anchor.diff:      GSC = generic_stream_cipher_from_bin(T, HashSz),
       #generic_stream_cipher{content=Content, mac=Mac} = GSC,
       {Content, Mac, CipherState#cipher_state{state=State1}};
  -decipher(?DES, HashSz, CipherState, Fragment) ->
  +decipher(?DES, HashSz, CipherState, Fragment, Version) ->
       block_decipher(fun(Key, IV, T) ->
   			   crypto:des_cbc_decrypt(Key, IV, T)
  -		   end, CipherState, HashSz, Fragment);
  -%% decipher(?DES40, HashSz, CipherState, Fragment) ->
  +		   end, CipherState, HashSz, Fragment, Version);
  +%% decipher(?DES40, HashSz, CipherState, Fragment, Version) ->
   %%     block_decipher(fun(Key, IV, T) ->
   %% 			   crypto:des_cbc_decrypt(Key, IV, T)
  -%% 		   end, CipherState, HashSz, Fragment);
  -decipher(?'3DES', HashSz, CipherState, Fragment) ->
  +%% 		   end, CipherState, HashSz, Fragment, Version);
  +decipher(?'3DES', HashSz, CipherState, Fragment, Version) ->
       block_decipher(fun(<<K1:8/binary, K2:8/binary, K3:8/binary>>, IV, T) ->
   			   crypto:des3_cbc_decrypt(K1, K2, K3, IV, T)
  -		   end, CipherState, HashSz, Fragment);
  -decipher(?AES, HashSz, CipherState, Fragment) ->
  +		   end, CipherState, HashSz, Fragment, Version);
  +decipher(?AES, HashSz, CipherState, Fragment, Version) ->
       block_decipher(fun(Key, IV, T) when byte_size(Key) =:= 16 ->
   			   crypto:aes_cbc_128_decrypt(Key, IV, T);
   		      (Key, IV, T) when byte_size(Key) =:= 32 ->
   			   crypto:aes_cbc_256_decrypt(Key, IV, T)
  -		   end, CipherState, HashSz, Fragment).
  -%% decipher(?IDEA, HashSz, CipherState, Fragment) ->
  +		   end, CipherState, HashSz, Fragment, Version).
  +%% decipher(?IDEA, HashSz, CipherState, Fragment, Version) ->
   %%     block_decipher(fun(Key, IV, T) ->
   %%  			   crypto:idea_cbc_decrypt(Key, IV, T)
  -%%  		   end, CipherState, HashSz, Fragment);
  +%%  		   end, CipherState, HashSz, Fragment, Version);
   
   block_decipher(Fun, #cipher_state{key=Key, iv=IV} = CipherState0, 
  -	       HashSz, Fragment) ->
  +	       HashSz, Fragment, Version) ->
       ?DBG_HEX(Key),
       ?DBG_HEX(IV),
       ?DBG_HEX(Fragment),
       T = Fun(Key, IV, Fragment),
       ?DBG_HEX(T),
       GBC = generic_block_cipher_from_bin(T, HashSz),
  -    ok = check_padding(GBC),  %% TODO kolla ocks...
  -    Content = GBC#generic_block_cipher.content,
  -    Mac = GBC#generic_block_cipher.mac,
  -    CipherState1 = CipherState0#cipher_state{iv=next_iv(Fragment, IV)},
  -    {Content, Mac, CipherState1}.
  -
  +    case is_correct_padding(GBC, Version) of  
  +	true ->
  +	    Content = GBC#generic_block_cipher.content,
  +	    Mac = GBC#generic_block_cipher.mac,
  +	    CipherState1 = CipherState0#cipher_state{iv=next_iv(Fragment, IV)},
  +	    {Content, Mac, CipherState1};
  +	false ->
  +	    ?ALERT_REC(?FATAL, ?BAD_RECORD_MAC)
  +    end.
  +	    
   %%--------------------------------------------------------------------
   %% Function: suites(Version) -> [Suite]
   %%
  
positive.code:     #generic_stream_cipher{content=Content,
  			   mac=Mac}.
  
  check_padding(_GBC) ->
      ok.
  
  get_padding(Length, BlockSize) ->
      get_padding_aux(BlockSize, Length rem BlockSize).
  
  
negative.code: -include("ssl_internal.hrl").
  -include("ssl_record.hrl").
  -include("ssl_cipher.hrl").
  -include("ssl_alert.hrl").
  -include("ssl_debug.hrl").
  
  -export([security_parameters/2, suite_definition/1,
  	 decipher/5, cipher/4, 
  	 suite/1, suites/1,
  	 openssl_suite/1, openssl_suite_name/1]).
  
  