Merge remote-tracking branch 'upstream/maint'

Conflicts:
	bootstrap/lib/stdlib/ebin/beam_lib.beam
	lib/public_key/test/erl_make_certs.erl

12 files changed, 139 insertions, 72 deletions

diff --git a/lib/ssl/src/Makefile b/lib/ssl/src/Makefile
index d3ba76d34e..3b8145089e 100644
--- a/lib/ssl/src/Makefile
+++ b/lib/ssl/src/Makefile
@@ -66,7 +66,7 @@ MODULES= \
 
 INTERNAL_HRL_FILES = \
 	 ssl_alert.hrl ssl_cipher.hrl ssl_handshake.hrl ssl_internal.hrl \
-	 ssl_record.hrl ssl_srp.hrl ssl_srp_primes.hrl
+	 ssl_record.hrl ssl_srp.hrl
 
 ERL_FILES= \
 	$(MODULES:%=%.erl) \
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index f52862729a..fb64a6652f 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -37,7 +37,6 @@
 -include("ssl_record.hrl").
 -include("ssl_cipher.hrl").
 -include("ssl_handshake.hrl").
--include("ssl_srp_primes.hrl").
 
 -include_lib("public_key/include/public_key.hrl"). 
 
diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index dc413d6dfc..898b421dff 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -1024,30 +1024,32 @@ filter(DerCert, Ciphers) ->
 %% Description: filter suites for algorithms
 %%-------------------------------------------------------------------
 filter_suites(Suites = [{_,_,_}|_]) ->
-    Algos = crypto:algorithms(),
+    Algos = crypto:supports(),
     lists:filter(fun({KeyExchange, Cipher, Hash}) ->
-			 is_acceptable_keyexchange(KeyExchange, Algos) andalso
-			     is_acceptable_cipher(Cipher, Algos) andalso
-			     is_acceptable_hash(Hash, Algos)
+			 is_acceptable_keyexchange(KeyExchange,  proplists:get_value(public_keys, Algos)) andalso
+			     is_acceptable_cipher(Cipher,  proplists:get_value(ciphers, Algos)) andalso
+			     is_acceptable_hash(Hash,  proplists:get_value(hashs, Algos))
 		 end, Suites);
 
 filter_suites(Suites = [{_,_,_,_}|_]) ->
-    Algos = crypto:algorithms(),
+    Algos = crypto:supports(),
+    Hashs =  proplists:get_value(hashs, Algos),
     lists:filter(fun({KeyExchange, Cipher, Hash, Prf}) ->
-			 is_acceptable_keyexchange(KeyExchange, Algos) andalso
-			     is_acceptable_cipher(Cipher, Algos) andalso
-			     is_acceptable_hash(Hash, Algos) andalso
-			     is_acceptable_prf(Prf, Algos)
+			 is_acceptable_keyexchange(KeyExchange, proplists:get_value(public_keys, Algos)) andalso
+			     is_acceptable_cipher(Cipher, proplists:get_value(ciphers, Algos)) andalso
+			     is_acceptable_hash(Hash, Hashs) andalso
+			     is_acceptable_prf(Prf, Hashs)
 		 end, Suites);
 
 filter_suites(Suites) ->
-    Algos = crypto:algorithms(),
+    Algos = crypto:supports(),
+    Hashs =  proplists:get_value(hashs, Algos),
     lists:filter(fun(Suite) ->
 			 {KeyExchange, Cipher, Hash, Prf} = ssl_cipher:suite_definition(Suite),
-			 is_acceptable_keyexchange(KeyExchange, Algos) andalso
-			     is_acceptable_cipher(Cipher, Algos) andalso
-			     is_acceptable_hash(Hash, Algos) andalso
-			     is_acceptable_prf(Prf, Algos)
+			 is_acceptable_keyexchange(KeyExchange, proplists:get_value(public_keys, Algos)) andalso
+			     is_acceptable_cipher(Cipher,  proplists:get_value(ciphers, Algos)) andalso
+			     is_acceptable_hash(Hash, Hashs) andalso
+			     is_acceptable_prf(Prf, Hashs)
 		 end, Suites).
 
 is_acceptable_keyexchange(KeyExchange, Algos)
@@ -1056,7 +1058,7 @@ is_acceptable_keyexchange(KeyExchange, Algos)
        KeyExchange == ecdh_rsa;
        KeyExchange == ecdhe_rsa;
        KeyExchange == ecdh_anon ->
-    proplists:get_bool(ec, Algos);
+    proplists:get_bool(ecdh, Algos);
 is_acceptable_keyexchange(_, _) ->
     true.
 
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 54eed03d3c..de9260fd8c 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -35,7 +35,6 @@
 -include("ssl_cipher.hrl"). 
 -include("ssl_internal.hrl").
 -include("ssl_srp.hrl").
--include("ssl_srp_primes.hrl").
 -include_lib("public_key/include/public_key.hrl"). 
 
 %% Internal application API
@@ -2216,7 +2215,7 @@ client_srp_master_secret(Generator, Prime, Salt, ServerPub, ClientKeys,
     case ssl_srp_primes:check_srp_params(Generator, Prime) of
 	ok ->
 	    {Username, Password} = SslOpts#ssl_options.srp_identity,
-	    DerivedKey = crypto:sha([Salt, crypto:sha([Username, <<$:>>, Password])]),
+	    DerivedKey = crypto:hash(sha, [Salt, crypto:hash(sha, [Username, <<$:>>, Password])]),
 	    case crypto:compute_key(srp, ServerPub, ClientKeys, {user, [DerivedKey, Prime, Generator, '6a']}) of
 		error ->
 		    ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER);
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index e358cbe9bb..24ea86311f 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -840,7 +840,8 @@ select_next_protocol(Protocols, NextProtocolSelector) ->
     end.
 
 default_ecc_extensions(Version) ->
-    case proplists:get_bool(ec, crypto:algorithms()) of
+    CryptoSupport = proplists:get_value(public_keys, crypto:supports()),
+    case proplists:get_bool(ecdh, CryptoSupport) of
 	true ->
 	    EcPointFormats = #ec_point_formats{ec_point_format_list = [?ECPOINT_UNCOMPRESSED]},
 	    EllipticCurves = #elliptic_curves{elliptic_curve_list = ssl_tls1:ecc_curves(Version)},
@@ -850,7 +851,8 @@ default_ecc_extensions(Version) ->
     end.
 
 handle_ecc_extensions(Version, EcPointFormats0, EllipticCurves0) ->
-    case proplists:get_bool(ec, crypto:algorithms()) of
+    CryptoSupport = proplists:get_value(public_keys, crypto:supports()),
+    case proplists:get_bool(ecdh, CryptoSupport) of
 	true ->
 	    EcPointFormats1 = handle_ecc_point_fmt_extension(EcPointFormats0),
 	    EllipticCurves1 = handle_ecc_curves_extension(Version, EllipticCurves0),
@@ -1767,7 +1769,8 @@ default_hash_signs() ->
 		 ?TLSEXT_SIGALG(sha),
 		 ?TLSEXT_SIGALG_DSA(sha),
 		 ?TLSEXT_SIGALG_RSA(md5)],
-    HasECC = proplists:get_bool(ec, crypto:algorithms()),
+    CryptoSupport = proplists:get_value(public_keys, crypto:supports()),
+    HasECC = proplists:get_bool(ecdsa, CryptoSupport),
     #hash_sign_algos{hash_sign_algos =
 			 lists:filter(fun({_, ecdsa}) -> HasECC;
 					 (_) -> true end, HashSigns)}.
diff --git a/lib/ssl/src/ssl_record.erl b/lib/ssl/src/ssl_record.erl
index 50b1b2cda9..2a3356d60f 100644
--- a/lib/ssl/src/ssl_record.erl
+++ b/lib/ssl/src/ssl_record.erl
@@ -712,4 +712,5 @@ mac_hash({3, N} = Version, MacAlg, MacSecret, SeqNo, Type, Length, Fragment)
 		      Length, Fragment).
 
 sufficient_tlsv1_2_crypto_support() ->
-    proplists:get_bool(sha256, crypto:algorithms()).
+    CryptoSupport = crypto:supports(),
+    proplists:get_bool(sha256, proplists:get_value(hashs, CryptoSupport)).
diff --git a/lib/ssl/src/ssl_srp_primes.hrl b/lib/ssl/src/ssl_srp_primes.hrl
deleted file mode 100644
index 4bd534efbf..0000000000
--- a/lib/ssl/src/ssl_srp_primes.hrl
+++ /dev/null
@@ -1 +0,0 @@
--type srp_parameters() :: srp_1024 | srp_1536 | srp_2048 | srp_3072 | srp_4096 | srp_6144 | srp_8192.
diff --git a/lib/ssl/src/ssl_tls1.erl b/lib/ssl/src/ssl_tls1.erl
index f8fd9efd07..8ab66d0627 100644
--- a/lib/ssl/src/ssl_tls1.erl
+++ b/lib/ssl/src/ssl_tls1.erl
@@ -184,6 +184,22 @@ mac_hash(Method, Mac_write_secret, Seq_num, Type, {Major, Minor},
 -spec suites(1|2|3) -> [cipher_suite()].
     
 suites(Minor) when Minor == 1; Minor == 2->
+    case sufficent_ec_support() of
+	true ->
+	    all_suites(Minor);
+	false ->
+	    no_ec_suites(Minor)
+    end;
+
+suites(Minor) when Minor == 3 ->
+    case sufficent_ec_support() of
+	true ->
+	    all_suites(3) ++ all_suites(2);
+	false ->
+	    no_ec_suites(3) ++ no_ec_suites(2)
+    end.
+
+all_suites(Minor) when Minor == 1; Minor == 2->		
     [ 
       ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
       ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
@@ -208,7 +224,7 @@ suites(Minor) when Minor == 1; Minor == 2->
       ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
       ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
       ?TLS_RSA_WITH_AES_128_CBC_SHA,
-      %%?TLS_RSA_WITH_IDEA_CBC_SHA,
+      
       ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
       ?TLS_ECDHE_RSA_WITH_RC4_128_SHA,
       ?TLS_RSA_WITH_RC4_128_SHA,
@@ -216,31 +232,55 @@ suites(Minor) when Minor == 1; Minor == 2->
       ?TLS_DHE_RSA_WITH_DES_CBC_SHA,
       ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
       ?TLS_ECDH_RSA_WITH_RC4_128_SHA,
+      
       ?TLS_RSA_WITH_DES_CBC_SHA
-     ];
-
-suites(Minor) when Minor == 3 ->
+    ];
+all_suites(3) ->	
     [
      ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
      ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
      ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
      ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
-
+     
      ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
      ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
      ?TLS_RSA_WITH_AES_256_CBC_SHA256,
-
+     
      ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
      ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
      ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
      ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
+     
+     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
+     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
+     ?TLS_RSA_WITH_AES_128_CBC_SHA256
+    ].
 
+no_ec_suites(Minor) when Minor == 1; Minor == 2->		
+    [ 
+      ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
+      ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
+      ?TLS_RSA_WITH_AES_256_CBC_SHA,
+      ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
+      ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
+      ?TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+      ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
+      ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
+      ?TLS_RSA_WITH_AES_128_CBC_SHA,
+      ?TLS_RSA_WITH_RC4_128_SHA,
+      ?TLS_RSA_WITH_RC4_128_MD5,
+      ?TLS_DHE_RSA_WITH_DES_CBC_SHA,
+      ?TLS_RSA_WITH_DES_CBC_SHA
+    ];
+no_ec_suites(3) ->	
+    [
+     ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
+     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
+     ?TLS_RSA_WITH_AES_256_CBC_SHA256,
      ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
      ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
      ?TLS_RSA_WITH_AES_128_CBC_SHA256
-     %% ?TLS_DH_anon_WITH_AES_128_CBC_SHA256,
-     %% ?TLS_DH_anon_WITH_AES_256_CBC_SHA256
-	] ++ suites(2).
+    ].
 
 %%--------------------------------------------------------------------
 %%% Internal functions
@@ -386,3 +426,7 @@ enum_to_oid(22) -> ?secp256k1;
 enum_to_oid(23) -> ?secp256r1;
 enum_to_oid(24) -> ?secp384r1;
 enum_to_oid(25) -> ?secp521r1.
+
+sufficent_ec_support() ->
+    CryptoSupport = crypto:supports(),
+    proplists:get_bool(ecdh, proplists:get_value(public_keys, CryptoSupport)).
diff --git a/lib/ssl/test/erl_make_certs.erl b/lib/ssl/test/erl_make_certs.erl
index 723ccf4496..22dc951ac1 100644
--- a/lib/ssl/test/erl_make_certs.erl
+++ b/lib/ssl/test/erl_make_certs.erl
@@ -391,35 +391,32 @@ gen_dsa2(LSize, NSize) ->
 	error -> 
 	    gen_dsa2(LSize, NSize);
 	P ->	    
-	    G = crypto:mod_exp(2, (P-1) div Q, P), % Choose G a number whose multiplicative order modulo p is q.
+	    G = crypto:mod_pow(2, (P-1) div Q, P), % Choose G a number whose multiplicative order modulo p is q.
 	    %%                 such that This may be done by setting g = h^(p-1)/q mod p, commonly h=2 is used.
 	    
 	    X = prime(20),               %% Choose x by some random method, where 0 < x < q.
-	    Y = crypto:mod_exp(G, X, P), %% Calculate y = g^x mod p.
+	    Y = crypto:mod_pow(G, X, P), %% Calculate y = g^x mod p.
 	    
-	    #'DSAPrivateKey'{version=0, p=P, q=Q, g=G, y=Y, x=X}
+	    #'DSAPrivateKey'{version=0, p = P, q = Q, 
+			     g = crypto:bytes_to_integer(G), y = crypto:bytes_to_integer(Y), x = X}
     end.
     
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %% EC key generation  (OBS: for testing only)
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
-int2list(I) ->
-    L = (length(integer_to_list(I, 16)) + 1) div 2,
-    binary_to_list(<<I:(L*8)>>).
-
 gen_ec2(CurveId) ->
-     {PrivKey, PubKey} = crypto:generate_key(ecdh, CurveId),
+     {PubKey, PrivKey} = crypto:generate_key(ecdh, CurveId),
 
     #'ECPrivateKey'{version = 1,
-		    privateKey = int2list(PrivKey),
+		    privateKey = binary_to_list(PrivKey),
 		    parameters = {namedCurve, pubkey_cert_records:namedCurves(CurveId)},
 		    publicKey = {0, PubKey}}.
 
 %% See fips_186-3.pdf
 dsa_search(T, P0, Q, Iter) when Iter > 0 ->
     P = 2*T*Q*P0 + 1,
-    case is_prime(crypto:mpint(P), 50) of
+    case is_prime(P, 50) of
 	true -> P;
 	false -> dsa_search(T+1, P0, Q, Iter-1)
     end;
@@ -430,38 +427,40 @@ dsa_search(_,_,_,_) ->
 %%%%%%% Crypto Math %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 prime(ByteSize) ->
     Rand = odd_rand(ByteSize),
-    crypto:erlint(prime_odd(Rand, 0)).
+    prime_odd(Rand, 0).
 
 prime_odd(Rand, N) ->
     case is_prime(Rand, 50) of
 	true -> 
 	    Rand;
 	false -> 
-	    NotPrime = crypto:erlint(Rand),
-	    prime_odd(crypto:mpint(NotPrime+2), N+1)
+	    prime_odd(Rand+2, N+1)
     end.
 
 %% see http://en.wikipedia.org/wiki/Fermat_primality_test
 is_prime(_, 0) -> true;
 is_prime(Candidate, Test) -> 
-    CoPrime = odd_rand(<<0,0,0,4, 10000:32>>, Candidate),
-    case crypto:mod_exp(CoPrime, Candidate, Candidate) of
-	CoPrime -> is_prime(Candidate, Test-1);
-	_       -> false
-    end.
+    CoPrime = odd_rand(10000, Candidate),
+    Result = crypto:mod_pow(CoPrime, Candidate, Candidate) ,
+    is_prime(CoPrime, crypto:bytes_to_integer(Result), Candidate, Test).
+
+is_prime(CoPrime, CoPrime, Candidate, Test) ->
+    is_prime(Candidate, Test-1);
+is_prime(_,_,_,_) ->
+    false.
 
 odd_rand(Size) ->
     Min = 1 bsl (Size*8-1),
     Max = (1 bsl (Size*8))-1,
-    odd_rand(crypto:mpint(Min), crypto:mpint(Max)).
+    odd_rand(Min, Max).
 
 odd_rand(Min,Max) ->
-    Rand = <<Sz:32, _/binary>> = crypto:rand_uniform(Min,Max),
-    BitSkip = (Sz+4)*8-1,
-    case Rand of
-	Odd  = <<_:BitSkip,  1:1>> -> Odd;
-	Even = <<_:BitSkip,  0:1>> -> 
-	    crypto:mpint(crypto:erlint(Even)+1)
+    Rand = crypto:rand_uniform(Min,Max),
+    case Rand rem 2 of
+	0 -> 
+	    Rand + 1;
+	_ -> 
+	    Rand
     end.
 
 extended_gcd(A, B) ->
@@ -480,3 +479,4 @@ pem_to_der(File) ->
 der_to_pem(File, Entries) ->
     PemBin = public_key:pem_encode(Entries),
     file:write_file(File, PemBin).
+
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 165a8a5fcc..c4a6cf1407 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -1549,7 +1549,7 @@ ciphers_rsa_signed_certs(Config) when is_list(Config) ->
     Version = 
 	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
 
-    Ciphers = ssl_test_lib:rsa_suites(erlang),
+    Ciphers = ssl_test_lib:rsa_suites(crypto),
     ct:log("~p erlang cipher suites ~p~n", [Version, Ciphers]),
     run_suites(Ciphers, Version, Config, rsa).
 %%-------------------------------------------------------------------
@@ -1559,7 +1559,7 @@ ciphers_rsa_signed_certs_openssl_names() ->
 ciphers_rsa_signed_certs_openssl_names(Config) when is_list(Config) ->
     Version = 
 	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
-    Ciphers = ssl_test_lib:openssl_rsa_suites(),  
+    Ciphers = ssl_test_lib:openssl_rsa_suites(crypto),  
     ct:log("tls1 openssl cipher suites ~p~n", [Ciphers]),
     run_suites(Ciphers, Version, Config, rsa).
 
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index a8ff5187b6..34c52b10b3 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -285,7 +285,7 @@ user_lookup(psk, _Identity, UserState) ->
     {ok, UserState};
 user_lookup(srp, Username, _UserState) ->
     Salt = ssl:random_bytes(16),
-    UserPassHash = crypto:sha([Salt, crypto:sha([Username, <<$:>>, <<"secret">>])]),
+    UserPassHash = crypto:hash(sha, [Salt, crypto:hash(sha, [Username, <<$:>>, <<"secret">>])]),
     {ok, {srp_1024, Salt, UserPassHash}}.
 
 cert_options(Config) ->
@@ -405,7 +405,8 @@ make_dsa_cert(Config) ->
      | Config].
 
 make_ecdsa_cert(Config) ->
-    case proplists:get_bool(ec, crypto:algorithms()) of
+    CryptoSupport = crypto:supports(),
+    case proplists:get_bool(ecdsa, proplists:get_value(public_keys, CryptoSupport)) of
 	    true ->
 	    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = make_cert_files("server", Config, ec, ec, ""),
 	    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = make_cert_files("client", Config, ec, ec, ""),
@@ -429,7 +430,8 @@ make_ecdsa_cert(Config) ->
 %%    This key exchange algorithm is the same as ECDH_ECDSA except that the
 %%    server's certificate MUST be signed with RSA rather than ECDSA.
 make_ecdh_rsa_cert(Config) ->
-    case proplists:get_bool(ec, crypto:algorithms()) of
+    CryptoSupport = crypto:supports(),
+    case proplists:get_bool(ecdh, proplists:get_value(public_keys, CryptoSupport)) of
 	true ->
 	    {ServerCaCertFile, ServerCertFile, ServerKeyFile} = make_cert_files("server", Config, rsa, ec, "rsa_"),
 	    {ClientCaCertFile, ClientCertFile, ClientKeyFile} = make_cert_files("client", Config, rsa, ec, "rsa_"),
@@ -754,14 +756,20 @@ ecdh_rsa_suites() ->
 		 end,
 		 ssl:cipher_suites()).
 
-openssl_rsa_suites() ->
+openssl_rsa_suites(CounterPart) ->
     Ciphers = ssl:cipher_suites(openssl),
+    Names = case is_sane_ecc(CounterPart) of
+		true ->
+		    "DSS | ECDSA";
+		false ->
+		    "DSS | ECDHE | ECDH"
+		end,
     lists:filter(fun(Str) ->
-			 case re:run(Str,"DSS|ECDH-RSA|ECDSA",[]) of
+			 case re:run(Str, Names,[]) of
 			     nomatch ->
-				 true;
+				 false;
 			     _ ->
-				 false
+				 true
 			 end 
 		     end, Ciphers).
 
@@ -939,9 +947,11 @@ init_tls_version(Version) ->
     ssl:start().
 
 sufficient_crypto_support('tlsv1.2') ->
-    proplists:get_bool(sha256, crypto:algorithms());
+    CryptoSupport = crypto:supports(),
+    proplists:get_bool(sha256, proplists:get_value(hashs, CryptoSupport));
 sufficient_crypto_support(ciphers_ec) ->
-    proplists:get_bool(ec, crypto:algorithms());
+    CryptoSupport = crypto:supports(),
+    proplists:get_bool(ecdh, proplists:get_value(public_keys, CryptoSupport));
 sufficient_crypto_support(_) ->
     true.
 
@@ -990,6 +1000,16 @@ is_sane_ecc(openssl) ->
 	_ ->
 	    true
     end;
+is_sane_ecc(crypto) ->
+    [{_,_, Bin}]  = crypto:info_lib(), 
+    case binary_to_list(Bin) of
+	"OpenSSL 0.9.8" ++ _ -> % Does not support ECC
+	    false;
+	"OpenSSL 0.9.7" ++ _ -> % Does not support ECC
+	    false;
+	_ ->
+	    true
+    end;
 is_sane_ecc(_) ->
     true.
 
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 075b4b1ec4..7f91865a86 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -106,9 +106,9 @@ init_per_suite(Config0) ->
 					      ?config(priv_dir, Config0))),
 		    ct:log("Make certs  ~p~n", [Result]),
 		    Config1 = ssl_test_lib:make_dsa_cert(Config0),
-		    Config = ssl_test_lib:cert_options(Config1),
-		    NewConfig = [{watchdog, Dog} | Config],
-		    ssl_test_lib:cipher_restriction(NewConfig)
+		    Config2 = ssl_test_lib:cert_options(Config1),
+		    Config = [{watchdog, Dog} | Config2],
+		    ssl_test_lib:cipher_restriction(Config)
 		catch _:_  ->
 		    {skip, "Crypto did not start"}
 	    end