diff --git a/runtimes/google/ipc/stream/benchmark/throughput_tls.go b/runtimes/google/ipc/stream/benchmark/throughput_tls.go
index 2bf35d0..40e6b8d 100644
--- a/runtimes/google/ipc/stream/benchmark/throughput_tls.go
+++ b/runtimes/google/ipc/stream/benchmark/throughput_tls.go
@@ -1,12 +1,17 @@
+// +build !go1.4
+
+// TODO(ashankar): Remove the build tag and replace the tls import with crypto/tls
+// when go1.4 is released.
+
 package benchmark
 
 import (
-	"crypto/tls"
 	"io"
 	"net"
 	"testing"
 
 	"veyron/runtimes/google/ipc/stream/crypto"
+	tls "veyron/runtimes/google/ipc/stream/crypto/tlsfork"
 )
 
 func benchmarkTLS(b *testing.B, nConns int) {
diff --git a/runtimes/google/ipc/stream/crypto/tls.go b/runtimes/google/ipc/stream/crypto/tls.go
index 8c62afe..d07c52c 100644
--- a/runtimes/google/ipc/stream/crypto/tls.go
+++ b/runtimes/google/ipc/stream/crypto/tls.go
@@ -1,3 +1,5 @@
+// +build go1.4
+
 package crypto
 
 import (
@@ -20,14 +22,21 @@
 
 func (TLSClientSessionCache) IPCStreamVCOpt() {}
 
+// NewTLSClientSessionCache creates a new session cache.
+// TODO(ashankar): Remove this once go1.4 is released and tlsfork can be release, at that
+// point use crypto/tls.NewLRUClientSessionCache directly.
+func NewTLSClientSessionCache() TLSClientSessionCache {
+	return TLSClientSessionCache{tls.NewLRUClientSessionCache(-1)}
+}
+
 // NewTLSClient returns a Crypter implementation that uses TLS, assuming
 // handshaker was initiated by a client.
-func NewTLSClient(handshaker net.Conn, sessionCache tls.ClientSessionCache, pool *iobuf.Pool) (Crypter, error) {
+func NewTLSClient(handshaker net.Conn, sessionCache TLSClientSessionCache, pool *iobuf.Pool) (Crypter, error) {
 	var config tls.Config
 	// TLS + resumption + channel bindings is broken: <https://secure-resumption.com/#channelbindings>.
 	config.SessionTicketsDisabled = true
 	config.InsecureSkipVerify = true
-	config.ClientSessionCache = sessionCache
+	config.ClientSessionCache = sessionCache.ClientSessionCache
 	return newTLSCrypter(handshaker, &config, pool, false)
 }
 
diff --git a/runtimes/google/ipc/stream/crypto/tls_old.go b/runtimes/google/ipc/stream/crypto/tls_old.go
index 0320c35..6399b36 100644
--- a/runtimes/google/ipc/stream/crypto/tls_old.go
+++ b/runtimes/google/ipc/stream/crypto/tls_old.go
@@ -5,6 +5,8 @@
 // Please do NOT make edits to this file. Instead edit tls.go and
 // use the script to regenerate this file
 
+// +build !go1.4
+
 package crypto
 
 import (
@@ -27,14 +29,21 @@
 
 func (TLSClientSessionCache) IPCStreamVCOpt() {}
 
+// NewTLSClientSessionCache creates a new session cache.
+// TODO(ashankar): Remove this once go1.4 is released and tlsfork can be release, at that
+// point use crypto/tls.NewLRUClientSessionCache directly.
+func NewTLSClientSessionCache() TLSClientSessionCache {
+	return TLSClientSessionCache{tls.NewLRUClientSessionCache(-1)}
+}
+
 // NewTLSClient returns a Crypter implementation that uses TLS, assuming
 // handshaker was initiated by a client.
-func NewTLSClient(handshaker net.Conn, sessionCache tls.ClientSessionCache, pool *iobuf.Pool) (Crypter, error) {
+func NewTLSClient(handshaker net.Conn, sessionCache TLSClientSessionCache, pool *iobuf.Pool) (Crypter, error) {
 	var config tls.Config
 	// TLS + resumption + channel bindings is broken: <https://secure-resumption.com/#channelbindings>.
 	config.SessionTicketsDisabled = true
 	config.InsecureSkipVerify = true
-	config.ClientSessionCache = sessionCache
+	config.ClientSessionCache = sessionCache.ClientSessionCache
 	return newTLSCrypter(handshaker, &config, pool, false)
 }
 
diff --git a/runtimes/google/ipc/stream/manager/manager.go b/runtimes/google/ipc/stream/manager/manager.go
index a7895b6..48824f3 100644
--- a/runtimes/google/ipc/stream/manager/manager.go
+++ b/runtimes/google/ipc/stream/manager/manager.go
@@ -2,7 +2,6 @@
 package manager
 
 import (
-	"crypto/tls"
 	"errors"
 	"fmt"
 	"net"
@@ -34,7 +33,7 @@
 	return &manager{
 		rid:          rid,
 		vifs:         vif.NewSet(),
-		sessionCache: crypto.TLSClientSessionCache{tls.NewLRUClientSessionCache(-1)},
+		sessionCache: crypto.NewTLSClientSessionCache(),
 		listeners:    make(map[listener]bool),
 	}
 }
diff --git a/runtimes/google/ipc/stream/vc/vc.go b/runtimes/google/ipc/stream/vc/vc.go
index 9bd195c..d4f3752 100644
--- a/runtimes/google/ipc/stream/vc/vc.go
+++ b/runtimes/google/ipc/stream/vc/vc.go
@@ -5,7 +5,6 @@
 // Verbosity level 2 is for per-Flow messages.
 
 import (
-	"crypto/tls"
 	"errors"
 	"fmt"
 	"sort"
@@ -373,7 +372,7 @@
 // local process (i.e., the local process "Dial"ed to create the VC).
 func (vc *VC) HandshakeDialedVC(opts ...stream.VCOpt) error {
 	var localID LocalID
-	var tlsSessionCache tls.ClientSessionCache
+	var tlsSessionCache crypto.TLSClientSessionCache
 	var securityLevel veyron2.VCSecurityLevel
 	for _, o := range opts {
 		switch v := o.(type) {
@@ -382,7 +381,7 @@
 		case veyron2.VCSecurityLevel:
 			securityLevel = v
 		case crypto.TLSClientSessionCache:
-			tlsSessionCache = (tls.ClientSessionCache)(v)
+			tlsSessionCache = v
 		}
 	}
 	switch securityLevel {