diff --git a/Network/TLS/Handshake/Server.hs b/Network/TLS/Handshake/Server.hs
--- a/Network/TLS/Handshake/Server.hs
+++ b/Network/TLS/Handshake/Server.hs
@@ -93,9 +93,9 @@
         when (null commonCompressions) $
                 throwCore $ Error_Protocol ("no compression in common with the client", True, HandshakeFailure)
         usingState_ ctx $ modify (\st -> st
-                { stVersion     = ver
-                , stCipher      = Just usedCipher
-                , stCompression = usedCompression
+                { stVersion       = ver
+                , stPendingCipher = Just usedCipher
+                , stCompression   = usedCompression
                 })
 
         resumeSessionData <- case clientSession of
diff --git a/Network/TLS/Receiving.hs b/Network/TLS/Receiving.hs
--- a/Network/TLS/Receiving.hs
+++ b/Network/TLS/Receiving.hs
@@ -45,7 +45,7 @@
 
 processPacket (Record ProtocolType_Handshake ver fragment) = do
         keyxchg <- getCipherKeyExchangeType
-        npn <- getExtensionNPN
+        npn     <- getExtensionNPN
         let currentparams = CurrentParams
                 { cParamsVersion     = ver
                 , cParamsKeyXchgType = maybe CipherKeyExchange_RSA id $ keyxchg
diff --git a/Network/TLS/Record/Disengage.hs b/Network/TLS/Record/Disengage.hs
--- a/Network/TLS/Record/Disengage.hs
+++ b/Network/TLS/Record/Disengage.hs
@@ -66,7 +66,7 @@
 decryptData econtent = do
         st <- get
 
-        let cipher     = fromJust "cipher" $ stCipher st
+        let cipher     = fromJust "cipher" $ stActiveRxCipher st
         let bulk       = cipherBulk cipher
         let cst        = fromJust "rx crypt state" $ stActiveRxCryptState st
         let digestSize = hashSize $ cipherHash cipher
diff --git a/Network/TLS/Record/Engage.hs b/Network/TLS/Record/Engage.hs
--- a/Network/TLS/Record/Engage.hs
+++ b/Network/TLS/Record/Engage.hs
@@ -51,7 +51,7 @@
 encryptData content = do
         st <- get
 
-        let cipher = fromJust "cipher" $ stCipher st
+        let cipher = fromJust "cipher" $ stActiveTxCipher st
         let bulk = cipherBulk cipher
         let cst = fromJust "tx crypt state" $ stActiveTxCryptState st
 
diff --git a/Network/TLS/State.hs b/Network/TLS/State.hs
--- a/Network/TLS/State.hs
+++ b/Network/TLS/State.hs
@@ -148,7 +148,9 @@
         , stActiveRxMacState    :: !(Maybe TLSMacState)
         , stPendingTxMacState   :: !(Maybe TLSMacState)
         , stPendingRxMacState   :: !(Maybe TLSMacState)
-        , stCipher              :: Maybe Cipher
+        , stActiveTxCipher      :: Maybe Cipher
+        , stActiveRxCipher      :: Maybe Cipher
+        , stPendingCipher       :: Maybe Cipher
         , stCompression         :: Compression
         , stRandomGen           :: StateRNG
         , stSecureRenegotiation :: Bool  -- RFC 5746
@@ -193,7 +195,9 @@
         , stActiveRxMacState    = Nothing
         , stPendingTxMacState   = Nothing
         , stPendingRxMacState   = Nothing
-        , stCipher              = Nothing
+        , stActiveTxCipher      = Nothing
+        , stActiveRxCipher      = Nothing
+        , stPendingCipher       = Nothing
         , stCompression         = nullCompression
         , stRandomGen           = StateRNG rng
         , stSecureRenegotiation = False
@@ -230,7 +234,7 @@
         let ver = stVersion st
         let cst = fromJust "crypt state" $ if w then stActiveTxCryptState st else stActiveRxCryptState st
         let ms = fromJust "mac state" $ if w then stActiveTxMacState st else stActiveRxMacState st
-        let cipher = fromJust "cipher" $ stCipher st
+        let cipher = fromJust "cipher" $ if w then stActiveTxCipher st else stActiveRxCipher st
         let hashf = hashF $ cipherHash cipher
 
         let (macF, msg) =
@@ -284,12 +288,14 @@
 certVerifyHandshakeMaterial = certVerifyHandshakeTypeMaterial . typeOfHandshake
 
 switchTxEncryption, switchRxEncryption :: MonadState TLSState m => m ()
-switchTxEncryption = modify (\st -> st { stTxEncrypted = True,
-                                         stActiveTxMacState = stPendingTxMacState st,
-                                         stActiveTxCryptState = stPendingTxCryptState st })
-switchRxEncryption = modify (\st -> st { stRxEncrypted = True,
-                                         stActiveRxMacState = stPendingRxMacState st,
-                                         stActiveRxCryptState = stPendingRxCryptState st })
+switchTxEncryption = modify (\st -> st { stTxEncrypted = True
+                                       , stActiveTxMacState = stPendingTxMacState st
+                                       , stActiveTxCryptState = stPendingTxCryptState st
+                                       , stActiveTxCipher = stPendingCipher st })
+switchRxEncryption = modify (\st -> st { stRxEncrypted = True
+                                       , stActiveRxMacState = stPendingRxMacState st
+                                       , stActiveRxCryptState = stPendingRxCryptState st
+                                       , stActiveRxCipher = stPendingCipher st })
 
 setServerRandom :: MonadState TLSState m => ServerRandom -> m ()
 setServerRandom ran = updateHandshake "srand" (\hst -> hst { hstServerRandom = Just ran })
@@ -359,7 +365,7 @@
         where wrapSessionData st masterSecret = do
                 return $ SessionData
                         { sessionVersion = stVersion st
-                        , sessionCipher  = cipherID $ fromJust "cipher" $ stCipher st
+                        , sessionCipher  = cipherID $ fromJust "cipher" $ stActiveTxCipher st
                         , sessionSecret  = masterSecret
                         }
 
@@ -375,7 +381,7 @@
 needEmptyPacket :: MonadState TLSState m => m Bool
 needEmptyPacket = gets f
     where f st = (stVersion st <= TLS10)
-              && (maybe False (\c -> bulkBlockSize (cipherBulk c) > 0) (stCipher st))
+              && (maybe False (\c -> bulkBlockSize (cipherBulk c) > 0) (stActiveTxCipher st))
 
 setKeyBlock :: MonadState TLSState m => m ()
 setKeyBlock = modify setPendingState where
@@ -386,7 +392,7 @@
                             }
         where hst          = fromJust "handshake" $ stHandshake st
               cc           = stClientContext st
-              cipher       = fromJust "cipher" $ stCipher st
+              cipher       = fromJust "cipher" $ stPendingCipher st
               keyblockSize = cipherKeyBlockSize cipher
 
               bulk         = cipherBulk cipher
@@ -410,7 +416,7 @@
               msServer = TLSMacState { msSequence = 0 }
 
 setCipher :: MonadState TLSState m => Cipher -> m ()
-setCipher cipher = modify (\st -> st { stCipher = Just cipher })
+setCipher cipher = modify (\st -> st { stPendingCipher = Just cipher })
 
 setVersion :: MonadState TLSState m => Version -> m ()
 setVersion ver = modify (\st -> st { stVersion = ver })
@@ -446,7 +452,7 @@
 getClientCertificateChain = gets stClientCertificateChain
 
 getCipherKeyExchangeType :: MonadState TLSState m => m (Maybe CipherKeyExchangeType)
-getCipherKeyExchangeType = gets (\st -> cipherKeyExchange <$> stCipher st)
+getCipherKeyExchangeType = gets (\st -> cipherKeyExchange <$> stPendingCipher st)
 
 getVerifiedData :: MonadState TLSState m => Bool -> m Bytes
 getVerifiedData client = gets (if client then stClientVerifiedData else stServerVerifiedData)
diff --git a/tls.cabal b/tls.cabal
--- a/tls.cabal
+++ b/tls.cabal
@@ -1,5 +1,5 @@
 Name:                tls
-Version:             1.0.1
+Version:             1.0.2
 Description:
    Native Haskell TLS and SSL protocol implementation for server and client.
    .