anchor.diff:  scheme_to_components(ecdsa_sha1) -> {sha1, ecdsa, undefined};
   %% Handling legacy signature algorithms
   scheme_to_components({Hash,Sign}) -> {Hash, Sign, undefined}.
  +
  +%%--------------------------------------------------------------------
  +%%% Internal functions
  +%%--------------------------------------------------------------------
  +mac_hash({_,_}, ?NULL, _MacSecret, _SeqNo, _Type,
  +	 _Length, _Fragment) ->
  +    <<>>;
  +mac_hash({3, N} = Version, MacAlg, MacSecret, SeqNo, Type, Length, Fragment)  
  +  when N =:= 1; N =:= 2; N =:= 3; N =:= 4 ->
  +    tls_v1:mac_hash(MacAlg, MacSecret, SeqNo, Type, Version,
  +		      Length, Fragment).
  +
  +bulk_cipher_algorithm(null) ->
  +    ?NULL;
  +bulk_cipher_algorithm(rc4_128) ->
  +    ?RC4;
  +bulk_cipher_algorithm(des_cbc) ->
  +    ?DES;
  +bulk_cipher_algorithm('3des_ede_cbc') ->
  +    ?'3DES';
  +bulk_cipher_algorithm(Cipher) when Cipher == aes_128_cbc;
  +				   Cipher == aes_256_cbc ->
  +    ?AES_CBC;
  +bulk_cipher_algorithm(Cipher) when Cipher == aes_128_gcm;
  +				   Cipher == aes_256_gcm ->
  +    ?AES_GCM;
  +bulk_cipher_algorithm(Cipher) when Cipher == aes_128_ccm;
  +				   Cipher == aes_256_ccm ->
  +    ?AES_CCM;
  +bulk_cipher_algorithm(Cipher) when Cipher == aes_128_ccm_8;
  +				   Cipher == aes_256_ccm_8 ->
  +    ?AES_CCM_8;
  +bulk_cipher_algorithm(chacha20_poly1305) ->
  +    ?CHACHA20_POLY1305.
  +
  +type(Cipher) when Cipher == null;
  +		  Cipher == rc4_128 ->
  +    ?STREAM;
  +
  +type(Cipher) when Cipher == des_cbc;
  +		  Cipher == '3des_ede_cbc';
  +		  Cipher == aes_128_cbc;
  +		  Cipher == aes_256_cbc ->
  +    ?BLOCK;
  +type(Cipher) when Cipher == aes_128_gcm;
  +		  Cipher == aes_256_gcm;
  +                  Cipher == aes_128_ccm;
  +		  Cipher == aes_256_ccm;
  +                  Cipher == aes_128_ccm_8;
  +		  Cipher == aes_256_ccm_8;
  +		  Cipher == chacha20_poly1305 ->
  +    ?AEAD.
  +
  +key_material(null) ->
  +    0;
  +key_material(rc4_128) ->
  +    16;
  +key_material(des_cbc) ->
  +    8;
  +key_material('3des_ede_cbc') ->
  +    24;
  +key_material(aes_128_cbc) ->
  +    16;
  +key_material(aes_256_cbc) ->
  +    32;
  +key_material(aes_128_gcm) ->
  +    16;
  +key_material(aes_128_ccm) ->
  +    16;
  +key_material(aes_128_ccm_8) ->
  +    16;
  +key_material(aes_256_gcm) ->
  +    32;
  +key_material(aes_256_ccm_8) ->
  +    32;
  +key_material(aes_256_ccm) ->
  +    32;
  +key_material(chacha20_poly1305) ->
  +    32.
  +
  +expanded_key_material(null) ->
  +    0;
  +expanded_key_material(rc4_128) ->
  +    16;
  +expanded_key_material(Cipher) when Cipher == des_cbc ->
  +    8;
  +expanded_key_material('3des_ede_cbc') ->
  +    24;
  +expanded_key_material(Cipher) when Cipher == aes_128_cbc;
  +				   Cipher == aes_256_cbc;
  +				   Cipher == aes_128_gcm;
  +				   Cipher == aes_256_gcm;
  +                                   Cipher == aes_128_ccm;
  +				   Cipher == aes_256_ccm;
  +                                   Cipher == aes_128_ccm_8;
  +				   Cipher == aes_256_ccm_8;
  +				   Cipher == chacha20_poly1305 ->
  +    unknown.  
  +
  +effective_key_bits(null) ->
  +    0;
  +effective_key_bits(des_cbc) ->
  +    56;
  +effective_key_bits(Cipher) when Cipher == rc4_128;
  +				Cipher == aes_128_cbc;
  +				Cipher == aes_128_gcm;
  +                                Cipher == aes_128_ccm;
  +                                Cipher == aes_128_ccm_8 ->
  +    128;
  +effective_key_bits('3des_ede_cbc') ->
  +    168;
  +effective_key_bits(Cipher) when Cipher == aes_256_cbc;
  +				Cipher == aes_256_gcm;
  +				Cipher == aes_256_ccm;
  +                                Cipher == aes_256_ccm_8;
  +				Cipher == chacha20_poly1305 ->
  +    256.
  +
  +iv_size(Cipher) when Cipher == null;
  +		     Cipher == rc4_128 ->
  +    0;
  +iv_size(Cipher) when Cipher == aes_128_gcm;
  +		     Cipher == aes_256_gcm;
  +                     Cipher == aes_128_ccm;
  +		     Cipher == aes_256_ccm;
  +                     Cipher == aes_128_ccm_8;
  +		     Cipher == aes_256_ccm_8 ->
  +    4;
  +iv_size(chacha20_poly1305) ->
  +    12;
  +iv_size(Cipher) ->
  +    block_size(Cipher).
  +
  +block_size(Cipher) when Cipher == des_cbc;
  +			Cipher == des_ede3_cbc;
  +			Cipher == '3des_ede_cbc' -> 
  +    8;
  +block_size(Cipher) when Cipher == aes_128_cbc;
  +			Cipher == aes_256_cbc;
  +			Cipher == aes_128_gcm;
  +			Cipher == aes_256_gcm;
  +                        Cipher == aes_128_ccm;
  +			Cipher == aes_256_ccm;
  +                        Cipher == aes_128_ccm_8;
  +			Cipher == aes_256_ccm_8;
  +			Cipher == chacha20_poly1305 ->
  +    16.
  +
  +prf_algorithm(default_prf, {3, N}) when N >= 3 ->
  +    ?SHA256;
  +prf_algorithm(default_prf, {3, _}) ->
  +    ?MD5SHA;
  +prf_algorithm(Algo, _) ->
  +    hash_algorithm(Algo).
  +
  +mac_algorithm(aead) ->
  +    aead;
  +mac_algorithm(Algo) ->
  +    hash_algorithm(Algo).
  +
  +hash_algorithm(null)   -> ?NULL;
  +hash_algorithm(md5)    -> ?MD5;
  +hash_algorithm(sha)   -> ?SHA; %% Only sha always refers to "SHA-1"
  +hash_algorithm(sha224) -> ?SHA224;
  +hash_algorithm(sha256) -> ?SHA256;
  +hash_algorithm(sha384) -> ?SHA384;
  +hash_algorithm(sha512) -> ?SHA512;
  +hash_algorithm(?NULL) -> null;
  +hash_algorithm(?MD5) -> md5;
  +hash_algorithm(?SHA) -> sha;
  +hash_algorithm(?SHA224) -> sha224;
  +hash_algorithm(?SHA256) -> sha256;
  +hash_algorithm(?SHA384) -> sha384;
  +hash_algorithm(?SHA512) -> sha512;
  +hash_algorithm(Other)  when is_integer(Other) andalso ((Other >= 7) and (Other =< 223)) -> unassigned;
  +hash_algorithm(Other)  when is_integer(Other) andalso ((Other >= 224) and (Other =< 255)) -> Other.
  +
  +sign_algorithm(anon)  -> ?ANON;
  +sign_algorithm(rsa)   -> ?RSA;
  +sign_algorithm(dsa)   -> ?DSA;
  +sign_algorithm(ecdsa) -> ?ECDSA;
  +sign_algorithm(?ANON) -> anon;
  +sign_algorithm(?RSA) -> rsa;
  +sign_algorithm(?DSA) -> dsa;
  +sign_algorithm(?ECDSA) -> ecdsa;
  +sign_algorithm(Other) when is_integer(Other) andalso ((Other >= 4) and (Other =< 223)) -> unassigned;
  +sign_algorithm(Other) when is_integer(Other) andalso ((Other >= 224) and (Other =< 255)) -> Other.
  +
   
   signature_algorithm_to_scheme(#'SignatureAlgorithm'{algorithm = ?'id-RSASSA-PSS',
                                                       parameters =  #'RSASSA-PSS-params'{
  
positive.code:         lists:member(rsa_pss_rsae_sha384, HashSigns);
  is_supported_sign(SignAlgo, HashSigns) -> %% PRE TLS-1.3 SignAlgo::tuple() TLS-1.3 SignAlgo::atom()
      lists:member(SignAlgo, HashSigns).
  
  
  
  %%--------------------------------------------------------------------
  %%% Internal functions
  %%--------------------------------------------------------------------
  mac_hash({_,_}, ?NULL, _MacSecret, _SeqNo, _Type,
  	 _Length, _Fragment) ->
      <<>>;
  mac_hash({3, N} = Version, MacAlg, MacSecret, SeqNo, Type, Length, Fragment)  
    when N =:= 1; N =:= 2; N =:= 3; N =:= 4 ->
      tls_v1:mac_hash(MacAlg, MacSecret, SeqNo, Type, Version,
  		      Length, Fragment).
  
  bulk_cipher_algorithm(null) ->
      ?NULL;
  bulk_cipher_algorithm(rc4_128) ->
      ?RC4;
  bulk_cipher_algorithm(des_cbc) ->
      ?DES;
  bulk_cipher_algorithm('3des_ede_cbc') ->
      ?'3DES';
  bulk_cipher_algorithm(Cipher) when Cipher == aes_128_cbc;
  				   Cipher == aes_256_cbc ->
      ?AES_CBC;
  bulk_cipher_algorithm(Cipher) when Cipher == aes_128_gcm;
  				   Cipher == aes_256_gcm ->
      ?AES_GCM;
  bulk_cipher_algorithm(Cipher) when Cipher == aes_128_ccm;
  				   Cipher == aes_256_ccm ->
      ?AES_CCM;
  bulk_cipher_algorithm(Cipher) when Cipher == aes_128_ccm_8;
  				   Cipher == aes_256_ccm_8 ->
      ?AES_CCM_8;
  bulk_cipher_algorithm(chacha20_poly1305) ->
      ?CHACHA20_POLY1305.
  
  type(Cipher) when Cipher == null;
  		  Cipher == rc4_128 ->
      ?STREAM;
  
  type(Cipher) when Cipher == des_cbc;
  		  Cipher == '3des_ede_cbc';
  		  Cipher == aes_128_cbc;
  		  Cipher == aes_256_cbc ->
      ?BLOCK;
  type(Cipher) when Cipher == aes_128_gcm;
  		  Cipher == aes_256_gcm;
                    Cipher == aes_128_ccm;
  		  Cipher == aes_256_ccm;
                    Cipher == aes_128_ccm_8;
  		  Cipher == aes_256_ccm_8;
  		  Cipher == chacha20_poly1305 ->
      ?AEAD.
  
  key_material(null) ->
      0;
  key_material(rc4_128) ->
      16;
  key_material(des_cbc) ->
      8;
  key_material('3des_ede_cbc') ->
      24;
  key_material(aes_128_cbc) ->
      16;
  key_material(aes_256_cbc) ->
      32;
  key_material(aes_128_gcm) ->
      16;
  key_material(aes_128_ccm) ->
      16;
  key_material(aes_128_ccm_8) ->
      16;
  key_material(aes_256_gcm) ->
      32;
  key_material(aes_256_ccm_8) ->
      32;
  key_material(aes_256_ccm) ->
      32;
  key_material(chacha20_poly1305) ->
      32.
  
  expanded_key_material(null) ->
      0;
  expanded_key_material(rc4_128) ->
      16;
  expanded_key_material(Cipher) when Cipher == des_cbc ->
      8;
  expanded_key_material('3des_ede_cbc') ->
      24;
  expanded_key_material(Cipher) when Cipher == aes_128_cbc;
  				   Cipher == aes_256_cbc;
  				   Cipher == aes_128_gcm;
  				   Cipher == aes_256_gcm;
                                     Cipher == aes_128_ccm;
  				   Cipher == aes_256_ccm;
                                     Cipher == aes_128_ccm_8;
  				   Cipher == aes_256_ccm_8;
  				   Cipher == chacha20_poly1305 ->
      unknown.  
  
  effective_key_bits(null) ->
      0;
  effective_key_bits(des_cbc) ->
      56;
  effective_key_bits(Cipher) when Cipher == rc4_128;
  				Cipher == aes_128_cbc;
  				Cipher == aes_128_gcm;
                                  Cipher == aes_128_ccm;
                                  Cipher == aes_128_ccm_8 ->
      128;
  effective_key_bits('3des_ede_cbc') ->
      168;
  effective_key_bits(Cipher) when Cipher == aes_256_cbc;
  				Cipher == aes_256_gcm;
  				Cipher == aes_256_ccm;
                                  Cipher == aes_256_ccm_8;
  				Cipher == chacha20_poly1305 ->
      256.
  
  iv_size(Cipher) when Cipher == null;
  		     Cipher == rc4_128 ->
      0;
  iv_size(Cipher) when Cipher == aes_128_gcm;
  		     Cipher == aes_256_gcm;
                       Cipher == aes_128_ccm;
  		     Cipher == aes_256_ccm;
                       Cipher == aes_128_ccm_8;
  		     Cipher == aes_256_ccm_8 ->
      4;
  iv_size(chacha20_poly1305) ->
      12;
  iv_size(Cipher) ->
      block_size(Cipher).
  
  block_size(Cipher) when Cipher == des_cbc;
  			Cipher == des_ede3_cbc;
  			Cipher == '3des_ede_cbc' -> 
      8;
  block_size(Cipher) when Cipher == aes_128_cbc;
  			Cipher == aes_256_cbc;
  			Cipher == aes_128_gcm;
  			Cipher == aes_256_gcm;
                          Cipher == aes_128_ccm;
  			Cipher == aes_256_ccm;
                          Cipher == aes_128_ccm_8;
  			Cipher == aes_256_ccm_8;
  			Cipher == chacha20_poly1305 ->
      16.
  
  prf_algorithm(default_prf, {3, N}) when N >= 3 ->
      ?SHA256;
  prf_algorithm(default_prf, {3, _}) ->
      ?MD5SHA;
  prf_algorithm(Algo, _) ->
      hash_algorithm(Algo).
  
  mac_algorithm(aead) ->
      aead;
  mac_algorithm(Algo) ->
      hash_algorithm(Algo).
  
  hash_algorithm(null)   -> ?NULL;
  hash_algorithm(md5)    -> ?MD5;
  hash_algorithm(sha)   -> ?SHA; %% Only sha always refers to "SHA-1"
  hash_algorithm(sha224) -> ?SHA224;
  hash_algorithm(sha256) -> ?SHA256;
  hash_algorithm(sha384) -> ?SHA384;
  hash_algorithm(sha512) -> ?SHA512;
  hash_algorithm(?NULL) -> null;
  hash_algorithm(?MD5) -> md5;
  hash_algorithm(?SHA) -> sha;
  hash_algorithm(?SHA224) -> sha224;
  hash_algorithm(?SHA256) -> sha256;
  hash_algorithm(?SHA384) -> sha384;
  hash_algorithm(?SHA512) -> sha512;
  hash_algorithm(Other)  when is_integer(Other) andalso ((Other >= 7) and (Other =< 223)) -> unassigned;
  hash_algorithm(Other)  when is_integer(Other) andalso ((Other >= 224) and (Other =< 255)) -> Other.
  
  sign_algorithm(anon)  -> ?ANON;
  sign_algorithm(rsa)   -> ?RSA;
  sign_algorithm(dsa)   -> ?DSA;
  sign_algorithm(ecdsa) -> ?ECDSA;
  sign_algorithm(?ANON) -> anon;
  sign_algorithm(?RSA) -> rsa;
  sign_algorithm(?DSA) -> dsa;
  sign_algorithm(?ECDSA) -> ecdsa;
  sign_algorithm(Other) when is_integer(Other) andalso ((Other >= 4) and (Other =< 223)) -> unassigned;
  sign_algorithm(Other) when is_integer(Other) andalso ((Other >= 224) and (Other =< 255)) -> Other.
  
  
  signature_scheme(rsa_pkcs1_sha256) -> ?RSA_PKCS1_SHA256;
  signature_scheme(rsa_pkcs1_sha384) -> ?RSA_PKCS1_SHA384;
  
negative.code:     <<?BYTE(Hash),?BYTE(Sign)>> = <<?UINT16(SignAlgo)>>,
      {ssl_cipher:hash_algorithm(Hash), ssl_cipher:sign_algorithm(Sign)};
  signature_scheme(_) -> unassigned.
  
  signature_schemes_1_2(SigAlgs) ->
      lists:map(fun(Algs) ->
                        {Hash, Sign, _} = scheme_to_components(Algs),
                        {Hash, Sign}
                end, SigAlgs).
  
  %% TODO: reserved code points?
  
  scheme_to_components(rsa_pkcs1_sha256) -> {sha256, rsa_pkcs1, undefined};
  