Merge branch 'maint'

Conflicts:
	lib/ssl/src/ssl_cipher.erl
	lib/ssl/src/ssl_handshake.erl

6 files changed, 1088 insertions, 405 deletions

diff --git a/lib/ssl/src/dtls_handshake.erl b/lib/ssl/src/dtls_handshake.erl
index 1d6f0a42c8..5e8f5c2ca0 100644
--- a/lib/ssl/src/dtls_handshake.erl
+++ b/lib/ssl/src/dtls_handshake.erl
@@ -189,7 +189,7 @@ handle_client_hello(Version,
 		no_suite ->
 		    ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY);
 		_ ->
-		    {KeyExAlg,_,_,_} = ssl_cipher:suite_definition(CipherSuite),
+		    #{key_exchange := KeyExAlg} = ssl_cipher:suite_definition(CipherSuite),
 		    case ssl_handshake:select_hashsign(ClientHashSigns, Cert, KeyExAlg, 
 						       SupportedHashSigns, TLSVersion) of
 			#alert{} = Alert ->
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 4bff9fdf39..656ed94ea5 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -374,13 +374,12 @@ negotiated_protocol(#sslsocket{pid = Pid}) ->
     ssl_connection:negotiated_protocol(Pid).
 
 %%--------------------------------------------------------------------
--spec cipher_suites() -> [ssl_cipher:erl_cipher_suite()] | [string()].
+-spec cipher_suites() -> [ssl_cipher:old_erl_cipher_suite()] | [string()].
 %%--------------------------------------------------------------------
 cipher_suites() ->
     cipher_suites(erlang).
 %%--------------------------------------------------------------------
--spec cipher_suites(erlang | openssl | all) -> [ssl_cipher:erl_cipher_suite()] |
-					       [string()].
+-spec cipher_suites(erlang | openssl | all) -> [ssl_cipher:old_erl_cipher_suite() | string()].
 %% Description: Returns all supported cipher suites.
 %%--------------------------------------------------------------------
 cipher_suites(erlang) ->
@@ -1153,9 +1152,8 @@ binary_cipher_suites(Version, []) ->
     %% not require explicit configuration
     ssl_cipher:filter_suites(ssl_cipher:suites(tls_version(Version)));
 binary_cipher_suites(Version, [Tuple|_] = Ciphers0) when is_tuple(Tuple) ->
-    Ciphers = [ssl_cipher:suite(C) || C <- Ciphers0],
+    Ciphers = [ssl_cipher:suite(tuple_to_map(C)) || C <- Ciphers0],
     binary_cipher_suites(Version, Ciphers);
-
 binary_cipher_suites(Version, [Cipher0 | _] = Ciphers0) when is_binary(Cipher0) ->
     All = ssl_cipher:all_suites(tls_version(Version)),
     case [Cipher || Cipher <- Ciphers0, lists:member(Cipher, All)] of
@@ -1175,6 +1173,17 @@ binary_cipher_suites(Version, Ciphers0)  ->
     Ciphers = [ssl_cipher:openssl_suite(C) || C <- string:lexemes(Ciphers0, ":")],
     binary_cipher_suites(Version, Ciphers).
 
+tuple_to_map({Kex, Cipher, Mac}) ->
+    #{key_exchange => Kex,
+      cipher => Cipher,
+      mac => Mac,
+      prf => default_prf};
+tuple_to_map({Kex, Cipher, Mac, Prf}) ->
+    #{key_exchange => Kex,
+      cipher => Cipher,
+      mac => Mac,
+      prf => Prf}.
+
 handle_eccs_option(Value, Version) when is_list(Value) ->
     {_Major, Minor} = tls_version(Version),
     try tls_v1:ecc_curves(Minor, Value) of
diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index b6cd22dd13..b0e38fb9ad 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -44,20 +44,21 @@
          is_stream_ciphersuite/1]).
 
 -export_type([cipher_suite/0,
-	      erl_cipher_suite/0, openssl_cipher_suite/0,
+	      erl_cipher_suite/0, old_erl_cipher_suite/0, openssl_cipher_suite/0,
 	      hash/0, key_algo/0, sign_algo/0]).
 
--type cipher()            :: null |rc4_128 | des_cbc | '3des_ede_cbc' 
-			   | aes_128_cbc |  aes_256_cbc | aes_128_gcm | aes_256_gcm | chacha20_poly1305.
+-type cipher()            :: null |rc4_128 | des_cbc | '3des_ede_cbc' | aes_128_cbc |  aes_256_cbc | aes_128_gcm | aes_256_gcm | chacha20_poly1305.
 -type hash()              :: null | md5 | sha | sha224 | sha256 | sha384 | sha512.
 -type sign_algo()         :: rsa | dsa | ecdsa.
--type key_algo()          :: null | rsa | dhe_rsa | dhe_dss | ecdhe_ecdsa| ecdh_ecdsa | ecdh_rsa| srp_rsa| srp_dss | 
-			     psk | dhe_psk | rsa_psk | dh_anon | ecdh_anon | srp_anon.
--type erl_cipher_suite()  :: {key_algo(), cipher(), hash()} % Pre TLS 1.2 
-			     %% TLS 1.2, internally PRE TLS 1.2 will use default_prf
-			   | {key_algo(), cipher(), hash(), hash() | default_prf}. 
-
- 
+-type key_algo()          :: null | rsa | dhe_rsa | dhe_dss | ecdhe_ecdsa| ecdh_ecdsa | ecdh_rsa| srp_rsa| srp_dss | psk | dhe_psk | rsa_psk | dh_anon | ecdh_anon | srp_anon.
+-type erl_cipher_suite()  :: #{key_exchange := key_algo(),
+                               cipher := cipher(),
+                               mac    := hash(),
+                               prf    := hash() | default_prf %% Old cipher suites, version dependent
+                              }.  
+-type old_erl_cipher_suite() :: {key_algo(), cipher(), hash()} % Pre TLS 1.2 
+                                %% TLS 1.2, internally PRE TLS 1.2 will use default_prf
+                              | {key_algo(), cipher(), hash(), hash() | default_prf}. 
 -type cipher_suite()      :: binary().
 -type cipher_enum()        :: integer().
 -type openssl_cipher_suite()  :: string().
@@ -83,7 +84,8 @@ security_parameters(?TLS_NULL_WITH_NULL_NULL = CipherSuite, SecParams) ->
 %% cipher values has been updated according to <CipherSuite> 
 %%-------------------------------------------------------------------
 security_parameters(Version, CipherSuite, SecParams) ->
-    { _, Cipher, Hash, PrfHashAlg} = suite_definition(CipherSuite),
+    #{cipher := Cipher, mac := Hash, 
+      prf := PrfHashAlg} = suite_definition(CipherSuite),
     SecParams#security_parameters{
       cipher_suite = CipherSuite,
       bulk_cipher_algorithm = bulk_cipher_algorithm(Cipher),
@@ -465,353 +467,740 @@ des_suites(_)->
 %%-------------------------------------------------------------------
 %% TLS v1.1 suites
 suite_definition(?TLS_NULL_WITH_NULL_NULL) ->
-    {null, null, null, null};
+    #{key_exchange => null,
+      cipher => null, 
+      mac => null, 
+      prf => null};
 %% RFC 5746 - Not a real cipher suite used to signal empty "renegotiation_info" extension
 %% to avoid handshake failure from old servers that do not ignore
 %% hello extension data as they should.
 suite_definition(?TLS_EMPTY_RENEGOTIATION_INFO_SCSV) ->
-    {null, null, null, null};
-%% suite_definition(?TLS_RSA_WITH_NULL_MD5) ->
-%%     {rsa, null, md5, default_prf};
-%% suite_definition(?TLS_RSA_WITH_NULL_SHA) ->
-%%     {rsa, null, sha, default_prf};
+    #{key_exchange => null,
+      cipher => null, 
+      mac => null,
+      prf => null};
 suite_definition(?TLS_RSA_WITH_RC4_128_MD5) ->	
-    {rsa, rc4_128, md5, default_prf};
+    #{key_exchange => rsa,
+      cipher => rc4_128, 
+      mac => md5, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_WITH_RC4_128_SHA) ->
-    {rsa, rc4_128, sha, default_prf};
+    #{key_exchange => rsa,
+      cipher => rc4_128,
+      mac => sha,
+      prf => default_prf};
 suite_definition(?TLS_RSA_WITH_DES_CBC_SHA) ->
-    {rsa, des_cbc, sha, default_prf};
+    #{key_exchange => rsa,
+      cipher => des_cbc,
+      mac => sha,
+      prf => default_prf};
 suite_definition(?TLS_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    {rsa, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => rsa,
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_DSS_WITH_DES_CBC_SHA) ->
-    {dhe_dss, des_cbc, sha, default_prf};
+    #{key_exchange => dhe_dss, 
+      cipher => des_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA) ->
-    {dhe_dss, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => dhe_dss, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_RSA_WITH_DES_CBC_SHA) ->
-    {dhe_rsa, des_cbc, sha, default_prf};
+    #{key_exchange => dhe_rsa, 
+      cipher => des_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    {dhe_rsa, '3des_ede_cbc', sha, default_prf};
-
+    #{key_exchange => dhe_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 %%% TSL V1.1 AES suites
 suite_definition(?TLS_RSA_WITH_AES_128_CBC_SHA) -> 
-    {rsa, aes_128_cbc, sha, default_prf};
+    #{key_exchange => rsa,
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA) ->
-    {dhe_dss, aes_128_cbc, sha, default_prf};
+    #{key_exchange => dhe_dss, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA) ->
-    {dhe_rsa, aes_128_cbc, sha, default_prf};
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA) -> 
-    {rsa, aes_256_cbc, sha, default_prf};
+    #{key_exchange => rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA) ->
-    {dhe_dss, aes_256_cbc, sha, default_prf};
+    #{key_exchange => dhe_dss, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
-    {dhe_rsa, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 %% TLS v1.2 suites
-
 %% suite_definition(?TLS_RSA_WITH_NULL_SHA) ->
 %%     {rsa, null, sha, default_prf};
 suite_definition(?TLS_RSA_WITH_AES_128_CBC_SHA256) ->
-    {rsa, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA256) ->
-    {rsa, aes_256_cbc, sha256, default_prf};
+    #{key_exchange => rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256) ->
-    {dhe_dss, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => dhe_dss, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256) ->
-    {dhe_rsa, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256) ->
-    {dhe_dss, aes_256_cbc, sha256, default_prf};
+    #{key_exchange => dhe_dss, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256) ->
-    {dhe_rsa, aes_256_cbc, sha256, default_prf};
-
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 %% not defined YET:
 %%   TLS_DH_DSS_WITH_AES_128_CBC_SHA256      DH_DSS       AES_128_CBC  SHA256
 %%   TLS_DH_RSA_WITH_AES_128_CBC_SHA256      DH_RSA       AES_128_CBC  SHA256
 %%   TLS_DH_DSS_WITH_AES_256_CBC_SHA256      DH_DSS       AES_256_CBC  SHA256
 %%   TLS_DH_RSA_WITH_AES_256_CBC_SHA256      DH_RSA       AES_256_CBC  SHA256
-
 %%% DH-ANON deprecated by TLS spec and not available
 %%% by default, but good for testing purposes.
 suite_definition(?TLS_DH_anon_WITH_RC4_128_MD5) ->
-    {dh_anon, rc4_128, md5, default_prf};
+    #{key_exchange => dh_anon, 
+      cipher => rc4_128, 
+      mac => md5, 
+      prf => default_prf};
 suite_definition(?TLS_DH_anon_WITH_DES_CBC_SHA) ->
-    {dh_anon, des_cbc, sha, default_prf};
+    #{key_exchange => dh_anon, 
+      cipher => des_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA) ->
-    {dh_anon, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => dh_anon, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA) ->
-    {dh_anon, aes_128_cbc, sha, default_prf};
+    #{key_exchange => dh_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA) ->
-    {dh_anon, aes_256_cbc, sha, default_prf};
+    #{key_exchange => dh_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA256) ->
-    {dh_anon, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => dh_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA256) ->
-    {dh_anon, aes_256_cbc, sha256, default_prf};
-
+    #{key_exchange => dh_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 %%% PSK Cipher Suites RFC 4279
-
 suite_definition(?TLS_PSK_WITH_RC4_128_SHA) ->
-    {psk, rc4_128, sha, default_prf};
+    #{key_exchange => psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    {psk, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => psk, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_PSK_WITH_AES_128_CBC_SHA) ->
-    {psk, aes_128_cbc, sha, default_prf};
+    #{key_exchange => psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_PSK_WITH_AES_256_CBC_SHA) ->
-    {psk, aes_256_cbc, sha, default_prf};
+    #{key_exchange => psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_RC4_128_SHA) ->
-    {dhe_psk, rc4_128, sha, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    {dhe_psk, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_AES_128_CBC_SHA) ->
-    {dhe_psk, aes_128_cbc, sha, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_AES_256_CBC_SHA) ->
-    {dhe_psk, aes_256_cbc, sha, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_RC4_128_SHA) ->
-    {rsa_psk, rc4_128, sha, default_prf};
+    #{key_exchange => rsa_psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    {rsa_psk, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => rsa_psk, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_AES_128_CBC_SHA) ->
-    {rsa_psk, aes_128_cbc, sha, default_prf};
+    #{key_exchange => rsa_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_AES_256_CBC_SHA) ->
-    {rsa_psk, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => rsa_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 %%% PSK NULL Cipher Suites RFC 4785
-
 suite_definition(?TLS_PSK_WITH_NULL_SHA) ->
-    {psk, null, sha, default_prf};
+    #{key_exchange => psk, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA) ->
-    {dhe_psk, null, sha, default_prf};
+    #{key_exchange => dhe_psk,
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA) ->
-    {rsa_psk, null, sha, default_prf};
-
+    #{key_exchange => rsa_psk,
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};  
 %%% TLS 1.2 PSK Cipher Suites RFC 5487
-
 suite_definition(?TLS_PSK_WITH_AES_128_GCM_SHA256) ->
-    {psk, aes_128_gcm, null, sha256};
+    #{key_exchange => psk, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_PSK_WITH_AES_256_GCM_SHA384) ->
-    {psk, aes_256_gcm, null, sha384};
+    #{key_exchange => psk, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_DHE_PSK_WITH_AES_128_GCM_SHA256) ->
-    {dhe_psk, aes_128_gcm, null, sha256};
+    #{key_exchange => dhe_psk, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_DHE_PSK_WITH_AES_256_GCM_SHA384) ->
-    {dhe_psk, aes_256_gcm, null, sha384};
+    #{key_exchange => dhe_psk, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_RSA_PSK_WITH_AES_128_GCM_SHA256) ->
-    {rsa_psk, aes_128_gcm, null, sha256};
+    #{key_exchange => rsa_psk, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_RSA_PSK_WITH_AES_256_GCM_SHA384) ->
-    {rsa_psk, aes_256_gcm, null, sha384};
-
+    #{key_exchange => rsa_psk, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_PSK_WITH_AES_128_CBC_SHA256) ->
-    {psk, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_PSK_WITH_AES_256_CBC_SHA384) ->
-    {psk, aes_256_cbc, sha384, default_prf};
+    #{key_exchange => psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_AES_128_CBC_SHA256) ->
-    {dhe_psk, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_AES_256_CBC_SHA384) ->
-    {dhe_psk, aes_256_cbc, sha384, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_AES_128_CBC_SHA256) ->
-    {rsa_psk, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => rsa_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_AES_256_CBC_SHA384) ->
-    {rsa_psk, aes_256_cbc, sha384, default_prf};
-
+    #{key_exchange => rsa_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
 suite_definition(?TLS_PSK_WITH_NULL_SHA256) ->
-    {psk, null, sha256, default_prf};
+    #{key_exchange => psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_PSK_WITH_NULL_SHA384) ->
-    {psk, null, sha384, default_prf};
+    #{key_exchange => psk, 
+      cipher => null, 
+      mac => sha384, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA256) ->
-    {dhe_psk, null, sha256, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_DHE_PSK_WITH_NULL_SHA384) ->
-    {dhe_psk, null, sha384, default_prf};
+    #{key_exchange => dhe_psk, 
+      cipher => null, 
+      mac => sha384, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA256) ->
-    {rsa_psk, null, sha256, default_prf};
+    #{key_exchange => rsa_psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_RSA_PSK_WITH_NULL_SHA384) ->
-    {rsa_psk, null, sha384, default_prf};
-
+    #{key_exchange => rsa_psk, 
+      cipher => null, 
+      mac => sha384, 
+      prf => default_prf};
 %%% ECDHE PSK Cipher Suites RFC 5489
-
 suite_definition(?TLS_ECDHE_PSK_WITH_RC4_128_SHA) ->
-    {ecdhe_psk, rc4_128, sha, default_prf};
+    #{key_exchange => ecdhe_psk, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA) ->
-    {ecdhe_psk, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => ecdhe_psk, 
+      cipher => '3des_ede_cbc',
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA) ->
-    {ecdhe_psk, aes_128_cbc, sha, default_prf};
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA) ->
-    {ecdhe_psk, aes_256_cbc, sha, default_prf};
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256) ->
-    {ecdhe_psk, aes_128_cbc, sha256, default_prf};
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384) ->
-    {ecdhe_psk, aes_256_cbc, sha384, default_prf};
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_PSK_WITH_NULL_SHA256) ->
-    {ecdhe_psk, null, sha256, default_prf};
+    #{key_exchange => ecdhe_psk, 
+      cipher => null, 
+      mac => sha256, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_PSK_WITH_NULL_SHA384) ->
-    {ecdhe_psk, null, sha384, default_prf};
-
+    #{key_exchange => ecdhe_psk, 
+      cipher => null, mac => sha384, 
+      prf => default_prf};
 %%% ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites, draft-ietf-tls-ecdhe-psk-aead-05
-
 suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256) ->
-    {ecdhe_psk, aes_128_gcm, null, sha256};
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384) ->
-    {ecdhe_psk, aes_256_gcm, null, sha384};
+    #{key_exchange => ecdhe_psk, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 %% suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256) ->
-%%    {ecdhe_psk, aes_128_ccm, null, sha256};
+%%     #{key_exchange => ecdhe_psk, 
+%%       cipher => aes_128_ccm, 
+%%       mac => null, 
+%%       prf =>sha256};
 %% suite_definition(?TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256) ->
-%%    {ecdhe_psk, aes_256_ccm, null, sha256};
-
+%%     #{key_exchange => ecdhe_psk, 
+%%       cipher => aes_256_ccm, 
+%%       mac => null, 
+%%       prf => sha256};
 %%% SRP Cipher Suites RFC 5054
-
 suite_definition(?TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA) ->
-    {srp_anon, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => srp_anon, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    {srp_rsa, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => srp_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA) ->
-    {srp_dss, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => srp_dss, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_WITH_AES_128_CBC_SHA) ->
-    {srp_anon, aes_128_cbc, sha, default_prf};
+    #{key_exchange => srp_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA) ->
-    {srp_rsa, aes_128_cbc, sha, default_prf};
+    #{key_exchange => srp_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA) ->
-    {srp_dss, aes_128_cbc, sha, default_prf};
+    #{key_exchange => srp_dss, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_WITH_AES_256_CBC_SHA) ->
-    {srp_anon, aes_256_cbc, sha, default_prf};
+    #{key_exchange => srp_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA) ->
-    {srp_rsa, aes_256_cbc, sha, default_prf};
+    #{key_exchange => srp_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA) ->
-    {srp_dss, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => srp_dss, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 %% RFC 4492 EC TLS suites
 suite_definition(?TLS_ECDH_ECDSA_WITH_NULL_SHA) ->
-    {ecdh_ecdsa, null, sha, default_prf};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_ECDSA_WITH_RC4_128_SHA) ->
-    {ecdh_ecdsa, rc4_128, sha, default_prf};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
-    {ecdh_ecdsa, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA) ->
-    {ecdh_ecdsa, aes_128_cbc, sha, default_prf};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA) ->
-    {ecdh_ecdsa, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_NULL_SHA) ->
-    {ecdhe_ecdsa, null, sha, default_prf};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA) ->
-    {ecdhe_ecdsa, rc4_128, sha, default_prf};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA) ->
-    {ecdhe_ecdsa, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA) ->
-    {ecdhe_ecdsa, aes_128_cbc, sha, default_prf};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) ->
-    {ecdhe_ecdsa, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_RSA_WITH_NULL_SHA) ->
-    {ecdh_rsa, null, sha, default_prf};
+    #{key_exchange => ecdh_rsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_RSA_WITH_RC4_128_SHA) ->
-    {ecdh_rsa, rc4_128, sha, default_prf};
+    #{key_exchange => ecdh_rsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    {ecdh_rsa, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => ecdh_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA) ->
-    {ecdh_rsa, aes_128_cbc, sha, default_prf};
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA) ->
-    {ecdh_rsa, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_RSA_WITH_NULL_SHA) ->
-    {ecdhe_rsa, null, sha, default_prf};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_RSA_WITH_RC4_128_SHA) ->
-    {ecdhe_rsa, rc4_128, sha, default_prf};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) ->
-    {ecdhe_rsa, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) ->
-    {ecdhe_rsa, aes_128_cbc, sha, default_prf};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) ->
-    {ecdhe_rsa, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_anon_WITH_NULL_SHA) ->
-    {ecdh_anon, null, sha, default_prf};
+    #{key_exchange => ecdh_anon, 
+      cipher => null, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_anon_WITH_RC4_128_SHA) ->
-    {ecdh_anon, rc4_128, sha, default_prf};
+    #{key_exchange => ecdh_anon, 
+      cipher => rc4_128, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA) ->
-    {ecdh_anon, '3des_ede_cbc', sha, default_prf};
+    #{key_exchange => ecdh_anon, 
+      cipher => '3des_ede_cbc', 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_anon_WITH_AES_128_CBC_SHA) ->
-    {ecdh_anon, aes_128_cbc, sha, default_prf};
+    #{key_exchange => ecdh_anon, 
+      cipher => aes_128_cbc, 
+      mac => sha, 
+      prf => default_prf};
 suite_definition(?TLS_ECDH_anon_WITH_AES_256_CBC_SHA) ->
-    {ecdh_anon, aes_256_cbc, sha, default_prf};
-
+    #{key_exchange => ecdh_anon, 
+      cipher => aes_256_cbc, 
+      mac => sha, 
+      prf => default_prf};
 %% RFC 5289 EC TLS suites
 suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256) ->
-    {ecdhe_ecdsa, aes_128_cbc, sha256, sha256};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384) ->
-    {ecdhe_ecdsa, aes_256_cbc, sha384, sha384};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
 suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256) ->
-    {ecdh_ecdsa, aes_128_cbc, sha256, sha256};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
 suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384) ->
-    {ecdh_ecdsa, aes_256_cbc, sha384, sha384};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
 suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) ->
-    {ecdhe_rsa, aes_128_cbc, sha256, sha256};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
 suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) ->
-    {ecdhe_rsa, aes_256_cbc, sha384, sha384};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
 suite_definition(?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256) ->
-    {ecdh_rsa, aes_128_cbc, sha256, sha256};
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_128_cbc, 
+      mac => sha256, 
+      prf => sha256};
 suite_definition(?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384) ->
-    {ecdh_rsa, aes_256_cbc, sha384, sha384};
-
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_256_cbc, 
+      mac => sha384, 
+      prf => sha384};
 %% RFC 5288 AES-GCM Cipher Suites
 suite_definition(?TLS_RSA_WITH_AES_128_GCM_SHA256) ->
-    {rsa, aes_128_gcm, null, sha256};
+    #{key_exchange => rsa, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_RSA_WITH_AES_256_GCM_SHA384) ->
-    {rsa, aes_256_gcm, null, sha384};
+    #{key_exchange => rsa, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) ->
-    {dhe_rsa, aes_128_gcm, null, sha256};
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384) ->
-    {dhe_rsa, aes_256_gcm, null, sha384};
+    #{key_exchange => dhe_rsa, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_DH_RSA_WITH_AES_128_GCM_SHA256) ->
-    {dh_rsa, aes_128_gcm, null, sha256};
+    #{key_exchange => dh_rsa, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_DH_RSA_WITH_AES_256_GCM_SHA384) ->
-    {dh_rsa, aes_256_gcm, null, sha384};
+    #{key_exchange => dh_rsa, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256) ->
-    {dhe_dss, aes_128_gcm, null, sha256};
+    #{key_exchange => dhe_dss, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384) ->
-    {dhe_dss, aes_256_gcm, null, sha384};
+    #{key_exchange => dhe_dss, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_DH_DSS_WITH_AES_128_GCM_SHA256) ->
-    {dh_dss, aes_128_gcm, null, sha256};
+    #{key_exchange => dh_dss, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_DH_DSS_WITH_AES_256_GCM_SHA384) ->
-    {dh_dss, aes_256_gcm, null, sha384};
+    #{key_exchange => dh_dss, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_DH_anon_WITH_AES_128_GCM_SHA256) ->
-    {dh_anon, aes_128_gcm, null, sha256};
+    #{key_exchange => dh_anon, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_DH_anon_WITH_AES_256_GCM_SHA384) ->
-    {dh_anon, aes_256_gcm, null, sha384};
-
+    #{key_exchange => dh_anon, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 %% RFC 5289 ECC AES-GCM Cipher Suites
 suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) ->
-    {ecdhe_ecdsa, aes_128_gcm, null, sha256};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384) ->
-    {ecdhe_ecdsa, aes_256_gcm, null, sha384};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256) ->
-    {ecdh_ecdsa, aes_128_gcm, null, sha256};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384) ->
-    {ecdh_ecdsa, aes_256_gcm, null, sha384};
+    #{key_exchange => ecdh_ecdsa, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) ->
-    {ecdhe_rsa, aes_128_gcm, null, sha256};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) ->
-    {ecdhe_rsa, aes_256_gcm, null, sha384};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 suite_definition(?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256) ->
-    {ecdh_rsa, aes_128_gcm, null, sha256};
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_128_gcm, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384) ->
-    {ecdh_rsa, aes_256_gcm, null, sha384};
-
+    #{key_exchange => ecdh_rsa, 
+      cipher => aes_256_gcm, 
+      mac => null, 
+      prf => sha384};
 %% draft-agl-tls-chacha20poly1305-04 Chacha20/Poly1305 Suites
 suite_definition(?TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) ->
-    {ecdhe_rsa, chacha20_poly1305, null, sha256};
+    #{key_exchange => ecdhe_rsa, 
+      cipher => chacha20_poly1305, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) ->
-    {ecdhe_ecdsa, chacha20_poly1305, null, sha256};
+    #{key_exchange => ecdhe_ecdsa, 
+      cipher => chacha20_poly1305, 
+      mac => null, 
+      prf => sha256};
 suite_definition(?TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256) ->
-    {dhe_rsa, chacha20_poly1305, null, sha256}.
+    #{key_exchange => dhe_rsa, 
+      cipher => chacha20_poly1305, 
+      mac => null, 
+      prf => sha256}.
 
 %%--------------------------------------------------------------------
--spec erl_suite_definition(cipher_suite()) -> erl_cipher_suite().
+-spec erl_suite_definition(cipher_suite() | erl_cipher_suite()) -> old_erl_cipher_suite().
 %%
 %% Description: Return erlang cipher suite definition. Filters last value
 %% for now (compatibility reasons).
 %%--------------------------------------------------------------------
-erl_suite_definition(S) ->
-    case suite_definition(S) of
-	{KeyExchange, Cipher, Hash, default_prf} ->
+erl_suite_definition(Bin) when is_binary(Bin) ->
+    erl_suite_definition(suite_definition(Bin));    
+erl_suite_definition(#{key_exchange := KeyExchange, cipher := Cipher,
+                       mac := Hash, prf := Prf}) ->
+    case Prf of
+        default_prf ->
 	    {KeyExchange, Cipher, Hash};
-	Suite ->
-	    Suite
+	_ ->
+            {KeyExchange, Cipher, Hash, Prf}
     end.
 
 %%--------------------------------------------------------------------
@@ -819,327 +1208,607 @@ erl_suite_definition(S) ->
 %%
 %% Description: Return TLS cipher suite definition.
 %%--------------------------------------------------------------------
-
 %% TLS v1.1 suites
-%%suite({rsa, null, md5}) ->
-%%    ?TLS_RSA_WITH_NULL_MD5;
-%%suite({rsa, null, sha}) ->
-%%    ?TLS_RSA_WITH_NULL_SHA;
-suite({rsa, rc4_128, md5}) ->
+suite(#{key_exchange := rsa, 
+        cipher := rc4_128, 
+        mac := md5}) ->
     ?TLS_RSA_WITH_RC4_128_MD5;
-suite({rsa, rc4_128, sha}) ->
+suite(#{key_exchange := rsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
     ?TLS_RSA_WITH_RC4_128_SHA;
-suite({rsa, des_cbc, sha}) ->
+suite(#{key_exchange := rsa, 
+        cipher := des_cbc, 
+        mac := sha}) ->
     ?TLS_RSA_WITH_DES_CBC_SHA; 
-suite({rsa, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := rsa, 
+        cipher :='3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_RSA_WITH_3DES_EDE_CBC_SHA; 
-suite({dhe_dss, des_cbc, sha}) ->
+suite(#{key_exchange := dhe_dss,  
+        cipher:= des_cbc, 
+        mac := sha}) ->
     ?TLS_DHE_DSS_WITH_DES_CBC_SHA;
-suite({dhe_dss, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := dhe_dss, 
+        cipher:= '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA;
-suite({dhe_rsa, des_cbc, sha}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher:= des_cbc,
+        mac := sha}) ->
     ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
-suite({dhe_rsa, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher:= '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA; 
-suite({dh_anon, rc4_128, md5}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher:= rc4_128,
+        mac := md5}) ->
     ?TLS_DH_anon_WITH_RC4_128_MD5;
-suite({dh_anon, des_cbc, sha}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher:= des_cbc,  
+        mac := sha}) ->
     ?TLS_DH_anon_WITH_DES_CBC_SHA;
-suite({dh_anon, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher:= '3des_ede_cbc',
+        mac := sha}) ->
     ?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
-
 %%% TSL V1.1 AES suites
-suite({rsa, aes_128_cbc, sha}) ->
+suite(#{key_exchange := rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_RSA_WITH_AES_128_CBC_SHA; 
-suite({dhe_dss, aes_128_cbc, sha}) ->
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA; 
-suite({dhe_rsa, aes_128_cbc, sha}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
-suite({dh_anon, aes_128_cbc, sha}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_DH_anon_WITH_AES_128_CBC_SHA;
-suite({rsa, aes_256_cbc, sha}) ->
+suite(#{key_exchange := rsa, 
+        cipher := aes_256_cbc,  
+        mac := sha}) ->
     ?TLS_RSA_WITH_AES_256_CBC_SHA;
-suite({dhe_dss, aes_256_cbc, sha}) ->
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
-suite({dhe_rsa, aes_256_cbc, sha}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
-suite({dh_anon, aes_256_cbc, sha}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_DH_anon_WITH_AES_256_CBC_SHA;
-
 %% TLS v1.2 suites
-
-%% suite_definition(?TLS_RSA_WITH_NULL_SHA) ->
-%%     {rsa, null, sha, sha256};
-suite({rsa, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
     ?TLS_RSA_WITH_AES_128_CBC_SHA256;
-suite({rsa, aes_256_cbc, sha256}) ->
+suite(#{key_exchange := rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
     ?TLS_RSA_WITH_AES_256_CBC_SHA256;
-suite({dhe_dss, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256;
-suite({dhe_rsa, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
-suite({dhe_dss, aes_256_cbc, sha256}) ->
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256;
-suite({dhe_rsa, aes_256_cbc, sha256}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
     ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
-suite({dh_anon, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
     ?TLS_DH_anon_WITH_AES_128_CBC_SHA256;
-suite({dh_anon, aes_256_cbc, sha256}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha256}) ->
     ?TLS_DH_anon_WITH_AES_256_CBC_SHA256;
-
 %%% PSK Cipher Suites RFC 4279
-
-suite({psk, rc4_128,sha}) ->
+suite(#{key_exchange := psk, 
+        cipher := rc4_128,
+        mac := sha}) ->
     ?TLS_PSK_WITH_RC4_128_SHA;
-suite({psk, '3des_ede_cbc',sha}) ->
+suite(#{key_exchange := psk, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_PSK_WITH_3DES_EDE_CBC_SHA;
-suite({psk, aes_128_cbc,sha}) ->
+suite(#{key_exchange := psk, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_PSK_WITH_AES_128_CBC_SHA;
-suite({psk, aes_256_cbc,sha}) ->
+suite(#{key_exchange := psk, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_PSK_WITH_AES_256_CBC_SHA;
-suite({dhe_psk, rc4_128,sha}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := rc4_128, 
+        mac := sha})  ->
     ?TLS_DHE_PSK_WITH_RC4_128_SHA;
-suite({dhe_psk, '3des_ede_cbc',sha}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA;
-suite({dhe_psk, aes_128_cbc,sha}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_DHE_PSK_WITH_AES_128_CBC_SHA;
-suite({dhe_psk, aes_256_cbc,sha}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_DHE_PSK_WITH_AES_256_CBC_SHA;
-suite({rsa_psk, rc4_128,sha}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := rc4_128, 
+        mac := sha}) ->
     ?TLS_RSA_PSK_WITH_RC4_128_SHA;
-suite({rsa_psk, '3des_ede_cbc',sha}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA;
-suite({rsa_psk, aes_128_cbc,sha}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA;
-suite({rsa_psk, aes_256_cbc,sha}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA;
-
 %%% PSK NULL Cipher Suites RFC 4785
-
-suite({psk, null, sha}) ->
+suite(#{key_exchange := psk, 
+        cipher := null, 
+        mac := sha}) ->
     ?TLS_PSK_WITH_NULL_SHA;
-suite({dhe_psk, null, sha}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := null, 
+        mac := sha}) ->
     ?TLS_DHE_PSK_WITH_NULL_SHA;
-suite({rsa_psk, null, sha}) ->
+suite(#{key_exchange := rsa_psk, 
+       cipher := null, 
+       mac := sha}) ->
     ?TLS_RSA_PSK_WITH_NULL_SHA;
-
 %%% TLS 1.2 PSK Cipher Suites RFC 5487
-
-suite({psk, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := psk, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_PSK_WITH_AES_128_GCM_SHA256;
-suite({psk, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := psk, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_PSK_WITH_AES_256_GCM_SHA384;
-suite({dhe_psk, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_DHE_PSK_WITH_AES_128_GCM_SHA256;
-suite({dhe_psk, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_DHE_PSK_WITH_AES_256_GCM_SHA384;
-suite({rsa_psk, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_RSA_PSK_WITH_AES_128_GCM_SHA256;
-suite({rsa_psk, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_RSA_PSK_WITH_AES_256_GCM_SHA384;
-
-suite({psk, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := psk, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
     ?TLS_PSK_WITH_AES_128_CBC_SHA256;
-suite({psk, aes_256_cbc, sha384}) ->
+suite(#{key_exchange := psk, 
+        cipher := aes_256_cbc, 
+        mac := sha384}) ->
     ?TLS_PSK_WITH_AES_256_CBC_SHA384;
-suite({dhe_psk, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
     ?TLS_DHE_PSK_WITH_AES_128_CBC_SHA256;
-suite({dhe_psk, aes_256_cbc, sha384}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha384}) ->
     ?TLS_DHE_PSK_WITH_AES_256_CBC_SHA384;
-suite({rsa_psk, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_128_cbc, 
+        mac := sha256}) ->
     ?TLS_RSA_PSK_WITH_AES_128_CBC_SHA256;
-suite({rsa_psk, aes_256_cbc, sha384}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := aes_256_cbc, 
+        mac := sha384}) ->
     ?TLS_RSA_PSK_WITH_AES_256_CBC_SHA384;
-
-suite({psk, null, sha256}) ->
+suite(#{key_exchange := psk, 
+        cipher := null, 
+        mac := sha256}) ->
     ?TLS_PSK_WITH_NULL_SHA256;
-suite({psk, null, sha384}) ->
+suite(#{key_exchange := psk, 
+        cipher := null,
+        mac := sha384}) ->
     ?TLS_PSK_WITH_NULL_SHA384;
-suite({dhe_psk, null, sha256}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := null, 
+        mac := sha256}) ->
     ?TLS_DHE_PSK_WITH_NULL_SHA256;
-suite({dhe_psk, null, sha384}) ->
+suite(#{key_exchange := dhe_psk, 
+        cipher := null, 
+        mac := sha384}) ->
     ?TLS_DHE_PSK_WITH_NULL_SHA384;
-suite({rsa_psk, null, sha256}) ->
+suite(#{key_exchange := rsa_psk, 
+        cipher := null,  
+        mac := sha256}) ->
     ?TLS_RSA_PSK_WITH_NULL_SHA256;
-suite({rsa_psk, null, sha384}) ->
+suite(#{key_exchange := rsa_psk, 
+       cipher := null, 
+       mac := sha384}) ->
     ?TLS_RSA_PSK_WITH_NULL_SHA384;
-
 %%% ECDHE PSK Cipher Suites RFC 5489
-
-suite({ecdhe_psk, rc4_128,sha}) ->
+suite(#{key_exchange := ecdhe_psk, 
+        cipher := rc4_128,
+        mac := sha}) ->
     ?TLS_ECDHE_PSK_WITH_RC4_128_SHA;
-suite({ecdhe_psk, '3des_ede_cbc',sha}) ->
+suite(#{key_exchange := ecdhe_psk, 
+        cipher :='3des_ede_cbc',
+        mac := sha}) ->
     ?TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA;
-suite({ecdhe_psk, aes_128_cbc,sha}) ->
+suite(#{key_exchange := ecdhe_psk, 
+        cipher := aes_128_cbc,
+        mac := sha}) ->
     ?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA;
-suite({ecdhe_psk, aes_256_cbc,sha}) ->
+suite(#{key_exchange := ecdhe_psk, 
+        cipher := aes_256_cbc,
+        mac := sha}) ->
     ?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA;
-suite({ecdhe_psk, aes_128_cbc, sha256}) ->
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_128_cbc, 
+       mac := sha256}) ->
     ?TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256;
-suite({ecdhe_psk, aes_256_cbc, sha384}) ->
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_256_cbc, 
+       mac := sha384}) ->
     ?TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384;
-suite({ecdhe_psk, null, sha256}) ->
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := null, 
+       mac := sha256}) ->
     ?TLS_ECDHE_PSK_WITH_NULL_SHA256;
-suite({ecdhe_psk, null, sha384}) ->
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := null, 
+       mac := sha384}) ->
     ?TLS_ECDHE_PSK_WITH_NULL_SHA384;
-
 %%% ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites, draft-ietf-tls-ecdhe-psk-aead-05
-
-suite({ecdhe_psk, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_128_gcm, 
+       mac := null, 
+       prf := sha256}) ->
     ?TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256;
-suite({ecdhe_psk, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := ecdhe_psk, 
+       cipher := aes_256_gcm, 
+       mac := null, 
+       prf := sha384}) ->
     ?TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384;
-%% suite({ecdhe_psk, aes_128_ccm, null, sha256}) ->
-%%     ?TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256;
-%% suite({ecdhe_psk, aes_256_ccm, null, sha256}) ->
-%%     ?TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256;
-
+ %% suite(#{key_exchange := ecdhe_psk, 
+ %%        cipher := aes_128_ccm, 
+ %%        mac := null, 
+ %%        prf := sha256}) ->
+ %%    ?TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256;
+ %% suite(#{key_exchange := ecdhe_psk, 
+ %%         cipher := aes_256_ccm, 
+ %%         mac := null, 
+ %%         prf := sha256}) ->
+ %%    ?TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256;
 %%% SRP Cipher Suites RFC 5054
-
-suite({srp_anon, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := srp_anon, 
+        cipher := '3des_ede_cbc',
+        mac :=  sha}) ->
     ?TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA;
-suite({srp_rsa, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := srp_rsa, 
+        cipher := '3des_ede_cbc',
+        mac := sha}) ->
     ?TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA;
-suite({srp_dss, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := srp_dss, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA;
-suite({srp_anon, aes_128_cbc, sha}) ->
+suite(#{key_exchange := srp_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_SRP_SHA_WITH_AES_128_CBC_SHA;
-suite({srp_rsa, aes_128_cbc, sha}) ->
+suite(#{key_exchange := srp_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA;
-suite({srp_dss, aes_128_cbc, sha}) ->
+suite(#{key_exchange := srp_dss, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA;
-suite({srp_anon, aes_256_cbc, sha}) ->
+suite(#{key_exchange := srp_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_SRP_SHA_WITH_AES_256_CBC_SHA;
-suite({srp_rsa, aes_256_cbc, sha}) ->
+suite(#{key_exchange := srp_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA;
-suite({srp_dss, aes_256_cbc, sha}) ->
+suite(#{key_exchange := srp_dss, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA;
-
 %%% RFC 4492 EC TLS suites
-suite({ecdh_ecdsa, null, sha}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := null, 
+        mac := sha}) ->
     ?TLS_ECDH_ECDSA_WITH_NULL_SHA;
-suite({ecdh_ecdsa, rc4_128, sha}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := rc4_128,  
+        mac := sha})  ->
     ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA;
-suite({ecdh_ecdsa, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA;
-suite({ecdh_ecdsa, aes_128_cbc, sha}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA;
-suite({ecdh_ecdsa, aes_256_cbc, sha}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA;
-
-suite({ecdhe_ecdsa, null, sha}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := null, 
+        mac := sha}) ->
     ?TLS_ECDHE_ECDSA_WITH_NULL_SHA;
-suite({ecdhe_ecdsa, rc4_128, sha}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
     ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA;
-suite({ecdhe_ecdsa, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA;
-suite({ecdhe_ecdsa, aes_128_cbc, sha}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA;
-suite({ecdhe_ecdsa, aes_256_cbc, sha}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA;
-
-suite({ecdh_rsa, null, sha}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := null, 
+        mac := sha}) ->
     ?TLS_ECDH_RSA_WITH_NULL_SHA;
-suite({ecdh_rsa, rc4_128, sha}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
     ?TLS_ECDH_RSA_WITH_RC4_128_SHA;
-suite({ecdh_rsa, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := '3des_ede_cbc', mac := sha}) ->
     ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA;
-suite({ecdh_rsa, aes_128_cbc, sha}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA;
-suite({ecdh_rsa, aes_256_cbc, sha}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA;
-
-suite({ecdhe_rsa, null, sha}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := null, 
+        mac := sha}) ->
     ?TLS_ECDHE_RSA_WITH_NULL_SHA;
-suite({ecdhe_rsa, rc4_128, sha}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := rc4_128, 
+        mac := sha}) ->
     ?TLS_ECDHE_RSA_WITH_RC4_128_SHA;
-suite({ecdhe_rsa, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := '3des_ede_cbc', 
+        mac := sha}) ->
     ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA;
-suite({ecdhe_rsa, aes_128_cbc, sha}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;
-suite({ecdhe_rsa, aes_256_cbc, sha}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;
-
-suite({ecdh_anon, null, sha}) ->
+suite(#{key_exchange := ecdh_anon, 
+        cipher := null, 
+        mac := sha}) ->
     ?TLS_ECDH_anon_WITH_NULL_SHA;
-suite({ecdh_anon, rc4_128, sha}) ->
+suite(#{key_exchange := ecdh_anon, 
+        cipher := rc4_128, 
+        mac := sha}) ->
     ?TLS_ECDH_anon_WITH_RC4_128_SHA;
-suite({ecdh_anon, '3des_ede_cbc', sha}) ->
+suite(#{key_exchange := ecdh_anon, 
+        cipher := '3des_ede_cbc', 
+        mac :=  sha}) ->
     ?TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA;
-suite({ecdh_anon, aes_128_cbc, sha}) ->
+suite(#{key_exchange := ecdh_anon, 
+        cipher := aes_128_cbc, 
+        mac := sha}) ->
     ?TLS_ECDH_anon_WITH_AES_128_CBC_SHA;
-suite({ecdh_anon, aes_256_cbc, sha}) ->
+suite(#{key_exchange := ecdh_anon, 
+        cipher := aes_256_cbc, 
+        mac := sha}) ->
     ?TLS_ECDH_anon_WITH_AES_256_CBC_SHA;
-
 %%% RFC 5289 EC TLS suites
-suite({ecdhe_ecdsa, aes_128_cbc, sha256, sha256}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac:= sha256, 
+        prf := sha256}) ->
     ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
-suite({ecdhe_ecdsa, aes_256_cbc, sha384, sha384}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
     ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;
-suite({ecdh_ecdsa, aes_128_cbc, sha256, sha256}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256, 
+        prf := sha256}) ->
     ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256;
-suite({ecdh_ecdsa, aes_256_cbc, sha384, sha384}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
     ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384;
-suite({ecdhe_rsa, aes_128_cbc, sha256, sha256}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256, 
+        prf := sha256}) ->
     ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
-suite({ecdhe_rsa, aes_256_cbc, sha384, sha384}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
     ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;
-suite({ecdh_rsa, aes_128_cbc, sha256, sha256}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_128_cbc, 
+        mac := sha256, 
+        prf := sha256}) ->
     ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256;
-suite({ecdh_rsa, aes_256_cbc, sha384, sha384}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_256_cbc, 
+        mac := sha384, 
+        prf := sha384}) ->
     ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384;
-
 %% RFC 5288 AES-GCM Cipher Suites
-suite({rsa, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := rsa, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_RSA_WITH_AES_128_GCM_SHA256;
-suite({rsa, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := rsa, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_RSA_WITH_AES_256_GCM_SHA384;
-suite({dhe_rsa, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_DHE_RSA_WITH_AES_128_GCM_SHA256;
-suite({dhe_rsa, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_DHE_RSA_WITH_AES_256_GCM_SHA384;
-suite({dh_rsa, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := dh_rsa, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_DH_RSA_WITH_AES_128_GCM_SHA256;
-suite({dh_rsa, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := dh_rsa, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_DH_RSA_WITH_AES_256_GCM_SHA384;
-suite({dhe_dss, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_DHE_DSS_WITH_AES_128_GCM_SHA256;
-suite({dhe_dss, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := dhe_dss, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_DHE_DSS_WITH_AES_256_GCM_SHA384;
-suite({dh_dss, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := dh_dss, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_DH_DSS_WITH_AES_128_GCM_SHA256;
-suite({dh_dss, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := dh_dss, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_DH_DSS_WITH_AES_256_GCM_SHA384;
-suite({dh_anon, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_DH_anon_WITH_AES_128_GCM_SHA256;
-suite({dh_anon, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := dh_anon, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_DH_anon_WITH_AES_256_GCM_SHA384;
-
 %% RFC 5289 ECC AES-GCM Cipher Suites
-suite({ecdhe_ecdsa, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
-suite({ecdhe_ecdsa, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
-suite({ecdh_ecdsa, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256;
-suite({ecdh_ecdsa, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := ecdh_ecdsa, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384;
-suite({ecdhe_rsa, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
-suite({ecdhe_rsa, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;
-suite({ecdh_rsa, aes_128_gcm, null, sha256}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_128_gcm, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256;
-suite({ecdh_rsa, aes_256_gcm, null, sha384}) ->
+suite(#{key_exchange := ecdh_rsa, 
+        cipher := aes_256_gcm, 
+        mac := null, 
+        prf := sha384}) ->
     ?TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384;
-
-
 %% draft-agl-tls-chacha20poly1305-04 Chacha20/Poly1305 Suites
-suite({ecdhe_rsa, chacha20_poly1305, null, sha256}) ->
+suite(#{key_exchange := ecdhe_rsa, 
+        cipher := chacha20_poly1305,  
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256;
-suite({ecdhe_ecdsa, chacha20_poly1305, null, sha256}) ->
+suite(#{key_exchange := ecdhe_ecdsa, 
+        cipher := chacha20_poly1305, 
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256;
-suite({dhe_rsa, chacha20_poly1305, null, sha256}) ->
+suite(#{key_exchange := dhe_rsa, 
+        cipher := chacha20_poly1305,  
+        mac := null, 
+        prf := sha256}) ->
     ?TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
 
 %%--------------------------------------------------------------------
@@ -1516,14 +2185,13 @@ filter(DerCert, Ciphers) ->
 %%
 %% Description: Filter suites for algorithms supported by crypto.
 %%-------------------------------------------------------------------
-filter_suites(Suites = [Value|_]) when is_tuple(Value) ->
+filter_suites(Suites = [Value|_]) when is_map(Value) ->
     Algos = crypto:supports(),
     Hashs =  proplists:get_value(hashs, Algos),
-    lists:filter(fun({KeyExchange, Cipher, Hash}) ->
-			 is_acceptable_keyexchange(KeyExchange,  proplists:get_value(public_keys, Algos)) andalso
-			     is_acceptable_cipher(Cipher,  proplists:get_value(ciphers, Algos)) andalso
-			     is_acceptable_hash(Hash,  proplists:get_value(hashs, Algos));
-		    ({KeyExchange, Cipher, Hash, Prf}) ->
+    lists:filter(fun(#{key_exchange := KeyExchange, 
+                       cipher := Cipher, 
+                       mac := Hash,
+                       prf := Prf}) ->
 			 is_acceptable_keyexchange(KeyExchange, proplists:get_value(public_keys, Algos)) andalso
 			     is_acceptable_cipher(Cipher, proplists:get_value(ciphers, Algos)) andalso
 			     is_acceptable_hash(Hash, Hashs) andalso
@@ -1534,9 +2202,12 @@ filter_suites(Suites) ->
     Algos = crypto:supports(),
     Hashs =  proplists:get_value(hashs, Algos),
     lists:filter(fun(Suite) ->
-			 {KeyExchange, Cipher, Hash, Prf} = ssl_cipher:suite_definition(Suite),
+			 #{key_exchange := KeyExchange, 
+                           cipher := Cipher, 
+                           mac := Hash,
+                           prf := Prf} = suite_definition(Suite),
 			 is_acceptable_keyexchange(KeyExchange, proplists:get_value(public_keys, Algos)) andalso
-			     is_acceptable_cipher(Cipher,  proplists:get_value(ciphers, Algos)) andalso
+			     is_acceptable_cipher(Cipher, proplists:get_value(ciphers, Algos)) andalso
 			     is_acceptable_hash(Hash, Hashs) andalso
 			     is_acceptable_prf(Prf, Hashs)
 		 end, Suites).
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index b9b463eeb6..d046145dff 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -495,7 +495,7 @@ handle_session(#server_hello{cipher_suite = CipherSuite,
 	       #state{session = #session{session_id = OldId},
 		      negotiated_version = ReqVersion,
 		      negotiated_protocol = CurrentProtocol} = State0) ->
-    {KeyAlgorithm, _, _, _} =
+    #{key_exchange := KeyAlgorithm} =
 	ssl_cipher:suite_definition(CipherSuite),
     
     PremasterSecret = make_premaster_secret(ReqVersion, KeyAlgorithm),
@@ -1406,9 +1406,9 @@ connection_info(#state{sni_hostname = SNIHostname,
 		       negotiated_version =  {_,_} = Version, 
 		       ssl_options = Opts}) ->
     RecordCB = record_cb(Connection),
-    CipherSuiteDef = ssl_cipher:erl_suite_definition(CipherSuite),
-    IsNamedCurveSuite = lists:member(element(1,CipherSuiteDef),
-			      [ecdh_ecdsa, ecdhe_ecdsa, ecdh_anon]),
+    CipherSuiteDef = #{key_exchange := KexAlg} = ssl_cipher:suite_definition(CipherSuite),
+    IsNamedCurveSuite = lists:member(KexAlg,
+                                     [ecdh_ecdsa, ecdhe_ecdsa, ecdh_anon]),
     CurveInfo = case ECCCurve of
 		    {namedCurve, Curve} when IsNamedCurveSuite ->
 			[{ecc, {named_curve, pubkey_cert_records:namedCurves(Curve)}}];
@@ -1417,7 +1417,7 @@ connection_info(#state{sni_hostname = SNIHostname,
 		end,
     [{protocol, RecordCB:protocol_version(Version)},
      {session_id, SessionId},
-     {cipher_suite, CipherSuiteDef},
+     {cipher_suite, ssl_cipher:erl_suite_definition(CipherSuiteDef)},
      {sni_hostname, SNIHostname} | CurveInfo] ++ ssl_options_list(Opts).
 
 security_info(#state{connection_states = ConnectionStates}) ->
@@ -1485,7 +1485,7 @@ resumed_server_hello(#state{session = Session,
 
 server_hello(ServerHello, State0, Connection) ->
     CipherSuite = ServerHello#server_hello.cipher_suite,
-    {KeyAlgorithm, _, _, _} = ssl_cipher:suite_definition(CipherSuite),
+    #{key_exchange := KeyAlgorithm}  = ssl_cipher:suite_definition(CipherSuite),
     State = Connection:queue_handshake(ServerHello, State0),
     State#state{key_algorithm = KeyAlgorithm}.
 
@@ -1499,8 +1499,8 @@ handle_peer_cert(Role, PeerCert, PublicKeyInfo,
     State1 = State0#state{session =
 			 Session#session{peer_certificate = PeerCert},
 			 public_key_info = PublicKeyInfo},
-    {KeyAlg,_,_,_} = ssl_cipher:suite_definition(CipherSuite),
-    State2 = handle_peer_cert_key(Role, PeerCert, PublicKeyInfo, KeyAlg, State1),
+    #{key_exchange := KeyAlgorithm} = ssl_cipher:suite_definition(CipherSuite),
+    State2 = handle_peer_cert_key(Role, PeerCert, PublicKeyInfo, KeyAlgorithm, State1),
 
     {Record, State} = Connection:next_record(State2),
     Connection:next_event(certify, Record, State).
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 24f3a97b9b..61d61b53dd 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -1184,19 +1184,22 @@ certificate_types(_, {N, M}) when N >= 3 andalso M >= 3 ->
 	false ->
 	    <<?BYTE(?RSA_SIGN), ?BYTE(?DSS_SIGN)>>
     end;
-certificate_types({KeyExchange, _, _, _}, _) when KeyExchange == rsa;
-						  KeyExchange == dh_rsa;
-						  KeyExchange == dhe_rsa;
-						  KeyExchange == ecdhe_rsa ->
+
+certificate_types(#{key_exchange := KeyExchange}, _) when KeyExchange == rsa;
+                                                          KeyExchange == dh_rsa;
+                                                          KeyExchange == dhe_rsa;
+                                                          KeyExchange == ecdhe_rsa ->
     <<?BYTE(?RSA_SIGN)>>;
-certificate_types({KeyExchange, _, _, _}, _)  when KeyExchange == dh_dss; 
-						   KeyExchange == dhe_dss;
-						   KeyExchange == srp_dss ->
+
+certificate_types(#{key_exchange := KeyExchange}, _)  when KeyExchange == dh_dss; 
+                                                           KeyExchange == dhe_dss;
+                                                           KeyExchange == srp_dss ->
     <<?BYTE(?DSS_SIGN)>>;
-certificate_types({KeyExchange, _, _, _}, _) when KeyExchange == dh_ecdsa;
-						  KeyExchange == dhe_ecdsa;
-						  KeyExchange == ecdh_ecdsa;
-						  KeyExchange == ecdhe_ecdsa ->
+
+certificate_types(#{key_exchange := KeyExchange}, _) when KeyExchange == dh_ecdsa;
+                                                          KeyExchange == dhe_ecdsa;
+                                                          KeyExchange == ecdh_ecdsa;
+                                                          KeyExchange == ecdhe_ecdsa ->
     <<?BYTE(?ECDSA_SIGN)>>;
 certificate_types(_, _) ->
     <<?BYTE(?RSA_SIGN)>>.
@@ -2062,23 +2065,23 @@ handle_psk_identity(PSKIdentity, {Fun, UserState}) ->
 
 filter_hashsigns([], [], _, Acc) ->
     lists:reverse(Acc);
-filter_hashsigns([Suite | Suites], [{KeyExchange,_,_,_} | Algos], HashSigns,
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns,
 		 Acc) when KeyExchange == dhe_ecdsa;
 			   KeyExchange == ecdhe_ecdsa ->
     do_filter_hashsigns(ecdsa, Suite, Suites, Algos, HashSigns, Acc);
 
-filter_hashsigns([Suite | Suites], [{KeyExchange,_,_,_} | Algos], HashSigns,
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns,
 		 Acc) when KeyExchange == rsa;
 			   KeyExchange == dhe_rsa;
 			   KeyExchange == ecdhe_rsa;
 			   KeyExchange == srp_rsa;
 			   KeyExchange == rsa_psk ->
     do_filter_hashsigns(rsa, Suite, Suites, Algos, HashSigns, Acc);
-filter_hashsigns([Suite | Suites], [{KeyExchange,_,_,_} | Algos], HashSigns, Acc) when 
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Acc) when 
       KeyExchange == dhe_dss;
       KeyExchange == srp_dss ->							       
     do_filter_hashsigns(dsa, Suite, Suites, Algos, HashSigns, Acc);
-filter_hashsigns([Suite | Suites], [{KeyExchange,_,_,_} | Algos], HashSigns, Acc) when 
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Acc) when 
       KeyExchange == dh_dss; 
       KeyExchange == dh_rsa; 
       KeyExchange == dh_ecdsa;
@@ -2088,7 +2091,7 @@ filter_hashsigns([Suite | Suites], [{KeyExchange,_,_,_} | Algos], HashSigns, Acc
       %%  algorithm pair appearing in the hash_sign extension.  The names
     %%  DH_DSS, DH_RSA, ECDH_ECDSA, and ECDH_RSA are historical.
     filter_hashsigns(Suites, Algos, HashSigns, [Suite| Acc]);
-filter_hashsigns([Suite | Suites], [{KeyExchange,_,_,_} | Algos], HashSigns, Acc) when 
+filter_hashsigns([Suite | Suites], [#{key_exchange := KeyExchange} | Algos], HashSigns, Acc) when 
       KeyExchange == dh_anon;
       KeyExchange == ecdh_anon;
       KeyExchange == srp_anon;
@@ -2294,15 +2297,15 @@ handle_ecc_point_fmt_extension(_) ->
 
 advertises_ec_ciphers([]) ->
     false;
-advertises_ec_ciphers([{ecdh_ecdsa, _,_,_} | _]) ->
+advertises_ec_ciphers([#{key_exchange := ecdh_ecdsa} | _]) ->
     true;
-advertises_ec_ciphers([{ecdhe_ecdsa, _,_,_} | _]) ->
+advertises_ec_ciphers([#{key_exchange := ecdhe_ecdsa} | _]) ->
     true;
-advertises_ec_ciphers([{ecdh_rsa, _,_,_} | _]) ->
+advertises_ec_ciphers([#{key_exchange := ecdh_rsa} | _]) ->
     true;
-advertises_ec_ciphers([{ecdhe_rsa, _,_,_} | _]) ->
+advertises_ec_ciphers([#{key_exchange := ecdhe_rsa} | _]) ->
     true;
-advertises_ec_ciphers([{ecdh_anon, _,_,_} | _]) ->
+advertises_ec_ciphers([#{key_exchange := ecdh_anon} | _]) ->
     true;
 advertises_ec_ciphers([{ecdhe_psk, _,_,_} | _]) ->
     true;
diff --git a/lib/ssl/src/tls_handshake.erl b/lib/ssl/src/tls_handshake.erl
index a38c5704a6..d59e817ffb 100644
--- a/lib/ssl/src/tls_handshake.erl
+++ b/lib/ssl/src/tls_handshake.erl
@@ -203,7 +203,7 @@ handle_client_hello(Version,
 		no_suite ->
                     ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY, no_suitable_ciphers);
 		_ ->
-		    {KeyExAlg,_,_,_} = ssl_cipher:suite_definition(CipherSuite),
+		    #{key_exchange := KeyExAlg} = ssl_cipher:suite_definition(CipherSuite),
 		    case ssl_handshake:select_hashsign(ClientHashSigns, Cert, KeyExAlg, 
                                                        SupportedHashSigns, Version) of
 			#alert{} = Alert ->