anchor.diff:  
   cipher(Type, Version, Fragment, CS0) ->
       Length = erlang:iolist_size(Fragment),
  -    {Hash, CS1=#connection_state{cipher_state = CipherS0,
  +    {MacHash, CS1=#connection_state{cipher_state = CipherS0,
   				 security_parameters=
   				 #security_parameters{bulk_cipher_algorithm = 
   						      BCA}
   				}} = 
   	hash_and_bump_seqno(CS0, Type, Version, Length, Fragment),
       ?DBG_HEX(Fragment),
  -    {Ciphered, CipherS1} = ssl_cipher:cipher(BCA, CipherS0, Hash, Fragment),
  +    {Ciphered, CipherS1} = ssl_cipher:cipher(BCA, CipherS0, MacHash, Fragment),
       ?DBG_HEX(Ciphered),
       CS2 = CS1#connection_state{cipher_state=CipherS1},
       {Ciphered, CS2}.
   
   decipher(TLS=#ssl_tls{type=Type, version=Version, fragment=Fragment}, CS0) ->
       SP = CS0#connection_state.security_parameters,
  -    BCA = SP#security_parameters.bulk_cipher_algorithm, % eller Cipher?
  +    BCA = SP#security_parameters.bulk_cipher_algorithm, 
       HashSz = SP#security_parameters.hash_size,
       CipherS0 = CS0#connection_state.cipher_state,
  -    {T, Mac, CipherS1} = ssl_cipher:decipher(BCA, HashSz, CipherS0, Fragment),
  -    CS1 = CS0#connection_state{cipher_state = CipherS1},
  -    TLength = size(T),
  -    {Hash, CS2} = hash_and_bump_seqno(CS1, Type, Version, TLength, Fragment),
  -    ok = check_hash(Hash, Mac),
  -    {TLS#ssl_tls{fragment = T}, CS2}.
  +    case ssl_cipher:decipher(BCA, HashSz, CipherS0, Fragment, Version) of
  +	{T, Mac, CipherS1} ->
  +	    CS1 = CS0#connection_state{cipher_state = CipherS1},
  +	    TLength = size(T),
  +	    {MacHash, CS2} = hash_and_bump_seqno(CS1, Type, Version, TLength, T),
  +	    case is_correct_mac(Mac, MacHash) of
  +		true ->		  
  +		    {TLS#ssl_tls{fragment = T}, CS2};
  +		false ->
  +		    ?ALERT_REC(?FATAL, ?BAD_RECORD_MAC)
  +	    end;
  +	#alert{} = Alert ->
  +	    Alert
  +    end.
   
   uncompress(?NULL, Data = #ssl_tls{type = _Type,
   				  version = _Version,
  
positive.code: 		    Length, Fragment),
      {Hash, CS0#connection_state{sequence_number = SeqNo+1}}.
  
  check_hash(_, _) ->
      ok. %% TODO check this 
  
  mac_hash({_,_}, ?NULL, _MacSecret, _SeqNo, _Type,
  	 _Length, _Fragment) ->
  
negative.code:     #connection_state{compression_state = CompressionS0,
  		      security_parameters = SecParams} = ReadState0,
      CompressAlg = SecParams#security_parameters.compression_algorithm,
     case decipher(CipherText, ReadState0) of
         {Compressed, ReadState1} ->
  	   {Plain, CompressionS1} = uncompress(CompressAlg, 
  					       Compressed, CompressionS0),
  	   ConnnectionStates = ConnnectionStates0#connection_states{
  				 current_read = ReadState1#connection_state{
  						  compression_state = CompressionS1}},
  	   {Plain, ConnnectionStates};
         #alert{} = Alert ->
  	   Alert
     end.
  
  %%--------------------------------------------------------------------
  %%% Internal functions
  