diff --git a/package/libs/polarssl/Makefile b/package/libs/polarssl/Makefile
index 2a8a33c07c0..4b4acdb7900 100644
--- a/package/libs/polarssl/Makefile
+++ b/package/libs/polarssl/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=polarssl
-PKG_VERSION:=1.2.6
+PKG_VERSION:=1.2.8
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz
 PKG_SOURCE_URL:=https://polarssl.org/code/releases
-PKG_MD5SUM:=e00d55ddda1e68a16af766dd92d69ce6
+PKG_MD5SUM:=985151639b1ca037293f06da44fbc6bc
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
diff --git a/package/libs/polarssl/patches/200-reduce_config.patch b/package/libs/polarssl/patches/200-reduce_config.patch
index c66bb3fb821..40bdedc5a79 100644
--- a/package/libs/polarssl/patches/200-reduce_config.patch
+++ b/package/libs/polarssl/patches/200-reduce_config.patch
@@ -1,6 +1,6 @@
 --- a/include/polarssl/config.h
 +++ b/include/polarssl/config.h
-@@ -177,8 +177,8 @@
+@@ -206,8 +206,8 @@
   * Requires: POLARSSL_BIGNUM_C, POLARSSL_RSA_C
   *
   * Enable the RSA prime-number generation code.
@@ -10,7 +10,7 @@
  
  /**
   * \def POLARSSL_FS_IO
-@@ -235,8 +235,8 @@
+@@ -264,8 +264,8 @@
   * \def POLARSSL_SELF_TEST
   *
   * Enable the checkup functions (*_self_test).
@@ -20,7 +20,7 @@
  
  /**
   * \def POLARSSL_SSL_ALL_ALERT_MESSAGES
-@@ -425,8 +425,8 @@
+@@ -466,8 +466,8 @@
   *      TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
   *      TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
   *      TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
@@ -30,7 +30,7 @@
  
  /**
   * \def POLARSSL_CERTS_C
-@@ -437,8 +437,8 @@
+@@ -478,8 +478,8 @@
   * Caller:
   *
   * This module is used for testing (ssl_client/server).
@@ -40,7 +40,7 @@
  
  /**
   * \def POLARSSL_CIPHER_C
-@@ -477,8 +477,8 @@
+@@ -518,8 +518,8 @@
   *          library/ssl_tls.c
   *
   * This module provides debugging functions.
@@ -50,7 +50,7 @@
  
  /**
   * \def POLARSSL_DES_C
-@@ -560,8 +560,8 @@
+@@ -604,8 +604,8 @@
   * enabled as well):
   *      TLS_RSA_WITH_AES_128_GCM_SHA256
   *      TLS_RSA_WITH_AES_256_GCM_SHA384
@@ -60,17 +60,7 @@
  
  /**
   * \def POLARSSL_HAVEGE_C
-@@ -574,8 +574,8 @@
-  * Requires: POLARSSL_TIMING_C
-  *
-  * This module enables the HAVEGE random number generator.
-- */
- #define POLARSSL_HAVEGE_C
-+ */
- 
- /**
-  * \def POLARSSL_MD_C
-@@ -649,8 +649,8 @@
+@@ -704,8 +704,8 @@
   * Caller:  library/aes.c
   *
   * This modules adds support for the VIA PadLock on x86.
@@ -80,7 +70,7 @@
  
  /**
   * \def POLARSSL_PBKDF2_C
-@@ -763,8 +763,8 @@
+@@ -848,8 +848,8 @@
   * Caller:
   *
   * Requires: POLARSSL_SSL_CACHE_C
@@ -90,7 +80,7 @@
  
  /**
   * \def POLARSSL_SSL_CLI_C
-@@ -818,8 +818,8 @@
+@@ -903,8 +903,8 @@
   * Caller:  library/havege.c
   *
   * This module is used by the HAVEGE random number generator.
@@ -100,7 +90,7 @@
  
  /**
   * \def POLARSSL_VERSION_C
-@@ -868,8 +868,8 @@
+@@ -953,8 +953,8 @@
   *
   * Module:  library/xtea.c
   * Caller:
@@ -109,4 +99,4 @@
 + */
  /* \} name */
  
- #endif /* config.h */
+ /**
diff --git a/package/libs/polarssl/patches/300-openssl_cipher_name_compat.patch b/package/libs/polarssl/patches/300-openssl_cipher_name_compat.patch
index 6ca43c31288..027d6d8c6f7 100644
--- a/package/libs/polarssl/patches/300-openssl_cipher_name_compat.patch
+++ b/package/libs/polarssl/patches/300-openssl_cipher_name_compat.patch
@@ -27,7 +27,7 @@
 @@ -643,7 +643,7 @@ const cipher_info_t blowfish_cbc_info = 
      POLARSSL_CIPHER_BLOWFISH_CBC,
      POLARSSL_MODE_CBC,
-     32,
+     128,
 -    "BLOWFISH-CBC",
 +    "BF-CBC",
      8,
@@ -36,7 +36,7 @@
 @@ -654,7 +654,7 @@ const cipher_info_t blowfish_cfb64_info 
      POLARSSL_CIPHER_BLOWFISH_CFB64,
      POLARSSL_MODE_CFB,
-     32,
+     128,
 -    "BLOWFISH-CFB64",
 +    "BF-CFB64",
      8,
@@ -45,7 +45,7 @@
 @@ -666,7 +666,7 @@ const cipher_info_t blowfish_ctr_info = 
      POLARSSL_CIPHER_BLOWFISH_CTR,
      POLARSSL_MODE_CTR,
-     32,
+     128,
 -    "BLOWFISH-CTR",
 +    "BF-CTR",
      8,
diff --git a/package/libs/polarssl/patches/310-fix_blowfish_key_len.patch b/package/libs/polarssl/patches/310-fix_blowfish_key_len.patch
deleted file mode 100644
index 0b4878e1929..00000000000
--- a/package/libs/polarssl/patches/310-fix_blowfish_key_len.patch
+++ /dev/null
@@ -1,29 +0,0 @@
---- a/library/cipher_wrap.c
-+++ b/library/cipher_wrap.c
-@@ -642,7 +642,7 @@ const cipher_base_t blowfish_info = {
- const cipher_info_t blowfish_cbc_info = {
-     POLARSSL_CIPHER_BLOWFISH_CBC,
-     POLARSSL_MODE_CBC,
--    32,
-+    128,
-     "BF-CBC",
-     8,
-     8,
-@@ -653,7 +653,7 @@ const cipher_info_t blowfish_cbc_info = 
- const cipher_info_t blowfish_cfb64_info = {
-     POLARSSL_CIPHER_BLOWFISH_CFB64,
-     POLARSSL_MODE_CFB,
--    32,
-+    128,
-     "BF-CFB64",
-     8,
-     8,
-@@ -665,7 +665,7 @@ const cipher_info_t blowfish_cfb64_info 
- const cipher_info_t blowfish_ctr_info = {
-     POLARSSL_CIPHER_BLOWFISH_CTR,
-     POLARSSL_MODE_CTR,
--    32,
-+    128,
-     "BF-CTR",
-     8,
-     8,