[System]: Remove unpredictable pluggable setup and cleanup APIs.

(cherry picked from commit 2d945d75bb1abb3a750e6fa2bc0facb768228dbb)

34 files changed, 1570 insertions, 51 deletions

diff --git a/mcs/class/Makefile b/mcs/class/Makefile
index ae9651fc59e..a0dd126efac 100644
--- a/mcs/class/Makefile
+++ b/mcs/class/Makefile
@@ -54,7 +54,8 @@ mobile_common_dirs := \
 	Microsoft.CSharp \
 	Mono.Security.Providers.DotNet	\
 	Mono.Security.Providers.OldTls \
-	Mono.Security.Providers.NewSystemSource
+	Mono.Security.Providers.NewSystemSource \
+	Mono.Security.Providers.NewTls
 
 mobile_static_dirs := \
 	$(mobile_common_dirs)	\
@@ -133,6 +134,7 @@ xammac_4_5_dirs := \
 	Mono.Security.Providers.DotNet \
 	Mono.Security.Providers.OldTls \
 	Mono.Security.Providers.NewSystemSource \
+	Mono.Security.Providers.NewTls \
 	$(pcl_facade_dirs)
 
 net_4_x_dirs := \
@@ -217,7 +219,9 @@ net_4_x_dirs := \
 	System.Net.Http.Formatting \
 	System.Web.Http \
 	System.Web.Http.SelfHost \
-	System.Web.Http.WebHost
+	System.Web.Http.WebHost \
+	Mono.Security.Providers.NewSystemSource \
+	Mono.Security.Providers.NewTls
 
 # These are the subdirs which depends on libs in net_4_x_dirs
 # or have proper dependencies between each other
@@ -262,7 +266,6 @@ net_4_x_parallel_dirs := \
 	System.Xml.Serialization \
 	Mono.Security.Providers.DotNet \
 	Mono.Security.Providers.OldTls \
-	Mono.Security.Providers.NewSystemSource \
 	System.DirectoryServices.Protocols	\
 	RabbitMQ.Client			\
 	Microsoft.VisualC		\
diff --git a/mcs/class/Mono.Security.Providers.DotNet/Mono.Security.Providers.DotNet/DotNetTlsProvider.cs b/mcs/class/Mono.Security.Providers.DotNet/Mono.Security.Providers.DotNet/DotNetTlsProvider.cs
index 74b2a8e71c7..3be685a46d2 100644
--- a/mcs/class/Mono.Security.Providers.DotNet/Mono.Security.Providers.DotNet/DotNetTlsProvider.cs
+++ b/mcs/class/Mono.Security.Providers.DotNet/Mono.Security.Providers.DotNet/DotNetTlsProvider.cs
@@ -62,7 +62,7 @@ namespace Mono.Security.Providers.DotNet
 			get { return false; }
 		}
 
-		public override bool SupportsTlsContext {
+		internal override bool SupportsTlsContext {
 			get { return false; }
 		}
 
@@ -88,7 +88,7 @@ namespace Mono.Security.Providers.DotNet
 			return new DotNetSslStreamImpl (innerStream, leaveInnerStreamOpen, this, validation_callback, selection_callback);
 		}
 
-		public override IMonoTlsContext CreateTlsContext (
+		internal override IMonoTlsContext CreateTlsContext (
 			string hostname, bool serverMode, TlsProtocols protocolFlags,
 			X509Certificate serverCertificate, X509CertificateCollection clientCertificates,
 			bool remoteCertRequired, MonoEncryptionPolicy encryptionPolicy,
diff --git a/mcs/class/Mono.Security.Providers.NewSystemSource/Mono.Security.Providers.NewSystemSource.dll.sources b/mcs/class/Mono.Security.Providers.NewSystemSource/Mono.Security.Providers.NewSystemSource.dll.sources
index 80d1238c4b6..c8974658e27 100644
--- a/mcs/class/Mono.Security.Providers.NewSystemSource/Mono.Security.Providers.NewSystemSource.dll.sources
+++ b/mcs/class/Mono.Security.Providers.NewSystemSource/Mono.Security.Providers.NewSystemSource.dll.sources
@@ -30,3 +30,4 @@
 ../System/Mono.Net.Security/IMonoTlsProvider.cs
 ../System/Mono.Net.Security/MonoTlsProviderFactory.cs
 ../System/Mono.Net.Security/MonoTlsProviderWrapper.cs
+
diff --git a/mcs/class/Mono.Security.Providers.NewSystemSource/Properties/AssemblyInfo.cs b/mcs/class/Mono.Security.Providers.NewSystemSource/Properties/AssemblyInfo.cs
index b3178b82c3a..23ba5bb2537 100644
--- a/mcs/class/Mono.Security.Providers.NewSystemSource/Properties/AssemblyInfo.cs
+++ b/mcs/class/Mono.Security.Providers.NewSystemSource/Properties/AssemblyInfo.cs
@@ -45,3 +45,4 @@ using System.Runtime.InteropServices;
 [assembly: NeutralResourcesLanguage ("en-US")]
 
 [assembly: InternalsVisibleTo ("Mono.Security.Providers.NewTls, PublicKey=002400000480000094000000060200000024000052534131000400001100000003336d6aed41624ca156ab579881fe90a576f1dfec48378fc94e4e440f4556776224e2d70c18996d91f36227f539fdb44340e07651f1455a489b29a7e6219a8f85e52b0f8588b4f8a857746a8468d37b556223d1452f3fcbaf0f269cdf1900ceb68f69485dc5887750d19571030c732331e00387d9b813a9ad52891087301793")]
+[assembly: InternalsVisibleTo ("Mono.Security.Providers.NewTls, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Makefile b/mcs/class/Mono.Security.Providers.NewTls/Makefile
new file mode 100644
index 00000000000..a5f641229e4
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Makefile
@@ -0,0 +1,12 @@
+thisdir = class/Mono.Security.Providers.NewTls
+SUBDIRS = 
+include ../../build/rules.make
+
+LIBRARY = Mono.Security.Providers.NewTls.dll
+LIB_MCS_FLAGS = -unsafe -nowarn:1030 -keyfile:../mono.pub -delaysign -r:System.dll \
+	-r:NewSystemSource=Mono.Security.Providers.NewSystemSource.dll -r:Mono.Security.dll
+
+include ../../build/library.make
+
+$(the_lib): ../Mono.Security/Makefile
+
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls.dll.sources b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls.dll.sources
new file mode 100644
index 00000000000..12d8a20f781
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls.dll.sources
@@ -0,0 +1,13 @@
+./Properties/AssemblyInfo.cs
+../../build/common/SR.cs
+../../build/common/Consts.cs
+../../build/common/Locale.cs
+
+./Mono.Security.Providers.NewTls/ITlsConfiguration.cs
+./Mono.Security.Providers.NewTls/ITlsContext.cs
+
+./Mono.Security.Providers.NewTls/MonoNewTlsStream.cs
+./Mono.Security.Providers.NewTls/MonoNewTlsStreamFactory.cs
+./Mono.Security.Providers.NewTls/NewTlsProvider.cs
+./Mono.Security.Providers.NewTls/TlsContextWrapper.cs
+./Mono.Security.Providers.NewTls/TlsProviderFactory.cs
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/ITlsConfiguration.cs b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/ITlsConfiguration.cs
new file mode 100644
index 00000000000..401afd763eb
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/ITlsConfiguration.cs
@@ -0,0 +1,47 @@
+//
+// ITlsContext.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015-2016 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+using System;
+using System.Security.Cryptography;
+
+using Mono.Security.Interface;
+using MX = Mono.Security.X509;
+
+namespace Mono.Security.Providers.NewTls
+{
+	interface ITlsConfiguration
+	{
+		bool HasCredentials {
+			get;
+		}
+
+		void SetCertificate (MX.X509Certificate certificate, AsymmetricAlgorithm privateKey);
+
+		bool? AskForClientCertificate {
+			get; set;
+		}
+	}
+}
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/ITlsContext.cs b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/ITlsContext.cs
new file mode 100644
index 00000000000..0d69805c4d0
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/ITlsContext.cs
@@ -0,0 +1,70 @@
+//
+// ITlsContext.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015-2016 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+extern alias NewSystemSource;
+
+using System;
+using System.Security.Cryptography;
+
+using Mono.Security.Interface;
+using MX = Mono.Security.X509;
+
+namespace Mono.Security.Providers.NewTls
+{
+	interface ITlsContext : IDisposable
+	{
+		bool IsValid {
+			get;
+		}
+
+		TlsException LastError {
+			get;
+		}
+
+		bool ReceivedCloseNotify {
+			get;
+		}
+
+		MonoTlsConnectionInfo ConnectionInfo {
+			get;
+		}
+
+		MX.X509Certificate GetRemoteCertificate (out MX.X509CertificateCollection remoteCertificateStore);
+
+		bool VerifyRemoteCertificate ();
+
+		int GenerateNextToken (TlsBuffer incoming, TlsMultiBuffer outgoing);
+
+		int DecryptMessage (ref TlsBuffer incoming);
+
+		int EncryptMessage (ref TlsBuffer incoming);
+
+		byte[] CreateAlert (Alert alert);
+
+		byte[] CreateHelloRequest ();
+	}
+}
+
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/MonoNewTlsStream.cs b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/MonoNewTlsStream.cs
new file mode 100644
index 00000000000..6117f0f7740
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/MonoNewTlsStream.cs
@@ -0,0 +1,93 @@
+//
+// MonoNewTlsStream.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+extern alias NewSystemSource;
+
+using EncryptionPolicy = NewSystemSource::System.Net.Security.EncryptionPolicy;
+using LocalCertificateSelectionCallback = NewSystemSource::System.Net.Security.LocalCertificateSelectionCallback;
+using RemoteCertificateValidationCallback = NewSystemSource::System.Net.Security.RemoteCertificateValidationCallback;
+using SslStream = NewSystemSource::System.Net.Security.SslStream;
+
+using System;
+using System.IO;
+using System.Threading.Tasks;
+
+using MSI = Mono.Security.Interface;
+
+using XAuthenticatedStream = System.Net.Security.AuthenticatedStream;
+using System.Security.Cryptography.X509Certificates;
+
+namespace Mono.Security.Providers.NewTls
+{
+	public class MonoNewTlsStream : SslStream, MSI.IMonoSslStream
+	{
+		MSI.MonoTlsProvider provider;
+
+		internal MonoNewTlsStream (Stream innerStream, MSI.MonoTlsProvider provider, MSI.MonoTlsSettings settings)
+			: this (innerStream, false, provider, settings)
+		{
+		}
+
+		internal MonoNewTlsStream (Stream innerStream, bool leaveOpen, MSI.MonoTlsProvider provider, MSI.MonoTlsSettings settings)
+			: base (innerStream, leaveOpen, EncryptionPolicy.RequireEncryption, provider, settings)
+		{
+			this.provider = provider;
+		}
+
+		public MSI.MonoTlsProvider Provider {
+			get { return provider; }
+		}
+
+		new public bool IsClosed {
+			get { return base.IsClosed; }
+		}
+
+		public MSI.MonoTlsConnectionInfo GetConnectionInfo ()
+		{
+			return GetMonoConnectionInfo ();
+		}
+
+		public Task Shutdown ()
+		{
+			return Task.Factory.FromAsync ((state, result) => BeginShutdown (state, result), EndShutdown, null);
+		}
+
+		public Task RequestRenegotiation ()
+		{
+			return Task.Factory.FromAsync ((state, result) => BeginRenegotiate (state, result), EndRenegotiate, null);
+		}
+
+		 X509Certificate MSI.IMonoSslStream.InternalLocalCertificate {
+			get { return InternalLocalCertificate; }
+		}
+
+		XAuthenticatedStream MSI.IMonoSslStream.AuthenticatedStream {
+			get { return this; }
+		}
+	}
+}
+
+
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/MonoNewTlsStreamFactory.cs b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/MonoNewTlsStreamFactory.cs
new file mode 100644
index 00000000000..d39f1bb2c51
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/MonoNewTlsStreamFactory.cs
@@ -0,0 +1,91 @@
+//
+// MonoNewTlsStreamFactory.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+extern alias NewSystemSource;
+
+using XEncryptionPolicy = NewSystemSource::System.Net.Security.EncryptionPolicy;
+using XSslPolicyErrors = NewSystemSource::System.Net.Security.SslPolicyErrors;
+using XLocalCertificateSelectionCallback = NewSystemSource::System.Net.Security.LocalCertificateSelectionCallback;
+using XRemoteCertificateValidationCallback = NewSystemSource::System.Net.Security.RemoteCertificateValidationCallback;
+
+using System;
+using System.IO;
+using System.Net.Security;
+using System.Security.Authentication;
+
+using Mono.Security.Interface;
+
+using PSSCX = System.Security.Cryptography.X509Certificates;
+using SSCX = System.Security.Cryptography.X509Certificates;
+
+namespace Mono.Security.Providers.NewTls
+{
+	public static class MonoNewTlsStreamFactory
+	{
+		internal static IMonoSslStream CreateSslStream (
+			Stream innerStream, bool leaveInnerStreamOpen,
+			MonoTlsProvider provider, MonoTlsSettings settings = null)
+		{
+			return new MonoNewTlsStream (innerStream, leaveInnerStreamOpen, provider, settings);
+		}
+
+		public static MonoNewTlsStream CreateServer (
+			Stream innerStream, bool leaveOpen, MonoTlsProvider provider, MonoTlsSettings settings,
+			SSCX.X509Certificate serverCertificate, bool clientCertificateRequired,
+			SslProtocols enabledSslProtocols, bool checkCertificateRevocation)
+		{
+			var stream = new MonoNewTlsStream (innerStream, leaveOpen, provider, settings);
+
+			try {
+				stream.AuthenticateAsServer (serverCertificate, clientCertificateRequired, enabledSslProtocols, checkCertificateRevocation);
+			} catch (Exception ex) {
+				var tlsEx = stream.LastError;
+				if (tlsEx != null)
+					throw new AggregateException (ex, tlsEx);
+				throw;
+			}
+
+			return stream;
+		}
+
+		public static MonoNewTlsStream CreateClient (
+			Stream innerStream, bool leaveOpen, MonoTlsProvider provider, MonoTlsSettings settings,
+			string targetHost, PSSCX.X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, bool checkCertificateRevocation)
+		{
+			var stream = new MonoNewTlsStream (innerStream, leaveOpen, provider, settings);
+
+			try {
+				stream.AuthenticateAsClient (targetHost, clientCertificates, enabledSslProtocols, checkCertificateRevocation);
+			} catch (Exception ex) {
+				var tlsEx = stream.LastError;
+				if (tlsEx != null)
+					throw new AggregateException (ex, tlsEx);
+				throw;
+			}
+			return stream;
+		}
+	}
+}
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/NewTlsProvider.cs b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/NewTlsProvider.cs
new file mode 100644
index 00000000000..e2b347fbe2b
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/NewTlsProvider.cs
@@ -0,0 +1,95 @@
+//
+// NewTlsProvider.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+extern alias NewSystemSource;
+
+using System;
+using System.IO;
+using System.Net;
+using System.Net.Security;
+using System.Security.Authentication;
+
+using MSI = Mono.Security.Interface;
+using MX = Mono.Security.X509;
+
+using PSSCX = System.Security.Cryptography.X509Certificates;
+using SSCX = System.Security.Cryptography.X509Certificates;
+
+namespace Mono.Security.Providers.NewTls
+{
+	public class NewTlsProvider : MSI.MonoTlsProvider
+	{
+		static readonly Guid id = new Guid ("e5ff34f1-8b7a-4aa6-aff9-24719d709693");
+
+		public override Guid ID {
+			get { return id; }
+		}
+
+		public override string Name {
+			get { return "newtls"; }
+		}
+
+		public override bool SupportsSslStream {
+			get { return true; }
+		}
+
+		public override bool SupportsConnectionInfo {
+			get { return true; }
+		}
+
+		public override bool SupportsMonoExtensions {
+			get { return true; }
+		}
+
+		internal override bool SupportsTlsContext {
+			get { return true; }
+		}
+
+		public override SslProtocols SupportedProtocols {
+			get { return SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls; }
+		}
+
+		public override MSI.IMonoSslStream CreateSslStream (
+			Stream innerStream, bool leaveInnerStreamOpen,
+			MSI.MonoTlsSettings settings = null)
+		{
+			return MonoNewTlsStreamFactory.CreateSslStream (innerStream, leaveInnerStreamOpen, this, settings);
+		}
+
+		internal override MSI.IMonoTlsContext CreateTlsContext (
+			string hostname, bool serverMode, MSI.TlsProtocols protocolFlags,
+			SSCX.X509Certificate serverCertificate, PSSCX.X509CertificateCollection clientCertificates,
+			bool remoteCertRequired, MSI.MonoEncryptionPolicy encryptionPolicy,
+			MSI.MonoTlsSettings settings)
+		{
+			var config = TlsProviderFactory.CreateTlsConfiguration (
+				hostname, serverMode, protocolFlags, serverCertificate,
+				remoteCertRequired, settings);
+			return new TlsContextWrapper (config, serverMode);
+		}
+	}
+}
+
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/TlsContextWrapper.cs b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/TlsContextWrapper.cs
new file mode 100644
index 00000000000..389dd1a19f3
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/TlsContextWrapper.cs
@@ -0,0 +1,221 @@
+//
+// TlsContextWrapper.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+extern alias NewSystemSource;
+
+using System;
+using System.Security.Cryptography;
+
+using SSCX = System.Security.Cryptography.X509Certificates;
+using PSSCX = System.Security.Cryptography.X509Certificates;
+
+using MSI = Mono.Security.Interface;
+using MX = Mono.Security.X509;
+
+namespace Mono.Security.Providers.NewTls
+{
+	class TlsContextWrapper : IDisposable, MSI.IMonoTlsContext
+	{
+		ITlsConfiguration config;
+		ITlsContext context;
+		bool serverMode;
+
+		public TlsContextWrapper (ITlsConfiguration config, bool serverMode)
+		{
+			this.config = config;
+			this.serverMode = serverMode;
+		}
+
+		public bool IsServer {
+			get { return serverMode; }
+		}
+
+		public bool IsValid {
+			get { return context != null && context.IsValid; }
+		}
+
+		public void Initialize (MSI.IMonoTlsEventSink eventSink)
+		{
+			if (context != null)
+				throw new InvalidOperationException ();
+			context = TlsProviderFactory.CreateTlsContext (config, serverMode, eventSink);
+		}
+
+		void Clear ()
+		{
+			if (context != null) {
+				context.Dispose ();
+				context = null;
+			}
+		}
+
+		public ITlsConfiguration Configuration {
+			get {
+				if (config == null)
+					throw new ObjectDisposedException ("TlsConfiguration");
+				return config;
+			}
+		}
+
+		public ITlsContext Context {
+			get {
+				if (!IsValid)
+					throw new ObjectDisposedException ("TlsContext");
+				return context;
+			}
+		}
+
+		public bool HasCredentials {
+			get { return Configuration.HasCredentials; }
+		}
+
+		public void SetCertificate (SSCX.X509Certificate certificate, AsymmetricAlgorithm privateKey)
+		{
+			var monoCert = new MX.X509Certificate (certificate.GetRawCertData ());
+			Configuration.SetCertificate (monoCert, privateKey);
+		}
+
+		public int GenerateNextToken (MSI.IBufferOffsetSize incoming, out MSI.IBufferOffsetSize outgoing)
+		{
+			var input = incoming != null ? new MSI.TlsBuffer (BOSWrapper.Wrap (incoming)) : null;
+			var output = new MSI.TlsMultiBuffer ();
+			var retval = Context.GenerateNextToken (input, output);
+			if (output.IsEmpty)
+				outgoing = null;
+			outgoing = BOSWrapper.Wrap (output.StealBuffer ());
+			return (int)retval;
+		}
+
+		public int EncryptMessage (ref MSI.IBufferOffsetSize incoming)
+		{
+			var buffer = new MSI.TlsBuffer (BOSWrapper.Wrap (incoming));
+			var retval = Context.EncryptMessage (ref buffer);
+			incoming = BOSWrapper.Wrap (buffer.GetRemaining ());
+			return (int)retval;
+		}
+
+		public int DecryptMessage (ref MSI.IBufferOffsetSize incoming)
+		{
+			var buffer = new MSI.TlsBuffer (BOSWrapper.Wrap (incoming));
+			var retval = Context.DecryptMessage (ref buffer);
+			incoming = buffer != null ? BOSWrapper.Wrap (buffer.GetRemaining ()) : null;
+			return (int)retval;
+		}
+
+		class BOSWrapper : MSI.IBufferOffsetSize
+		{
+			public byte[] Buffer {
+				get;
+				private set;
+			}
+
+			public int Offset {
+				get;
+				private set;
+			}
+
+			public int Size {
+				get;
+				private set;
+			}
+
+			BOSWrapper (byte[] buffer, int offset, int size)
+			{
+				Buffer = buffer;
+				Offset = offset;
+				Size = size;
+			}
+
+			public static BOSWrapper Wrap (MSI.IBufferOffsetSize bos)
+			{
+				return bos != null ? new BOSWrapper (bos.Buffer, bos.Offset, bos.Size) : null;
+			}
+		}
+
+		public byte[] CreateCloseNotify ()
+		{
+			return Context.CreateAlert (new MSI.Alert (MSI.AlertLevel.Warning, MSI.AlertDescription.CloseNotify));
+		}
+
+		public byte[] CreateHelloRequest ()
+		{
+			return Context.CreateHelloRequest ();
+		}
+
+		public SSCX.X509Certificate GetRemoteCertificate (out PSSCX.X509CertificateCollection remoteCertificateStore)
+		{
+			MX.X509CertificateCollection monoCollection;
+			var remoteCert = Context.GetRemoteCertificate (out monoCollection);
+			if (remoteCert == null) {
+				remoteCertificateStore = null;
+				return null;
+			}
+
+			remoteCertificateStore = new PSSCX.X509CertificateCollection ();
+			foreach (var cert in monoCollection) {
+				remoteCertificateStore.Add (new PSSCX.X509Certificate2 (cert.RawData));
+			}
+			return new PSSCX.X509Certificate2 (remoteCert.RawData);
+
+		}
+
+		public bool VerifyRemoteCertificate ()
+		{
+			return Context.VerifyRemoteCertificate ();
+		}
+
+		public Exception LastError {
+			get {
+				if (context != null)
+					return context.LastError;
+				return null;
+			}
+		}
+
+		public bool ReceivedCloseNotify {
+			get {
+				return Context.ReceivedCloseNotify;
+			}
+		}
+
+		public MSI.MonoTlsConnectionInfo GetConnectionInfo ()
+		{
+			return Context.ConnectionInfo;
+		}
+
+		public void Dispose ()
+		{
+			Dispose (true);
+			GC.SuppressFinalize (this);
+		}
+
+		void Dispose (bool disposing)
+		{
+			Clear ();
+		}
+	}
+}
+
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/TlsProviderFactory.cs b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/TlsProviderFactory.cs
new file mode 100644
index 00000000000..92d8ab08f69
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Mono.Security.Providers.NewTls/TlsProviderFactory.cs
@@ -0,0 +1,97 @@
+//
+// TlsProviderFactory.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015-2016 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+extern alias NewSystemSource;
+
+using System;
+using System.IO;
+
+using System.Net;
+using System.Net.Security;
+using System.Security.Authentication;
+
+using MSI = Mono.Security.Interface;
+using MX = Mono.Security.X509;
+
+using PSSCX = System.Security.Cryptography.X509Certificates;
+using SSCX = System.Security.Cryptography.X509Certificates;
+
+namespace Mono.Security.Providers.NewTls
+{
+	static class TlsProviderFactory
+	{
+		const string assemblyName = "Mono.Security.NewTls, Version=4.0.0.0, Culture=neutral, PublicKeyToken=84e3aee7225169c2";
+		const string tlsConfigTypeName = "Mono.Security.NewTls.TlsConfiguration";
+		const string tlsContextTypeName = "Mono.Security.NewTls.TlsContext";
+
+		static object CreateInstance (string typeName, object[] args)
+		{
+			var type = Type.GetType (typeName + ", " + assemblyName);
+			return Activator.CreateInstance (type, args);
+		}
+
+		internal static ITlsConfiguration CreateTlsConfiguration (
+			string hostname, bool serverMode, MSI.TlsProtocols protocolFlags,
+			SSCX.X509Certificate serverCertificate, bool remoteCertRequired,
+			MSI.MonoTlsSettings settings)
+		{
+			object[] args;
+			ITlsConfiguration config;
+			if (serverMode) {
+				var cert = (PSSCX.X509Certificate2)serverCertificate;
+				var monoCert = new MX.X509Certificate (cert.RawData);
+				args = new object[] {
+					(MSI.TlsProtocols)protocolFlags,
+					(MSI.MonoTlsSettings)settings,
+					monoCert,
+					cert.PrivateKey
+				};
+			} else {
+				args = new object[] {
+					(MSI.TlsProtocols)protocolFlags,
+					(MSI.MonoTlsSettings)settings,
+					hostname
+				};
+			}
+
+			config = (ITlsConfiguration)CreateInstance (tlsConfigTypeName, args);
+
+			if (serverMode && remoteCertRequired)
+				config.AskForClientCertificate = true;
+
+			return config;
+		}
+
+		internal static ITlsContext CreateTlsContext (
+			ITlsConfiguration config, bool serverMode,
+			MSI.IMonoTlsEventSink eventSink)
+		{
+			return (ITlsContext)CreateInstance (
+				tlsContextTypeName,
+				new object[] { config, serverMode, eventSink });
+		}
+	}
+}
diff --git a/mcs/class/Mono.Security.Providers.NewTls/Properties/AssemblyInfo.cs b/mcs/class/Mono.Security.Providers.NewTls/Properties/AssemblyInfo.cs
new file mode 100644
index 00000000000..e3690939201
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/Properties/AssemblyInfo.cs
@@ -0,0 +1,47 @@
+//
+// AssemblyInfo.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2015 Xamarin, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+using System;
+using System.Reflection;
+using System.Resources;
+using System.Security;
+using System.Security.Permissions;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about the system assembly
+
+[assembly: AssemblyVersion (Consts.FxVersion)]
+
+[assembly: AssemblyCompany ("Xamarin")]
+[assembly: AssemblyCopyright ("(c) 2015 Xamarin")]
+[assembly: AssemblyDescription ("Mono.Security.Providers.NewTls.dll")]
+[assembly: AssemblyProduct ("MONO CLI")]
+[assembly: AssemblyTitle ("Mono.Security.Providers.NewTls.dll")]
+[assembly: CLSCompliant (false)]
+[assembly: ComVisible (false)]
+[assembly: NeutralResourcesLanguage ("en-US")]
+
+[assembly: InternalsVisibleTo ("Mono.Security.NewTls, PublicKey=002400000480000094000000060200000024000052534131000400001100000003336d6aed41624ca156ab579881fe90a576f1dfec48378fc94e4e440f4556776224e2d70c18996d91f36227f539fdb44340e07651f1455a489b29a7e6219a8f85e52b0f8588b4f8a857746a8468d37b556223d1452f3fcbaf0f269cdf1900ceb68f69485dc5887750d19571030c732331e00387d9b813a9ad52891087301793")]
diff --git a/mcs/class/Mono.Security.Providers.NewTls/mobile_Mono.Security.Providers.NewTls.dll.sources b/mcs/class/Mono.Security.Providers.NewTls/mobile_Mono.Security.Providers.NewTls.dll.sources
new file mode 100644
index 00000000000..7218dabc34a
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/mobile_Mono.Security.Providers.NewTls.dll.sources
@@ -0,0 +1,7 @@
+Properties/AssemblyInfo.cs
+
+Mono.Security.Providers.NewTls/ITlsConfiguration.cs
+Mono.Security.Providers.NewTls/ITlsContext.cs
+
+Mono.Security.Providers.NewTls/MonoNewTlsStream.cs
+Mono.Security.Providers.NewTls/MonoNewTlsStreamFactory.cs
diff --git a/mcs/class/Mono.Security.Providers.NewTls/mobile_static_Mono.Security.Providers.NewTls.dll.sources b/mcs/class/Mono.Security.Providers.NewTls/mobile_static_Mono.Security.Providers.NewTls.dll.sources
new file mode 100644
index 00000000000..baded514340
--- /dev/null
+++ b/mcs/class/Mono.Security.Providers.NewTls/mobile_static_Mono.Security.Providers.NewTls.dll.sources
@@ -0,0 +1 @@
+#include mobile_Mono.Security.Providers.NewTls.dll.sources
diff --git a/mcs/class/Mono.Security.Providers.OldTls/Mono.Security.Providers.OldTls/OldTlsProvider.cs b/mcs/class/Mono.Security.Providers.OldTls/Mono.Security.Providers.OldTls/OldTlsProvider.cs
index 82bd9d5437b..4532a17e02f 100644
--- a/mcs/class/Mono.Security.Providers.OldTls/Mono.Security.Providers.OldTls/OldTlsProvider.cs
+++ b/mcs/class/Mono.Security.Providers.OldTls/Mono.Security.Providers.OldTls/OldTlsProvider.cs
@@ -58,7 +58,7 @@ namespace Mono.Security.Providers.OldTls
 			get { return false; }
 		}
 
-		public override bool SupportsTlsContext {
+		internal override bool SupportsTlsContext {
 			get { return false; }
 		}
 
@@ -74,7 +74,7 @@ namespace Mono.Security.Providers.OldTls
 			return new MNS.Private.MonoSslStreamImpl (impl);
 		}
 
-		public override IMonoTlsContext CreateTlsContext (
+		internal override IMonoTlsContext CreateTlsContext (
 			string hostname, bool serverMode, TlsProtocols protocolFlags,
 			X509Certificate serverCertificate, X509CertificateCollection clientCertificates,
 			bool remoteCertRequired, MonoEncryptionPolicy encryptionPolicy,
diff --git a/mcs/class/Mono.Security/Assembly/AssemblyInfo.cs b/mcs/class/Mono.Security/Assembly/AssemblyInfo.cs
index 85244bc1e4f..55e17aad73d 100644
--- a/mcs/class/Mono.Security/Assembly/AssemblyInfo.cs
+++ b/mcs/class/Mono.Security/Assembly/AssemblyInfo.cs
@@ -60,6 +60,13 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyDelaySign (true)]
 [assembly: AssemblyKeyFile ("../mono.pub")]
 
-#if MOBILE
+#if NET_2_1
 [assembly: InternalsVisibleTo ("System, PublicKey=00240000048000009400000006020000002400005253413100040000010001008D56C76F9E8649383049F383C44BE0EC204181822A6C31CF5EB7EF486944D032188EA1D3920763712CCB12D75FB77E9811149E6148E5D32FBAAB37611C1878DDC19E20EF135D0CB2CFF2BFEC3D115810C3D9069638FE4BE215DBF795861920E5AB6F7DB2E2CEEF136AC23D5DD2BF031700AEC232F6C6B1C785B4305C123B37AB")]
+#else
+[assembly: InternalsVisibleTo ("System, PublicKey=00000000000000000400000000000000")]
 #endif
+
+[assembly: InternalsVisibleTo ("Mono.Security.Providers.NewTls, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
+[assembly: InternalsVisibleTo ("Mono.Security.Providers.OldTls, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
+[assembly: InternalsVisibleTo ("Mono.Security.Providers.DotNet, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
+[assembly: InternalsVisibleTo ("Mono.Security.Providers.NewSystemSource, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/BufferOffsetSize.cs b/mcs/class/Mono.Security/Mono.Security.Interface/BufferOffsetSize.cs
new file mode 100644
index 00000000000..71389628f2c
--- /dev/null
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/BufferOffsetSize.cs
@@ -0,0 +1,96 @@
+//
+// BufferOffsetSize.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2014-2016 Xamarin Inc. (http://www.xamarin.com)
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+using System;
+
+namespace Mono.Security.Interface
+{
+	public class BufferOffsetSize : SecretParameters, IBufferOffsetSize
+	{
+		public byte[] Buffer {
+			get;
+			private set;
+		}
+
+		public int Offset {
+			get;
+			internal set;
+		}
+
+		public int Size {
+			get { return EndOffset - Offset; }
+		}
+
+		public int EndOffset {
+			get;
+			internal set;
+		}
+
+		public BufferOffsetSize (byte[] buffer, int offset, int size)
+		{
+			Buffer = buffer;
+			Offset = offset;
+			EndOffset = offset + size;
+		}
+
+		public BufferOffsetSize (byte[] buffer)
+			: this (buffer, 0, buffer.Length)
+		{
+		}
+
+		public BufferOffsetSize (int size)
+			: this (new byte [size])
+		{
+		}
+
+		public byte[] GetBuffer ()
+		{
+			var copy = new byte [Size];
+			Array.Copy (Buffer, Offset, copy, 0, Size);
+			return copy;
+		}
+
+		public void TruncateTo (int newSize)
+		{
+			if (newSize > Size)
+				throw new ArgumentException ("newSize");
+			EndOffset = Offset + newSize;
+		}
+
+		protected void SetBuffer (byte[] buffer, int offset, int size)
+		{
+			Buffer = buffer;
+			Offset = offset;
+			EndOffset = offset + size;
+		}
+
+		protected override void Clear ()
+		{
+			Buffer = null;
+			Offset = EndOffset = 0;
+		}
+	}
+}
+
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/IMonoTlsContext.cs b/mcs/class/Mono.Security/Mono.Security.Interface/IMonoTlsContext.cs
index 508bdc4fe61..d1ac4e27d0e 100644
--- a/mcs/class/Mono.Security/Mono.Security.Interface/IMonoTlsContext.cs
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/IMonoTlsContext.cs
@@ -29,7 +29,7 @@ using System.Security.Cryptography.X509Certificates;
 
 namespace Mono.Security.Interface
 {
-	public interface IMonoTlsContext : IDisposable
+	interface IMonoTlsContext : IDisposable
 	{
 		bool IsServer {
 			get;
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProvider.cs b/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProvider.cs
index 740d7953648..753cd97e5a2 100644
--- a/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProvider.cs
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProvider.cs
@@ -72,6 +72,10 @@ namespace Mono.Security.Interface
 
 	public abstract class MonoTlsProvider
 	{
+		internal MonoTlsProvider ()
+		{
+		}
+
 		public abstract Guid ID {
 			get;
 		}
@@ -155,11 +159,11 @@ namespace Mono.Security.Interface
 		 * The managed SSPI implementation from the new TLS code.
 		 */
 
-		public abstract bool SupportsTlsContext {
+		internal abstract bool SupportsTlsContext {
 			get;
 		}
 
-		public abstract IMonoTlsContext CreateTlsContext (
+		internal abstract IMonoTlsContext CreateTlsContext (
 			string hostname, bool serverMode, TlsProtocols protocolFlags,
 			X509Certificate serverCertificate, X509CertificateCollection clientCertificates,
 			bool remoteCertRequired, MonoEncryptionPolicy encryptionPolicy,
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProviderFactory.cs b/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProviderFactory.cs
index 9548da030fe..770680cbb8c 100644
--- a/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProviderFactory.cs
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/MonoTlsProviderFactory.cs
@@ -72,14 +72,14 @@ namespace Mono.Security.Interface
 		}
 
 		/*
-		 * Installs a custom TLS Provider.
+		 * Selects the default TLS Provider.
 		 *
 		 * May only be called at application startup and will throw
 		 * @InvalidOperationException if a provider has already been installed.
 		 */
-		public static void InstallProvider (MonoTlsProvider provider)
+		public static void SetDefaultProvider (string name)
 		{
-			NoReflectionHelper.InstallProvider (provider);
+			NoReflectionHelper.SetDefaultProvider (name);
 		}
 
 		/*
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/SecretParameters.cs b/mcs/class/Mono.Security/Mono.Security.Interface/SecretParameters.cs
new file mode 100644
index 00000000000..a225ba67e82
--- /dev/null
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/SecretParameters.cs
@@ -0,0 +1,67 @@
+//
+// SecretParameters.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2014-2016 Xamarin Inc. (http://www.xamarin.com)
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+using System;
+
+namespace Mono.Security.Interface
+{
+	public abstract class SecretParameters : IDisposable
+	{
+		protected abstract void Clear ();
+
+		bool disposed;
+
+		protected void CheckDisposed ()
+		{
+			if (disposed)
+				throw new ObjectDisposedException (GetType ().Name);
+		}
+
+		protected static void Clear (byte[] array)
+		{
+			Array.Clear (array, 0, array.Length);
+		}
+
+		public void Dispose ()
+		{
+			Dispose (true);
+			GC.SuppressFinalize (this);
+		}
+
+		void Dispose (bool disposing)
+		{
+			if (!disposed) {
+				disposed = true;
+				Clear ();
+			}
+		}
+
+		~SecretParameters ()
+		{
+			Dispose (false);
+		}
+	}
+}
+
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/SecureBuffer.cs b/mcs/class/Mono.Security/Mono.Security.Interface/SecureBuffer.cs
new file mode 100644
index 00000000000..fc05f7a535e
--- /dev/null
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/SecureBuffer.cs
@@ -0,0 +1,86 @@
+//
+// SecureBuffer.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2014-2016 Xamarin Inc. (http://www.xamarin.com)
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+using System;
+
+namespace Mono.Security.Interface
+{
+	public class SecureBuffer : SecretParameters, IBufferOffsetSize
+	{
+		byte[] buffer;
+
+		public byte[] Buffer {
+			get {
+				CheckDisposed ();
+				return buffer;
+			}
+		}
+
+		public int Size {
+			get {
+				CheckDisposed ();
+				return buffer != null ? buffer.Length : 0;
+			}
+		}
+
+		int IBufferOffsetSize.Offset {
+			get { return 0; }
+		}
+
+		public SecureBuffer (int size)
+		{
+			buffer = new byte [size];
+		}
+
+		public SecureBuffer (byte[] buffer)
+		{
+			this.buffer = buffer;
+		}
+
+		public byte[] StealBuffer ()
+		{
+			CheckDisposed ();
+			var retval = this.buffer;
+			this.buffer = null;
+			return retval;
+		}
+
+		public static SecureBuffer CreateCopy (byte[] buffer)
+		{
+			var copy = new byte [buffer.Length];
+			Array.Copy (buffer, copy, buffer.Length);
+			return new SecureBuffer (copy);
+		}
+
+		protected override void Clear ()
+		{
+			if (buffer != null) {
+				Array.Clear (buffer, 0, buffer.Length);
+				buffer = null;
+			}
+		}
+	}
+}
+
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/TlsBuffer.cs b/mcs/class/Mono.Security/Mono.Security.Interface/TlsBuffer.cs
new file mode 100644
index 00000000000..be3c007b5b5
--- /dev/null
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/TlsBuffer.cs
@@ -0,0 +1,334 @@
+//
+// TlsBuffer.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2014-2016 Xamarin Inc. (http://www.xamarin.com)
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+using System;
+
+namespace Mono.Security.Interface
+{
+	public class TlsBuffer : SecretParameters
+	{
+		public int Position {
+			get; set;
+		}
+
+		public int Remaining {
+			get { return Size - (Position - Offset); }
+		}
+
+		public byte[] Buffer {
+			get { return innerBuffer.Buffer; }
+		}
+
+		public int Offset {
+			get { return innerBuffer.Offset; }
+		}
+
+		public int Size {
+			get { return innerBuffer.Size; }
+		}
+
+		public int EndOffset {
+			get { return Offset + Size; }
+		}
+
+		IBufferOffsetSize innerBuffer;
+
+		protected TlsBuffer ()
+			: this (null, 0, 0)
+		{
+		}
+
+		public TlsBuffer (IBufferOffsetSize bos)
+		{
+			innerBuffer = bos;
+			Position = bos.Offset;
+		}
+
+		public TlsBuffer (byte[] buffer, int offset, int size)
+			: this (new BufferOffsetSize (buffer, offset, size))
+		{
+		}
+
+		public TlsBuffer (byte[] buffer)
+			: this (buffer, 0, buffer.Length)
+		{
+		}
+
+		public TlsBuffer (int size)
+			: this (new byte [size], 0, size)
+		{
+		}
+
+		public byte ReadByte ()
+		{
+			if (Position >= EndOffset)
+				throw new TlsException (AlertDescription.DecodeError, "Buffer overflow");
+			return Buffer [Position++];
+		}
+
+		public short ReadInt16 ()
+		{
+			if (Position + 1 >= EndOffset)
+				throw new TlsException (AlertDescription.DecodeError, "Buffer overflow");
+			var retval = (short)(Buffer [Position] << 8 | Buffer [Position + 1]);
+			Position += 2;
+			return retval;
+		}
+
+		public int ReadInt24 ()
+		{
+			if (Position + 2 >= EndOffset)
+				throw new TlsException (AlertDescription.DecodeError, "Buffer overflow");
+			var retval = ((Buffer [Position] << 16) | (Buffer [Position+1] << 8) | Buffer [Position+2]);
+			Position += 3;
+			return retval;
+		}
+
+		public int ReadInt32 ()
+		{
+			if (Position + 3 >= EndOffset)
+				throw new TlsException (AlertDescription.DecodeError, "Buffer overflow");
+			var retval = ((Buffer [Position] << 24) | (Buffer [Position+1] << 16) | (Buffer [Position+2] << 8) | Buffer [Position+3]);
+			Position += 4;
+			return retval;
+		}
+
+		public TlsBuffer ReadBuffer (int length)
+		{
+			if (Position + length > EndOffset)
+				throw new TlsException (AlertDescription.DecodeError, "Buffer overflow");
+			var retval = new TlsBuffer (Buffer, Position, length);
+			Position += length;
+			return retval;
+		}
+
+		public IBufferOffsetSize GetRemaining ()
+		{
+			return new BufferOffsetSize (Buffer, Position, Remaining);
+		}
+
+		protected virtual void MakeRoomInternal (int size)
+		{
+			if (Position + size > EndOffset)
+				throw new TlsException (AlertDescription.DecodeError, "Buffer overflow");
+		}
+
+		public void Write (byte value)
+		{
+			MakeRoomInternal (1);
+			Buffer [Position++] = value;
+		}
+
+		public void Write (short value)
+		{
+			MakeRoomInternal (2);
+			WriteInt16 (Buffer, Position, value);
+			Position += 2;
+		}
+
+		public static void WriteInt16 (byte[] buffer, int offset, short value)
+		{
+			buffer[offset] = ((byte)(value >> 8));
+			buffer[offset+1] = ((byte)value);
+		}
+
+		public void Write (int value)
+		{
+			MakeRoomInternal (4);
+			WriteInt32 (Buffer, Position, value);
+			Position += 4;
+		}
+
+		public void WriteInt24 (int value)
+		{
+			MakeRoomInternal (3);
+			WriteInt24 (Buffer, Position, value);
+			Position += 3;
+		}
+
+		#pragma warning disable 3001
+		public void Write (ulong value)
+		#pragma warning restore 3001
+		{
+			MakeRoomInternal (8);
+			WriteInt64 (Buffer, Position, value);
+			Position += 8;
+		}
+
+		public static void WriteInt24 (byte[] buffer, int offset, int value)
+		{
+			buffer[offset] = ((byte)(value >> 16));
+			buffer[offset+1] = ((byte)(value >> 8));
+			buffer[offset+2] = ((byte)value);
+		}
+
+		public static void WriteInt32 (byte[] buffer, int offset, int value)
+		{
+			buffer[offset] = ((byte)(value >> 24));
+			buffer[offset+1] = ((byte)(value >> 16));
+			buffer[offset+2] = ((byte)(value >> 8));
+			buffer[offset+3] = ((byte)value);
+		}
+
+		#pragma warning disable 3001
+		public static void WriteInt64 (byte[] buffer, int offset, ulong value)
+		#pragma warning restore 3001
+		{
+			buffer[offset] = (byte) (value >> 56);
+			buffer[offset+1] = (byte) (value >> 48);
+			buffer[offset+2] = (byte) (value >> 40);
+			buffer[offset+3] = (byte) (value >> 32);
+			buffer[offset+4] = (byte) (value >> 24);
+			buffer[offset+5] = (byte) (value >> 16);
+			buffer[offset+6] = (byte) (value >> 8);
+			buffer[offset+7] = (byte) value;
+		}
+
+		public void Write (byte[] buffer)
+		{
+			Write (buffer, 0, buffer.Length);
+		}
+
+		public void Write (byte[] buffer, int offset, int size)
+		{
+			MakeRoomInternal (size);
+			Array.Copy (buffer, offset, Buffer, Position, size);
+			Position += size;
+		}
+
+		public void Write (IBufferOffsetSize buffer)
+		{
+			Write (buffer.Buffer, buffer.Offset, buffer.Size);
+		}
+
+		public SecureBuffer ReadSecureBuffer (int count)
+		{
+			return new SecureBuffer (ReadBytes (count));
+		}
+
+		public byte[] ReadBytes (int count)
+		{
+			if (Position + count > EndOffset)
+				throw new TlsException (AlertDescription.DecodeError, "Buffer overflow");
+			var retval = new byte [count];
+			Array.Copy (Buffer, Position, retval, 0, count);
+			Position += count;
+			return retval;
+		}
+
+		internal static bool Compare (SecureBuffer buffer1, SecureBuffer buffer2)
+		{
+			if (buffer1 == null || buffer2 == null)
+				return false;
+
+			if (buffer1.Size != buffer2.Size)
+				return false;
+
+			for (int i = 0; i < buffer1.Size; i++) {
+				if (buffer1.Buffer [i] != buffer2.Buffer [i])
+					return false;
+			}
+			return true;
+		}
+
+		public static bool Compare (IBufferOffsetSize buffer1, IBufferOffsetSize buffer2)
+		{
+			if (buffer1 == null || buffer2 == null)
+				return false;
+
+			if (buffer1.Size != buffer2.Size)
+				return false;
+
+			for (int i = 0; i < buffer1.Size; i++) {
+				if (buffer1.Buffer [buffer1.Offset + i] != buffer2.Buffer [buffer2.Offset + i])
+					return false;
+			}
+			return true;
+		}
+
+		public static bool Compare (byte[] buffer1, byte[] buffer2)
+		{
+			if (buffer1 == null || buffer2 == null)
+				return false;
+
+			return Compare (buffer1, 0, buffer1.Length, buffer2, 0, buffer2.Length);
+		}
+
+		public static bool Compare (byte[] buffer1, int offset1, int size1, byte[] buffer2, int offset2, int size2)
+		{
+			if (buffer1 == null || buffer2 == null)
+				return false;
+
+			if (size1 != size2)
+				return false;
+
+			for (int i = 0; i < size1; i++) {
+				if (buffer1 [offset1 + i] != buffer2 [offset2 + i])
+					return false;
+			}
+			return true;
+
+		}
+
+		public static int ConstantTimeCompare (byte[] buffer1, int offset1, int size1, byte[] buffer2, int offset2, int size2)
+		{
+			int status = 0;
+			int effectiveSize;
+			if (size1 < size2) {
+				status--;
+				effectiveSize = size1;
+			} else if (size2 < size1) {
+				status--;
+				effectiveSize = size2;
+			} else {
+				effectiveSize = size1;
+			}
+
+			for (int i = 0; i < effectiveSize; i++) {
+				if (buffer1 [offset1 + i] != buffer2 [offset2 + i])
+					status--;
+			}
+
+			return status;
+		}
+
+		protected void SetBuffer (byte[] buffer, int offset, int size)
+		{
+			innerBuffer = new BufferOffsetSize (buffer, offset, size);
+		}
+
+		protected override void Clear ()
+		{
+			var disposable = innerBuffer as IDisposable;
+			if (disposable != null)
+				disposable.Dispose ();
+			innerBuffer = null;
+			Position = 0;
+		}
+
+		public static readonly byte[] EmptyArray = new byte [0];
+	}
+}
+
diff --git a/mcs/class/Mono.Security/Mono.Security.Interface/TlsMultiBuffer.cs b/mcs/class/Mono.Security/Mono.Security.Interface/TlsMultiBuffer.cs
new file mode 100644
index 00000000000..de2975a81db
--- /dev/null
+++ b/mcs/class/Mono.Security/Mono.Security.Interface/TlsMultiBuffer.cs
@@ -0,0 +1,119 @@
+//
+// TlsMultiBuffer.cs
+//
+// Author:
+//       Martin Baulig <martin.baulig@xamarin.com>
+//
+// Copyright (c) 2014-2016 Xamarin Inc. (http://www.xamarin.com)
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+using System;
+
+namespace Mono.Security.Interface
+{
+	public class TlsMultiBuffer
+	{
+		MemoryChunk first, last;
+
+		private class MemoryChunk : BufferOffsetSize
+		{
+			public MemoryChunk next;
+
+			public MemoryChunk (byte[] buffer, int offset, int size)
+				: base (buffer, offset, size)
+			{
+			}
+		}
+
+		public bool IsEmpty {
+			get { return first == null; }
+		}
+
+		public bool IsSingle {
+			get { return first != null && first.next == null; }
+		}
+
+		public void Add (TlsBuffer buffer)
+		{
+			Add (buffer.Buffer, buffer.Offset, buffer.Size);
+		}
+
+		public void Add (byte[] buffer)
+		{
+			Add (buffer, 0, buffer.Length);
+		}
+
+		public void Add (byte[] buffer, int offset, int size)
+		{
+			var chunk = new MemoryChunk (buffer, offset, size);
+			if (last == null)
+				first = last = chunk;
+			else {
+				last.next = chunk;
+				last = chunk;
+			}
+		}
+
+		public BufferOffsetSize[] GetBufferArray ()
+		{
+			int count = 0;
+			for (var ptr = first; ptr != null; ptr = ptr.next)
+				count++;
+			var array = new BufferOffsetSize [count];
+			count = 0;
+			for (var ptr = first; ptr != null; ptr = ptr.next)
+				array [count++] = ptr;
+			return array;
+		}
+
+		public void Clear ()
+		{
+			for (var ptr = first; ptr != null; ptr = ptr.next)
+				ptr.Dispose ();
+			first = last = null;
+		}
+
+		public BufferOffsetSize GetBuffer ()
+		{
+			int totalSize = 0;
+			for (var ptr = first; ptr != null; ptr = ptr.next)
+				totalSize += ptr.Size;
+
+			var outBuffer = new BufferOffsetSize (new byte [totalSize]);
+			int offset = 0;
+			for (var ptr = first; ptr != null; ptr = ptr.next) {
+				Buffer.BlockCopy (ptr.Buffer, ptr.Offset, outBuffer.Buffer, offset, ptr.Size);
+				offset += ptr.Size;
+			}
+			return outBuffer;
+		}
+
+		public BufferOffsetSize StealBuffer ()
+		{
+			if (IsSingle) {
+				var retval = first;
+				first = last = null;
+				return retval;
+			}
+
+			return GetBuffer ();
+		}
+	}
+}
+
diff --git a/mcs/class/Mono.Security/Mono.Security.dll.sources b/mcs/class/Mono.Security/Mono.Security.dll.sources
index 7d6e4aaca19..7330f81b7be 100644
--- a/mcs/class/Mono.Security/Mono.Security.dll.sources
+++ b/mcs/class/Mono.Security/Mono.Security.dll.sources
@@ -152,3 +152,9 @@
 ./Mono.Security.Interface/TlsException.cs
 ./Mono.Security.Interface/TlsProtocolCode.cs
 ./Mono.Security.Interface/TlsProtocols.cs
+
+./Mono.Security.Interface/BufferOffsetSize.cs
+./Mono.Security.Interface/SecretParameters.cs
+./Mono.Security.Interface/SecureBuffer.cs
+./Mono.Security.Interface/TlsBuffer.cs
+./Mono.Security.Interface/TlsMultiBuffer.cs
\ No newline at end of file
diff --git a/mcs/class/Mono.Security/mobile_Mono.Security.dll.sources b/mcs/class/Mono.Security/mobile_Mono.Security.dll.sources
index dba5c340209..05cc4faad16 100644
--- a/mcs/class/Mono.Security/mobile_Mono.Security.dll.sources
+++ b/mcs/class/Mono.Security/mobile_Mono.Security.dll.sources
@@ -130,3 +130,9 @@
 ./Mono.Security.Protocol.Tls.Handshake.Server/TlsServerKeyExchange.cs
 ./Mono.Xml/MiniParser.cs
 ./Mono.Xml/SecurityParser.cs
+
+./Mono.Security.Interface/BufferOffsetSize.cs
+./Mono.Security.Interface/SecretParameters.cs
+./Mono.Security.Interface/SecureBuffer.cs
+./Mono.Security.Interface/TlsBuffer.cs
+./Mono.Security.Interface/TlsMultiBuffer.cs
diff --git a/mcs/class/System/Assembly/AssemblyInfo.cs b/mcs/class/System/Assembly/AssemblyInfo.cs
index 4f0d50bf065..a7651da891f 100644
--- a/mcs/class/System/Assembly/AssemblyInfo.cs
+++ b/mcs/class/System/Assembly/AssemblyInfo.cs
@@ -80,4 +80,6 @@ using System.Runtime.InteropServices;
 
 	[assembly: InternalsVisibleTo ("Mono.Security.Providers.NewSystemSource, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
 	[assembly: InternalsVisibleTo ("Mono.Security.Providers.OldTls, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
+	[assembly: InternalsVisibleTo ("Mono.Security.Providers.NewTls, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
+	[assembly: InternalsVisibleTo ("Mono.Security.Providers.DotNet, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
 	[assembly: InternalsVisibleTo ("Mono.Security, PublicKey=002400000480000094000000060200000024000052534131000400000100010079159977d2d03a8e6bea7a2e74e8d1afcc93e8851974952bb480a12c9134474d04062447c37e0e68c080536fcf3c3fbe2ff9c979ce998475e506e8ce82dd5b0f350dc10e93bf2eeecf874b24770c5081dbea7447fddafa277b22de47d6ffea449674a4f9fccf84d15069089380284dbdd35f46cdff12a1bd78e4ef0065d016df")]
diff --git a/mcs/class/System/Mono.Net.Security/MonoDefaultTlsProvider.cs b/mcs/class/System/Mono.Net.Security/MonoDefaultTlsProvider.cs
index c39b2144781..d6f6e5296f4 100644
--- a/mcs/class/System/Mono.Net.Security/MonoDefaultTlsProvider.cs
+++ b/mcs/class/System/Mono.Net.Security/MonoDefaultTlsProvider.cs
@@ -86,7 +86,7 @@ namespace Mono.Net.Security.Private
 			get { return false; }
 		}
 
-		public override bool SupportsTlsContext {
+		internal override bool SupportsTlsContext {
 			get { return false; }
 		}
 
diff --git a/mcs/class/System/Mono.Net.Security/MonoTlsProviderFactory.cs b/mcs/class/System/Mono.Net.Security/MonoTlsProviderFactory.cs
index 85023644aee..f2cf321677d 100644
--- a/mcs/class/System/Mono.Net.Security/MonoTlsProviderFactory.cs
+++ b/mcs/class/System/Mono.Net.Security/MonoTlsProviderFactory.cs
@@ -134,25 +134,35 @@ namespace Mono.Net.Security
 
 #if SECURITY_DEP && !MONO_FEATURE_NEW_SYSTEM_SOURCE
 
-#if !MOBILE
 		static Dictionary<string,string> providerRegistration;
 
-		internal static void RegisterProvider (string name, string type)
+		static Type LookupProviderType (string name, bool throwOnError)
 		{
 			lock (locker) {
 				InitializeProviderRegistration ();
-				providerRegistration.Add (name, type);
+				string typeName;
+				if (!providerRegistration.TryGetValue (name, out typeName)) {
+					if (throwOnError)
+						throw new NotSupportedException (string.Format ("No such TLS Provider: `{0}'.", name));
+					return null;
+				}
+				var type = Type.GetType (typeName, false);
+				if (type == null && throwOnError)
+					throw new NotSupportedException (string.Format ("Could not find TLS Provider: `{0}'.", typeName));
+				return type;
 			}
 		}
 
-		static string LookupProvider (string name)
+		static MSI.MonoTlsProvider LookupProvider (string name, bool throwOnError)
 		{
-			lock (locker) {
-				InitializeProviderRegistration ();
-				string type;
-				if (!providerRegistration.TryGetValue (name, out type))
-					type = null;
-				return type;
+			var type = LookupProviderType (name, throwOnError);
+			if (type == null)
+				return null;
+
+			try {
+				return (MSI.MonoTlsProvider)Activator.CreateInstance (type);
+			} catch (Exception ex) {
+				throw new NotSupportedException (string.Format ("Unable to instantiate TLS Provider `{0}'.", type), ex);
 			}
 		}
 
@@ -162,11 +172,12 @@ namespace Mono.Net.Security
 				if (providerRegistration != null)
 					return;
 				providerRegistration = new Dictionary<string,string> ();
-				providerRegistration.Add ("newtls", "Mono.Security.Providers.NewTls.NewTlsProvider, Mono.Security.Providers.NewTls, Version=4.0.0.0, Culture=neutral, PublicKeyToken=84e3aee7225169c2");
-				providerRegistration.Add ("oldtls", "Mono.Security.Providers.OldTls.OldTlsProvider, Mono.Security.Providers.OldTls, Version=4.0.0.0, Culture=neutral, PublicKeyToken=84e3aee7225169c2");
+				providerRegistration.Add ("newtls", "Mono.Security.Providers.NewTls.NewTlsProvider, Mono.Security.Providers.NewTls, Version=4.0.0.0, Culture=neutral, PublicKeyToken=0738eb9f132ed756");
+				providerRegistration.Add ("oldtls", "Mono.Security.Providers.OldTls.OldTlsProvider, Mono.Security.Providers.OldTls, Version=4.0.0.0, Culture=neutral, PublicKeyToken=0738eb9f132ed756");
 			}
 		}
 
+#if !MOBILE
 		static IMonoTlsProvider TryDynamicLoad ()
 		{
 			var variable = Environment.GetEnvironmentVariable ("MONO_TLS_PROVIDER");
@@ -176,25 +187,7 @@ namespace Mono.Net.Security
 			if (string.Equals (variable, "default", StringComparison.OrdinalIgnoreCase))
 				return null;
 
-			string typeName;
-			if (variable.IndexOfAny (new char[] { ',', '.', '=' }) > 0) {
-				typeName = variable;
-			} else {
-				typeName = LookupProvider (variable);
-				if (typeName == null)
-					throw new NotSupportedException (string.Format ("No such TLS Provider: `{0}'.", typeName));
-			}
-
-			var type = Type.GetType (typeName, false);
-			if (type == null)
-				throw new NotSupportedException (string.Format ("Could not find TLS Provider: `{0}'.", typeName));
-
-			MSI.MonoTlsProvider provider;
-			try {
-				provider = (MSI.MonoTlsProvider)Activator.CreateInstance (type);
-			} catch (Exception ex) {
-				throw new NotSupportedException (string.Format ("Unable to instantiate TLS Provider `{0}'.", typeName), ex);
-			}
+			var provider = LookupProvider (variable, true);
 
 			return new Private.MonoTlsProviderWrapper (provider);
 		}
@@ -245,9 +238,10 @@ namespace Mono.Net.Security
 			}
 		}
 
-		internal static void InstallProvider (MSI.MonoTlsProvider provider)
+		internal static void SetDefaultProvider (string name)
 		{
 			lock (locker) {
+				var provider = LookupProvider (name, true);
 				currentProvider = new Private.MonoTlsProviderWrapper (provider);
 			}
 		}
diff --git a/mcs/class/System/Mono.Net.Security/MonoTlsProviderImpl.cs b/mcs/class/System/Mono.Net.Security/MonoTlsProviderImpl.cs
index 4216e5809f3..b0ae5d82c72 100644
--- a/mcs/class/System/Mono.Net.Security/MonoTlsProviderImpl.cs
+++ b/mcs/class/System/Mono.Net.Security/MonoTlsProviderImpl.cs
@@ -100,7 +100,7 @@ namespace Mono.Net.Security.Private
 			bool remoteCertRequired, MSI.MonoEncryptionPolicy encryptionPolicy,
 			MSI.MonoTlsSettings settings);
 
-		public override MSI.IMonoTlsContext CreateTlsContext (
+		internal override MSI.IMonoTlsContext CreateTlsContext (
 			string hostname, bool serverMode, MSI.TlsProtocols protocolFlags,
 			X509Certificate serverCertificate, XX509CertificateCollection clientCertificates,
 			bool remoteCertRequired, MSI.MonoEncryptionPolicy encryptionPolicy,
diff --git a/mcs/class/System/Mono.Net.Security/NoReflectionHelper.cs b/mcs/class/System/Mono.Net.Security/NoReflectionHelper.cs
index f4ccac81cb0..a11fcec2c19 100644
--- a/mcs/class/System/Mono.Net.Security/NoReflectionHelper.cs
+++ b/mcs/class/System/Mono.Net.Security/NoReflectionHelper.cs
@@ -84,10 +84,10 @@ namespace Mono.Net.Security
 			}
 		}
 
-		internal static void InstallProvider (object provider)
+		internal static void SetDefaultProvider (string name)
 		{
 			#if SECURITY_DEP
-			MonoTlsProviderFactory.InstallProvider ((MSI.MonoTlsProvider)provider);
+			MonoTlsProviderFactory.SetDefaultProvider (name);
 			#else
 			throw new NotSupportedException ();
 			#endif
diff --git a/mcs/class/corlib/Assembly/AssemblyInfo.cs b/mcs/class/corlib/Assembly/AssemblyInfo.cs
index 818dc50039a..b3284ea7879 100644
--- a/mcs/class/corlib/Assembly/AssemblyInfo.cs
+++ b/mcs/class/corlib/Assembly/AssemblyInfo.cs
@@ -99,4 +99,3 @@ using System.Runtime.InteropServices;
 #endif
 
 [assembly: Guid ("BED7F4EA-1A96-11D2-8F08-00A0C9A6186D")]
-