Decision not to support DH and export cipher suites.

5 files changed, 121 insertions, 508 deletions

diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index ef4b450d68..1818247e59 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -48,7 +48,7 @@
 %% cipher values has been updated according to <CipherSuite> 
 %%-------------------------------------------------------------------
 security_parameters(CipherSuite, SecParams) ->
-    { _, Cipher, Hash, Exportable} = suite_definition(CipherSuite),
+    { _, Cipher, Hash} = suite_definition(CipherSuite),
     SecParams#security_parameters{
       cipher_suite = CipherSuite,
       bulk_cipher_algorithm = bulk_cipher_algorithm(Cipher),
@@ -58,8 +58,7 @@ security_parameters(CipherSuite, SecParams) ->
       key_material_length = key_material(Cipher),
       iv_size = iv_size(Cipher),
       mac_algorithm = mac_algorithm(Hash),
-      hash_size = hash_size(Hash),
-      exportable = Exportable}.
+      hash_size = hash_size(Hash)}.
 
 %%--------------------------------------------------------------------
 %% Function: cipher(Method, CipherState, Mac, Data) -> 
@@ -109,10 +108,6 @@ cipher(?AES, CipherState, Mac, Fragment) ->
 %%     block_cipher(fun(Key, IV, T) ->
 %% 			 crypto:idea_cbc_encrypt(Key, IV, T)
 %% 		 end, block_size(idea_cbc), CipherState, Mac, Fragment);
-%% cipher(?RC2, CipherState, Mac, Fragment) ->
-%%     block_cipher(fun(Key, IV, T) ->
-%% 			 crypto:rc2_40_cbc_encrypt(Key, IV, T)
-%% 		 end, block_size(rc2_cbc_40), CipherState, Mac, Fragment).
 
 block_cipher(Fun, BlockSz, #cipher_state{key=Key, iv=IV} = CS0, 
 	     Mac, Fragment) ->
@@ -175,10 +170,6 @@ decipher(?AES, HashSz, CipherState, Fragment) ->
 %%     block_decipher(fun(Key, IV, T) ->
 %%  			   crypto:idea_cbc_decrypt(Key, IV, T)
 %%  		   end, CipherState, HashSz, Fragment);
-%% decipher(?RC2, HashSz, CipherState, Fragment) ->
-%%     block_decipher(fun(Key, IV, T) ->
-%% 			   crypto:rc2_40_cbc_decrypt(Key, IV, T)
-%% 		   end, CipherState, HashSz, Fragment).
 
 block_decipher(Fun, #cipher_state{key=Key, iv=IV} = CipherState0, 
 	       HashSz, Fragment) ->
@@ -209,289 +200,147 @@ suites({3, N}) when N == 1; N == 2 ->
 
 %%--------------------------------------------------------------------
 %% Function: suite_definition(CipherSuite) -> 
-%%                                {KeyExchange, Cipher, Hash, Exportable}
+%%                                {KeyExchange, Cipher, Hash}
 %%                                             
 %%
 %% CipherSuite - as defined in ssl_cipher.hrl
-%% KeyExchange - rsa | dh_dss | dh_rsa | dh_anon | dhe_dss | dhe_rsa
-%%               krb5 | *_export (old ssl)
+%% KeyExchange - rsa | dh_anon | dhe_dss | dhe_rsa | kerb5
+%%                
 %% Cipher      - null | rc4_128 | idea_cbc | des_cbc | '3des_ede_cbc'
-%%               des40_cbc | dh_dss | aes_128_cbc | aes_256_cbc |
-%%               rc2_cbc_40 | rc4_40 
+%%               des40_cbc | aes_128_cbc | aes_256_cbc  
 %% Hash        - null | md5 | sha
-%% Exportable  - export | no_export | ignore(?)
 %%
-%% Description: Returns a security parameters record where the
+%% Description: Returns a security parameters tuple where the
 %% cipher values has been updated according to <CipherSuite> 
 %% Note: Currently not supported suites are commented away.
 %% They should be supported or removed in the future.
 %%-------------------------------------------------------------------
 %% TLS v1.1 suites
 suite_definition(?TLS_NULL_WITH_NULL_NULL) ->
-    {null, null, null, ignore};
+    {null, null, null};
 %% suite_definition(?TLS_RSA_WITH_NULL_MD5) ->
-%%     {rsa, null, md5, ignore};
+%%     {rsa, null, md5};
 %% suite_definition(?TLS_RSA_WITH_NULL_SHA) ->
-%%     {rsa, null, sha, ignore};	
+%%     {rsa, null, sha};	
 suite_definition(?TLS_RSA_WITH_RC4_128_MD5) ->	
-    {rsa, rc4_128, md5, no_export};
+    {rsa, rc4_128, md5};
 suite_definition(?TLS_RSA_WITH_RC4_128_SHA) ->	
-    {rsa, rc4_128, sha, no_export};
+    {rsa, rc4_128, sha};
 %% suite_definition(?TLS_RSA_WITH_IDEA_CBC_SHA) -> 
-%%     {rsa, idea_cbc, sha, no_export};
+%%     {rsa, idea_cbc, sha};
 suite_definition(?TLS_RSA_WITH_DES_CBC_SHA) ->	
-    {rsa, des_cbc, sha, no_export}; 
+    {rsa, des_cbc, sha}; 
 suite_definition(?TLS_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    {rsa, '3des_ede_cbc', sha, no_export}; 
-%% suite_definition(?TLS_DH_DSS_WITH_DES_CBC_SHA) ->
-%%     {dh_dss, des_cbc, sha, no_export};
-%% suite_definition(?TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA) ->
-%%     {dh_dss, '3des_ede_cbc', sha, no_export};
-%% suite_definition(?TLS_DH_RSA_WITH_DES_CBC_SHA) ->
-%%     {dh_rsa, des_cbc, sha, no_export};
-%% suite_definition(?TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA) ->
-%%     {dh_rsa, '3des_ede_cbc', sha, no_export};
+    {rsa, '3des_ede_cbc', sha}; 
 suite_definition(?TLS_DHE_DSS_WITH_DES_CBC_SHA) ->
-    {dhe_dss, des_cbc, sha, no_export};
+    {dhe_dss, des_cbc, sha};
 suite_definition(?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) ->
-    {dhe_dss, '3des_ede_cbc', sha, no_export};
+    {dhe_dss, '3des_ede_cbc'};
 suite_definition(?TLS_DHE_RSA_WITH_DES_CBC_SHA) ->
-    {dhe_rsa, des_cbc, sha, no_export};
+    {dhe_rsa, des_cbc, sha};
 suite_definition(?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    {dhe_rsa, '3des_ede_cbc', sha, no_export}; 
-%% suite_definition(?TLS_DH_anon_WITH_RC4_128_MD5) ->
-%%     {dh_anon, rc4_128, md5, no_export};
-%% suite_definition(?TLS_DH_anon_WITH_DES_CBC_SHA) ->
-%%     {dh_anon, des40_cbc, sha, no_export};
-%% suite_definition(?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA) ->
-%%     {dh_anon, '3des_ede_cbc', sha, no_export};
+    {dhe_rsa, '3des_ede_cbc', sha}; 
 
 %%% TSL V1.1 AES suites
 suite_definition(?TLS_RSA_WITH_AES_128_CBC_SHA) -> 
-    {rsa, aes_128_cbc, sha, ignore};
-%% suite_definition(?TLS_DH_DSS_WITH_AES_128_CBC_SHA) ->
-%%     {dh_dss, aes_128_cbc, sha, ignore};
-%% suite_definition(?TLS_DH_RSA_WITH_AES_128_CBC_SHA) ->
-%%     {dh_rsa, aes_128_cbc, sha, ignore};
+    {rsa, aes_128_cbc, sha};
 suite_definition(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA) ->
-    {dhe_dss, aes_128_cbc, sha, ignore};
+    {dhe_dss, aes_128_cbc, sha};
 suite_definition(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA) ->
-    {dhe_rsa, aes_128_cbc, sha, ignore};
-%% suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA) ->
-%%     {dh_anon, aes_128_cbc, sha, ignore};
+    {dhe_rsa, aes_128_cbc, sha};
 suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA) -> 
-    {rsa, aes_256_cbc, sha, ignore};
-%% suite_definition(?TLS_DH_DSS_WITH_AES_256_CBC_SHA) ->
-%%     {dh_dss, aes_256_cbc, sha, ignore};
-%% suite_definition(?TLS_DH_RSA_WITH_AES_256_CBC_SHA) ->
-%%     {dh_rsa, aes_256_cbc, sha, ignore};
+    {rsa, aes_256_cbc, sha};
 suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA) ->
-    {dhe_dss, aes_256_cbc, sha, ignore};
+    {dhe_dss, aes_256_cbc, sha};
 suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
-    {dhe_rsa, aes_256_cbc, sha, ignore}.
-%% suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA) ->
-%%     {dh_anon, aes_256_cbc, sha, ignore};
+    {dhe_rsa, aes_256_cbc, sha}.
 
-%% TSL V1.1 KRB SUITES
+%% TODO: support kerbos key exchange?
+%% TSL V1.1 KRB SUITES 
 %% suite_definition(?TLS_KRB5_WITH_DES_CBC_SHA) ->
-%%     {krb5, des_cbc, sha, ignore};
+%%     {krb5, des_cbc, sha};
 %% suite_definition(?TLS_KRB5_WITH_3DES_EDE_CBC_SHA) ->
-%%     {krb5, '3des_ede_cbc', sha, ignore};
+%%     {krb5, '3des_ede_cbc', sha};
 %% suite_definition(?TLS_KRB5_WITH_RC4_128_SHA) ->
-%%     {krb5, rc4_128, sha, ignore};
+%%     {krb5, rc4_128, sha};
 %% suite_definition(?TLS_KRB5_WITH_IDEA_CBC_SHA) ->
-%%     {krb5, idea_cbc, sha, ignore};
+%%     {krb5, idea_cbc, sha};
 %% suite_definition(?TLS_KRB5_WITH_DES_CBC_MD5) ->
-%%     {krb5, des_cbc, md5, ignore};
+%%     {krb5, des_cbc, md5};
 %% suite_definition(?TLS_KRB5_WITH_3DES_EDE_CBC_MD5) ->
-%%     {krb5, '3des_ede_cbc', md5, ignore};
+%%     {krb5, '3des_ede_cbc', md5};
 %% suite_definition(?TLS_KRB5_WITH_RC4_128_MD5) ->
-%%     {krb5, rc4_128, md5, ignore};
+%%     {krb5, rc4_128, md5};
 %% suite_definition(?TLS_KRB5_WITH_IDEA_CBC_MD5) ->
-%%     {krb5, idea_cbc, md5, ignore};
-
-%% suite_definition(?TLS_RSA_EXPORT1024_WITH_RC4_56_MD5) ->
-%%     {rsa, rc4_56, md5, export};
-%% suite_definition(?TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5) ->
-%%     {rsa, rc2_cbc_56, md5, export};
-%% suite_definition(?TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA) ->
-%%     {rsa, des_cbc, sha, export};
-%% suite_definition(?TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA) ->
-%%     {dhe_dss, des_cbc, sha, export};
-%% suite_definition(?TLS_RSA_EXPORT1024_WITH_RC4_56_SHA) ->
-%%     {rsa, rc4_56, sha, export};
-%% suite_definition(?TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA) ->
-%%     {dhe_dss, rc4_56, sha, export};
-%% suite_definition(?TLS_DHE_DSS_WITH_RC4_128_SHA) ->
-%%     {dhe_dss, rc4_128, sha, export};
-
-%% Export suites  TLS 1.0 OR SSLv3-only servers.  
-%% suite_definition(?TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA) ->
-%%     {krb5_export, des40_cbc, sha, export};
-%% suite_definition(?TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA) ->
-%%     {krb5_export, rc2_cbc_40, sha, export};
-%% suite_definition(?TLS_KRB5_EXPORT_WITH_RC4_40_SHA) ->
-%%     {krb5_export, des40_cbc, sha, export};
-%% suite_definition(?TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5) ->
-%%     {krb5_export, des40_cbc, md5, export};
-%% suite_definition(?TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5) ->
-%%     {krb5_export, rc2_cbc_40, md5, export};
-%% suite_definition(?TLS_KRB5_EXPORT_WITH_RC4_40_MD5) ->
-%%     {krb5_export, rc2_cbc_40, md5, export};
-%% suite_definition(?TLS_RSA_EXPORT_WITH_RC4_40_MD5) -> 
-%%     {rsa, rc4_40, md5, export};	
-%% suite_definition(?TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) -> 
-%%     {rsa, rc2_cbc_40, md5, export};
-%% suite_definition(?TLS_RSA_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     {rsa, des40_cbc, sha, export};
-%% suite_definition(?TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     {dh_dss, des40_cbc, sha, export};
-%% suite_definition(?TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     {dh_rsa, des40_cbc, sha, export};
-%% suite_definition(?TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     {dhe_dss, des40_cbc, sha, export};
-%% suite_definition(?TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     {dhe_rsa, des40_cbc, sha, export};
-%% suite_definition(?TLS_DH_anon_EXPORT_WITH_RC4_40_MD5) ->
-%%     {dh_anon, rc4_40, md5, export};
-%% suite_definition(?TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     {dh_anon, des40_cbc, sha, export}.
+%%     {krb5, idea_cbc, md5};
 
 %% TLS v1.1 suites
-suite({rsa, null, md5, ignore}) ->
+suite({rsa, null, md5}) ->
     ?TLS_RSA_WITH_NULL_MD5;
-suite({rsa, null, sha, ignore}) ->
+suite({rsa, null, sha}) ->
     ?TLS_RSA_WITH_NULL_SHA;
-suite({rsa, rc4_128, md5, no_export}) ->
+suite({rsa, rc4_128, md5}) ->
     ?TLS_RSA_WITH_RC4_128_MD5;
-suite({rsa, rc4_128, sha, no_export}) ->
+suite({rsa, rc4_128, sha}) ->
     ?TLS_RSA_WITH_RC4_128_SHA;
-%% suite({rsa, idea_cbc, sha, no_export}) -> 
+%% suite({rsa, idea_cbc, sha}) -> 
 %%     ?TLS_RSA_WITH_IDEA_CBC_SHA;
-suite({rsa, des_cbc, sha, no_export}) ->
+suite({rsa, des_cbc, sha}) ->
     ?TLS_RSA_WITH_DES_CBC_SHA; 
-suite({rsa, '3des_ede_cbc', sha, no_export}) ->
+suite({rsa, '3des_ede_cbc', sha}) ->
     ?TLS_RSA_WITH_3DES_EDE_CBC_SHA; 
-%% suite({dh_dss, des_cbc, sha, no_export}) ->
-%%     ?TLS_DH_DSS_WITH_DES_CBC_SHA;
-%% suite({dh_dss, '3des_ede_cbc', sha, no_export}) ->
-%%     ?TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA;
-%% suite({dh_rsa, des_cbc, sha, no_export}) ->
-%%     ?TLS_DH_RSA_WITH_DES_CBC_SHA;
-%% suite({dh_rsa, '3des_ede_cbc', sha, no_export}) ->
-%%     ?TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA;
-suite({dhe_dss, des_cbc, sha, no_export}) ->
+suite({dhe_dss, des_cbc, sha}) ->
     ?TLS_DHE_DSS_WITH_DES_CBC_SHA;
-suite({dhe_dss, '3des_ede_cbc', sha, no_export}) ->
+suite({dhe_dss, '3des_ede_cbc', sha}) ->
     ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
-suite({dhe_rsa, des_cbc, sha, no_export}) ->
+suite({dhe_rsa, des_cbc, sha}) ->
     ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
-suite({dhe_rsa, '3des_ede_cbc', sha, no_export}) ->
+suite({dhe_rsa, '3des_ede_cbc', sha}) ->
     ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA; 
-%% suite({dh_anon, rc4_128, md5, no_export}) ->
+%% suite({dh_anon, rc4_128, md5}) ->
 %%     ?TLS_DH_anon_WITH_RC4_128_MD5;
-%% suite({dh_anon, des40_cbc, sha, no_export}) ->
+%% suite({dh_anon, des40_cbc, sha}) ->
 %%     ?TLS_DH_anon_WITH_DES_CBC_SHA;
-%% suite({dh_anon, '3des_ede_cbc', sha, no_export}) ->
+%% suite({dh_anon, '3des_ede_cbc', sha}) ->
 %%     ?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
 
 %%% TSL V1.1 AES suites
-suite({rsa, aes_128_cbc, sha, ignore}) ->
+suite({rsa, aes_128_cbc, sha}) ->
     ?TLS_RSA_WITH_AES_128_CBC_SHA; 
-%% suite({dh_dss, aes_128_cbc, sha, ignore}) ->
-%%     ?TLS_DH_DSS_WITH_AES_128_CBC_SHA;
-%% suite({dh_rsa, aes_128_cbc, sha, ignore}) ->
-%%      ?TLS_DH_RSA_WITH_AES_128_CBC_SHA;
-%% suite({dhe_dss, aes_128_cbc, sha, ignore}) ->
+%% suite({dhe_dss, aes_128_cbc, sha}) ->
 %%     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA; 
-suite({dhe_rsa, aes_128_cbc, sha, ignore}) ->
+suite({dhe_rsa, aes_128_cbc, sha}) ->
     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
-%% suite({dh_anon, aes_128_cbc, sha, ignore}) ->
+%% suite({dh_anon, aes_128_cbc, sha}) ->
 %%     ?TLS_DH_anon_WITH_AES_128_CBC_SHA;
-suite({rsa, aes_256_cbc, sha, ignore}) ->
+suite({rsa, aes_256_cbc, sha}) ->
     ?TLS_RSA_WITH_AES_256_CBC_SHA;
-%% suite({dh_dss, aes_256_cbc, sha, ignore}) ->
-%%     ?TLS_DH_DSS_WITH_AES_256_CBC_SHA;
-%% suite({dh_rsa, aes_256_cbc, sha, ignore}) ->
-%%     ?TLS_DH_RSA_WITH_AES_256_CBC_SHA;
-suite({dhe_dss, aes_256_cbc, sha, ignore}) ->
+suite({dhe_dss, aes_256_cbc, sha}) ->
     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
-suite({dhe_rsa, aes_256_cbc, sha, ignore}) ->
+suite({dhe_rsa, aes_256_cbc, sha}) ->
     ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA.
-%% suite({dh_anon, aes_256_cbc, sha, ignore}) ->
+%% suite({dh_anon, aes_256_cbc, sha}) ->
 %%     ?TLS_DH_anon_WITH_AES_256_CBC_SHA.
 
+%% TODO: support kerbos key exchange?
 %% TSL V1.1 KRB SUITES
-%% suite({krb5, des_cbc, sha, ignore}) ->
+%% suite({krb5, des_cbc, sha}) ->
 %%     ?TLS_KRB5_WITH_DES_CBC_SHA;
-%% suite({krb5_cbc, '3des_ede_cbc', sha, ignore}) ->
+%% suite({krb5_cbc, '3des_ede_cbc', sha}) ->
 %%     ?TLS_KRB5_WITH_3DES_EDE_CBC_SHA;
-%% suite({krb5, rc4_128, sha, ignore}) ->
+%% suite({krb5, rc4_128, sha}) ->
 %%      ?TLS_KRB5_WITH_RC4_128_SHA;
-%% suite({krb5_cbc, idea_cbc, sha, ignore}) ->
+%% suite({krb5_cbc, idea_cbc, sha}) ->
 %%     ?TLS_KRB5_WITH_IDEA_CBC_SHA;
-%% suite({krb5_cbc, md5, ignore}) ->
+%% suite({krb5_cbc, md5}) ->
 %%     ?TLS_KRB5_WITH_DES_CBC_MD5;
-%% suite({krb5_ede_cbc, des_cbc, md5, ignore}) ->
+%% suite({krb5_ede_cbc, des_cbc, md5}) ->
 %%     ?TLS_KRB5_WITH_3DES_EDE_CBC_MD5;
-%% suite({krb5_128, rc4_128, md5, ignore}) ->
+%% suite({krb5_128, rc4_128, md5}) ->
 %%     ?TLS_KRB5_WITH_RC4_128_MD5;
-%% suite({krb5, idea_cbc, md5, ignore}) ->
+%% suite({krb5, idea_cbc, md5}) ->
 %%     ?TLS_KRB5_WITH_IDEA_CBC_MD5;
 
-%% Export suites  TLS 1.0 OR SSLv3-only servers.  
-%% suite({rsa, rc4_40, md5, export}) ->	
-%%     ?TLS_RSA_EXPORT_WITH_RC4_40_MD5;
-%% suite({rsa, rc2_cbc_40, md5, export}) ->
-%%     ?TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
-%% suite({rsa, des40_cbc, sha, export}) ->
-%%     ?TLS_RSA_EXPORT_WITH_DES40_CBC_SHA;
-%% suite({rsa, rc4_56, md5, export}) ->
-%%     ?TLS_RSA_EXPORT1024_WITH_RC4_56_MD5;
-%% suite({rsa, rc2_cbc_56, md5, export}) -> 
-%%     ?TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5;
-%% suite({rsa, des_cbc, sha, export}) ->
-%%     ?TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA;
-%% suite({dhe_dss, des_cbc, sha, export}) ->
-%%     ?TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA;
-%% suite({rsa, rc4_56, sha, export}) ->
-%%     ?TLS_RSA_EXPORT1024_WITH_RC4_56_SHA;
-%% suite({dhe_dss, rc4_56, sha, export}) ->
-%%     ?TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA;
-%% suite({dhe_dss, rc4_128, sha, export}) ->
-%%     ?TLS_DHE_DSS_WITH_RC4_128_SHA;
-%% suite({krb5_export, des40_cbc, sha, export}) ->
-%%     ?TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA;
-%% suite({krb5_export, rc2_cbc_40, sha, export}) ->
-%%     ?TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA;
-%% suite({krb5_export, rc4_cbc_40, sha, export}) ->
-%%     ?TLS_KRB5_EXPORT_WITH_RC4_40_SHA;
-%% suite({krb5_export, des40_cbc, md5, export}) ->
-%%      ?TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5;
-%% suite({krb5_export, rc2_cbc_40, md5, export}) ->
-%%     ?TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5;
-%% suite({krb5_export, rc4_cbc_40, md5, export}) ->
-%%      ?TLS_KRB5_EXPORT_WITH_RC4_40_MD5;
-%% suite({rsa_export, rc4_cbc_40, md5, export}) ->
-%%     ?TLS_RSA_EXPORT_WITH_RC4_40_MD5;	
-%% suite({rsa_export, rc2_cbc_40, md5, export}) ->
-%%     ?TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
-%% suite({rsa_export, des40_cbc, sha, export}) ->
-%%     ?TLS_RSA_EXPORT_WITH_DES40_CBC_SHA;
-%% suite({dh_dss_export, des40_cbc, sha, export}) ->
-%%     ?TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA;
-%% suite({dh_rsa_export, des40_cbc, sha, export}) ->
-%%     ?TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA;
-%% suite({dhe_dss_export, des40_cbc, sha, export}) ->
-%%     ?TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA;
-%% suite({dhe_rsa_export, des40_cbc, sha, export}) ->
-%%     ?TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA;
-%% suite({dh_anon_export, rc4_40, md5, export}) ->
-%%     ?TLS_DH_anon_EXPORT_WITH_RC4_40_MD5;
-%% suite({dh_anon_export, des40_cbc, sha, export}) ->
-%%     ?TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA.
-
-
 %% translate constants <-> openssl-strings
 %% TODO: Is there a pattern in the nameing
 %% that is useable to make a nicer function defention?
@@ -523,36 +372,12 @@ openssl_suite("RC4-SHA") ->
     ?TLS_RSA_WITH_RC4_128_SHA;
 openssl_suite("RC4-MD5") -> 
     ?TLS_RSA_WITH_RC4_128_MD5;
-%% TODO: Do we want to support this?
-%% openssl_suite("EXP1024-RC4-MD5") ->
-%%     ?TLS_RSA_EXPORT1024_WITH_RC4_56_MD5;
-%% openssl_suite("EXP1024-RC2-CBC-MD5") ->
-%%     ?TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5;
-%% openssl_suite("EXP1024-DES-CBC-SHA") ->
-%%     ?TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA;
-%% openssl_suite("EXP1024-DHE-DSS-DES-CBC-SHA") ->
-%%     ?TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA;
-%% openssl_suite("EXP1024-RC4-SHA") ->
-%%     ?TLS_RSA_EXPORT1024_WITH_RC4_56_SHA;
-%% openssl_suite("EXP1024-DHE-DSS-RC4-SHA") ->
-%%     ?TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA;
 %% openssl_suite("DHE-DSS-RC4-SHA") ->
 %%     ?TLS_DHE_DSS_WITH_RC4_128_SHA;
-
 openssl_suite("EDH-RSA-DES-CBC-SHA") ->
     ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
 openssl_suite("DES-CBC-SHA") ->
     ?TLS_RSA_WITH_DES_CBC_SHA.
-%% openssl_suite("EXP-EDH-RSA-DES-CBC-SHA") ->
-%%     ?TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA;
-%% openssl_suite("EXP-EDH-DSS-DES-CBC-SHA") ->
-%%     ?TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA;
-%% openssl_suite("EXP-DES-CBC-SHA") ->
-%%     ?TLS_RSA_EXPORT_WITH_DES40_CBC_SHA;
-%% openssl_suite("EXP-RC2-CBC-MD5") ->
-%%     ?TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
-%% openssl_suite("EXP-RC4-MD5") -> 
-%%     ?TLS_RSA_EXPORT_WITH_RC4_40_MD5.
 
 openssl_suite_name(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
     "DHE-RSA-AES256-SHA";
@@ -582,29 +407,7 @@ openssl_suite_name(?TLS_DHE_RSA_WITH_DES_CBC_SHA) ->
     "EDH-RSA-DES-CBC-SHA";
 openssl_suite_name(?TLS_RSA_WITH_DES_CBC_SHA) ->
     "DES-CBC-SHA";
-%% openssl_suite_name(?TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     "EXP-EDH-RSA-DES-CBC-SHA";
-%% openssl_suite_name(?TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     "EXP-EDH-DSS-DES-CBC-SHA";
-%% openssl_suite_name(?TLS_RSA_EXPORT_WITH_DES40_CBC_SHA) ->
-%%     "EXP-DES-CBC-SHA";
-%% openssl_suite_name(?TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) ->
-%%     "EXP-RC2-CBC-MD5";
-%% openssl_suite_name(?TLS_RSA_EXPORT_WITH_RC4_40_MD5) -> 
-%%     "EXP-RC4-MD5";
-
-%% openssl_suite_name(?TLS_RSA_EXPORT1024_WITH_RC4_56_MD5) ->
-%%     "EXP1024-RC4-MD5";
-%% openssl_suite_name(?TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5) ->
-%%     "EXP1024-RC2-CBC-MD5";
-%% openssl_suite_name(?TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA) ->
-%%     "EXP1024-DES-CBC-SHA";
-%% openssl_suite_name(?TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA) ->
-%%     "EXP1024-DHE-DSS-DES-CBC-SHA";
-%% openssl_suite_name(?TLS_RSA_EXPORT1024_WITH_RC4_56_SHA) ->
-%%     "EXP1024-RC4-SHA";
-%% openssl_suite_name(?TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA) ->
-%%     "EXP1024-DHE-DSS-RC4-SHA";
+
 %% openssl_suite_name(?TLS_DHE_DSS_WITH_RC4_128_SHA) ->
 %%     "DHE-DSS-RC4-SHA";
 
@@ -621,11 +424,7 @@ bulk_cipher_algorithm(null) ->
 %% Not supported yet
 %% bulk_cipher_algorithm(idea_cbc) ->
 %%     ?IDEA;
-%% bulk_cipher_algorithm(Cipher) when Cipher == rc2_cbc_40;
-%% 				   Cipher == rc2_cbc_56 ->
-%%     ?RC2;
-bulk_cipher_algorithm(Cipher) when Cipher == rc4_40;
-				   Cipher == rc4_56;
+bulk_cipher_algorithm(Cipher) when Cipher == rc4_56;
 				   Cipher == rc4_128 ->
     ?RC4;
 %% bulk_cipher_algorithm(des40_cbc) ->
@@ -639,14 +438,11 @@ bulk_cipher_algorithm(Cipher) when Cipher == aes_128_cbc;
     ?AES.
 
 type(Cipher) when Cipher == null;
-		  Cipher == rc4_40;
 		  Cipher == rc4_56;
 		  Cipher == rc4_128 ->
     ?STREAM;
 
 type(Cipher) when Cipher == idea_cbc;
-		  Cipher == rc2_cbc_40;
-		  Cipher == rc2_cbc_56;
 		  Cipher == des40_cbc;
 		  Cipher == des_cbc;
 		  Cipher == '3des_ede_cbc';
@@ -659,12 +455,9 @@ key_material(null) ->
 key_material(Cipher) when Cipher == idea_cbc;
  			  Cipher == rc4_128 ->
     16;
-key_material(Cipher) when Cipher == rc2_cbc_56;
-			  Cipher == rc4_56 ->
+key_material(rc4_56) ->
     7;
-key_material(Cipher) when Cipher == rc2_cbc_40;
- 			  Cipher == rc4_40;
- 			  Cipher == des40_cbc ->
+key_material(des40_cbc) ->	
     5;
 key_material(des_cbc) ->
     8;
@@ -678,9 +471,6 @@ key_material(aes_256_cbc) ->
 expanded_key_material(null) ->
     0;
 expanded_key_material(Cipher) when Cipher == idea_cbc;
- 				   Cipher == rc2_cbc_40;
- 				   Cipher == rc2_cbc_56;
- 				   Cipher == rc4_40;
 				   Cipher == rc4_56;
  				   Cipher == rc4_128 ->
     16;
@@ -696,12 +486,9 @@ expanded_key_material(Cipher) when Cipher == aes_128_cbc;
 
 effective_key_bits(null) ->
     0;
-effective_key_bits(Cipher) when Cipher == rc2_cbc_40;
-				Cipher == rc4_40;
-				Cipher == des40_cbc ->
+effective_key_bits(des40_cbc) -> 
     40;
-effective_key_bits(Cipher) when Cipher == rc2_cbc_56;
-				Cipher == rc4_56;
+effective_key_bits(Cipher) when Cipher == rc4_56;
 				Cipher == des_cbc ->
     56;
 effective_key_bits(Cipher) when Cipher == idea_cbc;
@@ -714,7 +501,6 @@ effective_key_bits(aes_256_cbc) ->
     256.
 
 iv_size(Cipher) when Cipher == null;
-		     Cipher == rc4_40;
 		     Cipher == rc4_56;
 		     Cipher == rc4_128 ->
     0;
@@ -722,8 +508,6 @@ iv_size(Cipher) ->
     block_size(Cipher).
 
 block_size(Cipher) when Cipher == idea_cbc;
-			Cipher == rc2_cbc_40;
-			Cipher == rc2_cbc_56;
 			Cipher == des40_cbc;
 			Cipher == des_cbc;
 			Cipher == '3des_ede_cbc' -> 
diff --git a/lib/ssl/src/ssl_cipher.hrl b/lib/ssl/src/ssl_cipher.hrl
index d282cbd780..80fe527f45 100644
--- a/lib/ssl/src/ssl_cipher.hrl
+++ b/lib/ssl/src/ssl_cipher.hrl
@@ -57,7 +57,7 @@
 %% TLS_NULL_WITH_NULL_NULL = { 0x00,0x00 };
 -define(TLS_NULL_WITH_NULL_NULL, <<?BYTE(16#00), ?BYTE(16#00)>>).
 
-%%% The following CipherSuite definitions require that the server
+%%% The following cipher suite definitions require that the server
 %%% provide an RSA certificate that can be used for key exchange. The
 %%% server may request either an RSA or a DSS signature-capable
 %%% certificate in the certificate request message.
@@ -68,24 +68,15 @@
 %%      TLS_RSA_WITH_NULL_SHA = { 0x00,0x02 };
 -define(TLS_RSA_WITH_NULL_SHA, <<?BYTE(16#00), ?BYTE(16#02)>>).
 
-%%      TLS_RSA_EXPORT_WITH_RC4_40_MD5 = { 0x00,0x03 };
--define(TLS_RSA_EXPORT_WITH_RC4_40_MD5, <<?BYTE(16#00), ?BYTE(16#03)>>).
-
 %%      TLS_RSA_WITH_RC4_128_MD5 = { 0x00,0x04 };
 -define(TLS_RSA_WITH_RC4_128_MD5, <<?BYTE(16#00), ?BYTE(16#04)>>).
 
 %%      TLS_RSA_WITH_RC4_128_SHA = { 0x00,0x05 };
 -define(TLS_RSA_WITH_RC4_128_SHA, <<?BYTE(16#00), ?BYTE(16#05)>>).
 
-%%      TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 = { 0x00,0x06 };
--define(TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5, <<?BYTE(16#00), ?BYTE(16#06)>>).
-
 %%      TLS_RSA_WITH_IDEA_CBC_SHA = { 0x00,0x07 };
 -define(TLS_RSA_WITH_IDEA_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#07)>>).
 
-%%      TLS_RSA_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x08 };
--define(TLS_RSA_EXPORT_WITH_DES40_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#08)>>).
-
 %%      TLS_RSA_WITH_DES_CBC_SHA = { 0x00,0x09 };
 -define(TLS_RSA_WITH_DES_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#09)>>).
 
@@ -106,51 +97,33 @@
 %%% provided by the client must use the parameters (group and
 %%% generator) described by the server.
 
-%%      TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA   = { 0x00,0x0B }; 
--define(TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#0B)>>).
-
 %%	TLS_DH_DSS_WITH_DES_CBC_SHA            = { 0x00,0x0C };
 -define(TLS_DH_DSS_WITH_DES_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#0C)>>).
 
 %%	TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA       = { 0x00,0x0D };
 -define(TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#0D)>>).
 
-%%	TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA   = { 0x00,0x0E };
--define(TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#0E)>>).
-
 %%	TLS_DH_RSA_WITH_DES_CBC_SHA            = { 0x00,0x0F };
 -define(TLS_DH_RSA_WITH_DES_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#0F)>>).
 
 %%	TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA       = { 0x00,0x10 };
 -define(TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#10)>>).
 
-%%	TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x11 };
--define(TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#11)>>).
-
 %%	TLS_DHE_DSS_WITH_DES_CBC_SHA           = { 0x00,0x12 };
 -define(TLS_DHE_DSS_WITH_DES_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#12)>>).
 
 %%	TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA      = { 0x00,0x13 };
 -define(TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#13)>>).
 
-%%	TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x14 };
--define(TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#14)>>).
-
 %%	TLS_DHE_RSA_WITH_DES_CBC_SHA           = { 0x00,0x15 };
 -define(TLS_DHE_RSA_WITH_DES_CBC_SHA,  <<?BYTE(16#00), ?BYTE(16#15)>>).
 
 %%	TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA      = { 0x00,0x16 };
 -define(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,   <<?BYTE(16#00), ?BYTE(16#16)>>).
 
-%%	TLS_DH_anon_EXPORT_WITH_RC4_40_MD5     = { 0x00,0x17 };
--define(TLS_DH_anon_EXPORT_WITH_RC4_40_MD5,  <<?BYTE(16#00), ?BYTE(16#17)>>).
-
 %%	TLS_DH_anon_WITH_RC4_128_MD5           = { 0x00,0x18 };
 -define(TLS_DH_anon_WITH_RC4_128_MD5,   <<?BYTE(16#00),?BYTE(16#18)>>).
 
-%%	TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x19 };
--define(TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#19)>>).
-
 %%	TLS_DH_anon_WITH_DES_CBC_SHA           = { 0x00,0x1A };
 -define(TLS_DH_anon_WITH_DES_CBC_SHA,   <<?BYTE(16#00), ?BYTE(16#1A)>>).
 
@@ -222,35 +195,7 @@
 %%      TLS_KRB5_WITH_IDEA_CBC_MD5           = { 0x00,0x25 };
 -define(TLS_KRB5_WITH_IDEA_CBC_MD5, <<?BYTE(16#00), ?BYTE(16#25)>>).
 
-%%      TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA  = { 0x00,0x26 };
--define(TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, <<?BYTE(16#00), ?BYTE(16#26)>>). 
-
-%%      TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA  = { 0x00,0x27 };
--define(TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA, <<?BYTE(16#00), ?BYTE(16#27)>>). 
-
-%%      TLS_KRB5_EXPORT_WITH_RC4_40_SHA      = { 0x00,0x28 };
--define(TLS_KRB5_EXPORT_WITH_RC4_40_SHA, <<?BYTE(16#00), ?BYTE(16#28)>>). 
-
-%%      TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5  = { 0x00,0x29 };
--define(TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5, <<?BYTE(16#00), ?BYTE(16#29)>>). 
-
-%%      TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5  = { 0x00,0x2A };
--define(TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5, <<?BYTE(16#00), ?BYTE(16#2A)>>). 
-
-%%      TLS_KRB5_EXPORT_WITH_RC4_40_MD5      = { 0x00,0x2B };
--define(TLS_KRB5_EXPORT_WITH_RC4_40_MD5, <<?BYTE(16#00), ?BYTE(16#2B)>>).
-
-%% Additional TLS ciphersuites from draft-ietf-tls-56-bit-ciphersuites-00.txt
-
--define(TLS_RSA_EXPORT1024_WITH_RC4_56_MD5, <<?BYTE(16#00), ?BYTE(16#60)>>).
--define(TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5, <<?BYTE(16#00), ?BYTE(16#61)>>).
--define(TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#62)>>).
--define(TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA, <<?BYTE(16#00), ?BYTE(16#63)>>).
--define(TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, <<?BYTE(16#00), ?BYTE(16#64)>>).
--define(TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA, <<?BYTE(16#00), ?BYTE(16#65)>>).
--define(TLS_DHE_DSS_WITH_RC4_128_SHA, <<?BYTE(16#00), ?BYTE(16#66)>>).
-
-%% RFC 5746 - Not a real ciphersuite used to signal empty "renegotiation_info" extension
+%% RFC 5746 - Not a real cipher suite used to signal empty "renegotiation_info" extension
 %% to avoid handshake failure from old servers that do not ignore
 %% hello extension data as they should.
 -define(TLS_EMPTY_RENEGOTIATION_INFO_SCSV, <<?BYTE(16#00), ?BYTE(16#FF)>>).
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 3772e540b3..5f3dff8894 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -282,7 +282,7 @@ client_certificate_verify(OwnCert, MasterSecret, Version, Algorithm,
 			  PrivateKey, {Hashes0, _}) ->
     case public_key:pkix_is_fixed_dh_cert(OwnCert) of
 	true ->
-	    ignore;
+	    ?ALERT_REC(?FATAL, ?UNSUPPORTED_CERTIFICATE);
 	false ->	    
 	    Hashes = 
 		calc_certificate_verify(Version, MasterSecret,
@@ -302,7 +302,6 @@ client_certificate_verify(OwnCert, MasterSecret, Version, Algorithm,
 certificate_verify(Signature, {_, PublicKey, _}, Version, 
 		   MasterSecret, Algorithm, {_, Hashes0}) 
   when Algorithm == rsa;
-       Algorithm == dh_rsa;
        Algorithm == dhe_rsa ->
     Hashes = calc_certificate_verify(Version, MasterSecret,
 					   Algorithm, Hashes0),
@@ -346,13 +345,6 @@ key_exchange(client, {premaster_secret, Secret, {_, PublicKey, _}}) ->
 	encrypted_premaster_secret(Secret, PublicKey),
     #client_key_exchange{exchange_keys = EncPremasterSecret};
 
-%% Uncomment if dh_rsa and dh_dss cipher suites should
-%% be supported.
-%% key_exchange(client, fixed_diffie_hellman) -> 
-%%     #client_key_exchange{exchange_keys = 
-%% 			 #client_diffie_hellman_public{
-%% 			   dh_public = <<>>
-%% 			  }};
 key_exchange(client, {dh, <<?UINT32(Len), PublicKey:Len/binary>>}) ->
     #client_key_exchange{
 	      exchange_keys = #client_diffie_hellman_public{
@@ -725,12 +717,11 @@ master_secret(Version, MasterSecret, #security_parameters{
 			 hash_size = HashSize,
 			 key_material_length = KML,
 			 expanded_key_material_length = EKML,
-			 iv_size = IVS,
-			 exportable = Exportable},
+			 iv_size = IVS},
 	      ConnectionStates, Role) ->
     {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
      ServerWriteKey, ClientIV, ServerIV} =
-	setup_keys(Version, Exportable, MasterSecret, ServerRandom, 
+	setup_keys(Version, MasterSecret, ServerRandom, 
 		   ClientRandom, HashSize, KML, EKML, IVS),
     ?DBG_HEX(ClientWriteKey),
     ?DBG_HEX(ClientIV),
@@ -812,14 +803,7 @@ dec_hs(?SERVER_HELLO, <<?BYTE(Major), ?BYTE(Minor), Random:32/binary,
 	renegotiation_info = RenegotiationInfo};
 dec_hs(?CERTIFICATE, <<?UINT24(ACLen), ASN1Certs:ACLen/binary>>, _, _) ->
     #certificate{asn1_certificates = certs_to_list(ASN1Certs)};
-%% Uncomment if support for export ciphers is added.
-%% dec_hs(?SERVER_KEY_EXCHANGE, <<?UINT16(ModLen), Mod:ModLen/binary,
-%% 			      ?UINT16(ExpLen),  Exp:ExpLen/binary,
-%% 			      ?UINT16(_),  Sig/binary>>,
-%%        ?KEY_EXCHANGE_RSA, _) ->
-%%     #server_key_exchange{params = #server_rsa_params{rsa_modulus = Mod, 
-%% 						     rsa_exponent = Exp}, 
-%% 			 signed_params = Sig}; 	
+
 dec_hs(?SERVER_KEY_EXCHANGE, <<?UINT16(PLen), P:PLen/binary,
 			      ?UINT16(GLen), G:GLen/binary,
 			      ?UINT16(YLen), Y:YLen/binary,
@@ -846,8 +830,7 @@ dec_hs(?CLIENT_KEY_EXCHANGE, <<?UINT16(_), PKEPMS/binary>>,
     PreSecret = #encrypted_premaster_secret{premaster_secret = PKEPMS},
     #client_key_exchange{exchange_keys = PreSecret};
 dec_hs(?CLIENT_KEY_EXCHANGE, <<>>, ?KEY_EXCHANGE_DIFFIE_HELLMAN, _) -> 
-    %% TODO: Should check whether the cert already contains a suitable DH-key (7.4.7.2)
-    throw(?ALERT_REC(?FATAL, implicit_public_value_encoding));
+    throw(?ALERT_REC(?FATAL, ?UNSUPPORTED_CERTIFICATE));
 dec_hs(?CLIENT_KEY_EXCHANGE, <<?UINT16(DH_YLen), DH_Y:DH_YLen/binary>>,
        ?KEY_EXCHANGE_DIFFIE_HELLMAN, _) ->
     #client_key_exchange{exchange_keys = 
@@ -953,17 +936,6 @@ enc_hs(#certificate{asn1_certificates = ASN1CertList}, _Version, _) ->
     ASN1Certs = certs_from_list(ASN1CertList),
     ACLen = erlang:iolist_size(ASN1Certs),
     {?CERTIFICATE, <<?UINT24(ACLen), ASN1Certs:ACLen/binary>>};
-%% Uncomment if support for export ciphers is added.
-%% enc_hs(#server_key_exchange{params = #server_rsa_params{rsa_modulus = Mod,
-%% 							rsa_exponent = Exp},
-%% 			    signed_params = SignedParams}, _Version, _) -> 
-%%     ModLen = byte_size(Mod),
-%%     ExpLen = byte_size(Exp),
-%%     SignedLen = byte_size(SignedParams),
-%%     {?SERVER_KEY_EXCHANGE, <<?UINT16(ModLen),Mod/binary,
-%% 			    ?UINT16(ExpLen), Exp/binary,
-%% 			    ?UINT16(SignedLen), SignedParams/binary>>
-%%     };
 enc_hs(#server_key_exchange{params = #server_dh_params{
 			      dh_p = P, dh_g = G, dh_y = Y},
 	signed_params = SignedParams}, _Version, _) ->
@@ -1073,16 +1045,11 @@ from_2bytes(<<?UINT16(N), Rest/binary>>, Acc) ->
 
 certificate_types({KeyExchange, _, _, _})  
   when KeyExchange == rsa;
-       KeyExchange == dh_dss;
-       KeyExchange == dh_rsa;
        KeyExchange == dhe_dss;
        KeyExchange == dhe_rsa ->
     <<?BYTE(?RSA_SIGN), ?BYTE(?DSS_SIGN)>>;
 
 certificate_types(_) ->
-    %%TODO: Is this a good default,
-    %% is there a case where we like to request
-    %% a RSA_FIXED_DH or DSS_FIXED_DH
     <<?BYTE(?RSA_SIGN)>>.
 
 certificate_authorities(CertDbRef) ->
@@ -1125,22 +1092,16 @@ calc_master_secret({3,N},PremasterSecret, ClientRandom, ServerRandom)
   when N == 1; N == 2 ->
     ssl_tls1:master_secret(PremasterSecret, ClientRandom, ServerRandom).
 
-setup_keys({3,0}, Exportable, MasterSecret,
+setup_keys({3,0}, MasterSecret,
 	   ServerRandom, ClientRandom, HashSize, KML, EKML, IVS) ->
-    ssl_ssl3:setup_keys(Exportable, MasterSecret, ServerRandom, 
+    ssl_ssl3:setup_keys(MasterSecret, ServerRandom, 
 			ClientRandom, HashSize, KML, EKML, IVS);
 
-setup_keys({3,1}, _Exportable, MasterSecret,
+setup_keys({3,1}, MasterSecret,
 	   ServerRandom, ClientRandom, HashSize, KML, _EKML, IVS) ->
     ssl_tls1:setup_keys(MasterSecret, ServerRandom, ClientRandom, HashSize, 
 			KML, IVS).
 
-%% Uncomment when supported
-%% setup_keys({3,2}, _Exportable, MasterSecret,
-%% 	   ServerRandom, ClientRandom, HashSize, KML, _EKML, _IVS) ->
-%%     ssl_tls1:setup_keys(MasterSecret, ServerRandom, 
-%% 			ClientRandom, HashSize, KML).
-
 calc_finished({3, 0}, Role, MasterSecret, Hashes) ->
     ssl_ssl3:finished(Role, MasterSecret, Hashes);
 calc_finished({3, N}, Role, MasterSecret, Hashes) 
@@ -1154,7 +1115,6 @@ calc_certificate_verify({3, N}, _, Algorithm, Hashes)
     ssl_tls1:certificate_verify(Algorithm, Hashes).
 
 server_key_exchange_hash(Algorithm, Value) when Algorithm == rsa;
- 						Algorithm == dh_rsa;
  						Algorithm == dhe_rsa ->
     MD5Context = crypto:md5_init(),
     NewMD5Context = crypto:md5_update(MD5Context, Value),
@@ -1166,9 +1126,7 @@ server_key_exchange_hash(Algorithm, Value) when Algorithm == rsa;
 
     <<MD5/binary, SHA/binary>>;
 
-server_key_exchange_hash(Algorithm, Value) when Algorithm == dh_dss;
-						Algorithm == dhe_dss ->
-
+server_key_exchange_hash(dhe_dss, Value) ->
     SHAContext = crypto:sha_init(),
     NewSHAContext = crypto:sha_update(SHAContext, Value),
     crypto:sha_final(NewSHAContext).
@@ -1176,9 +1134,9 @@ server_key_exchange_hash(Algorithm, Value) when Algorithm == dh_dss;
 
 sig_alg(dh_anon) ->
     ?SIGNATURE_ANONYMOUS;
-sig_alg(Alg) when Alg == dhe_rsa; Alg == rsa; Alg == dh_rsa ->
+sig_alg(Alg) when Alg == dhe_rsa; Alg == rsa ->
     ?SIGNATURE_RSA;
-sig_alg(Alg) when Alg == dh_dss; Alg == dhe_dss ->
+sig_alg(dhe_dss) ->
     ?SIGNATURE_DSA;
 sig_alg(_) ->
     ?NULL.
diff --git a/lib/ssl/src/ssl_ssl3.erl b/lib/ssl/src/ssl_ssl3.erl
index df809ce275..1bf8c2b458 100644
--- a/lib/ssl/src/ssl_ssl3.erl
+++ b/lib/ssl/src/ssl_ssl3.erl
@@ -30,7 +30,7 @@
 -include("ssl_record.hrl"). 			% MD5 and SHA
 
 -export([master_secret/3, finished/3, certificate_verify/3,
-	 mac_hash/6, setup_keys/8, 
+	 mac_hash/6, setup_keys/7, 
 	 suites/0]).
 -compile(inline).
 
@@ -76,7 +76,7 @@ finished(Role, MasterSecret, {MD5Hash, SHAHash}) ->
     <<MD5/binary, SHA/binary>>.
 
 certificate_verify(Algorithm, MasterSecret, {MD5Hash, SHAHash}) 
-  when Algorithm == rsa; Algorithm == dh_rsa; Algorithm == dhe_rsa ->
+  when Algorithm == rsa; Algorithm == dhe_rsa ->
      %% md5_hash
      %%           MD5(master_secret + pad_2 +
      %%               MD5(handshake_messages + master_secret + pad_1));
@@ -88,8 +88,7 @@ certificate_verify(Algorithm, MasterSecret, {MD5Hash, SHAHash})
     SHA = handshake_hash(?SHA, MasterSecret, undefined, SHAHash),
     <<MD5/binary, SHA/binary>>;
 
-certificate_verify(Algorithm, MasterSecret, {_, SHAHash}) 
-  when Algorithm == dh_dss; Algorithm == dhe_dss ->
+certificate_verify(dhe_dss, MasterSecret, {_, SHAHash}) ->
      %% sha_hash
      %%           SHA(master_secret + pad_2 +
      %%               SHA(handshake_messages + master_secret + pad_1));
@@ -114,9 +113,7 @@ mac_hash(Method, Mac_write_secret, Seq_num, Type, Length, Fragment) ->
     ?DBG_HEX(Mac),
     Mac.
 
-setup_keys(Exportable, MasterSecret, ServerRandom, ClientRandom, 
-	   HS, KML, _EKML, IVS)
-  when Exportable == no_export; Exportable == ignore ->
+setup_keys(MasterSecret, ServerRandom, ClientRandom, HS, KML, _EKML, IVS) ->
     KeyBlock = generate_keyblock(MasterSecret, ServerRandom, ClientRandom,
 				 2*(HS+KML+IVS)),
     %%  draft-ietf-tls-ssl-version3-00 - 6.2.2
@@ -137,47 +134,7 @@ setup_keys(Exportable, MasterSecret, ServerRandom, ClientRandom,
     ?DBG_HEX(ClientIV),
     ?DBG_HEX(ServerIV),
     {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
-     ServerWriteKey, ClientIV, ServerIV};
-
-setup_keys(export, MasterSecret, ServerRandom, ClientRandom, 
-	   HS, KML, EKML, IVS) ->
-    KeyBlock = generate_keyblock(MasterSecret, ServerRandom, ClientRandom,
-				 2*(HS+KML)),
-    %%  draft-ietf-tls-ssl-version3-00 - 6.2.2
-    %%  Exportable encryption algorithms (for which
-    %%  CipherSpec.is_exportable is true) require additional processing as
-    %%  follows to derive their final write keys:
-
-    %%  final_client_write_key = MD5(client_write_key +
-    %%                               ClientHello.random +
-    %%                               ServerHello.random);
-    %%  final_server_write_key = MD5(server_write_key +
-    %%                               ServerHello.random +
-    %%                               ClientHello.random);
-
-    %%  Exportable encryption algorithms derive their IVs from the random
-    %%  messages:
-    %%  client_write_IV = MD5(ClientHello.random + ServerHello.random);
-    %%  server_write_IV = MD5(ServerHello.random + ClientHello.random);
-
-    <<ClientWriteMacSecret:HS/binary, ServerWriteMacSecret:HS/binary,
-     ClientWriteKey:KML/binary, ServerWriteKey:KML/binary>> = KeyBlock,
-    <<ClientIV:IVS/binary, _/binary>> = 
-	hash(?MD5, [ClientRandom, ServerRandom]),
-    <<ServerIV:IVS/binary, _/binary>> = 
-	hash(?MD5, [ServerRandom, ClientRandom]),
-    <<FinalClientWriteKey:EKML/binary, _/binary>> = 
-	hash(?MD5, [ClientWriteKey, ClientRandom, ServerRandom]),
-    <<FinalServerWriteKey:EKML/binary, _/binary>> = 
-	hash(?MD5, [ServerWriteKey, ServerRandom, ClientRandom]),
-    ?DBG_HEX(ClientWriteMacSecret),
-    ?DBG_HEX(ServerWriteMacSecret),
-    ?DBG_HEX(FinalClientWriteKey),
-    ?DBG_HEX(FinalServerWriteKey),
-    ?DBG_HEX(ClientIV),
-    ?DBG_HEX(ServerIV),
-    {ClientWriteMacSecret, ServerWriteMacSecret, FinalClientWriteKey,
-     FinalServerWriteKey, ClientIV, ServerIV}.
+     ServerWriteKey, ClientIV, ServerIV}.
 
 suites() ->
     [ 
@@ -191,25 +148,12 @@ suites() ->
       ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
       %%       ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
       ?TLS_RSA_WITH_AES_128_CBC_SHA,
-      %%?TLS_DHE_DSS_WITH_RC4_128_SHA, TODO: Support this?
+      %%?TLS_DHE_DSS_WITH_RC4_128_SHA, 
       %% ?TLS_RSA_WITH_IDEA_CBC_SHA, Not supported: in later openssl version than OTP requires
-      
       ?TLS_RSA_WITH_RC4_128_SHA,
       ?TLS_RSA_WITH_RC4_128_MD5,
-      %%?TLS_RSA_EXPORT1024_WITH_RC4_56_MD5,
-      %%?TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-      %%?TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-      %%?TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-      %%?TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
-      %%?TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
       %%?TLS_DHE_DSS_WITH_RC4_128_SHA,
-
       ?TLS_RSA_WITH_DES_CBC_SHA
-      %%       ?TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
-      %%       ?TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,
-      %% ?TLS_RSA_EXPORT_WITH_DES40_CBC_SHA,
-      %%?TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,
-      %%?TLS_RSA_EXPORT_WITH_RC4_40_MD5
      ].
 
 %%--------------------------------------------------------------------
@@ -269,8 +213,7 @@ handshake_hash(Method, MasterSecret, Sender, HandshakeHash) ->
     hash(Method, [MasterSecret, pad_2(Method), InnerHash]).
 
 get_sender(client) -> "CLNT";
-get_sender(server) -> "SRVR";
-get_sender(none) -> "".
+get_sender(server) -> "SRVR".
 
 generate_keyblock(MasterSecret, ServerRandom, ClientRandom, WantedLength) ->
     gen(MasterSecret, [MasterSecret, ServerRandom, ClientRandom],
diff --git a/lib/ssl/src/ssl_tls1.erl b/lib/ssl/src/ssl_tls1.erl
index ce9a135168..900b8e166d 100644
--- a/lib/ssl/src/ssl_tls1.erl
+++ b/lib/ssl/src/ssl_tls1.erl
@@ -30,7 +30,7 @@
 -include("ssl_debug.hrl").
 
 -export([master_secret/3, finished/3, certificate_verify/2, mac_hash/7, 
-	 setup_keys/5, setup_keys/6, suites/0]).
+	 setup_keys/6, suites/0]).
 
 %%====================================================================
 %% Internal application API
@@ -58,14 +58,12 @@ finished(Role, MasterSecret, {MD5Hash, SHAHash}) ->
 
 
 certificate_verify(Algorithm, {MD5Hash, SHAHash}) when Algorithm == rsa;
-						       Algorithm == dh_rsa;
 						       Algorithm == dhe_rsa ->
     MD5 = hash_final(?MD5, MD5Hash),
     SHA = hash_final(?SHA, SHAHash),
     <<MD5/binary, SHA/binary>>;
 
-certificate_verify(Algorithm, {_, SHAHash}) when Algorithm == dh_dss;
-						       Algorithm == dhe_dss ->
+certificate_verify(dhe_dss, {_, SHAHash}) ->
     hash_final(?SHA, SHAHash).
     
 setup_keys(MasterSecret, ServerRandom, ClientRandom, HashSize,
@@ -92,26 +90,27 @@ setup_keys(MasterSecret, ServerRandom, ClientRandom, HashSize,
     {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
      ServerWriteKey, ClientIV, ServerIV}.
 
-setup_keys(MasterSecret, ServerRandom, ClientRandom, HashSize, KeyMatLen) ->
-    %% RFC 4346 - 6.3. Key calculation
-    %% key_block = PRF(SecurityParameters.master_secret,
-    %%                      "key expansion",
-    %%                      SecurityParameters.server_random +
-    %%                      SecurityParameters.client_random);
-    %% Then the key_block is partitioned as follows:
-    %%  client_write_MAC_secret[SecurityParameters.hash_size]
-    %%  server_write_MAC_secret[SecurityParameters.hash_size]
-    %%  client_write_key[SecurityParameters.key_material_length]
-    %%  server_write_key[SecurityParameters.key_material_length]
-    WantedLength = 2 * (HashSize + KeyMatLen),
-    KeyBlock = prf(MasterSecret, "key expansion",
-		   [ServerRandom, ClientRandom], WantedLength),
-    <<ClientWriteMacSecret:HashSize/binary, 
-     ServerWriteMacSecret:HashSize/binary,
-     ClientWriteKey:KeyMatLen/binary, ServerWriteKey:KeyMatLen/binary>> 
-	= KeyBlock,
-    {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
-     ServerWriteKey, undefined, undefined}.
+%% TLS v1.1 uncomment when supported.
+%% setup_keys(MasterSecret, ServerRandom, ClientRandom, HashSize, KeyMatLen) ->
+%%     %% RFC 4346 - 6.3. Key calculation
+%%     %% key_block = PRF(SecurityParameters.master_secret,
+%%     %%                      "key expansion",
+%%     %%                      SecurityParameters.server_random +
+%%     %%                      SecurityParameters.client_random);
+%%     %% Then the key_block is partitioned as follows:
+%%     %%  client_write_MAC_secret[SecurityParameters.hash_size]
+%%     %%  server_write_MAC_secret[SecurityParameters.hash_size]
+%%     %%  client_write_key[SecurityParameters.key_material_length]
+%%     %%  server_write_key[SecurityParameters.key_material_length]
+%%     WantedLength = 2 * (HashSize + KeyMatLen),
+%%     KeyBlock = prf(MasterSecret, "key expansion",
+%% 		   [ServerRandom, ClientRandom], WantedLength),
+%%     <<ClientWriteMacSecret:HashSize/binary, 
+%%      ServerWriteMacSecret:HashSize/binary,
+%%      ClientWriteKey:KeyMatLen/binary, ServerWriteKey:KeyMatLen/binary>> 
+%% 	= KeyBlock,
+%%     {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey,
+%%      ServerWriteKey, undefined, undefined}.
 
 mac_hash(Method, Mac_write_secret, Seq_num, Type, {Major, Minor}, 
 	 Length, Fragment) ->
@@ -140,30 +139,18 @@ suites() ->
       %%?TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
       ?TLS_RSA_WITH_AES_256_CBC_SHA,
       ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
-      %%       ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
+      %%?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
       ?TLS_RSA_WITH_3DES_EDE_CBC_SHA,
       ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
-      %%       ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
+      %%?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
       ?TLS_RSA_WITH_AES_128_CBC_SHA,
-      %%?TLS_DHE_DSS_WITH_RC4_128_SHA, TODO: Support this?
-      %%       ?TLS_RSA_WITH_IDEA_CBC_SHA,
+      %%?TLS_DHE_DSS_WITH_RC4_128_SHA, 
+      %%?TLS_RSA_WITH_IDEA_CBC_SHA,
       ?TLS_RSA_WITH_RC4_128_SHA,
       ?TLS_RSA_WITH_RC4_128_MD5,
-      %%?TLS_RSA_EXPORT1024_WITH_RC4_56_MD5,
-      %%?TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-      %%?TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-      %%?TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-      %%?TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
-      %%?TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
-      %%?TLS_DHE_DSS_WITH_RC4_128_SHA,
-      %%?TLS_DHE_RSA_WITH_DES_CBC_SHA,
-      %% EDH-DSS-DES-CBC-SHA  TODO: ??
+      ?TLS_DHE_RSA_WITH_DES_CBC_SHA,
+      %%TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
       ?TLS_RSA_WITH_DES_CBC_SHA
-      %%       ?TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
-      %%       ?TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,
-      %%?TLS_RSA_EXPORT_WITH_DES40_CBC_SHA,
-      %%?TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,
-      %%?TLS_RSA_EXPORT_WITH_RC4_40_MD5
      ].
 
 %%--------------------------------------------------------------------
@@ -245,7 +232,3 @@ hash_final(?MD5, Conntext) ->
     crypto:md5_final(Conntext);
 hash_final(?SHA, Conntext) -> 
     crypto:sha_final(Conntext).
-
-
-
-