Remove remnants from PSK, KRB5 and SRP.

ok beck@ miod@

16 files changed, 86 insertions, 318 deletions

diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index b85908c733..004fd6e04f 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_clnt.c,v 1.29 2014/07/11 22:57:25 miod Exp $ */
+/* $OpenBSD: d1_clnt.c,v 1.30 2014/07/12 13:11:53 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -395,9 +395,9 @@ dtls1_connect(SSL *s)
                                 s->init_num = 0;
                                 break;
                         }
-                        /* Check if it is anon DH or PSK */
-                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
-                            !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                        /* Check if it is anon DH. */
+                        if (!(s->s3->tmp.new_cipher->algorithm_auth &
+                            SSL_aNULL)) {
                                 ret = ssl3_get_server_certificate(s);
                                 if (ret <= 0)
                                         goto end;
diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index 8531f2db2b..a94b7ed61b 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_srvr.c,v 1.31 2014/07/12 10:06:04 jsing Exp $ */
+/* $OpenBSD: d1_srvr.c,v 1.32 2014/07/12 13:11:53 jsing Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -427,9 +427,9 @@ dtls1_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_A:
                 case SSL3_ST_SW_CERT_B:
-                        /* Check if it is anon DH or normal PSK */
-                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
-                            !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                        /* Check if it is anon DH. */
+                        if (!(s->s3->tmp.new_cipher->algorithm_auth &
+                            SSL_aNULL)) {
                                 dtls1_start_timer(s);
                                 ret = dtls1_send_server_certificate(s);
                                 if (ret <= 0)
@@ -500,22 +500,13 @@ dtls1_accept(SSL *s)
                          *   and in RFC 2246) ... except when the application
                          *   insists on verification (against the specs, but
                          *   s3_clnt.c accepts this for SSL 3).
-                         *
-                         * - We are using a Kerberos ciphersuite.
-                         *
-                         * - We are using normal PSK certificates and
-                         *   Certificate Requests are omitted
                          */
                         if (!(s->verify_mode & SSL_VERIFY_PEER) ||
                             ((s->session->peer != NULL) &&
                              (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
                             ((s->s3->tmp.new_cipher->algorithm_auth &
                              SSL_aNULL) && !(s->verify_mode &
-                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
-                            (s->s3->tmp.new_cipher->algorithm_auth &
-                             SSL_aKRB5) ||
-                            (s->s3->tmp.new_cipher->algorithm_mkey &
-                             SSL_kPSK)) {
+                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) {
                                 /* no cert request */
                                 skip = 1;
                                 s->s3->tmp.cert_request = 0;
@@ -1216,8 +1207,7 @@ dtls1_send_server_key_exchange(SSL *s)
                         n += 2 + nr[i];
                 }
 
-                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
-                    && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)) {
                         if ((pkey = ssl_get_sign_pkey(s,
                             s->s3->tmp.new_cipher, NULL)) == NULL) {
                                 al = SSL_AD_DECODE_ERROR;
@@ -1463,12 +1453,9 @@ dtls1_send_server_certificate(SSL *s)
         if (s->state == SSL3_ST_SW_CERT_A) {
                 x = ssl_get_server_send_cert(s);
                 if (x == NULL) {
-                        /* VRS: allow null cert if auth == KRB5 */
-                        if ((s->s3->tmp.new_cipher->algorithm_mkey != SSL_kKRB5) ||
-                                (s->s3->tmp.new_cipher->algorithm_auth != SSL_aKRB5)) {
-                                SSLerr(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
-                                return (0);
-                        }
+                        SSLerr(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE,
+                            ERR_R_INTERNAL_ERROR);
+                        return (0);
                 }
 
                 l = dtls1_output_cert_chain(s, x);
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index 884b9f1efb..7d6681b3ac 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_clnt.c,v 1.78 2014/07/11 22:57:25 miod Exp $ */
+/* $OpenBSD: s3_clnt.c,v 1.79 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -339,11 +339,9 @@ ssl3_connect(SSL *s)
                                 s->init_num = 0;
                                 break;
                         }
-                        /* Check if it is anon DH/ECDH or PSK */
+                        /* Check if it is anon DH/ECDH. */
                         if (!(s->s3->tmp.new_cipher->algorithm_auth &
-                            SSL_aNULL) &&
-                            !(s->s3->tmp.new_cipher->algorithm_mkey &
-                            SSL_kPSK)) {
+                            SSL_aNULL)) {
                                 ret = ssl3_get_server_certificate(s);
                                 if (ret <= 0)
                                         goto end;
@@ -996,7 +994,6 @@ ssl3_get_server_certificate(SSL *s)
         SESS_CERT               *sc;
         EVP_PKEY                *pkey = NULL;
 
-        /* VRS: 0=> will allow null cert if auth == KRB5 */
         int                      need_cert = 1;
 
         n = s->method->ssl_get_message(s, SSL3_ST_CR_CERT_A,
@@ -1005,9 +1002,7 @@ ssl3_get_server_certificate(SSL *s)
         if (!ok)
                 return ((int)n);
 
-        if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) ||
-            ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) &&
-            (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE))) {
+        if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)) {
                 s->s3->tmp.reuse_message = 1;
                 return (1);
         }
@@ -1098,12 +1093,6 @@ ssl3_get_server_certificate(SSL *s)
 
         pkey = X509_get_pubkey(x);
 
-        /* VRS: allow null cert if auth == KRB5 */
-        need_cert = ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5) &&
-            (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
-            ? 0 : 1;
-
-
         if (need_cert && ((pkey == NULL) ||
             EVP_PKEY_missing_parameters(pkey))) {
                 x = NULL;
@@ -1553,8 +1542,8 @@ ssl3_get_key_exchange(SSL *s)
                         }
                 }
         } else {
-                /* aNULL or kPSK do not need public keys */
-                if (!(alg_a & SSL_aNULL) && !(alg_k & SSL_kPSK)) {
+                /* aNULL does not need public keys. */
+                if (!(alg_a & SSL_aNULL)) {
                         SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,
                             ERR_R_INTERNAL_ERROR);
                         goto err;
@@ -2615,7 +2604,7 @@ ssl3_check_cert_and_algorithm(SSL *s)
         alg_a = s->s3->tmp.new_cipher->algorithm_auth;
 
         /* We don't have a certificate. */
-        if ((alg_a & (SSL_aDH|SSL_aNULL|SSL_aKRB5)) || (alg_k & SSL_kPSK))
+        if (alg_a & (SSL_aDH|SSL_aNULL))
                 return (1);
 
         sc = s->session->sess_cert;
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index 237d90c581..cbd35ff7e3 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_pkt.c,v 1.49 2014/07/10 08:51:14 tedu Exp $ */
+/* $OpenBSD: s3_pkt.c,v 1.50 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1134,10 +1134,6 @@ start:
                                     SSL_R_NO_RENEGOTIATION);
                                 goto f_err;
                         }
-#ifdef SSL_AD_MISSING_SRP_USERNAME
-                        else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)
-                                return (0);
-#endif
                 } else if (alert_level == 2) {
                         /* fatal */
                         s->rwstate = SSL_NOTHING;
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 2d1bee1723..e0a7d78995 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.76 2014/07/12 10:06:04 jsing Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.77 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -373,13 +373,9 @@ ssl3_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_A:
                 case SSL3_ST_SW_CERT_B:
-                        /* Check if it is anon DH or anon ECDH, */
-                        /* normal PSK or KRB5 or SRP */
-                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
-                            && !(s->s3->tmp.new_cipher->algorithm_mkey &
-                            SSL_kPSK)
-                            && !(s->s3->tmp.new_cipher->algorithm_auth &
-                            SSL_aKRB5)) {
+                        /* Check if it is anon DH or anon ECDH. */
+                        if (!(s->s3->tmp.new_cipher->algorithm_auth &
+                            SSL_aNULL)) {
                                 ret = ssl3_send_server_certificate(s);
                                 if (ret <= 0)
                                         goto end;
@@ -417,10 +413,7 @@ ssl3_accept(SSL *s)
 
                         /*
                          * Only send if a DH key exchange, fortezza or
-                         * RSA but we have a sign only certificate
-                         *
-                         * PSK: send ServerKeyExchange if PSK identity
-                         * hint is provided
+                         * RSA but we have a sign only certificate.
                          *
                          * For ECC ciphersuites, we send a serverKeyExchange
                          * message only if the cipher suite is either
@@ -428,13 +421,12 @@ ssl3_accept(SSL *s)
                          * server certificate contains the server's
                          * public key for key exchange.
                          */
-                        if (s->s3->tmp.use_rsa_tmp
-                            || (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kEDH))
-                            || (alg_k & SSL_kEECDH)
-                            || ((alg_k & SSL_kRSA)
-                            && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey ==
-                            NULL
-                            ))) {
+                        if (s->s3->tmp.use_rsa_tmp ||
+                            (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kEDH)) ||
+                            (alg_k & SSL_kEECDH) ||
+                            ((alg_k & SSL_kRSA) &&
+                             (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey ==
+                             NULL))) {
                                 ret = ssl3_send_server_key_exchange(s);
                                 if (ret <= 0)
                                         goto end;
@@ -463,22 +455,13 @@ ssl3_accept(SSL *s)
                          *   and in RFC 2246) ... except when the application
                          *   insists on verification (against the specs, but
                          *   s3_clnt.c accepts this for SSL 3).
-                         *
-                         * - We are using a Kerberos ciphersuite.
-                         *
-                         * - We are using normal PSK certificates and
-                         *   Certificate Requests are omitted
                          */
                         if (!(s->verify_mode & SSL_VERIFY_PEER) ||
                             ((s->session->peer != NULL) &&
                              (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
                             ((s->s3->tmp.new_cipher->algorithm_auth &
                              SSL_aNULL) && !(s->verify_mode &
-                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
-                            (s->s3->tmp.new_cipher->algorithm_auth &
-                             SSL_aKRB5) ||
-                            (s->s3->tmp.new_cipher->algorithm_mkey &
-                             SSL_kPSK)) {
+                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) {
                                 /* No cert request */
                                 skip = 1;
                                 s->s3->tmp.cert_request = 0;
@@ -1605,8 +1588,7 @@ ssl3_send_server_key_exchange(SSL *s)
                         n += 2 + nr[i];
                 }
 
-                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
-                    !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)) {
                         if ((pkey = ssl_get_sign_pkey(
                             s, s->s3->tmp.new_cipher, &md)) == NULL) {
                                 al = SSL_AD_DECODE_ERROR;
@@ -2681,15 +2663,9 @@ ssl3_send_server_certificate(SSL *s)
         if (s->state == SSL3_ST_SW_CERT_A) {
                 x = ssl_get_server_send_cert(s);
                 if (x == NULL) {
-                        /* VRS: allow null cert if auth == KRB5 */
-                        if ((s->s3->tmp.new_cipher->algorithm_auth !=
-                            SSL_aKRB5) ||
-                            (s->s3->tmp.new_cipher->algorithm_mkey &
-                            SSL_kKRB5)) {
-                                SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,
-                                    ERR_R_INTERNAL_ERROR);
-                                return (0);
-                        }
+                        SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,
+                            ERR_R_INTERNAL_ERROR);
+                        return (0);
                 }
 
                 l = ssl3_output_cert_chain(s, x);
diff --git a/src/lib/libssl/src/ssl/d1_clnt.c b/src/lib/libssl/src/ssl/d1_clnt.c
index b85908c733..004fd6e04f 100644
--- a/src/lib/libssl/src/ssl/d1_clnt.c
+++ b/src/lib/libssl/src/ssl/d1_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_clnt.c,v 1.29 2014/07/11 22:57:25 miod Exp $ */
+/* $OpenBSD: d1_clnt.c,v 1.30 2014/07/12 13:11:53 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -395,9 +395,9 @@ dtls1_connect(SSL *s)
                                 s->init_num = 0;
                                 break;
                         }
-                        /* Check if it is anon DH or PSK */
-                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
-                            !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                        /* Check if it is anon DH. */
+                        if (!(s->s3->tmp.new_cipher->algorithm_auth &
+                            SSL_aNULL)) {
                                 ret = ssl3_get_server_certificate(s);
                                 if (ret <= 0)
                                         goto end;
diff --git a/src/lib/libssl/src/ssl/d1_srvr.c b/src/lib/libssl/src/ssl/d1_srvr.c
index 8531f2db2b..a94b7ed61b 100644
--- a/src/lib/libssl/src/ssl/d1_srvr.c
+++ b/src/lib/libssl/src/ssl/d1_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_srvr.c,v 1.31 2014/07/12 10:06:04 jsing Exp $ */
+/* $OpenBSD: d1_srvr.c,v 1.32 2014/07/12 13:11:53 jsing Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -427,9 +427,9 @@ dtls1_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_A:
                 case SSL3_ST_SW_CERT_B:
-                        /* Check if it is anon DH or normal PSK */
-                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
-                            !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                        /* Check if it is anon DH. */
+                        if (!(s->s3->tmp.new_cipher->algorithm_auth &
+                            SSL_aNULL)) {
                                 dtls1_start_timer(s);
                                 ret = dtls1_send_server_certificate(s);
                                 if (ret <= 0)
@@ -500,22 +500,13 @@ dtls1_accept(SSL *s)
                          *   and in RFC 2246) ... except when the application
                          *   insists on verification (against the specs, but
                          *   s3_clnt.c accepts this for SSL 3).
-                         *
-                         * - We are using a Kerberos ciphersuite.
-                         *
-                         * - We are using normal PSK certificates and
-                         *   Certificate Requests are omitted
                          */
                         if (!(s->verify_mode & SSL_VERIFY_PEER) ||
                             ((s->session->peer != NULL) &&
                              (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
                             ((s->s3->tmp.new_cipher->algorithm_auth &
                              SSL_aNULL) && !(s->verify_mode &
-                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
-                            (s->s3->tmp.new_cipher->algorithm_auth &
-                             SSL_aKRB5) ||
-                            (s->s3->tmp.new_cipher->algorithm_mkey &
-                             SSL_kPSK)) {
+                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) {
                                 /* no cert request */
                                 skip = 1;
                                 s->s3->tmp.cert_request = 0;
@@ -1216,8 +1207,7 @@ dtls1_send_server_key_exchange(SSL *s)
                         n += 2 + nr[i];
                 }
 
-                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
-                    && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)) {
                         if ((pkey = ssl_get_sign_pkey(s,
                             s->s3->tmp.new_cipher, NULL)) == NULL) {
                                 al = SSL_AD_DECODE_ERROR;
@@ -1463,12 +1453,9 @@ dtls1_send_server_certificate(SSL *s)
         if (s->state == SSL3_ST_SW_CERT_A) {
                 x = ssl_get_server_send_cert(s);
                 if (x == NULL) {
-                        /* VRS: allow null cert if auth == KRB5 */
-                        if ((s->s3->tmp.new_cipher->algorithm_mkey != SSL_kKRB5) ||
-                                (s->s3->tmp.new_cipher->algorithm_auth != SSL_aKRB5)) {
-                                SSLerr(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
-                                return (0);
-                        }
+                        SSLerr(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE,
+                            ERR_R_INTERNAL_ERROR);
+                        return (0);
                 }
 
                 l = dtls1_output_cert_chain(s, x);
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index 884b9f1efb..7d6681b3ac 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_clnt.c,v 1.78 2014/07/11 22:57:25 miod Exp $ */
+/* $OpenBSD: s3_clnt.c,v 1.79 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -339,11 +339,9 @@ ssl3_connect(SSL *s)
                                 s->init_num = 0;
                                 break;
                         }
-                        /* Check if it is anon DH/ECDH or PSK */
+                        /* Check if it is anon DH/ECDH. */
                         if (!(s->s3->tmp.new_cipher->algorithm_auth &
-                            SSL_aNULL) &&
-                            !(s->s3->tmp.new_cipher->algorithm_mkey &
-                            SSL_kPSK)) {
+                            SSL_aNULL)) {
                                 ret = ssl3_get_server_certificate(s);
                                 if (ret <= 0)
                                         goto end;
@@ -996,7 +994,6 @@ ssl3_get_server_certificate(SSL *s)
         SESS_CERT               *sc;
         EVP_PKEY                *pkey = NULL;
 
-        /* VRS: 0=> will allow null cert if auth == KRB5 */
         int                      need_cert = 1;
 
         n = s->method->ssl_get_message(s, SSL3_ST_CR_CERT_A,
@@ -1005,9 +1002,7 @@ ssl3_get_server_certificate(SSL *s)
         if (!ok)
                 return ((int)n);
 
-        if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) ||
-            ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5) &&
-            (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE))) {
+        if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)) {
                 s->s3->tmp.reuse_message = 1;
                 return (1);
         }
@@ -1098,12 +1093,6 @@ ssl3_get_server_certificate(SSL *s)
 
         pkey = X509_get_pubkey(x);
 
-        /* VRS: allow null cert if auth == KRB5 */
-        need_cert = ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5) &&
-            (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))
-            ? 0 : 1;
-
-
         if (need_cert && ((pkey == NULL) ||
             EVP_PKEY_missing_parameters(pkey))) {
                 x = NULL;
@@ -1553,8 +1542,8 @@ ssl3_get_key_exchange(SSL *s)
                         }
                 }
         } else {
-                /* aNULL or kPSK do not need public keys */
-                if (!(alg_a & SSL_aNULL) && !(alg_k & SSL_kPSK)) {
+                /* aNULL does not need public keys. */
+                if (!(alg_a & SSL_aNULL)) {
                         SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,
                             ERR_R_INTERNAL_ERROR);
                         goto err;
@@ -2615,7 +2604,7 @@ ssl3_check_cert_and_algorithm(SSL *s)
         alg_a = s->s3->tmp.new_cipher->algorithm_auth;
 
         /* We don't have a certificate. */
-        if ((alg_a & (SSL_aDH|SSL_aNULL|SSL_aKRB5)) || (alg_k & SSL_kPSK))
+        if (alg_a & (SSL_aDH|SSL_aNULL))
                 return (1);
 
         sc = s->session->sess_cert;
diff --git a/src/lib/libssl/src/ssl/s3_pkt.c b/src/lib/libssl/src/ssl/s3_pkt.c
index 237d90c581..cbd35ff7e3 100644
--- a/src/lib/libssl/src/ssl/s3_pkt.c
+++ b/src/lib/libssl/src/ssl/s3_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_pkt.c,v 1.49 2014/07/10 08:51:14 tedu Exp $ */
+/* $OpenBSD: s3_pkt.c,v 1.50 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1134,10 +1134,6 @@ start:
                                     SSL_R_NO_RENEGOTIATION);
                                 goto f_err;
                         }
-#ifdef SSL_AD_MISSING_SRP_USERNAME
-                        else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)
-                                return (0);
-#endif
                 } else if (alert_level == 2) {
                         /* fatal */
                         s->rwstate = SSL_NOTHING;
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 2d1bee1723..e0a7d78995 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.76 2014/07/12 10:06:04 jsing Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.77 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -373,13 +373,9 @@ ssl3_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_A:
                 case SSL3_ST_SW_CERT_B:
-                        /* Check if it is anon DH or anon ECDH, */
-                        /* normal PSK or KRB5 or SRP */
-                        if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
-                            && !(s->s3->tmp.new_cipher->algorithm_mkey &
-                            SSL_kPSK)
-                            && !(s->s3->tmp.new_cipher->algorithm_auth &
-                            SSL_aKRB5)) {
+                        /* Check if it is anon DH or anon ECDH. */
+                        if (!(s->s3->tmp.new_cipher->algorithm_auth &
+                            SSL_aNULL)) {
                                 ret = ssl3_send_server_certificate(s);
                                 if (ret <= 0)
                                         goto end;
@@ -417,10 +413,7 @@ ssl3_accept(SSL *s)
 
                         /*
                          * Only send if a DH key exchange, fortezza or
-                         * RSA but we have a sign only certificate
-                         *
-                         * PSK: send ServerKeyExchange if PSK identity
-                         * hint is provided
+                         * RSA but we have a sign only certificate.
                          *
                          * For ECC ciphersuites, we send a serverKeyExchange
                          * message only if the cipher suite is either
@@ -428,13 +421,12 @@ ssl3_accept(SSL *s)
                          * server certificate contains the server's
                          * public key for key exchange.
                          */
-                        if (s->s3->tmp.use_rsa_tmp
-                            || (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kEDH))
-                            || (alg_k & SSL_kEECDH)
-                            || ((alg_k & SSL_kRSA)
-                            && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey ==
-                            NULL
-                            ))) {
+                        if (s->s3->tmp.use_rsa_tmp ||
+                            (alg_k & (SSL_kDHr|SSL_kDHd|SSL_kEDH)) ||
+                            (alg_k & SSL_kEECDH) ||
+                            ((alg_k & SSL_kRSA) &&
+                             (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey ==
+                             NULL))) {
                                 ret = ssl3_send_server_key_exchange(s);
                                 if (ret <= 0)
                                         goto end;
@@ -463,22 +455,13 @@ ssl3_accept(SSL *s)
                          *   and in RFC 2246) ... except when the application
                          *   insists on verification (against the specs, but
                          *   s3_clnt.c accepts this for SSL 3).
-                         *
-                         * - We are using a Kerberos ciphersuite.
-                         *
-                         * - We are using normal PSK certificates and
-                         *   Certificate Requests are omitted
                          */
                         if (!(s->verify_mode & SSL_VERIFY_PEER) ||
                             ((s->session->peer != NULL) &&
                              (s->verify_mode & SSL_VERIFY_CLIENT_ONCE)) ||
                             ((s->s3->tmp.new_cipher->algorithm_auth &
                              SSL_aNULL) && !(s->verify_mode &
-                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) ||
-                            (s->s3->tmp.new_cipher->algorithm_auth &
-                             SSL_aKRB5) ||
-                            (s->s3->tmp.new_cipher->algorithm_mkey &
-                             SSL_kPSK)) {
+                             SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) {
                                 /* No cert request */
                                 skip = 1;
                                 s->s3->tmp.cert_request = 0;
@@ -1605,8 +1588,7 @@ ssl3_send_server_key_exchange(SSL *s)
                         n += 2 + nr[i];
                 }
 
-                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL) &&
-                    !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
+                if (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)) {
                         if ((pkey = ssl_get_sign_pkey(
                             s, s->s3->tmp.new_cipher, &md)) == NULL) {
                                 al = SSL_AD_DECODE_ERROR;
@@ -2681,15 +2663,9 @@ ssl3_send_server_certificate(SSL *s)
         if (s->state == SSL3_ST_SW_CERT_A) {
                 x = ssl_get_server_send_cert(s);
                 if (x == NULL) {
-                        /* VRS: allow null cert if auth == KRB5 */
-                        if ((s->s3->tmp.new_cipher->algorithm_auth !=
-                            SSL_aKRB5) ||
-                            (s->s3->tmp.new_cipher->algorithm_mkey &
-                            SSL_kKRB5)) {
-                                SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,
-                                    ERR_R_INTERNAL_ERROR);
-                                return (0);
-                        }
+                        SSLerr(SSL_F_SSL3_SEND_SERVER_CERTIFICATE,
+                            ERR_R_INTERNAL_ERROR);
+                        return (0);
                 }
 
                 l = ssl3_output_cert_chain(s, x);
diff --git a/src/lib/libssl/src/ssl/ssl_ciph.c b/src/lib/libssl/src/ssl/ssl_ciph.c
index 9df4f8a0c9..a2dec527ca 100644
--- a/src/lib/libssl/src/ssl/ssl_ciph.c
+++ b/src/lib/libssl/src/ssl/ssl_ciph.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_ciph.c,v 1.64 2014/07/12 07:52:36 guenther Exp $ */
+/* $OpenBSD: ssl_ciph.c,v 1.65 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -273,11 +273,6 @@ static const SSL_CIPHER cipher_aliases[] = {
         },
         
         {
-                .name = SSL_TXT_kKRB5,
-                .algorithm_mkey = SSL_kKRB5,
-        },
-        
-        {
                 .name = SSL_TXT_kECDHr,
                 .algorithm_mkey = SSL_kECDHr,
         },
@@ -299,14 +294,6 @@ static const SSL_CIPHER cipher_aliases[] = {
         },
         
         {
-                .name = SSL_TXT_kPSK,
-                .algorithm_mkey = SSL_kPSK,
-        },
-        {
-                .name = SSL_TXT_kSRP,
-                .algorithm_mkey = SSL_kSRP,
-        },
-        {
                 .name = SSL_TXT_kGOST,
                 .algorithm_mkey = SSL_kGOST,
         },
@@ -325,10 +312,6 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_auth = SSL_aDSS,
         },
         {
-                .name = SSL_TXT_aKRB5,
-                .algorithm_auth = SSL_aKRB5,
-        },
-        {
                 .name = SSL_TXT_aNULL,
                 .algorithm_auth = SSL_aNULL,
         },
@@ -350,10 +333,6 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_auth = SSL_aECDSA,
         },
         {
-                .name = SSL_TXT_aPSK,
-                .algorithm_auth = SSL_aPSK,
-        },
-        {
                 .name = SSL_TXT_aGOST94,
                 .algorithm_auth = SSL_aGOST94,
         },
@@ -382,11 +361,6 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_enc = SSL_eNULL,
         },
         {
-                .name = SSL_TXT_KRB5,
-                .algorithm_mkey = SSL_kKRB5,
-                .algorithm_auth = SSL_aKRB5,
-        },
-        {
                 .name = SSL_TXT_RSA,
                 .algorithm_mkey = SSL_kRSA,
                 .algorithm_auth = SSL_aRSA,
@@ -401,16 +375,7 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_mkey = SSL_kEECDH,
                 .algorithm_auth = SSL_aNULL,
         },
-        {
-                .name = SSL_TXT_PSK,
-                .algorithm_mkey = SSL_kPSK,
-                .algorithm_auth = SSL_aPSK,
-        },
-        {
-                .name = SSL_TXT_SRP,
-                .algorithm_mkey = SSL_kSRP,
-        },
-        
+
         /* symmetric encryption aliases */
         {
                 .name = SSL_TXT_DES,
@@ -881,11 +846,7 @@ ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, unsigned long
 
         *mkey |= SSL_kDHr|SSL_kDHd; /* no such ciphersuites supported! */
         *auth |= SSL_aDH;
-        *mkey |= SSL_kKRB5;
-        *auth |= SSL_aKRB5;
-        *mkey |= SSL_kPSK;
-        *auth |= SSL_aPSK;
-        *mkey |= SSL_kSRP;
+
         /* Check for presence of GOST 34.10 algorithms, and if they
          * do not present, disable  appropriate auth and key exchange */
         if (!get_optional_pkey_id("gost94")) {
@@ -1515,8 +1476,6 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         ssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
         /* ssl_cipher_apply_rule(0, 0, SSL_aDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); */
         ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
-        ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
-        ssl_cipher_apply_rule(0, SSL_kKRB5, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
 
         /* RC4 is sort-of broken -- move the the end */
         ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
@@ -1650,9 +1609,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_kDHd:
                 kx = "DH/DSS";
                 break;
-        case SSL_kKRB5:
-                kx = "KRB5";
-                break;
         case SSL_kEDH:
                 kx = "DH";
                 break;
@@ -1665,12 +1621,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_kEECDH:
                 kx = "ECDH";
                 break;
-        case SSL_kPSK:
-                kx = "PSK";
-                break;
-        case SSL_kSRP:
-                kx = "SRP";
-                break;
         default:
                 kx = "unknown";
         }
@@ -1685,9 +1635,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_aDH:
                 au = "DH";
                 break;
-        case SSL_aKRB5:
-                au = "KRB5";
-                break;
         case SSL_aECDH:
                 au = "ECDH";
                 break;
@@ -1697,9 +1644,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_aECDSA:
                 au = "ECDSA";
                 break;
-        case SSL_aPSK:
-                au = "PSK";
-                break;
         default:
                 au = "unknown";
                 break;
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index c3169204f6..beb8089475 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.74 2014/07/11 09:24:44 beck Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.75 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2137,9 +2137,6 @@ ssl_get_server_send_pkey(const SSL *s)
                         i = SSL_PKEY_RSA_SIGN;
                 else
                         i = SSL_PKEY_RSA_ENC;
-        } else if (alg_a & SSL_aKRB5) {
-                /* VRS something else here? */
-                return (NULL);
         } else if (alg_a & SSL_aGOST94) {
                 i = SSL_PKEY_GOST94;
         } else if (alg_a & SSL_aGOST01) {
diff --git a/src/lib/libssl/src/ssl/ssl_locl.h b/src/lib/libssl/src/ssl/ssl_locl.h
index c1e402b3a1..0d96ee5fe8 100644
--- a/src/lib/libssl/src/ssl/ssl_locl.h
+++ b/src/lib/libssl/src/ssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.59 2014/07/11 08:17:36 miod Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.60 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -257,13 +257,10 @@
 #define SSL_kDHr                0x00000002L /* DH cert, RSA CA cert */ /* no such ciphersuites supported! */
 #define SSL_kDHd                0x00000004L /* DH cert, DSA CA cert */ /* no such ciphersuite supported! */
 #define SSL_kEDH                0x00000008L /* tmp DH key no DH cert */
-#define SSL_kKRB5               0x00000010L /* Kerberos5 key exchange */
 #define SSL_kECDHr              0x00000020L /* ECDH cert, RSA CA cert */
 #define SSL_kECDHe              0x00000040L /* ECDH cert, ECDSA CA cert */
 #define SSL_kEECDH              0x00000080L /* ephemeral ECDH */
-#define SSL_kPSK                0x00000100L /* PSK */
-#define SSL_kGOST       0x00000200L /* GOST key exchange */
-#define SSL_kSRP        0x00000400L /* SRP */
+#define SSL_kGOST               0x00000200L /* GOST key exchange */
 
 /* Bits for algorithm_auth (server authentication) */
 #define SSL_aRSA                0x00000001L /* RSA auth */
@@ -271,9 +268,7 @@
 #define SSL_aNULL               0x00000004L /* no auth (i.e. use ADH or AECDH) */
 #define SSL_aDH                 0x00000008L /* Fixed DH auth (kDHd or kDHr) */ /* no such ciphersuites supported! */
 #define SSL_aECDH               0x00000010L /* Fixed ECDH auth (kECDHe or kECDHr) */
-#define SSL_aKRB5               0x00000020L /* KRB5 auth */
 #define SSL_aECDSA              0x00000040L /* ECDSA auth*/
-#define SSL_aPSK                0x00000080L /* PSK auth */
 #define SSL_aGOST94                             0x00000100L /* GOST R 34.10-94 signature auth */
 #define SSL_aGOST01                     0x00000200L /* GOST R 34.10-2001 signature auth */
 
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index 9df4f8a0c9..a2dec527ca 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_ciph.c,v 1.64 2014/07/12 07:52:36 guenther Exp $ */
+/* $OpenBSD: ssl_ciph.c,v 1.65 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -273,11 +273,6 @@ static const SSL_CIPHER cipher_aliases[] = {
         },
         
         {
-                .name = SSL_TXT_kKRB5,
-                .algorithm_mkey = SSL_kKRB5,
-        },
-        
-        {
                 .name = SSL_TXT_kECDHr,
                 .algorithm_mkey = SSL_kECDHr,
         },
@@ -299,14 +294,6 @@ static const SSL_CIPHER cipher_aliases[] = {
         },
         
         {
-                .name = SSL_TXT_kPSK,
-                .algorithm_mkey = SSL_kPSK,
-        },
-        {
-                .name = SSL_TXT_kSRP,
-                .algorithm_mkey = SSL_kSRP,
-        },
-        {
                 .name = SSL_TXT_kGOST,
                 .algorithm_mkey = SSL_kGOST,
         },
@@ -325,10 +312,6 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_auth = SSL_aDSS,
         },
         {
-                .name = SSL_TXT_aKRB5,
-                .algorithm_auth = SSL_aKRB5,
-        },
-        {
                 .name = SSL_TXT_aNULL,
                 .algorithm_auth = SSL_aNULL,
         },
@@ -350,10 +333,6 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_auth = SSL_aECDSA,
         },
         {
-                .name = SSL_TXT_aPSK,
-                .algorithm_auth = SSL_aPSK,
-        },
-        {
                 .name = SSL_TXT_aGOST94,
                 .algorithm_auth = SSL_aGOST94,
         },
@@ -382,11 +361,6 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_enc = SSL_eNULL,
         },
         {
-                .name = SSL_TXT_KRB5,
-                .algorithm_mkey = SSL_kKRB5,
-                .algorithm_auth = SSL_aKRB5,
-        },
-        {
                 .name = SSL_TXT_RSA,
                 .algorithm_mkey = SSL_kRSA,
                 .algorithm_auth = SSL_aRSA,
@@ -401,16 +375,7 @@ static const SSL_CIPHER cipher_aliases[] = {
                 .algorithm_mkey = SSL_kEECDH,
                 .algorithm_auth = SSL_aNULL,
         },
-        {
-                .name = SSL_TXT_PSK,
-                .algorithm_mkey = SSL_kPSK,
-                .algorithm_auth = SSL_aPSK,
-        },
-        {
-                .name = SSL_TXT_SRP,
-                .algorithm_mkey = SSL_kSRP,
-        },
-        
+
         /* symmetric encryption aliases */
         {
                 .name = SSL_TXT_DES,
@@ -881,11 +846,7 @@ ssl_cipher_get_disabled(unsigned long *mkey, unsigned long *auth, unsigned long
 
         *mkey |= SSL_kDHr|SSL_kDHd; /* no such ciphersuites supported! */
         *auth |= SSL_aDH;
-        *mkey |= SSL_kKRB5;
-        *auth |= SSL_aKRB5;
-        *mkey |= SSL_kPSK;
-        *auth |= SSL_aPSK;
-        *mkey |= SSL_kSRP;
+
         /* Check for presence of GOST 34.10 algorithms, and if they
          * do not present, disable  appropriate auth and key exchange */
         if (!get_optional_pkey_id("gost94")) {
@@ -1515,8 +1476,6 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         ssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
         /* ssl_cipher_apply_rule(0, 0, SSL_aDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail); */
         ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
-        ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
-        ssl_cipher_apply_rule(0, SSL_kKRB5, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
 
         /* RC4 is sort-of broken -- move the the end */
         ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
@@ -1650,9 +1609,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_kDHd:
                 kx = "DH/DSS";
                 break;
-        case SSL_kKRB5:
-                kx = "KRB5";
-                break;
         case SSL_kEDH:
                 kx = "DH";
                 break;
@@ -1665,12 +1621,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_kEECDH:
                 kx = "ECDH";
                 break;
-        case SSL_kPSK:
-                kx = "PSK";
-                break;
-        case SSL_kSRP:
-                kx = "SRP";
-                break;
         default:
                 kx = "unknown";
         }
@@ -1685,9 +1635,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_aDH:
                 au = "DH";
                 break;
-        case SSL_aKRB5:
-                au = "KRB5";
-                break;
         case SSL_aECDH:
                 au = "ECDH";
                 break;
@@ -1697,9 +1644,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
         case SSL_aECDSA:
                 au = "ECDSA";
                 break;
-        case SSL_aPSK:
-                au = "PSK";
-                break;
         default:
                 au = "unknown";
                 break;
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index c3169204f6..beb8089475 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.74 2014/07/11 09:24:44 beck Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.75 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2137,9 +2137,6 @@ ssl_get_server_send_pkey(const SSL *s)
                         i = SSL_PKEY_RSA_SIGN;
                 else
                         i = SSL_PKEY_RSA_ENC;
-        } else if (alg_a & SSL_aKRB5) {
-                /* VRS something else here? */
-                return (NULL);
         } else if (alg_a & SSL_aGOST94) {
                 i = SSL_PKEY_GOST94;
         } else if (alg_a & SSL_aGOST01) {
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index c1e402b3a1..0d96ee5fe8 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.59 2014/07/11 08:17:36 miod Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.60 2014/07/12 13:11:53 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -257,13 +257,10 @@
 #define SSL_kDHr                0x00000002L /* DH cert, RSA CA cert */ /* no such ciphersuites supported! */
 #define SSL_kDHd                0x00000004L /* DH cert, DSA CA cert */ /* no such ciphersuite supported! */
 #define SSL_kEDH                0x00000008L /* tmp DH key no DH cert */
-#define SSL_kKRB5               0x00000010L /* Kerberos5 key exchange */
 #define SSL_kECDHr              0x00000020L /* ECDH cert, RSA CA cert */
 #define SSL_kECDHe              0x00000040L /* ECDH cert, ECDSA CA cert */
 #define SSL_kEECDH              0x00000080L /* ephemeral ECDH */
-#define SSL_kPSK                0x00000100L /* PSK */
-#define SSL_kGOST       0x00000200L /* GOST key exchange */
-#define SSL_kSRP        0x00000400L /* SRP */
+#define SSL_kGOST               0x00000200L /* GOST key exchange */
 
 /* Bits for algorithm_auth (server authentication) */
 #define SSL_aRSA                0x00000001L /* RSA auth */
@@ -271,9 +268,7 @@
 #define SSL_aNULL               0x00000004L /* no auth (i.e. use ADH or AECDH) */
 #define SSL_aDH                 0x00000008L /* Fixed DH auth (kDHd or kDHr) */ /* no such ciphersuites supported! */
 #define SSL_aECDH               0x00000010L /* Fixed ECDH auth (kECDHe or kECDHr) */
-#define SSL_aKRB5               0x00000020L /* KRB5 auth */
 #define SSL_aECDSA              0x00000040L /* ECDSA auth*/
-#define SSL_aPSK                0x00000080L /* PSK auth */
 #define SSL_aGOST94                             0x00000100L /* GOST R 34.10-94 signature auth */
 #define SSL_aGOST01                     0x00000200L /* GOST R 34.10-2001 signature auth */