 5289 EC TLS suites
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) ->
-    "ECDHE-ECDSA-AES128-SHA256";
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) ->
-    "ECDHE-ECDSA-AES256-SHA384";
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256) ->
-    "ECDH-ECDSA-AES128-SHA256";
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384) ->
-    "ECDH-ECDSA-AES256-SHA384";
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) ->
-    "ECDHE-RSA-AES128-SHA256";
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) ->
-    "ECDHE-RSA-AES256-SHA384";
-openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256) ->
-    "ECDH-RSA-AES128-SHA256";
-openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384) ->
-    "ECDH-RSA-AES256-SHA384";
-
-%% RFC 5288 AES-GCM Cipher Suites
-openssl_suite_name(?TLS_RSA_WITH_AES_128_GCM_SHA256) ->
-    "AES128-GCM-SHA256";
-openssl_suite_name(?TLS_RSA_WITH_AES_256_GCM_SHA384) ->
-    "AES256-GCM-SHA384";
-openssl_suite_name(?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) ->
-    "DHE-RSA-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) ->
-    "DHE-RSA-AES256-GCM-SHA384";
-openssl_suite_name(?TLS_DH_RSA_WITH_AES_128_GCM_SHA256) ->
-    "DH-RSA-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_DH_RSA_WITH_AES_256_GCM_SHA384) ->
-    "DH-RSA-AES256-GCM-SHA384";
-openssl_suite_name(?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256) ->
-    "DHE-DSS-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384) ->
-    "DHE-DSS-AES256-GCM-SHA384";
-openssl_suite_name(?TLS_DH_DSS_WITH_AES_128_GCM_SHA256) ->
-    "DH-DSS-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_DH_DSS_WITH_AES_256_GCM_SHA384) ->
-    "DH-DSS-AES256-GCM-SHA384";
-
-%% RFC 5289 ECC AES-GCM Cipher Suites
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) ->
-    "ECDHE-ECDSA-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) ->
-    "ECDHE-ECDSA-AES256-GCM-SHA384";
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256) ->
-    "ECDH-ECDSA-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384) ->
-    "ECDH-ECDSA-AES256-GCM-SHA384";
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) ->
-    "ECDHE-RSA-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) ->
-    "ECDHE-RSA-AES256-GCM-SHA384";
-openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256) ->
-    "ECDH-RSA-AES128-GCM-SHA256";
-openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384) ->
-    "ECDH-RSA-AES256-GCM-SHA384";
-
-%% No oppenssl name
-openssl_suite_name(Cipher) ->
-    suite_definition(Cipher).
-
-%%--------------------------------------------------------------------
--spec filter(undefined | binary(), [cipher_suite()], ssl_record:ssl_version()) -> [cipher_suite()].
+-spec filter(undefined | binary(), [ssl_cipher_format:cipher_suite()], 
+             ssl_record:ssl_version()) -> [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Select the cipher suites that can be used together with the 
 %% supplied certificate. (Server side functionality)  
@@ -2262,8 +534,8 @@ filter(DerCert, Ciphers0, Version) ->
     filter_suites_signature(Sign, Ciphers, Version).
 
 %%--------------------------------------------------------------------
--spec filter_suites([erl_cipher_suite()] | [cipher_suite()], map()) ->
-                           [erl_cipher_suite()] |  [cipher_suite()].
+-spec filter_suites([ssl_cipher_format:erl_cipher_suite()] | [ssl_cipher_format:cipher_suite()], map()) ->
+                           [ssl_cipher_format:erl_cipher_suite()] |  [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Filter suites using supplied filter funs
 %%-------------------------------------------------------------------	
@@ -2286,11 +558,11 @@ filter_suite(#{key_exchange := KeyExchange,
         all_filters(Hash, HashFilters) andalso
         all_filters(Prf, PrfFilters);
 filter_suite(Suite, Filters) ->
-    filter_suite(suite_definition(Suite), Filters).
+    filter_suite(ssl_cipher_format:suite_definition(Suite), Filters).
 
 %%--------------------------------------------------------------------
--spec filter_suites([erl_cipher_suite()] | [cipher_suite()]) -> 
-                           [erl_cipher_suite()] | [cipher_suite()].
+-spec filter_suites([ssl_cipher_format:erl_cipher_suite()] | [ssl_cipher_format:cipher_suite()]) -> 
+                           [ssl_cipher_format:erl_cipher_suite()] | [ssl_cipher_format:cipher_suite()].
 %%
 %% Description: Filter suites for algorithms supported by crypto.
 %%-------------------------------------------------------------------
diff --git a/lib/ssl/src/ssl_cipher_format.erl b/lib/ssl/src/ssl_cipher_format.erl
new file mode 100644
index 0000000000..c311c0d097
--- /dev/null
+++ b/lib/ssl/src/ssl_cipher_format.erl
@@ -0,0 +1,1764 @@
+%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2018-2018. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+%%----------------------------------------------------------------------
+%% Purpose: Convert between diffrent cipher suite representations
+%% 
+%%----------------------------------------------------------------------
+-module(ssl_cipher_format).
+
+-include("ssl_cipher.hrl").
+-include("ssl_internal.hrl").
+-include_lib("public_key/include/public_key.hrl").
+
+-export_type([cipher_suite/0,
+	      erl_cipher_suite/0, old_erl_cipher_suite/0, openssl_cipher_suite/0,
+	      hash/0, key_algo/0, sign_algo/0]).
+
+-type cipher()            :: null |rc4_128 | des_cbc | '3des_ede_cbc' | aes_128_cbc |  aes_256_cbc | aes_128_gcm | aes_256_gcm | chacha20_poly1305.
+-type hash()              :: null | md5 | sha | sha224 | sha256 | sha384 | sha512.
+-type sign_algo()         :: rsa | dsa | ecdsa.
+-type key_algo()          :: null | rsa | dhe_rsa | dhe_dss | ecdhe_ecdsa| ecdh_ecdsa | ecdh_rsa| srp_rsa| srp_dss | psk | dhe_psk | rsa_psk | dh_anon | ecdh_anon | srp_anon.
+-type erl_cipher_suite()  :: #{key_exchange := key_algo(),
+                               cipher := cipher(),
+                               mac    := hash() | aead,
+                               prf    := hash() | default_prf %% Old cipher suites, version dependent
+                              }.  
+-type old_erl_cipher_suite() :: {key_algo(), cipher(), hash()} % Pre TLS 1.2 
+                                %% TLS 1.2, internally PRE TLS 1.2 will use default_prf
+                              | {key_algo(), cipher(), hash(), hash() | default_prf}. 
+-type cipher_suite()      :: binary().
+-type openssl_cipher_suite()  :: string().
+
+
+-export([suite_to_str/1, suite_definition/1, suite/1, erl_suite_definition/1, 
+         openssl_suite/1, openssl_suite_name/1]).
+
+%%--------------------------------------------------------------------
+-spec suite_to_str(erl_cipher_suite()) -> string().
+%%
+%% Description: Return the string representation of a cipher suite.
+%%--------------------------------------------------------------------
+suite_to_str(#{key_exchange := null,
+               cipher := null,
+               mac := null,
+               prf := null}) ->
+    "TLS_EMPTY_RENEGOTIATION_INFO_SCSV";
+suite_to_str(#{key_exchange := Kex,
+               cipher := Cipher,
+               mac := aead,
+               prf := PRF}) ->
+    "TLS_" ++ string:to_upper(atom_to_list(Kex)) ++
+        "_WITH_" ++  string:to_upper(atom_to_list(Cipher)) ++
+        "_" ++ string:to_upper(atom_to_list(PRF));
+suite_to_str(#{key_exchange := Kex,
+               cipher := Cipher,
+               mac := Mac}) ->
+    "TLS_" ++ string:to_upper(atom_to_list(Kex)) ++
+        "_WITH_" ++  string:to_upper(atom_to_list(Cipher)) ++
+        "_" ++ string:to_upper(atom_to_list(Mac)).
+
+%%--------------------------------------------------------------------
+-spec suite_definition(cipher_suite()) -> erl_cipher_suite().
+%%
+%% Description: Return erlang cipher suite definition.
+%% Note: Currently not supported suites are commented away.
+%% They should be supported or removed in the future.
+%%-------------------------------------------------------------------
+%% TLS v1.1 suites
+suite_definition(?TLS_NULL_WITH_NULL_NULL) ->
+    #{key_exchange => null,
+      cipher => null, 
+      mac => null, 
+      prf => null};
+%% RFC 5746 - Not a real cipher suite used to signal empty "renegotiation_info" extension
+%% to avoid handshake failure from old servers that do not ignore
+%% hello extension data as they should.
+suite_definition(?TLS_EMPTY_RENEGOTIATION_INFO_SCSV) ->
+    #{key_exchange => null,
+      cipher => null, 
+      mac => null,
+      prf => null};
+suite_definition(?TLS_RSA_WITH_RC4_128_MD5) ->	
+    #{key_exchange => rsa,
+      cipher => rc4_128, 
+      mac => md5, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_WITH_RC4_128_SHA) ->
+    #{key_exchange => rsa,
+      cipher => rc4_128,
+      mac => sha,
+      prf => default_prf};
+suite_definition(?TLS_RSA_WITH_DES_CBC_SHA) ->
+    #{key_exchange => rsa,
+      cipher => des_cbc,
+      mac => sha,
+      prf => default_prf};
+suite_definition(?TLS_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => rsa,
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_DSS_WITH_DES_CBC_SHA) ->
+    #{key_exchange => dhe_dss, 
+      cipher => des_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => dhe_dss, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_RSA_WITH_DES_CBC_SHA) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => des_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+%%% TSL V1.1 AES suites
+suite_definition(?TLS_RSA_WITH_AES_128_CBC_SHA) -> 
+    #{key_exchange => rsa,
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => dhe_dss, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA) -> 
+    #{key_exchange => rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => dhe_dss, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+%% TLS v1.2 suites
+%% suite_definition(?TLS_RSA_WITH_NULL_SHA) ->
+%%     {rsa, null, sha, default_prf};
+suite_definition(?TLS_RSA_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA256) ->
+    #{key_exchange => rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => dhe_dss, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256) ->
+    #{key_exchange => dhe_dss, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+%% not defined YET:
+%%   TLS_DH_DSS_WITH_AES_128_CBC_SHA256      DH_DSS       AES_128_CBC  SHA256
+%%   TLS_DH_RSA_WITH_AES_128_CBC_SHA256      DH_RSA       AES_128_CBC  SHA256
+%%   TLS_DH_DSS_WITH_AES_256_CBC_SHA256      DH_DSS       AES_256_CBC  SHA256
+%%   TLS_DH_RSA_WITH_AES_256_CBC_SHA256      DH_RSA       AES_256_CBC  SHA256
+%%% DH-ANON deprecated by TLS spec and not available
+%%% by default, but good for testing purposes.
+suite_definition(?TLS_DH_anon_WITH_RC4_128_MD5) ->
+    #{key_exchange => dh_anon, 
+      cipher => rc4_128, 
+      mac => md5, 
+      prf => default_prf};
+suite_definition(?TLS_DH_anon_WITH_DES_CBC_SHA) ->
+    #{key_exchange => dh_anon, 
+      cipher => des_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => dh_anon, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => dh_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => dh_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => dh_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA256) ->
+    #{key_exchange => dh_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+%%% PSK Cipher Suites RFC 4279
+suite_definition(?TLS_PSK_WITH_RC4_128_SHA) ->
+    #{key_exchange => psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_PSK_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => psk, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_PSK_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_PSK_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_RC4_128_SHA) ->
+    #{key_exchange => dhe_psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => dhe_psk, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => dhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => dhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_RC4_128_SHA) ->
+    #{key_exchange => rsa_psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => rsa_psk, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => rsa_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => rsa_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+%%% PSK NULL Cipher Suites RFC 4785
+suite_definition(?TLS_PSK_WITH_NULL_SHA) ->
+    #{key_exchange => psk, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA) ->
+    #{key_exchange => dhe_psk,
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA) ->
+    #{key_exchange => rsa_psk,
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};  
+%%% TLS 1.2 PSK Cipher Suites RFC 5487
+suite_definition(?TLS_PSK_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => psk, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_PSK_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => psk, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_DHE_PSK_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => dhe_psk, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_DHE_PSK_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => dhe_psk, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_RSA_PSK_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => rsa_psk, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_RSA_PSK_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => rsa_psk, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_PSK_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_PSK_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => dhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => dhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => rsa_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => rsa_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
+suite_definition(?TLS_PSK_WITH_NULL_SHA256) ->
+    #{key_exchange => psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_PSK_WITH_NULL_SHA384) ->
+    #{key_exchange => psk, 
+      cipher => null, 
+      mac => sha384, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA256) ->
+    #{key_exchange => dhe_psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA384) ->
+    #{key_exchange => dhe_psk, 
+      cipher => null, 
+      mac => sha384, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA256) ->
+    #{key_exchange => rsa_psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA384) ->
+    #{key_exchange => rsa_psk, 
+      cipher => null, 
+      mac => sha384, 
+      prf => default_prf};
+%%% ECDHE PSK Cipher Suites RFC 5489
+suite_definition(?TLS_ECDHE_PSK_WITH_RC4_128_SHA) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => '3des_ede_cbc',
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_PSK_WITH_NULL_SHA256) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_PSK_WITH_NULL_SHA384) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => null, mac => sha384, 
+      prf => default_prf};
+%%% ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites, draft-ietf-tls-ecdhe-psk-aead-05
+suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
+suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
+%% suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256) ->
+%%     #{key_exchange => ecdhe_psk, 
+%%       cipher => aes_128_ccm, 
+%%       mac => null, 
+%%       prf =>sha256};
+%% suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256) ->
+%%     #{key_exchange => ecdhe_psk, 
+%%       cipher => aes_256_ccm, 
+%%       mac => null, 
+%%       prf => sha256};
+%%% SRP Cipher Suites RFC 5054
+suite_definition(?TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => srp_anon, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => srp_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => srp_dss, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => srp_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => srp_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => srp_dss, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => srp_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => srp_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => srp_dss, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+%% RFC 4492 EC TLS suites
+suite_definition(?TLS_ECDH_ECDSA_WITH_NULL_SHA) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_ECDSA_WITH_RC4_128_SHA) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_NULL_SHA) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_RSA_WITH_NULL_SHA) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_RSA_WITH_RC4_128_SHA) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_RSA_WITH_NULL_SHA) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_RSA_WITH_RC4_128_SHA) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_anon_WITH_NULL_SHA) ->
+    #{key_exchange => ecdh_anon, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_anon_WITH_RC4_128_SHA) ->
+    #{key_exchange => ecdh_anon, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA) ->
+    #{key_exchange => ecdh_anon, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_anon_WITH_AES_128_CBC_SHA) ->
+    #{key_exchange => ecdh_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
+suite_definition(?TLS_ECDH_anon_WITH_AES_256_CBC_SHA) ->
+    #{key_exchange => ecdh_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
+%% RFC 5289 EC TLS suites
+suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
+suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
+suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
+suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
+suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
+suite_definition(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
+suite_definition(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
+%% RFC 5288 AES-GCM Cipher Suites
+suite_definition(?TLS_RSA_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => rsa, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_RSA_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => rsa, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_DH_RSA_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => dh_rsa, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_DH_RSA_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => dh_rsa, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => dhe_dss, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => dhe_dss, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_DH_DSS_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => dh_dss, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
+suite_definition(?TLS_DH_DSS_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => dh_dss, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_DH_anon_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => dh_anon, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_DH_anon_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => dh_anon, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+%% RFC 5289 ECC AES-GCM Cipher Suites
+suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+suite_definition(?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_128_gcm, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384) ->
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_256_gcm, 
+      mac => aead, 
+      prf => sha384};
+%% draft-agl-tls-chacha20poly1305-04 Chacha20/Poly1305 Suites
+suite_definition(?TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) ->
+    #{key_exchange => ecdhe_rsa, 
+      cipher => chacha20_poly1305, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) ->
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => chacha20_poly1305, 
+      mac => aead, 
+      prf => sha256};
+suite_definition(?TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256) ->
+    #{key_exchange => dhe_rsa, 
+      cipher => chacha20_poly1305, 
+      mac => aead, 
+      prf => sha256}.
+
+%%--------------------------------------------------------------------
+-spec erl_suite_definition(cipher_suite() | erl_cipher_suite()) -> old_erl_cipher_suite().
+%%
+%% Description: Return erlang cipher suite definition. Filters last value
+%% for now (compatibility reasons).
+%%--------------------------------------------------------------------
+erl_suite_definition(Bin) when is_binary(Bin) ->
+    erl_suite_definition(suite_definition(Bin));    
+erl_suite_definition(#{key_exchange := KeyExchange, cipher := Cipher,
+                       mac := Hash, prf := Prf}) ->
+    case Prf of
+        default_prf ->
+	    {KeyExchange, Cipher, Hash};
+	_ ->
+            {KeyExchange, Cipher, Hash, Prf}
+    end.
+
+%%--------------------------------------------------------------------
+-spec suite(erl_cipher_suite()) -> cipher_suite().
+%%
+%% Description: Return TLS cipher suite definition.
+%%--------------------------------------------------------------------
+%% TLS v1.1 suites
+suite(#{key_exchange := rsa, 
+        cipher := rc4_128, 
+        mac := md5}) ->
+    ?TLS_RSA_WITH_RC4_128_MD5;
+suite(#{key_exchange := rsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
+    ?TLS_RSA_WITH_RC4_128_SHA;
+suite(#{key_exchange := rsa, 
+        cipher := des_cbc, 
+        mac := sha}) ->
+    ?TLS_RSA_WITH_DES_CBC_SHA; 
+suite(#{key_exchange := rsa, 
+        cipher :='3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_RSA_WITH_3DES_EDE_CBC_SHA; 
+suite(#{key_exchange := dhe_dss,  
+        cipher:= des_cbc, 
+        mac := sha}) ->
+    ?TLS_DHE_DSS_WITH_DES_CBC_SHA;
+suite(#{key_exchange := dhe_dss, 
+        cipher:= '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := dhe_rsa, 
+        cipher:= des_cbc,
+        mac := sha}) ->
+    ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
+suite(#{key_exchange := dhe_rsa, 
+        cipher:= '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA; 
+suite(#{key_exchange := dh_anon, 
+        cipher:= rc4_128,
+        mac := md5}) ->
+    ?TLS_DH_anon_WITH_RC4_128_MD5;
+suite(#{key_exchange := dh_anon, 
+        cipher:= des_cbc,  
+        mac := sha}) ->
+    ?TLS_DH_anon_WITH_DES_CBC_SHA;
+suite(#{key_exchange := dh_anon, 
+        cipher:= '3des_ede_cbc',
+        mac := sha}) ->
+    ?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
+%%% TSL V1.1 AES suites
+suite(#{key_exchange := rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_RSA_WITH_AES_128_CBC_SHA; 
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA; 
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_DH_anon_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := rsa, 
+        cipher := aes_256_cbc,  
+        mac := sha}) ->
+    ?TLS_RSA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_DH_anon_WITH_AES_256_CBC_SHA;
+%% TLS v1.2 suites
+suite(#{key_exchange := rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
+    ?TLS_RSA_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
+    ?TLS_RSA_WITH_AES_256_CBC_SHA256;
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
+    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
+    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
+    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256;
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
+    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
+    ?TLS_DH_anon_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
+    ?TLS_DH_anon_WITH_AES_256_CBC_SHA256;
+%%% PSK Cipher Suites RFC 4279
+suite(#{key_exchange := psk, 
+        cipher := rc4_128,
+        mac := sha}) ->
+    ?TLS_PSK_WITH_RC4_128_SHA;
+suite(#{key_exchange := psk, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_PSK_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := psk, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_PSK_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := psk, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_PSK_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := dhe_psk, 
+        cipher := rc4_128, 
+        mac := sha})  ->
+    ?TLS_DHE_PSK_WITH_RC4_128_SHA;
+suite(#{key_exchange := dhe_psk, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_DHE_PSK_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_DHE_PSK_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := rsa_psk, 
+        cipher := rc4_128, 
+        mac := sha}) ->
+    ?TLS_RSA_PSK_WITH_RC4_128_SHA;
+suite(#{key_exchange := rsa_psk, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA;
+%%% PSK NULL Cipher Suites RFC 4785
+suite(#{key_exchange := psk, 
+        cipher := null, 
+        mac := sha}) ->
+    ?TLS_PSK_WITH_NULL_SHA;
+suite(#{key_exchange := dhe_psk, 
+        cipher := null, 
+        mac := sha}) ->
+    ?TLS_DHE_PSK_WITH_NULL_SHA;
+suite(#{key_exchange := rsa_psk, 
+       cipher := null, 
+       mac := sha}) ->
+    ?TLS_RSA_PSK_WITH_NULL_SHA;
+%%% TLS 1.2 PSK Cipher Suites RFC 5487
+suite(#{key_exchange := psk, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_PSK_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := psk, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_PSK_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_DHE_PSK_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_DHE_PSK_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_RSA_PSK_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_RSA_PSK_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := psk, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
+    ?TLS_PSK_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := psk, 
+        cipher := aes_256_cbc, 
+        mac := sha384}) ->
+    ?TLS_PSK_WITH_AES_256_CBC_SHA384;
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
+    ?TLS_DHE_PSK_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha384}) ->
+    ?TLS_DHE_PSK_WITH_AES_256_CBC_SHA384;
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
+    ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha384}) ->
+    ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA384;
+suite(#{key_exchange := psk, 
+        cipher := null, 
+        mac := sha256}) ->
+    ?TLS_PSK_WITH_NULL_SHA256;
+suite(#{key_exchange := psk, 
+        cipher := null,
+        mac := sha384}) ->
+    ?TLS_PSK_WITH_NULL_SHA384;
+suite(#{key_exchange := dhe_psk, 
+        cipher := null, 
+        mac := sha256}) ->
+    ?TLS_DHE_PSK_WITH_NULL_SHA256;
+suite(#{key_exchange := dhe_psk, 
+        cipher := null, 
+        mac := sha384}) ->
+    ?TLS_DHE_PSK_WITH_NULL_SHA384;
+suite(#{key_exchange := rsa_psk, 
+        cipher := null,  
+        mac := sha256}) ->
+    ?TLS_RSA_PSK_WITH_NULL_SHA256;
+suite(#{key_exchange := rsa_psk, 
+       cipher := null, 
+       mac := sha384}) ->
+    ?TLS_RSA_PSK_WITH_NULL_SHA384;
+%%% ECDHE PSK Cipher Suites RFC 5489
+suite(#{key_exchange := ecdhe_psk, 
+        cipher := rc4_128,
+        mac := sha}) ->
+    ?TLS_ECDHE_PSK_WITH_RC4_128_SHA;
+suite(#{key_exchange := ecdhe_psk, 
+        cipher :='3des_ede_cbc',
+        mac := sha}) ->
+    ?TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := ecdhe_psk, 
+        cipher := aes_128_cbc,
+        mac := sha}) ->
+    ?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := ecdhe_psk, 
+        cipher := aes_256_cbc,
+        mac := sha}) ->
+    ?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_128_cbc, 
+       mac := sha256}) ->
+    ?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_256_cbc, 
+       mac := sha384}) ->
+    ?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384;
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := null, 
+       mac := sha256}) ->
+    ?TLS_ECDHE_PSK_WITH_NULL_SHA256;
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := null, 
+       mac := sha384}) ->
+    ?TLS_ECDHE_PSK_WITH_NULL_SHA384;
+%%% ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites, draft-ietf-tls-ecdhe-psk-aead-05
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_128_gcm, 
+       mac := null, 
+       prf := sha256}) ->
+    ?TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_256_gcm, 
+       mac := null, 
+       prf := sha384}) ->
+    ?TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384;
+ %% suite(#{key_exchange := ecdhe_psk, 
+ %%        cipher := aes_128_ccm, 
+ %%        mac := null, 
+ %%        prf := sha256}) ->
+ %%    ?TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256;
+ %% suite(#{key_exchange := ecdhe_psk, 
+ %%         cipher := aes_256_ccm, 
+ %%         mac := null, 
+ %%         prf := sha256}) ->
+ %%    ?TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256;
+%%% SRP Cipher Suites RFC 5054
+suite(#{key_exchange := srp_anon, 
+        cipher := '3des_ede_cbc',
+        mac :=  sha}) ->
+    ?TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := srp_rsa, 
+        cipher := '3des_ede_cbc',
+        mac := sha}) ->
+    ?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := srp_dss, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := srp_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_SRP_SHA_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := srp_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := srp_dss, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := srp_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_SRP_SHA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := srp_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := srp_dss, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA;
+%%% RFC 4492 EC TLS suites
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := null, 
+        mac := sha}) ->
+    ?TLS_ECDH_ECDSA_WITH_NULL_SHA;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := rc4_128,  
+        mac := sha})  ->
+    ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := null, 
+        mac := sha}) ->
+    ?TLS_ECDHE_ECDSA_WITH_NULL_SHA;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
+    ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := null, 
+        mac := sha}) ->
+    ?TLS_ECDH_RSA_WITH_NULL_SHA;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
+    ?TLS_ECDH_RSA_WITH_RC4_128_SHA;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := '3des_ede_cbc', mac := sha}) ->
+    ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := null, 
+        mac := sha}) ->
+    ?TLS_ECDHE_RSA_WITH_NULL_SHA;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
+    ?TLS_ECDHE_RSA_WITH_RC4_128_SHA;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
+    ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;
+suite(#{key_exchange := ecdh_anon, 
+        cipher := null, 
+        mac := sha}) ->
+    ?TLS_ECDH_anon_WITH_NULL_SHA;
+suite(#{key_exchange := ecdh_anon, 
+        cipher := rc4_128, 
+        mac := sha}) ->
+    ?TLS_ECDH_anon_WITH_RC4_128_SHA;
+suite(#{key_exchange := ecdh_anon, 
+        cipher := '3des_ede_cbc', 
+        mac :=  sha}) ->
+    ?TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA;
+suite(#{key_exchange := ecdh_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDH_anon_WITH_AES_128_CBC_SHA;
+suite(#{key_exchange := ecdh_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
+    ?TLS_ECDH_anon_WITH_AES_256_CBC_SHA;
+%%% RFC 5289 EC TLS suites
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac:= sha256, 
+        prf := sha256}) ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256, 
+        prf := sha256}) ->
+    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
+    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256, 
+        prf := sha256}) ->
+    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
+    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256, 
+        prf := sha256}) ->
+    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
+    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384;
+%% RFC 5288 AES-GCM Cipher Suites
+suite(#{key_exchange := rsa, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_RSA_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := rsa, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_RSA_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := dh_rsa, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_DH_RSA_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := dh_rsa, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_DH_RSA_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := dh_dss, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_DH_DSS_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := dh_dss, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_DH_DSS_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_DH_anon_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_DH_anon_WITH_AES_256_GCM_SHA384;
+%% RFC 5289 ECC AES-GCM Cipher Suites
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_128_gcm, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256;
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_256_gcm, 
+        mac := aead, 
+        prf := sha384}) ->
+    ?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384;
+%% draft-agl-tls-chacha20poly1305-04 Chacha20/Poly1305 Suites
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := chacha20_poly1305,  
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256;
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := chacha20_poly1305, 
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256;
+suite(#{key_exchange := dhe_rsa, 
+        cipher := chacha20_poly1305,  
+        mac := aead, 
+        prf := sha256}) ->
+    ?TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
+
+%%--------------------------------------------------------------------
+-spec openssl_suite(openssl_cipher_suite()) -> cipher_suite().
+%%
+%% Description: Return TLS cipher suite definition.
+%%--------------------------------------------------------------------
+%% translate constants <-> openssl-strings
+openssl_suite("DHE-RSA-AES256-SHA256") ->
+    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
+openssl_suite("DHE-DSS-AES256-SHA256") ->
+    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256;
+openssl_suite("AES256-SHA256") ->
+    ?TLS_RSA_WITH_AES_256_CBC_SHA256;
+openssl_suite("DHE-RSA-AES128-SHA256") ->
+    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
+openssl_suite("DHE-DSS-AES128-SHA256") ->
+    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256;
+openssl_suite("AES128-SHA256") ->
+    ?TLS_RSA_WITH_AES_128_CBC_SHA256;
+openssl_suite("DHE-RSA-AES256-SHA") ->
+    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
+openssl_suite("DHE-DSS-AES256-SHA") ->
+    ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
+openssl_suite("AES256-SHA") ->
+    ?TLS_RSA_WITH_AES_256_CBC_SHA;
+openssl_suite("EDH-RSA-DES-CBC3-SHA") ->
+    ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("EDH-DSS-DES-CBC3-SHA") ->
+    ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("DES-CBC3-SHA") ->
+    ?TLS_RSA_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("DHE-RSA-AES128-SHA") ->
+    ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
+openssl_suite("DHE-DSS-AES128-SHA") ->
+    ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA;
+openssl_suite("AES128-SHA") ->
+    ?TLS_RSA_WITH_AES_128_CBC_SHA;
+openssl_suite("RC4-SHA") ->
+    ?TLS_RSA_WITH_RC4_128_SHA;
+openssl_suite("RC4-MD5") -> 
+    ?TLS_RSA_WITH_RC4_128_MD5;
+openssl_suite("EDH-RSA-DES-CBC-SHA") ->
+    ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
+openssl_suite("DES-CBC-SHA") ->
+    ?TLS_RSA_WITH_DES_CBC_SHA;
+
+%%% SRP Cipher Suites RFC 5054
+
+openssl_suite("SRP-DSS-AES-256-CBC-SHA") ->
+    ?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA;
+openssl_suite("SRP-RSA-AES-256-CBC-SHA") ->
+    ?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA;
+openssl_suite("SRP-DSS-3DES-EDE-CBC-SHA") ->
+    ?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("SRP-RSA-3DES-EDE-CBC-SHA") ->
+    ?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("SRP-DSS-AES-128-CBC-SHA") ->
+    ?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA;
+openssl_suite("SRP-RSA-AES-128-CBC-SHA") ->
+    ?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA;
+
+%% RFC 4492 EC TLS suites
+openssl_suite("ECDH-ECDSA-RC4-SHA") ->
+    ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA;
+openssl_suite("ECDH-ECDSA-DES-CBC3-SHA") ->
+    ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("ECDH-ECDSA-AES128-SHA") ->
+    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA;
+openssl_suite("ECDH-ECDSA-AES256-SHA") ->
+    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA;
+
+openssl_suite("ECDHE-ECDSA-RC4-SHA") ->
+    ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA;
+openssl_suite("ECDHE-ECDSA-DES-CBC3-SHA") ->
+    ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("ECDHE-ECDSA-AES128-SHA") ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA;
+openssl_suite("ECDHE-ECDSA-AES256-SHA") ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA;
+
+openssl_suite("ECDHE-RSA-RC4-SHA") ->
+    ?TLS_ECDHE_RSA_WITH_RC4_128_SHA;
+openssl_suite("ECDHE-RSA-DES-CBC3-SHA") ->
+    ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("ECDHE-RSA-AES128-SHA") ->
+    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;
+openssl_suite("ECDHE-RSA-AES256-SHA") ->
+    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;
+
+openssl_suite("ECDH-RSA-RC4-SHA") ->
+    ?TLS_ECDH_RSA_WITH_RC4_128_SHA;
+openssl_suite("ECDH-RSA-DES-CBC3-SHA") ->
+    ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA;
+openssl_suite("ECDH-RSA-AES128-SHA") ->
+    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA;
+openssl_suite("ECDH-RSA-AES256-SHA") ->
+    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA;
+
+%% RFC 5289 EC TLS suites
+openssl_suite("ECDHE-ECDSA-AES128-SHA256") ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
+openssl_suite("ECDHE-ECDSA-AES256-SHA384") ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;
+openssl_suite("ECDH-ECDSA-AES128-SHA256") ->
+    ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256;
+openssl_suite("ECDH-ECDSA-AES256-SHA384") ->
+    ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384;
+openssl_suite("ECDHE-RSA-AES128-SHA256") ->
+    ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
+openssl_suite("ECDHE-RSA-AES256-SHA384") ->
+    ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;
+openssl_suite("ECDH-RSA-AES128-SHA256") ->
+    ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256;
+openssl_suite("ECDH-RSA-AES256-SHA384") ->
+    ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384;
+
+%% RFC 5288 AES-GCM Cipher Suites
+openssl_suite("AES128-GCM-SHA256") ->
+    ?TLS_RSA_WITH_AES_128_GCM_SHA256;
+openssl_suite("AES256-GCM-SHA384") ->
+    ?TLS_RSA_WITH_AES_256_GCM_SHA384;
+openssl_suite("DHE-RSA-AES128-GCM-SHA256") ->
+    ?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256;
+openssl_suite("DHE-RSA-AES256-GCM-SHA384") ->
+    ?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384;
+openssl_suite("DH-RSA-AES128-GCM-SHA256") ->
+    ?TLS_DH_RSA_WITH_AES_128_GCM_SHA256;
+openssl_suite("DH-RSA-AES256-GCM-SHA384") ->
+    ?TLS_DH_RSA_WITH_AES_256_GCM_SHA384;
+openssl_suite("DHE-DSS-AES128-GCM-SHA256") ->
+    ?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256;
+openssl_suite("DHE-DSS-AES256-GCM-SHA384") ->
+    ?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384;
+openssl_suite("DH-DSS-AES128-GCM-SHA256") ->
+    ?TLS_DH_DSS_WITH_AES_128_GCM_SHA256;
+openssl_suite("DH-DSS-AES256-GCM-SHA384") ->
+    ?TLS_DH_DSS_WITH_AES_256_GCM_SHA384;
+
+%% RFC 5289 ECC AES-GCM Cipher Suites
+openssl_suite("ECDHE-ECDSA-AES128-GCM-SHA256") ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
+openssl_suite("ECDHE-ECDSA-AES256-GCM-SHA384") ->
+    ?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
+openssl_suite("ECDH-ECDSA-AES128-GCM-SHA256") ->
+    ?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256;
+openssl_suite("ECDH-ECDSA-AES256-GCM-SHA384") ->
+    ?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384;
+openssl_suite("ECDHE-RSA-AES128-GCM-SHA256") ->
+    ?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
+openssl_suite("ECDHE-RSA-AES256-GCM-SHA384") ->
+    ?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;
+openssl_suite("ECDH-RSA-AES128-GCM-SHA256") ->
+    ?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256;
+openssl_suite("ECDH-RSA-AES256-GCM-SHA384") ->
+    ?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384.
+
+%%--------------------------------------------------------------------
+-spec openssl_suite_name(cipher_suite()) -> openssl_cipher_suite() | erl_cipher_suite().
+%%
+%% Description: Return openssl cipher suite name if possible
+%%-------------------------------------------------------------------
+openssl_suite_name(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
+    "DHE-RSA-AES256-SHA";
+openssl_suite_name(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA) ->
+    "DHE-DSS-AES256-SHA";
+openssl_suite_name(?TLS_RSA_WITH_AES_256_CBC_SHA) ->
+    "AES256-SHA";
+openssl_suite_name(?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    "EDH-RSA-DES-CBC3-SHA";
+openssl_suite_name(?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) ->
+    "EDH-DSS-DES-CBC3-SHA";
+openssl_suite_name(?TLS_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    "DES-CBC3-SHA";
+openssl_suite_name( ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA) ->
+    "DHE-RSA-AES128-SHA";
+openssl_suite_name(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA) ->
+    "DHE-DSS-AES128-SHA";
+openssl_suite_name(?TLS_RSA_WITH_AES_128_CBC_SHA) ->
+    "AES128-SHA";
+openssl_suite_name(?TLS_RSA_WITH_RC4_128_SHA) ->
+    "RC4-SHA";
+openssl_suite_name(?TLS_RSA_WITH_RC4_128_MD5) -> 
+    "RC4-MD5";
+openssl_suite_name(?TLS_DHE_RSA_WITH_DES_CBC_SHA) ->
+    "EDH-RSA-DES-CBC-SHA";
+openssl_suite_name(?TLS_RSA_WITH_DES_CBC_SHA) ->
+    "DES-CBC-SHA";
+openssl_suite_name(?TLS_RSA_WITH_NULL_SHA256) ->
+    "NULL-SHA256";
+openssl_suite_name(?TLS_RSA_WITH_AES_128_CBC_SHA256) ->
+    "AES128-SHA256";
+openssl_suite_name(?TLS_RSA_WITH_AES_256_CBC_SHA256) ->
+    "AES256-SHA256";
+openssl_suite_name(?TLS_DH_DSS_WITH_AES_128_CBC_SHA256) ->
+    "DH-DSS-AES128-SHA256";
+openssl_suite_name(?TLS_DH_RSA_WITH_AES_128_CBC_SHA256) ->
+    "DH-RSA-AES128-SHA256";
+openssl_suite_name(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256) ->
+    "DHE-DSS-AES128-SHA256";
+openssl_suite_name(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) ->
+    "DHE-RSA-AES128-SHA256";
+openssl_suite_name(?TLS_DH_DSS_WITH_AES_256_CBC_SHA256) ->
+    "DH-DSS-AES256-SHA256";
+openssl_suite_name(?TLS_DH_RSA_WITH_AES_256_CBC_SHA256) ->
+    "DH-RSA-AES256-SHA256";
+openssl_suite_name(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256) ->
+    "DHE-DSS-AES256-SHA256";
+openssl_suite_name(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) ->
+    "DHE-RSA-AES256-SHA256";
+
+%%% PSK Cipher Suites RFC 4279
+
+openssl_suite_name(?TLS_PSK_WITH_AES_256_CBC_SHA) ->
+    "PSK-AES256-CBC-SHA";
+openssl_suite_name(?TLS_PSK_WITH_3DES_EDE_CBC_SHA) ->
+    "PSK-3DES-EDE-CBC-SHA";
+openssl_suite_name(?TLS_PSK_WITH_AES_128_CBC_SHA) ->
+    "PSK-AES128-CBC-SHA";
+openssl_suite_name(?TLS_PSK_WITH_RC4_128_SHA) ->
+    "PSK-RC4-SHA";
+
+%%% SRP Cipher Suites RFC 5054
+
+openssl_suite_name(?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    "SRP-RSA-3DES-EDE-CBC-SHA";
+openssl_suite_name(?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA) ->
+    "SRP-DSS-3DES-EDE-CBC-SHA";
+openssl_suite_name(?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) ->
+    "SRP-RSA-AES-128-CBC-SHA";
+openssl_suite_name(?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA) ->
+    "SRP-DSS-AES-128-CBC-SHA";
+openssl_suite_name(?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) ->
+    "SRP-RSA-AES-256-CBC-SHA";
+openssl_suite_name(?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA) ->
+    "SRP-DSS-AES-256-CBC-SHA";
+
+%% RFC 4492 EC TLS suites
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_RC4_128_SHA) ->
+    "ECDH-ECDSA-RC4-SHA";
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
+    "ECDH-ECDSA-DES-CBC3-SHA";
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA) ->
+    "ECDH-ECDSA-AES128-SHA";
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA) ->
+    "ECDH-ECDSA-AES256-SHA";
+
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) ->
+    "ECDHE-ECDSA-RC4-SHA";
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
+    "ECDHE-ECDSA-DES-CBC3-SHA";
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) ->
+    "ECDHE-ECDSA-AES128-SHA";
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) ->
+    "ECDHE-ECDSA-AES256-SHA";
+
+openssl_suite_name(?TLS_ECDH_RSA_WITH_RC4_128_SHA) ->
+    "ECDH-RSA-RC4-SHA";
+openssl_suite_name(?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    "ECDH-RSA-DES-CBC3-SHA";
+openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA) ->
+    "ECDH-RSA-AES128-SHA";
+openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA) ->
+    "ECDH-RSA-AES256-SHA";
+
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_RC4_128_SHA) ->
+    "ECDHE-RSA-RC4-SHA";
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
+    "ECDHE-RSA-DES-CBC3-SHA";
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) ->
+    "ECDHE-RSA-AES128-SHA";
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) ->
+    "ECDHE-RSA-AES256-SHA";
+
+%% RFC 5289 EC TLS suites
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) ->
+    "ECDHE-ECDSA-AES128-SHA256";
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) ->
+    "ECDHE-ECDSA-AES256-SHA384";
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256) ->
+    "ECDH-ECDSA-AES128-SHA256";
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384) ->
+    "ECDH-ECDSA-AES256-SHA384";
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) ->
+    "ECDHE-RSA-AES128-SHA256";
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) ->
+    "ECDHE-RSA-AES256-SHA384";
+openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256) ->
+    "ECDH-RSA-AES128-SHA256";
+openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384) ->
+    "ECDH-RSA-AES256-SHA384";
+
+%% RFC 5288 AES-GCM Cipher Suites
+openssl_suite_name(?TLS_RSA_WITH_AES_128_GCM_SHA256) ->
+    "AES128-GCM-SHA256";
+openssl_suite_name(?TLS_RSA_WITH_AES_256_GCM_SHA384) ->
+    "AES256-GCM-SHA384";
+openssl_suite_name(?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) ->
+    "DHE-RSA-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) ->
+    "DHE-RSA-AES256-GCM-SHA384";
+openssl_suite_name(?TLS_DH_RSA_WITH_AES_128_GCM_SHA256) ->
+    "DH-RSA-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_DH_RSA_WITH_AES_256_GCM_SHA384) ->
+    "DH-RSA-AES256-GCM-SHA384";
+openssl_suite_name(?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256) ->
+    "DHE-DSS-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384) ->
+    "DHE-DSS-AES256-GCM-SHA384";
+openssl_suite_name(?TLS_DH_DSS_WITH_AES_128_GCM_SHA256) ->
+    "DH-DSS-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_DH_DSS_WITH_AES_256_GCM_SHA384) ->
+    "DH-DSS-AES256-GCM-SHA384";
+
+%% RFC 5289 ECC AES-GCM Cipher Suites
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) ->
+    "ECDHE-ECDSA-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) ->
+    "ECDHE-ECDSA-AES256-GCM-SHA384";
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256) ->
+    "ECDH-ECDSA-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384) ->
+    "ECDH-ECDSA-AES256-GCM-SHA384";
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) ->
+    "ECDHE-RSA-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) ->
+    "ECDHE-RSA-AES256-GCM-SHA384";
+openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256) ->
+    "ECDH-RSA-AES128-GCM-SHA256";
+openssl_suite_name(?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384) ->
+    "ECDH-RSA-AES256-GCM-SHA384";
+
+%% No oppenssl name
+openssl_suite_name(Cipher) ->
+    suite_definition(Cipher).
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 6e98baf984..7cc5da49b8 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -542,7 +542,7 @@ handle_session(#server_hello{cipher_suite = CipherSuite,
 		      negotiated_version = ReqVersion,
 		      negotiated_protocol = CurrentProtocol} = State0) ->
     #{key_exchange := KeyAlgorithm} =
-	ssl_cipher:suite_definition(CipherSuite),
+	ssl_cipher_format:suite_definition(CipherSuite),
     
     PremasterSecret = make_premaster_secret(ReqVersion, KeyAlgorithm),
 
@@ -1490,7 +1490,7 @@ connection_info(#state{sni_hostname = SNIHostname,
 		       negotiated_version =  {_,_} = Version, 
 		       ssl_options = Opts}) ->
     RecordCB = record_cb(Connection),
-    CipherSuiteDef = #{key_exchange := KexAlg} = ssl_cipher:suite_definition(CipherSuite),
+    CipherSuiteDef = #{key_exchange := KexAlg} = ssl_cipher_format:suite_definition(CipherSuite),
     IsNamedCurveSuite = lists:member(KexAlg,
                                      [ecdh_ecdsa, ecdhe_ecdsa, ecdh_rsa, ecdhe_rsa, ecdh_anon]),
     CurveInfo = case ECCCurve of
@@ -1501,7 +1501,7 @@ connection_info(#state{sni_hostname = SNIHostname,
 		end,
     [{protocol, RecordCB:protocol_version(Version)},
      {session_id, SessionId},
-     {cipher_suite, ssl_cipher:erl_suite_definition(CipherSuiteDef)},
+     {cipher_suite, ssl_cipher_format:erl_suite_definition(CipherSuiteDef)},
      {selected_cipher_suite, CipherSuiteDef},
      {sni_hostname, SNIHostname} | CurveInfo] ++ ssl_options_list(Opts).
 
@@ -1629,7 +1629,7 @@ resumed_server_hello(#state{session = Session,
 
 server_hello(ServerHello, State0, Connection) ->
     CipherSuite = ServerHello#server_hello.cipher_suite,
-    #{key_exchange := KeyAlgorithm}  = ssl_cipher:suite_definition(CipherSuite),
+    #{key_exchange := KeyAlgorithm}  = ssl_cipher_format:suite_definition(CipherSuite),
     State = Connection:queue_handshake(ServerHello, State0),
     State#state{key_algorithm = KeyAlgorithm}.
 
@@ -1643,7 +1643,7 @@ handle_peer_cert(Role, PeerCert, PublicKeyInfo,
     State1 = State0#state{session =
 			 Session#session{peer_certificate = PeerCert},
 			 public_key_info = PublicKeyInfo},
-    #{key_exchange := KeyAlgorithm} = ssl_cipher:suite_definition(CipherSuite),
+    #{key_exchange := KeyAlgorithm} = ssl_cipher_format:suite_definition(CipherSuite),
     State2 = handle_peer_cert_key(Role, PeerCert, PublicKeyInfo, KeyAlgorithm, State1),
 
     {Record, State} = Connection:next_record(State2),
@@ -2608,7 +2608,7 @@ ssl_options_list([ciphers = Key | Keys], [Value | Values], Acc) ->
    ssl_options_list(Keys, Values, 
 		    [{Key, lists:map(
 			     fun(Suite) -> 
-				     ssl_cipher:suite_definition(Suite) 
+				     ssl_cipher_format:suite_definition(Suite) 
 			     end, Value)} 
 		     | Acc]);
 ssl_options_list([Key | Keys], [Value | Values], Acc) ->
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 73757e6b65..30fcdef98c 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -169,14 +169,14 @@ client_certificate_verify(OwnCert, MasterSecret, Version,
     end.
 
 %%--------------------------------------------------------------------
--spec certificate_request(ssl_cipher:cipher_suite(), db_handle(), 
+-spec certificate_request(ssl_cipher_format:cipher_suite(), db_handle(), 
 			  certdb_ref(),  #hash_sign_algos{}, ssl_record:ssl_version()) ->
 				 #certificate_request{}.
 %%
 %% Description: Creates a certificate_request message, called by the server.
 %%--------------------------------------------------------------------
 certificate_request(CipherSuite, CertDbHandle, CertDbRef, HashSigns, Version) ->
-    Types = certificate_types(ssl_cipher:suite_definition(CipherSuite), Version),
+    Types = certificate_types(ssl_cipher_format:suite_definition(CipherSuite), Version),
     Authorities = certificate_authorities(CertDbHandle, CertDbRef),
     #certificate_request{
 		    certificate_types = Types,
@@ -758,7 +758,7 @@ decode_hello_extensions(Extensions) ->
     dec_hello_extensions(Extensions, #hello_extensions{}).
 
 %%--------------------------------------------------------------------
--spec decode_server_key(binary(), ssl_cipher:key_algo(), ssl_record:ssl_version()) ->
+-spec decode_server_key(binary(), ssl_cipher_format:key_algo(), ssl_record:ssl_version()) ->
 			       #server_key_params{}.
 %%
 %% Description: Decode server_key data and return appropriate type
@@ -767,7 +767,7 @@ decode_server_key(ServerKey, Type, Version) ->
     dec_server_key(ServerKey, key_exchange_alg(Type), Version).
 
 %%--------------------------------------------------------------------
--spec decode_client_key(binary(), ssl_cipher:key_algo(), ssl_record:ssl_version()) ->
+-spec decode_client_key(binary(), ssl_cipher_format:key_algo(), ssl_record:ssl_version()) ->
 			    #encrypted_premaster_secret{}
 			    | #client_diffie_hellman_public{}
 			    | #client_ec_diffie_hellman_public{}
@@ -805,7 +805,7 @@ available_suites(ServerCert, UserSuites, Version, undefined, Curve) ->
     filter_unavailable_ecc_suites(Curve, Suites);
 available_suites(ServerCert, UserSuites, Version, HashSigns, Curve) ->
     Suites = available_suites(ServerCert, UserSuites, Version, undefined, Curve),
-    filter_hashsigns(Suites, [ssl_cipher:suite_definition(Suite) || Suite <- Suites], HashSigns, 
+    filter_hashsigns(Suites, [ssl_cipher_format:suite_definition(Suite) || Suite <- Suites], HashSigns, 
                      Version, []).
 
 available_signature_algs(undefined, _)  ->
@@ -961,7 +961,7 @@ client_hello_extensions(Version, CipherSuites,
 				     eccs = SupportedECCs,
                                      versions = Versions} = SslOpts, ConnectionStates, Renegotiation) ->
     {EcPointFormats, EllipticCurves} =
-	case advertises_ec_ciphers(lists:map(fun ssl_cipher:suite_definition/1, CipherSuites)) of
+	case advertises_ec_ciphers(lists:map(fun ssl_cipher_format:suite_definition/1, CipherSuites)) of
 	    true ->
 		client_ecc_extensions(SupportedECCs);
 	    false ->
@@ -2501,7 +2501,7 @@ handle_renegotiation_info(_RecordCB, ConnectionStates, SecureRenegotation) ->
 cert_curve(_, _, no_suite) ->
     {no_curve, no_suite};
 cert_curve(Cert, ECCCurve0, CipherSuite) ->
-    case ssl_cipher:suite_definition(CipherSuite) of
+    case ssl_cipher_format:suite_definition(CipherSuite) of
         #{key_exchange := Kex} when Kex == ecdh_ecdsa; 
                                     Kex == ecdh_rsa ->
             OtpCert = public_key:pkix_decode_cert(Cert, otp),
diff --git a/lib/ssl/src/tls.erl b/lib/ssl/src/tls.erl
deleted file mode 100644
index aa41cd1ba6..0000000000
--- a/lib/ssl/src/tls.erl
+++ /dev/null
@@ -1,112 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 1999-2016. All Rights Reserved.
-%%
-%% Licensed under the Apache License, Version 2.0 (the "License");
-%% you may not use this file except in compliance with the License.
-%% You may obtain a copy of the License at
-%%
-%%     http://www.apache.org/licenses/LICENSE-2.0
-%%
-%% Unless required by applicable law or agreed to in writing, software
-%% distributed under the License is distributed on an "AS IS" BASIS,
-%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-%% See the License for the specific language governing permissions and
-%% limitations under the License.
-%%
-%% %CopyrightEnd%
-%%
-
-%%
-
-%%% Purpose : Reflect TLS specific API options (fairly simple wrapper at the moment)
-
--module(tls).
-
--include("ssl_api.hrl").
--include("ssl_internal.hrl").
-
--export([connect/2, connect/3, listen/2, accept/1, accept/2,
-	 handshake/1, handshake/2, handshake/3]).
-
-%%--------------------------------------------------------------------
-%%
-%% Description: Connect to an TLS server.
-%%--------------------------------------------------------------------
-
--spec connect(host() | port(), [connect_option()]) -> {ok, #sslsocket{}} |
-					      {error, reason()}.
-
-connect(Socket, Options) when is_port(Socket) ->
-    connect(Socket, Options, infinity).
-
--spec connect(host() | port(), [connect_option()] | inet:port_number(),
-	      timeout() | list()) ->
-		     {ok, #sslsocket{}} | {error, reason()}.
-
-connect(Socket, SslOptions, Timeout)  when is_port(Socket) ->
-    TLSOpts = [{protocol, tls} | SslOptions],
-    ssl:connect(Socket, TLSOpts, Timeout);
-connect(Host, Port, Options) ->
-    connect(Host, Port, Options, infinity).
-
--spec connect(host() | port(), inet:port_number(), list(), timeout()) ->
-		     {ok, #sslsocket{}} | {error, reason()}.
-
-connect(Host, Port, Options, Timeout) ->
-    TLSOpts = [{protocol, tls} | Options],
-    ssl:connect(Host, Port, TLSOpts, Timeout).
-
-%%--------------------------------------------------------------------
--spec listen(inet:port_number(), [listen_option()]) ->{ok, #sslsocket{}} | {error, reason()}.
-		    
-%%
-%% Description: Creates an ssl listen socket.
-%%--------------------------------------------------------------------
-listen(Port, Options) ->
-    TLSOpts = [{protocol, tls} | Options],
-    ssl:listen(Port, TLSOpts).
-
-%%--------------------------------------------------------------------
-%%
-%% Description: Performs transport accept on an ssl listen socket
-%%--------------------------------------------------------------------
--spec accept(#sslsocket{}) -> {ok, #sslsocket{}} |
-					{error, reason()}.
-accept(ListenSocket) ->
-    accept(ListenSocket, infinity).
-
--spec accept(#sslsocket{}, timeout()) -> {ok, #sslsocket{}} |
-						   {error, reason()}.
-accept(Socket, Timeout) ->
-    ssl:transport_accept(Socket, Timeout).
-
-%%--------------------------------------------------------------------
-%%
-%% Description: Performs accept on an ssl listen socket. e.i. performs
-%%              ssl handshake. 
-%%--------------------------------------------------------------------
-
--spec handshake(#sslsocket{}) -> ok | {error, reason()}.
-
-handshake(ListenSocket) ->
-    handshake(ListenSocket, infinity).
-
-
--spec handshake(#sslsocket{} | port(), timeout()| [ssl_option()
-						    | transport_option()]) ->
-			ok | {ok, #sslsocket{}} | {error, reason()}.
-
-handshake(#sslsocket{} = Socket, Timeout) ->
-    ssl:ssl_accept(Socket, Timeout);
-    
-handshake(ListenSocket, SslOptions)  when is_port(ListenSocket) ->
-    handshake(ListenSocket, SslOptions, infinity).
-
-
--spec handshake(port(), [ssl_option()| transport_option()], timeout()) ->
-			{ok, #sslsocket{}} | {error, reason()}.
-
-handshake(Socket, SslOptions, Timeout) when is_port(Socket) ->
-    ssl:ssl_accept(Socket, SslOptions, Timeout).
diff --git a/lib/ssl/src/tls_handshake.erl b/lib/ssl/src/tls_handshake.erl
index 2ad1386900..6812d3b42a 100644
--- a/lib/ssl/src/tls_handshake.erl
+++ b/lib/ssl/src/tls_handshake.erl
@@ -94,13 +94,13 @@ client_hello(Host, Port, ConnectionStates,
 -spec hello(#server_hello{} | #client_hello{}, #ssl_options{},
 	    ssl_record:connection_states() | {inet:port_number(), #session{}, db_handle(),
 				    atom(), ssl_record:connection_states(), 
-				    binary() | undefined, ssl_cipher:key_algo()},
+				    binary() | undefined, ssl_cipher_format:key_algo()},
 	    boolean()) ->
 		   {tls_record:tls_version(), session_id(), 
 		    ssl_record:connection_states(), alpn | npn, binary() | undefined}|
 		   {tls_record:tls_version(), {resumed | new, #session{}}, 
 		    ssl_record:connection_states(), binary() | undefined, 
-		    #hello_extensions{}, {ssl_cipher:hash(), ssl_cipher:sign_algo()} | 
+		    #hello_extensions{}, {ssl_cipher_format:hash(), ssl_cipher_format:sign_algo()} | 
                     undefined} | #alert{}.
 %%
 %% Description: Handles a received hello message
@@ -291,7 +291,7 @@ handle_client_hello(Version,
 		no_suite ->
                     ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY, no_suitable_ciphers);
 		_ ->
-		    #{key_exchange := KeyExAlg} = ssl_cipher:suite_definition(CipherSuite),
+		    #{key_exchange := KeyExAlg} = ssl_cipher_format:suite_definition(CipherSuite),
 		    case ssl_handshake:select_hashsign(ClientHashSigns, Cert, KeyExAlg, 
                                                        SupportedHashSigns, Version) of
 			#alert{} = Alert ->
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 480988b6e4..fe705fcd02 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -5045,7 +5045,7 @@ run_suites(Ciphers, Config, Type) ->
     end.
 
 erlang_cipher_suite(Suite) when is_list(Suite)->
-    ssl_cipher:suite_definition(ssl_cipher:openssl_suite(Suite));
+    ssl_cipher_format:suite_definition(ssl_cipher_format:openssl_suite(Suite));
 erlang_cipher_suite(Suite) ->
     Suite.
 
diff --git a/lib/ssl/test/ssl_session_cache_SUITE.erl b/lib/ssl/test/ssl_session_cache_SUITE.erl
index 9862b3ce64..3b6e936a97 100644
--- a/lib/ssl/test/ssl_session_cache_SUITE.erl
+++ b/lib/ssl/test/ssl_session_cache_SUITE.erl
@@ -487,8 +487,8 @@ test_copts(_, 0, ClientOpts) ->
       ClientOpts;		 
 test_copts(max_table_size, N, ClientOpts) ->
     Version = tls_record:highest_protocol_version([]),		   
-    CipherSuites = %%lists:map(fun(X) -> ssl_cipher:suite_definition(X) end, ssl_cipher:filter_suites(ssl_cipher:suites(Version))),
-[ Y|| Y = {Alg,_, _, _} <- lists:map(fun(X) -> ssl_cipher:suite_definition(X) end, ssl_cipher:filter_suites(ssl_cipher:suites(Version))), Alg =/=  ecdhe_ecdsa,  Alg =/=  ecdh_ecdsa, Alg =/=  ecdh_rsa, Alg =/=  ecdhe_rsa, Alg =/= dhe_dss, Alg =/= dss], 
+    CipherSuites = %%lists:map(fun(X) -> ssl_cipher_format:suite_definition(X) end, ssl_cipher:filter_suites(ssl_cipher:suites(Version))),
+[ Y|| Y = {Alg,_, _, _} <- lists:map(fun(X) -> ssl_cipher_format:suite_definition(X) end, ssl_cipher:filter_suites(ssl_cipher:suites(Version))), Alg =/=  ecdhe_ecdsa,  Alg =/=  ecdh_ecdsa, Alg =/=  ecdh_rsa, Alg =/=  ecdhe_rsa, Alg =/= dhe_dss, Alg =/= dss], 
     case length(CipherSuites) of 
         M when M >= N ->		      
           Cipher = lists:nth(N, CipherSuites),
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 7202e3662c..57877d4517 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1221,13 +1221,13 @@ common_ciphers(crypto) ->
 common_ciphers(openssl) ->
     OpenSslSuites =
         string:tokens(string:strip(os:cmd("openssl ciphers"), right, $\n), ":"),
-    [ssl_cipher:suite_definition(S)
+    [ssl_cipher_format:suite_definition(S)
      || S <- ssl_cipher:suites(tls_record:highest_protocol_version([])),
-        lists:member(ssl_cipher:openssl_suite_name(S), OpenSslSuites)
+        lists:member(ssl_cipher_format:openssl_suite_name(S), OpenSslSuites)
     ].
 
 available_suites(Version) ->
-    [ssl_cipher:suite_definition(Suite) || 
+    [ssl_cipher_format:suite_definition(Suite) || 
 	Suite  <-  ssl_cipher:filter_suites(ssl_cipher:suites(Version))].
 
 
@@ -1300,7 +1300,7 @@ string_regex_filter(_Str, _Search) ->
     false.
 
 ecdh_dh_anonymous_suites(Version) ->
-    ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <- ssl_cipher:anonymous_suites(Version)],
+    ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <- ssl_cipher:anonymous_suites(Version)],
                              [{key_exchange, 
                                fun(dh_anon) -> 
                                        true;
@@ -1310,7 +1310,7 @@ ecdh_dh_anonymous_suites(Version) ->
                                        false 
                                end}]).
 psk_suites({3,_} = Version) ->
-    ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <- ssl_cipher:psk_suites(Version)], []);
+    ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <- ssl_cipher:psk_suites(Version)], []);
 psk_suites(Version) ->
     ssl:filter_cipher_suites(psk_suites(dtls_v1:corresponding_tls_version(Version)), 
                              [{cipher, 
@@ -1321,7 +1321,7 @@ psk_suites(Version) ->
                                end}]).
 
 psk_anon_suites({3,_} = Version) ->
-    ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <- ssl_cipher:psk_suites_anon(Version)], 
+    ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <- ssl_cipher:psk_suites_anon(Version)], 
                              [{key_exchange, 
                                fun(psk) -> 
                                        true;
@@ -1342,7 +1342,7 @@ psk_anon_suites(Version) ->
 
 
 srp_suites() ->
-    ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <- ssl_cipher:srp_suites()],
+    ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <- ssl_cipher:srp_suites()],
                              [{key_exchange, 
                                fun(srp_rsa) -> 
                                        true;
@@ -1350,10 +1350,10 @@ srp_suites() ->
                                        false 
                                end}]).
 srp_anon_suites() ->
-    ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <-  ssl_cipher:srp_suites_anon()],
+    ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <-  ssl_cipher:srp_suites_anon()],
                              []).
 srp_dss_suites() ->
-    ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <- ssl_cipher:srp_suites()], 
+    ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <- ssl_cipher:srp_suites()], 
                              [{key_exchange, 
                                fun(srp_dss) -> 
                                        true;
@@ -1361,14 +1361,14 @@ srp_dss_suites() ->
                                        false 
                                end}]).
 chacha_suites(Version) ->
-    [ssl_cipher:suite_definition(S) || S <- ssl_cipher:filter_suites(ssl_cipher:chacha_suites(Version))].
+    [ssl_cipher_format:suite_definition(S) || S <- ssl_cipher:filter_suites(ssl_cipher:chacha_suites(Version))].
 
 
 rc4_suites(Version) ->
-     ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <-ssl_cipher:rc4_suites(Version)], []).
+     ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <-ssl_cipher:rc4_suites(Version)], []).
 
 des_suites(Version) ->
-     ssl:filter_cipher_suites([ssl_cipher:suite_definition(S) || S <-ssl_cipher:des_suites(Version)], []).
+     ssl:filter_cipher_suites([ssl_cipher_format:suite_definition(S) || S <-ssl_cipher:des_suites(Version)], []).
 
 tuple_to_map({Kex, Cipher, Mac}) ->
     #{key_exchange => Kex,
@@ -1762,10 +1762,10 @@ version_flag('dtlsv1') ->
     "-dtls1".
 
 filter_suites([Cipher | _] = Ciphers, AtomVersion) when is_list(Cipher)->
-    filter_suites([ssl_cipher:openssl_suite(S) || S <- Ciphers], 
+    filter_suites([ssl_cipher_format:openssl_suite(S) || S <- Ciphers], 
                   AtomVersion);
 filter_suites([Cipher | _] = Ciphers, AtomVersion) when is_binary(Cipher)->
-    filter_suites([ssl_cipher:suite_definition(S) || S <- Ciphers], 
+    filter_suites([ssl_cipher_format:suite_definition(S) || S <- Ciphers], 
                   AtomVersion);
 filter_suites(Ciphers0, AtomVersion) ->
     Version = tls_version(AtomVersion),
@@ -1777,7 +1777,7 @@ filter_suites(Ciphers0, AtomVersion) ->
         ++ ssl_cipher:srp_suites_anon() 
 	++ ssl_cipher:rc4_suites(Version),
     Supported1 = ssl_cipher:filter_suites(Supported0),
-    Supported2 = [ssl_cipher:suite_definition(S) || S <- Supported1],
+    Supported2 = [ssl_cipher_format:suite_definition(S) || S <- Supported1],
     [Cipher || Cipher <- Ciphers0, lists:member(Cipher, Supported2)].
 
 -define(OPENSSL_QUIT, "Q\n").