diff --git a/.travis.yml b/.travis.yml
index cdb79d1..3d86681 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -89,16 +89,14 @@
           packages:
           - gcc
       script:
-        # Do a manual build+test sequence rather than using all.sh, because
-        # there's no all.sh component that does what we want. We should set
-        # CFLAGS for arm64 host CC.
+        # Do a manual build+test sequence rather than using all.sh.
+        #
+        # On Arm64 host of Travis CI, the time of `test_full_cmake_*` exceeds
+        # limitation of Travis CI. Base on `test_full_cmake_*`, we removed
+        # `ssl-opt.sh` and GnuTLS compat.sh here to meet the time limitation.
         - scripts/config.py full
-        - scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
-        - scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY
-        - scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
-        - scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY
         - make generated_files
-        - make CFLAGS='-march=armv8-a+crypto -O3 -Werror -fsanitize=address,undefined -fno-sanitize-recover=all' LDFLAGS='-Werror -fsanitize=address,undefined -fno-sanitize-recover=all'
+        - make CFLAGS='-O3 -Werror -fsanitize=address,undefined -fno-sanitize-recover=all' LDFLAGS='-Werror -fsanitize=address,undefined -fno-sanitize-recover=all'
         - make test
         - programs/test/selftest
         - tests/scripts/test_psa_constant_names.py
@@ -117,16 +115,14 @@
           - clang
           - gnutls-bin
       script:
-        # Do a manual build+test sequence rather than using all.sh, because
-        # there's no all.sh component that does what we want. We should set
-        # CFLAGS for arm64 host CC.
+        # Do a manual build+test sequence rather than using all.sh.
+        #
+        # On Arm64 host of Travis CI, the time of `test_full_cmake_*` exceeds
+        # limitation of Travis CI. Base on `test_full_cmake_*`, we removed
+        # `ssl-opt.sh` and OpenSSl compat.sh here to meet the time limitation.
         - scripts/config.py full
-        - scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
-        - scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY
-        - scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
-        - scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY
         - make generated_files
-        - make CC=clang CFLAGS='-march=armv8-a+crypto -O3 -Werror -fsanitize=address,undefined -fno-sanitize-recover=all' LDFLAGS='-Werror -fsanitize=address,undefined -fno-sanitize-recover=all'
+        - make CC=clang CFLAGS='-O3 -Werror -fsanitize=address,undefined -fno-sanitize-recover=all' LDFLAGS='-Werror -fsanitize=address,undefined -fno-sanitize-recover=all'
         # GnuTLS supports CAMELLIA but compat.sh doesn't properly enable it.
         - tests/compat.sh -p GnuTLS -e 'CAMELLIA'
         - tests/scripts/travis-log-failure.sh
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 519604b..7bd9189 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -280,12 +280,23 @@
 # to define the test executables.
 #
 if(ENABLE_TESTING OR ENABLE_PROGRAMS)
-    file(GLOB MBEDTLS_TEST_FILES ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/*.c ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/drivers/*.c)
+    file(GLOB MBEDTLS_TEST_FILES
+         ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/*.c
+         ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/drivers/*.c)
     add_library(mbedtls_test OBJECT ${MBEDTLS_TEST_FILES})
     target_include_directories(mbedtls_test
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tests/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
         PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/library)
+
+    file(GLOB MBEDTLS_TEST_HELPER_FILES
+         ${CMAKE_CURRENT_SOURCE_DIR}/tests/src/test_helpers/*.c)
+    add_library(mbedtls_test_helpers OBJECT ${MBEDTLS_TEST_HELPER_FILES})
+    target_include_directories(mbedtls_test_helpers
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tests/include
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/library
+        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/3rdparty/everest/include)
 endif()
 
 if(ENABLE_PROGRAMS)
diff --git a/ChangeLog.d/add-cache-remove-api.txt b/ChangeLog.d/add-cache-remove-api.txt
new file mode 100644
index 0000000..950ff97
--- /dev/null
+++ b/ChangeLog.d/add-cache-remove-api.txt
@@ -0,0 +1,5 @@
+Features
+   * Add new API mbedtls_ssl_cache_remove for cache entry removal by
+     its session id.
+Security
+   * Zeroize SSL cache entries when they are freed.
diff --git a/ChangeLog.d/armv8-aes.txt b/ChangeLog.d/armv8-aes.txt
new file mode 100644
index 0000000..8a95d28
--- /dev/null
+++ b/ChangeLog.d/armv8-aes.txt
@@ -0,0 +1,5 @@
+Features
+   * Add support for the Armv8-A Cryptographic Extension in AES on
+     64-bit Arm. A new configuration option, MBEDTLS_AESCE_C, can
+     be used to enable this feature. Run-time detection is supported
+     under Linux only.
diff --git a/ChangeLog.d/changelog-6567-psa_key_derivation_abort-no-other_secret.txt b/ChangeLog.d/changelog-6567-psa_key_derivation_abort-no-other_secret.txt
new file mode 100644
index 0000000..8fcc18b
--- /dev/null
+++ b/ChangeLog.d/changelog-6567-psa_key_derivation_abort-no-other_secret.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Fix a compilation error when PSA Crypto is built with support for
+     TLS12_PRF but not TLS12_PSK_TO_MS. Reported by joerchan in #7125.
diff --git a/ChangeLog.d/ec_jpake_driver_dispatch.txt b/ChangeLog.d/ec_jpake_driver_dispatch.txt
new file mode 100644
index 0000000..3439296
--- /dev/null
+++ b/ChangeLog.d/ec_jpake_driver_dispatch.txt
@@ -0,0 +1,3 @@
+Features
+   * Add a driver dispatch layer for EC J-PAKE, enabling alternative
+     implementations of EC J-PAKE through the driver entry points.
diff --git a/ChangeLog.d/fix-jpake-user-peer.txt b/ChangeLog.d/fix-jpake-user-peer.txt
new file mode 100644
index 0000000..e027fc3
--- /dev/null
+++ b/ChangeLog.d/fix-jpake-user-peer.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * Allow setting user and peer identifiers for EC J-PAKE operation
+     instead of role in PAKE PSA Crypto API as described in the specification.
+     This is a partial fix that allows only "client" and "server" identifiers.
diff --git a/ChangeLog.d/fix-oid-to-string-bugs.txt b/ChangeLog.d/fix-oid-to-string-bugs.txt
index 799f444..3cf02c3 100644
--- a/ChangeLog.d/fix-oid-to-string-bugs.txt
+++ b/ChangeLog.d/fix-oid-to-string-bugs.txt
@@ -3,4 +3,8 @@
      mbedtls_oid_get_numeric_string(). OIDs such as 2.40.0.25 are now printed
      correctly.
    * Reject OIDs with overlong-encoded subidentifiers when converting
-     OID-to-string.
+     them to a string.
+   * Reject OIDs with subidentifier values exceeding UINT_MAX.  Such
+     subidentifiers can be valid, but Mbed TLS cannot currently handle them.
+   * Reject OIDs that have unterminated subidentifiers, or (equivalently)
+     have the most-significant bit set in their last byte.
diff --git a/ChangeLog.d/pkcs7-parser.txt b/ChangeLog.d/pkcs7-parser.txt
new file mode 100644
index 0000000..b60d187
--- /dev/null
+++ b/ChangeLog.d/pkcs7-parser.txt
@@ -0,0 +1,15 @@
+Features
+   * Added partial support for parsing the PKCS #7 Cryptographic Message
+     Syntax, as defined in RFC 2315. Currently, support is limited to the
+     following:
+     - Only the signed-data content type, version 1 is supported.
+     - Only DER encoding is supported.
+     - Only a single digest algorithm per message is supported.
+     - Certificates must be in X.509 format. A message must have either 0
+       or 1 certificates.
+     - There is no support for certificate revocation lists.
+     - The authenticated and unauthenticated attribute fields of SignerInfo
+       must be empty.
+     Many thanks to Daniel Axtens, Nayna Jain, and Nick Child from IBM for
+     contributing this feature, and to Demi-Marie Obenour for contributing
+     various improvements, tests and bug fixes.
diff --git a/ChangeLog.d/san_csr.txt b/ChangeLog.d/san_csr.txt
new file mode 100644
index 0000000..b5c6cf3
--- /dev/null
+++ b/ChangeLog.d/san_csr.txt
@@ -0,0 +1,2 @@
+Features
+   * Add support to include the SubjectAltName extension to a CSR.
diff --git a/docs/architecture/psa-migration/md-cipher-dispatch.md b/docs/architecture/psa-migration/md-cipher-dispatch.md
index eee59c4..355f561 100644
--- a/docs/architecture/psa-migration/md-cipher-dispatch.md
+++ b/docs/architecture/psa-migration/md-cipher-dispatch.md
@@ -312,13 +312,16 @@
 ```
 #if defined(MBEDTLS_MD_LIGHT)
 #if defined(MBEDTLS_SHA256_C) || \
-    ((defined(MBEDTLS_PSA_CRYPTO_C) || defined(MBEDTLS_PSA_CRYPTO_CLIENT)) && \
-     PSA_WANT_ALG_SHA_256)
+    (defined(MBEDTLS_PSA_CRYPTO_C) && PSA_WANT_ALG_SHA_256)
 #define MBEDTLS_MD_CAN_SHA256
 #endif
 #endif
 ```
 
+Note: in the future, we may want to replace `defined(MBEDTLS_PSA_CRYPTO_C)`
+with `defined(MBEDTLS_PSA_CRYTO_C) || defined(MBEDTLS_PSA_CRYPTO_CLIENT)` but
+for now this is out of scope.
+
 #### MD light internal support macros
 
 * If at least one hash has a PSA driver, define `MBEDTLS_MD_SOME_PSA`.
@@ -337,16 +340,11 @@
 } mbedtls_md_engine_t; // private type
 
 typedef struct mbedtls_md_context_t {
-    const mbedtls_md_type_t type;
-    const mbedtls_md_engine_t engine;
-    union {
-#if defined(MBEDTLS_MD_SOME_LEGACY)
-        void *legacy; // used if engine == LEGACY
-#endif
+    mbedtls_md_type_t type;
 #if defined(MBEDTLS_MD_SOME_PSA)
-        psa_hash_operation_t *psa; // used if engine == PSA
+    mbedtls_md_engine_t engine;
 #endif
-    } digest;
+    void *md_ctx; // mbedtls_xxx_context or psa_hash_operation
 #if defined(MBEDTLS_MD_C)
     void *hmac_ctx;
 #endif
diff --git a/docs/proposed/psa-driver-interface.md b/docs/proposed/psa-driver-interface.md
index f681ea6..0027ec7 100644
--- a/docs/proposed/psa-driver-interface.md
+++ b/docs/proposed/psa-driver-interface.md
@@ -374,6 +374,22 @@
     uint8_t** p_key_buffer, size_t *key_buffer_size,
     const psa_key_attributes_t *attributes);
 
+psa_status_t psa_crypto_driver_pake_get_user_len(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    size_t *user_len);
+
+psa_status_t psa_crypto_driver_pake_get_user(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    uint8_t *user_id, size_t user_id_size, size_t *user_id_len);
+
+psa_status_t psa_crypto_driver_pake_get_peer_len(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    size_t *peer_len);
+
+psa_status_t psa_crypto_driver_pake_get_peer(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length);
+
 psa_status_t psa_crypto_driver_pake_get_role(
     const psa_crypto_driver_pake_inputs_t *inputs,
     psa_pake_role_t *role);
diff --git a/include/mbedtls/asn1write.h b/include/mbedtls/asn1write.h
index acfc073..da73759 100644
--- a/include/mbedtls/asn1write.h
+++ b/include/mbedtls/asn1write.h
@@ -35,6 +35,15 @@
         (g) += ret;                                 \
     } while (0)
 
+#define MBEDTLS_ASN1_CHK_CLEANUP_ADD(g, f)                      \
+    do                                                  \
+    {                                                   \
+        if ((ret = (f)) < 0)                         \
+        goto cleanup;                              \
+        else                                            \
+        (g) += ret;                                 \
+    } while (0)
+
 #ifdef __cplusplus
 extern "C" {
 #endif
diff --git a/include/mbedtls/build_info.h b/include/mbedtls/build_info.h
index 4835beb..bfbf9de 100644
--- a/include/mbedtls/build_info.h
+++ b/include/mbedtls/build_info.h
@@ -87,6 +87,13 @@
 #define MBEDTLS_MD_LIGHT
 #endif
 
+/* Auto-enable MBEDTLS_MD_LIGHT if some module needs it.
+ */
+#if defined(MBEDTLS_PEM_PARSE_C) || \
+    defined(MBEDTLS_RSA_C)
+#define MBEDTLS_MD_LIGHT
+#endif
+
 /* If MBEDTLS_PSA_CRYPTO_C is defined, make sure MBEDTLS_PSA_CRYPTO_CLIENT
  * is defined as well to include all PSA code.
  */
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index ca60a9d..3e48cf9 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -70,9 +70,12 @@
 #error "MBEDTLS_AESNI_C defined, but not all prerequisites"
 #endif
 
+#if defined(__aarch64__) && defined(__GNUC__)
+/* We don't do anything with MBEDTLS_AESCE_C on systems without ^ these two */
 #if defined(MBEDTLS_AESCE_C) && !defined(MBEDTLS_HAVE_ASM)
 #error "MBEDTLS_AESCE_C defined, but not all prerequisites"
 #endif
+#endif
 
 #if defined(MBEDTLS_CTR_DRBG_C) && !defined(MBEDTLS_AES_C)
 #error "MBEDTLS_CTR_DRBG_C defined, but not all prerequisites"
@@ -1020,6 +1023,10 @@
 #error "MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH defined, but not all prerequisites"
 #endif
 
+#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) && ( !defined(MBEDTLS_SSL_PROTO_TLS1_3) )
+#error "MBEDTLS_SSL_RECORD_SIZE_LIMIT defined, but not all prerequisites"
+#endif
+
 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) && !( defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C) )
 #error "MBEDTLS_SSL_CONTEXT_SERIALIZATION defined, but not all prerequisites"
 #endif
diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h
index 7daba37..af9f9f8 100644
--- a/include/mbedtls/mbedtls_config.h
+++ b/include/mbedtls/mbedtls_config.h
@@ -1548,6 +1548,20 @@
 #define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
 
 /**
+ * \def MBEDTLS_SSL_RECORD_SIZE_LIMIT
+ *
+ * Enable support for RFC 8449 record_size_limit extension in SSL (TLS 1.3 only).
+ *
+ * \warning This extension is currently in development and must NOT be used except
+ *          for testing purposes.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_TLS1_3
+ *
+ * Uncomment this macro to enable support for the record_size_limit extension
+ */
+//#define MBEDTLS_SSL_RECORD_SIZE_LIMIT
+
+/**
  * \def MBEDTLS_SSL_PROTO_TLS1_2
  *
  * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
@@ -2025,35 +2039,25 @@
  *
  * Requires: MBEDTLS_HAVE_ASM
  *
- * This modules adds support for the AES-NI instructions on x86-64
+ * This module adds support for the AES-NI instructions on x86-64
  */
 #define MBEDTLS_AESNI_C
 
 /**
  * \def MBEDTLS_AESCE_C
  *
- * Enable AES crypto extension support on Arm64.
+ * Enable AES cryptographic extension support on 64-bit Arm.
  *
  * Module:  library/aesce.c
  * Caller:  library/aes.c
  *
  * Requires: MBEDTLS_HAVE_ASM, MBEDTLS_AES_C
  *
- * \note The code uses Neon intrinsics, so \c CFLAGS must be set to a minimum
- * of \c -march=armv8-a+crypto .
+ * \warning Runtime detection only works on Linux. For non-Linux operating
+ *          system, Armv8-A Cryptographic Extensions must be supported by
+ *          the CPU when this option is enabled.
  *
- * \warning If the target architecture is set to something that includes the
- *          SHA3 feature (e.g. `-march=armv8.2-a+sha3`), for example because
- *          `MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT` is desired, compilers
- *          generate code for `MBEDTLS_AESCE_C` that includes instructions
- *          only present with the (optional) SHA3 feature. This will lead to an
- *          undefined instruction exception if the code is run on a CPU without
- *          that feature.
- *
- * \warning Runtime detection only works on linux. For non-linux operation
- *          system, crypto extension MUST be supported by CPU.
- *
- * This module adds support for the AES crypto instructions on Arm64
+ * This module adds support for the AES Armv8-A Cryptographic Extensions on Aarch64 systems.
  */
 #define MBEDTLS_AESCE_C
 
@@ -2862,11 +2866,7 @@
 /**
  * \def MBEDTLS_PKCS7_C
  *
- * This feature is a work in progress and not ready for production. Testing and
- * validation is incomplete, and handling of malformed inputs may not be robust.
- * The API may change.
- *
- * Enable PKCS7 core for using PKCS7 formatted signatures.
+ * Enable PKCS #7 core for using PKCS #7-formatted signatures.
  * RFC Link - https://tools.ietf.org/html/rfc2315
  *
  * Module:  library/pkcs7.c
@@ -2875,9 +2875,9 @@
  *           MBEDTLS_X509_CRT_PARSE_C MBEDTLS_X509_CRL_PARSE_C,
  *           MBEDTLS_BIGNUM_C, MBEDTLS_MD_C
  *
- * This module is required for the PKCS7 parsing modules.
+ * This module is required for the PKCS #7 parsing modules.
  */
-//#define MBEDTLS_PKCS7_C
+#define MBEDTLS_PKCS7_C
 
 /**
  * \def MBEDTLS_PKCS12_C
diff --git a/include/mbedtls/md.h b/include/mbedtls/md.h
index 3341d1c..7bad24d 100644
--- a/include/mbedtls/md.h
+++ b/include/mbedtls/md.h
@@ -32,6 +32,93 @@
 #include "mbedtls/build_info.h"
 #include "mbedtls/platform_util.h"
 
+#if defined(MBEDTLS_MD_LIGHT)
+
+/*
+ * - MBEDTLS_MD_CAN_xxx is defined if the md module can perform xxx.
+ * - MBEDTLS_MD_xxx_VIA_PSA is defined if the md module may perform xxx via PSA
+ *   (see below).
+ * - MBEDTLS_MD_SOME_PSA is defined if at least one algorithm may be performed
+ *   via PSA (see below).
+ * - MBEDTLS_MD_SOME_LEGACY is defined if at least one algorithm may be performed
+ *   via a direct legacy call (see below).
+ *
+ * The md module performs an algorithm via PSA if there is a PSA hash
+ * accelerator and the PSA driver subsytem is initialized at the time the
+ * operation is started, and makes a direct legacy call otherwise.
+ */
+
+/* PSA accelerated implementations */
+#if defined(MBEDTLS_PSA_CRYPTO_C)
+#if defined(MBEDTLS_PSA_ACCEL_ALG_MD5)
+#define MBEDTLS_MD_CAN_MD5
+#define MBEDTLS_MD_MD5_VIA_PSA
+#define MBEDTLS_MD_SOME_PSA
+#endif
+#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1)
+#define MBEDTLS_MD_CAN_SHA1
+#define MBEDTLS_MD_SHA1_VIA_PSA
+#define MBEDTLS_MD_SOME_PSA
+#endif
+#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224)
+#define MBEDTLS_MD_CAN_SHA224
+#define MBEDTLS_MD_SHA224_VIA_PSA
+#define MBEDTLS_MD_SOME_PSA
+#endif
+#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256)
+#define MBEDTLS_MD_CAN_SHA256
+#define MBEDTLS_MD_SHA256_VIA_PSA
+#define MBEDTLS_MD_SOME_PSA
+#endif
+#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384)
+#define MBEDTLS_MD_CAN_SHA384
+#define MBEDTLS_MD_SHA384_VIA_PSA
+#define MBEDTLS_MD_SOME_PSA
+#endif
+#if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512)
+#define MBEDTLS_MD_CAN_SHA512
+#define MBEDTLS_MD_SHA512_VIA_PSA
+#define MBEDTLS_MD_SOME_PSA
+#endif
+#if defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160)
+#define MBEDTLS_MD_CAN_RIPEMD160
+#define MBEDTLS_MD_RIPEMD160_VIA_PSA
+#define MBEDTLS_MD_SOME_PSA
+#endif
+#endif /* MBEDTLS_PSA_CRYPTO_C */
+
+/* Built-in implementations */
+#if defined(MBEDTLS_MD5_C)
+#define MBEDTLS_MD_CAN_MD5
+#define MBEDTLS_MD_SOME_LEGACY
+#endif
+#if defined(MBEDTLS_SHA1_C)
+#define MBEDTLS_MD_CAN_SHA1
+#define MBEDTLS_MD_SOME_LEGACY
+#endif
+#if defined(MBEDTLS_SHA224_C)
+#define MBEDTLS_MD_CAN_SHA224
+#define MBEDTLS_MD_SOME_LEGACY
+#endif
+#if defined(MBEDTLS_SHA256_C)
+#define MBEDTLS_MD_CAN_SHA256
+#define MBEDTLS_MD_SOME_LEGACY
+#endif
+#if defined(MBEDTLS_SHA384_C)
+#define MBEDTLS_MD_CAN_SHA384
+#define MBEDTLS_MD_SOME_LEGACY
+#endif
+#if defined(MBEDTLS_SHA512_C)
+#define MBEDTLS_MD_CAN_SHA512
+#define MBEDTLS_MD_SOME_LEGACY
+#endif
+#if defined(MBEDTLS_RIPEMD160_C)
+#define MBEDTLS_MD_CAN_RIPEMD160
+#define MBEDTLS_MD_SOME_LEGACY
+#endif
+
+#endif /* MBEDTLS_MD_LIGHT */
+
 /** The selected feature is not available. */
 #define MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE                -0x5080
 /** Bad input parameters to function. */
@@ -64,19 +151,20 @@
     MBEDTLS_MD_RIPEMD160, /**< The RIPEMD-160 message digest. */
 } mbedtls_md_type_t;
 
-#if defined(MBEDTLS_SHA512_C)
+#if defined(MBEDTLS_MD_CAN_SHA512)
 #define MBEDTLS_MD_MAX_SIZE         64  /* longest known is SHA512 */
-#elif defined(MBEDTLS_SHA384_C)
+#elif defined(MBEDTLS_MD_CAN_SHA384)
 #define MBEDTLS_MD_MAX_SIZE         48  /* longest known is SHA384 */
-#elif defined(MBEDTLS_SHA256_C)
+#elif defined(MBEDTLS_MD_CAN_SHA256)
 #define MBEDTLS_MD_MAX_SIZE         32  /* longest known is SHA256 */
-#elif defined(MBEDTLS_SHA224_C)
+#elif defined(MBEDTLS_MD_CAN_SHA224)
 #define MBEDTLS_MD_MAX_SIZE         28  /* longest known is SHA224 */
 #else
-#define MBEDTLS_MD_MAX_SIZE         20  /* longest known is SHA1 or RIPE MD-160 */
+#define MBEDTLS_MD_MAX_SIZE         20  /* longest known is SHA1 or RIPE MD-160
+                                           or smaller (MD5 and earlier) */
 #endif
 
-#if defined(MBEDTLS_SHA512_C)
+#if defined(MBEDTLS_MD_CAN_SHA512)
 #define MBEDTLS_MD_MAX_BLOCK_SIZE         128
 #else
 #define MBEDTLS_MD_MAX_BLOCK_SIZE         64
@@ -95,17 +183,34 @@
 typedef struct mbedtls_md_info_t mbedtls_md_info_t;
 
 /**
+ * Used internally to indicate whether a context uses legacy or PSA.
+ *
+ * Internal use only.
+ */
+typedef enum {
+    MBEDTLS_MD_ENGINE_LEGACY = 0,
+    MBEDTLS_MD_ENGINE_PSA,
+} mbedtls_md_engine_t;
+
+/**
  * The generic message-digest context.
  */
 typedef struct mbedtls_md_context_t {
     /** Information about the associated message digest. */
     const mbedtls_md_info_t *MBEDTLS_PRIVATE(md_info);
 
-    /** The digest-specific context. */
+#if defined(MBEDTLS_MD_SOME_PSA)
+    /** Are hash operations dispatched to PSA or legacy? */
+    mbedtls_md_engine_t MBEDTLS_PRIVATE(engine);
+#endif
+
+    /** The digest-specific context (legacy) or the PSA operation. */
     void *MBEDTLS_PRIVATE(md_ctx);
 
+#if defined(MBEDTLS_MD_C)
     /** The HMAC part of the context. */
     void *MBEDTLS_PRIVATE(hmac_ctx);
+#endif
 } mbedtls_md_context_t;
 
 /**
@@ -185,6 +290,10 @@
  *
  * \return          \c 0 on success.
  * \return          #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure.
+ * \return          #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are
+ *                  not using the same engine. This can be avoided by moving
+ *                  the call to psa_crypto_init() before the first call to
+ *                  mbedtls_md_setup().
  */
 MBEDTLS_CHECK_RETURN_TYPICAL
 int mbedtls_md_clone(mbedtls_md_context_t *dst,
diff --git a/include/mbedtls/pkcs7.h b/include/mbedtls/pkcs7.h
index 126eac4..1231e34 100644
--- a/include/mbedtls/pkcs7.h
+++ b/include/mbedtls/pkcs7.h
@@ -1,7 +1,7 @@
 /**
  * \file pkcs7.h
  *
- * \brief PKCS7 generic defines and structures
+ * \brief PKCS #7 generic defines and structures
  *  https://tools.ietf.org/html/rfc2315
  */
 /*
@@ -22,27 +22,22 @@
  */
 
 /**
- * This feature is a work in progress and not ready for production. The API may
- * change. Furthermore, please note that the implementation has only been
- * validated with well-formed inputs, not yet with untrusted inputs (which is
- * almost always the case in practice).
- *
- * Note: For the time being, this implementation of the PKCS7 cryptographic
+ * Note: For the time being, this implementation of the PKCS #7 cryptographic
  * message syntax is a partial implementation of RFC 2315.
  * Differences include:
  *  - The RFC specifies 6 different content types. The only type currently
- *    supported in Mbed TLS is the signed data content type.
- *  - The only supported PKCS7 Signed Data syntax version is version 1
+ *    supported in Mbed TLS is the signed-data content type.
+ *  - The only supported PKCS #7 Signed Data syntax version is version 1
  *  - The RFC specifies support for BER. This implementation is limited to
  *    DER only.
  *  - The RFC specifies that multiple digest algorithms can be specified
  *    in the Signed Data type. Only one digest algorithm is supported in Mbed TLS.
- *  - The RFC specifies the Signed Data type can contain multiple X509 or PKCS6
+ *  - The RFC specifies the Signed Data type can contain multiple X.509 or PKCS #6 extended
  *    certificates. In Mbed TLS, this list can only contain 0 or 1 certificates
- *    and they must be in X509 format.
+ *    and they must be in X.509 format.
  *  - The RFC specifies the Signed Data type can contain
- *    certificate-revocation lists (crls). This implementation has no support
- *    for crls so it is assumed to be an empty list.
+ *    certificate-revocation lists (CRLs). This implementation has no support
+ *    for CRLs so it is assumed to be an empty list.
  *  - The RFC allows for SignerInfo structure to optionally contain
  *    unauthenticatedAttributes and authenticatedAttributes. In Mbed TLS it is
  *    assumed these fields are empty.
@@ -62,13 +57,13 @@
 #include "mbedtls/x509_crt.h"
 
 /**
- * \name PKCS7 Module Error codes
+ * \name PKCS #7 Module Error codes
  * \{
  */
 #define MBEDTLS_ERR_PKCS7_INVALID_FORMAT                   -0x5300  /**< The format is invalid, e.g. different type expected. */
 #define MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE              -0x5380  /**< Unavailable feature, e.g. anything other than signed data. */
-#define MBEDTLS_ERR_PKCS7_INVALID_VERSION                  -0x5400  /**< The PKCS7 version element is invalid or cannot be parsed. */
-#define MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO             -0x5480  /**< The PKCS7 content info is invalid or cannot be parsed. */
+#define MBEDTLS_ERR_PKCS7_INVALID_VERSION                  -0x5400  /**< The PKCS #7 version element is invalid or cannot be parsed. */
+#define MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO             -0x5480  /**< The PKCS #7 content info is invalid or cannot be parsed. */
 #define MBEDTLS_ERR_PKCS7_INVALID_ALG                      -0x5500  /**< The algorithm tag or value is invalid or cannot be parsed. */
 #define MBEDTLS_ERR_PKCS7_INVALID_CERT                     -0x5580  /**< The certificate tag or value is invalid or cannot be parsed. */
 #define MBEDTLS_ERR_PKCS7_INVALID_SIGNATURE                -0x5600  /**< Error parsing the signature */
@@ -76,11 +71,11 @@
 #define MBEDTLS_ERR_PKCS7_BAD_INPUT_DATA                   -0x5700  /**< Input invalid. */
 #define MBEDTLS_ERR_PKCS7_ALLOC_FAILED                     -0x5780  /**< Allocation of memory failed. */
 #define MBEDTLS_ERR_PKCS7_VERIFY_FAIL                      -0x5800  /**< Verification Failed */
-#define MBEDTLS_ERR_PKCS7_CERT_DATE_INVALID                -0x5880  /**< The PKCS7 date issued/expired dates are invalid */
+#define MBEDTLS_ERR_PKCS7_CERT_DATE_INVALID                -0x5880  /**< The PKCS #7 date issued/expired dates are invalid */
 /* \} name */
 
 /**
- * \name PKCS7 Supported Version
+ * \name PKCS #7 Supported Version
  * \{
  */
 #define MBEDTLS_PKCS7_SUPPORTED_VERSION                           0x01
@@ -91,12 +86,12 @@
 #endif
 
 /**
- * Type-length-value structure that allows for ASN1 using DER.
+ * Type-length-value structure that allows for ASN.1 using DER.
  */
 typedef mbedtls_asn1_buf mbedtls_pkcs7_buf;
 
 /**
- * Container for ASN1 named information objects.
+ * Container for ASN.1 named information objects.
  * It allows for Relative Distinguished Names (e.g. cn=localhost,ou=code,etc.).
  */
 typedef mbedtls_asn1_named_data mbedtls_pkcs7_name;
@@ -107,7 +102,7 @@
 typedef mbedtls_asn1_sequence mbedtls_pkcs7_sequence;
 
 /**
- * PKCS7 types
+ * PKCS #7 types
  */
 typedef enum {
     MBEDTLS_PKCS7_NONE=0,
@@ -121,7 +116,7 @@
 mbedtls_pkcs7_type;
 
 /**
- * Structure holding PKCS7 signer info
+ * Structure holding PKCS #7 signer info
  */
 typedef struct mbedtls_pkcs7_signer_info {
     int MBEDTLS_PRIVATE(version);
@@ -151,7 +146,7 @@
 mbedtls_pkcs7_signed_data;
 
 /**
- * Structure holding PKCS7 structure, only signed data for now
+ * Structure holding PKCS #7 structure, only signed data for now
  */
 typedef struct mbedtls_pkcs7 {
     mbedtls_pkcs7_buf MBEDTLS_PRIVATE(raw);
@@ -160,21 +155,21 @@
 mbedtls_pkcs7;
 
 /**
- * \brief          Initialize pkcs7 structure.
+ * \brief          Initialize mbedtls_pkcs7 structure.
  *
- * \param pkcs7    pkcs7 structure.
+ * \param pkcs7    mbedtls_pkcs7 structure.
  */
 void mbedtls_pkcs7_init(mbedtls_pkcs7 *pkcs7);
 
 /**
- * \brief          Parse a single DER formatted pkcs7 detached signature.
+ * \brief          Parse a single DER formatted PKCS #7 detached signature.
  *
- * \param pkcs7    The pkcs7 structure to be filled by parser for the output.
- * \param buf      The buffer holding only the DER encoded pkcs7.
+ * \param pkcs7    The mbedtls_pkcs7 structure to be filled by the parser.
+ * \param buf      The buffer holding only the DER encoded PKCS #7 content.
  * \param buflen   The size in bytes of \p buf. The size must be exactly the
- *                 length of the DER encoded pkcs7.
+ *                 length of the DER encoded PKCS #7 content.
  *
- * \note           This function makes an internal copy of the PKCS7 buffer
+ * \note           This function makes an internal copy of the PKCS #7 buffer
  *                 \p buf. In particular, \p buf may be destroyed or reused
  *                 after this call returns.
  * \note           Signatures with internal data are not supported.
@@ -186,7 +181,7 @@
                             const size_t buflen);
 
 /**
- * \brief          Verification of PKCS7 signature against a caller-supplied
+ * \brief          Verification of PKCS #7 signature against a caller-supplied
  *                 certificate.
  *
  *                 For each signer in the PKCS structure, this function computes
@@ -197,10 +192,10 @@
  *                 matches.
  *
  *                 This function does not use the certificates held within the
- *                 PKCS7 structure itself, and does not check that the
+ *                 PKCS #7 structure itself, and does not check that the
  *                 certificate is signed by a trusted certification authority.
  *
- * \param pkcs7    PKCS7 structure containing signature.
+ * \param pkcs7    mbedtls_pkcs7 structure containing signature.
  * \param cert     Certificate containing key to verify signature.
  * \param data     Plain data on which signature has to be verified.
  * \param datalen  Length of the data.
@@ -216,7 +211,7 @@
                                      size_t datalen);
 
 /**
- * \brief          Verification of PKCS7 signature against a caller-supplied
+ * \brief          Verification of PKCS #7 signature against a caller-supplied
  *                 certificate.
  *
  *                 For each signer in the PKCS structure, this function
@@ -226,10 +221,10 @@
  *                 signature is good.
  *
  *                 This function does not use the certificates held within the
- *                 PKCS7 structure itself, and does not check that the
+ *                 PKCS #7 structure itself, and does not check that the
  *                 certificate is signed by a trusted certification authority.
  *
- * \param pkcs7    PKCS7 structure containing signature.
+ * \param pkcs7    PKCS #7 structure containing signature.
  * \param cert     Certificate containing key to verify signature.
  * \param hash     Hash of the plain data on which signature has to be verified.
  * \param hashlen  Length of the hash.
@@ -244,10 +239,10 @@
                                      const unsigned char *hash, size_t hashlen);
 
 /**
- * \brief          Unallocate all PKCS7 data and zeroize the memory.
- *                 It doesn't free pkcs7 itself. It should be done by the caller.
+ * \brief          Unallocate all PKCS #7 data and zeroize the memory.
+ *                 It doesn't free \p pkcs7 itself. This should be done by the caller.
  *
- * \param pkcs7    PKCS7 structure to free.
+ * \param pkcs7    mbedtls_pkcs7 structure to free.
  */
 void mbedtls_pkcs7_free(mbedtls_pkcs7 *pkcs7);
 
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 29ba85a..efe0830 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -571,6 +571,8 @@
 #define MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC            22 /* 0x16 */
 #define MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET  0x0017 /* 23 */
 
+#define MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT           28 /* RFC 8449 (implemented for TLS 1.3 only) */
+
 #define MBEDTLS_TLS_EXT_SESSION_TICKET              35
 
 #define MBEDTLS_TLS_EXT_PRE_SHARED_KEY              41 /* RFC 8446 TLS 1.3 */
diff --git a/include/mbedtls/ssl_cache.h b/include/mbedtls/ssl_cache.h
index 5cd1cd3..55dcf77 100644
--- a/include/mbedtls/ssl_cache.h
+++ b/include/mbedtls/ssl_cache.h
@@ -123,6 +123,23 @@
                           size_t session_id_len,
                           const mbedtls_ssl_session *session);
 
+/**
+ * \brief          Remove the cache entry by the session ID
+ *                 (Thread-safe if MBEDTLS_THREADING_C is enabled)
+ *
+ * \param data            The SSL cache context to use.
+ * \param session_id      The pointer to the buffer holding the session ID
+ *                        associated to \p session.
+ * \param session_id_len  The length of \p session_id in bytes.
+ *
+ * \return                0: The cache entry for session with provided ID
+ *                           is removed or does not exist.
+ *                        Otherwise: fail.
+ */
+int mbedtls_ssl_cache_remove(void *data,
+                             unsigned char const *session_id,
+                             size_t session_id_len);
+
 #if defined(MBEDTLS_HAVE_TIME)
 /**
  * \brief          Set the cache timeout
diff --git a/include/mbedtls/x509_csr.h b/include/mbedtls/x509_csr.h
index e376000..f3f9e13 100644
--- a/include/mbedtls/x509_csr.h
+++ b/include/mbedtls/x509_csr.h
@@ -83,6 +83,12 @@
 }
 mbedtls_x509write_csr;
 
+typedef struct mbedtls_x509_san_list {
+    mbedtls_x509_subject_alternative_name node;
+    struct mbedtls_x509_san_list *next;
+}
+mbedtls_x509_san_list;
+
 #if defined(MBEDTLS_X509_CSR_PARSE_C)
 /**
  * \brief          Load a Certificate Signing Request (CSR) in DER format
@@ -229,6 +235,20 @@
 int mbedtls_x509write_csr_set_key_usage(mbedtls_x509write_csr *ctx, unsigned char key_usage);
 
 /**
+ * \brief           Set Subject Alternative Name
+ *
+ * \param ctx       CSR context to use
+ * \param san_list  List of SAN values
+ *
+ * \return          0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED
+ *
+ * \note            Only "dnsName", "uniformResourceIdentifier" and "otherName",
+ *                  as defined in RFC 5280, are supported.
+ */
+int mbedtls_x509write_csr_set_subject_alternative_name(mbedtls_x509write_csr *ctx,
+                                                       const mbedtls_x509_san_list *san_list);
+
+/**
  * \brief           Set the Netscape Cert Type flags
  *                  (e.g. MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT | MBEDTLS_X509_NS_CERT_TYPE_EMAIL)
  *
diff --git a/include/psa/crypto_extra.h b/include/psa/crypto_extra.h
index 30d345c..4920508 100644
--- a/include/psa/crypto_extra.h
+++ b/include/psa/crypto_extra.h
@@ -1300,10 +1300,10 @@
  */
 static psa_pake_operation_t psa_pake_operation_init(void);
 
-/** Get the lengths of the password in bytes from given inputs.
+/** Get the length of the password in bytes from given inputs.
  *
  * \param[in]  inputs           Operation inputs.
- * \param[out] password_len     Return buffer for password length.
+ * \param[out] password_len     Password length.
  *
  * \retval #PSA_SUCCESS
  *         Success.
@@ -1344,6 +1344,70 @@
     const psa_crypto_driver_pake_inputs_t *inputs,
     psa_pake_role_t *role);
 
+/** Get the length of the user id in bytes from given inputs.
+ *
+ * \param[in]  inputs           Operation inputs.
+ * \param[out] user_len         User id length.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \retval #PSA_ERROR_BAD_STATE
+ *         User id hasn't been set yet.
+ */
+psa_status_t psa_crypto_driver_pake_get_user_len(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    size_t *user_len);
+
+/** Get the length of the peer id in bytes from given inputs.
+ *
+ * \param[in]  inputs           Operation inputs.
+ * \param[out] peer_len         Peer id length.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \retval #PSA_ERROR_BAD_STATE
+ *         Peer id hasn't been set yet.
+ */
+psa_status_t psa_crypto_driver_pake_get_peer_len(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    size_t *peer_len);
+
+/** Get the user id from given inputs.
+ *
+ * \param[in]  inputs           Operation inputs.
+ * \param[out] user_id          User id.
+ * \param      user_id_size     Size of \p user_id in bytes.
+ * \param[out] user_id_len      Size of the user id in bytes.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \retval #PSA_ERROR_BAD_STATE
+ *         User id hasn't been set yet.
+ * \retval #PSA_ERROR_BUFFER_TOO_SMALL
+ *         The size of the \p user_id is too small.
+ */
+psa_status_t psa_crypto_driver_pake_get_user(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    uint8_t *user_id, size_t user_id_size, size_t *user_id_len);
+
+/** Get the peer id from given inputs.
+ *
+ * \param[in]  inputs           Operation inputs.
+ * \param[out] peer_id          Peer id.
+ * \param      peer_id_size     Size of \p peer_id in bytes.
+ * \param[out] peer_id_length   Size of the peer id in bytes.
+ *
+ * \retval #PSA_SUCCESS
+ *         Success.
+ * \retval #PSA_ERROR_BAD_STATE
+ *         Peer id hasn't been set yet.
+ * \retval #PSA_ERROR_BUFFER_TOO_SMALL
+ *         The size of the \p peer_id is too small.
+ */
+psa_status_t psa_crypto_driver_pake_get_peer(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length);
+
 /** Get the cipher suite from given inputs.
  *
  * \param[in]  inputs           Operation inputs.
@@ -1498,6 +1562,7 @@
  *                              been set (psa_pake_set_user() hasn't been
  *                              called yet).
  * \param[in] user_id           The user ID to authenticate with.
+ *                              (temporary limitation: "client" or "server" only)
  * \param user_id_len           Size of the \p user_id buffer in bytes.
  *
  * \retval #PSA_SUCCESS
@@ -1539,6 +1604,7 @@
  *                              been set (psa_pake_set_peer() hasn't been
  *                              called yet).
  * \param[in] peer_id           The peer's ID to authenticate.
+ *                              (temporary limitation: "client" or "server" only)
  * \param peer_id_len           Size of the \p peer_id buffer in bytes.
  *
  * \retval #PSA_SUCCESS
@@ -1970,6 +2036,10 @@
     uint8_t *MBEDTLS_PRIVATE(password);
     size_t MBEDTLS_PRIVATE(password_len);
     psa_pake_role_t MBEDTLS_PRIVATE(role);
+    uint8_t *MBEDTLS_PRIVATE(user);
+    size_t MBEDTLS_PRIVATE(user_len);
+    uint8_t *MBEDTLS_PRIVATE(peer);
+    size_t MBEDTLS_PRIVATE(peer_len);
     psa_key_attributes_t MBEDTLS_PRIVATE(attributes);
     psa_pake_cipher_suite_t MBEDTLS_PRIVATE(cipher_suite);
 };
diff --git a/library/aesce.c b/library/aesce.c
index 0f6c323..84a804a 100644
--- a/library/aesce.c
+++ b/library/aesce.c
@@ -1,5 +1,5 @@
 /*
- *  Arm64 crypto extension support functions
+ *  Armv8-A Cryptographic Extension support functions for Aarch64
  *
  *  Copyright The Mbed TLS Contributors
  *  SPDX-License-Identifier: Apache-2.0
@@ -17,6 +17,28 @@
  *  limitations under the License.
  */
 
+#if defined(__aarch64__) && !defined(__ARM_FEATURE_CRYPTO) && \
+    defined(__clang__) && __clang_major__ >= 4
+/* TODO: Re-consider above after https://reviews.llvm.org/D131064 merged.
+ *
+ * The intrinsic declaration are guarded by predefined ACLE macros in clang:
+ * these are normally only enabled by the -march option on the command line.
+ * By defining the macros ourselves we gain access to those declarations without
+ * requiring -march on the command line.
+ *
+ * `arm_neon.h` could be included by any header file, so we put these defines
+ * at the top of this file, before any includes.
+ */
+#define __ARM_FEATURE_CRYPTO 1
+/* See: https://arm-software.github.io/acle/main/acle.html#cryptographic-extensions
+ *
+ * `__ARM_FEATURE_CRYPTO` is deprecated, but we need to continue to specify it
+ * for older compilers.
+ */
+#define __ARM_FEATURE_AES    1
+#define MBEDTLS_ENABLE_ARM_CRYPTO_EXTENSIONS_COMPILER_FLAG
+#endif
+
 #include <string.h>
 #include "common.h"
 
@@ -26,22 +48,24 @@
 
 #if defined(MBEDTLS_HAVE_ARM64)
 
-#if defined(__clang__)
-#   if __clang_major__ < 4
-#       error "A more recent Clang is required for MBEDTLS_AESCE_C"
+#if !defined(__ARM_FEATURE_AES) || defined(MBEDTLS_ENABLE_ARM_CRYPTO_EXTENSIONS_COMPILER_FLAG)
+#   if defined(__clang__)
+#       if __clang_major__ < 4
+#           error "A more recent Clang is required for MBEDTLS_AESCE_C"
+#       endif
+#       pragma clang attribute push (__attribute__((target("crypto"))), apply_to=function)
+#       define MBEDTLS_POP_TARGET_PRAGMA
+#   elif defined(__GNUC__)
+#       if __GNUC__ < 6
+#           error "A more recent GCC is required for MBEDTLS_AESCE_C"
+#       endif
+#       pragma GCC push_options
+#       pragma GCC target ("arch=armv8-a+crypto")
+#       define MBEDTLS_POP_TARGET_PRAGMA
+#   else
+#       error "Only GCC and Clang supported for MBEDTLS_AESCE_C"
 #   endif
-#elif defined(__GNUC__)
-#   if __GNUC__ < 6
-#       error "A more recent GCC is required for MBEDTLS_AESCE_C"
-#   endif
-#else
-#    error "Only GCC and Clang supported for MBEDTLS_AESCE_C"
-#endif
-
-#if !defined(__ARM_FEATURE_CRYPTO)
-#   error "`crypto` feature modifier MUST be enabled for MBEDTLS_AESCE_C."
-#   error "Typical option for GCC and Clang is `-march=armv8-a+crypto`."
-#endif /* !__ARM_FEATURE_CRYPTO */
+#endif /* !__ARM_FEATURE_AES || MBEDTLS_ENABLE_ARM_CRYPTO_EXTENSIONS_COMPILER_FLAG */
 
 #include <arm_neon.h>
 
@@ -252,6 +276,16 @@
     return 0;
 }
 
+
+#if defined(MBEDTLS_POP_TARGET_PRAGMA)
+#if defined(__clang__)
+#pragma clang attribute pop
+#elif defined(__GNUC__)
+#pragma GCC pop_options
+#endif
+#undef MBEDTLS_POP_TARGET_PRAGMA
+#endif
+
 #endif /* MBEDTLS_HAVE_ARM64 */
 
 #endif /* MBEDTLS_AESCE_C */
diff --git a/library/aesce.h b/library/aesce.h
index da42446..4e44a68 100644
--- a/library/aesce.h
+++ b/library/aesce.h
@@ -1,8 +1,8 @@
 /**
  * \file aesce.h
  *
- * \brief AES-CE for hardware AES acceleration on ARMv8 processors with crypto
- *        extension.
+ * \brief Support hardware AES acceleration on Armv8-A processors with
+ *        the Armv8-A Cryptographic Extension in AArch64 execution state.
  *
  * \warning These functions are only for internal use by other library
  *          functions; you must not call them directly.
diff --git a/library/common.h b/library/common.h
index 46af79f..eb159a7 100644
--- a/library/common.h
+++ b/library/common.h
@@ -26,6 +26,7 @@
 #include "mbedtls/build_info.h"
 #include "alignment.h"
 
+#include <assert.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stddef.h>
@@ -149,4 +150,18 @@
 #endif
 /* *INDENT-ON* */
 
+/* Always provide a static assert macro, so it can be used unconditionally.
+ * It will expand to nothing on some systems.
+ * Can be used outside functions (but don't add a trailing ';' in that case:
+ * the semicolon is included here to avoid triggering -Wextra-semi when
+ * MBEDTLS_STATIC_ASSERT() expands to nothing).
+ * Can't use the C11-style `defined(static_assert)` on FreeBSD, since it
+ * defines static_assert even with -std=c99, but then complains about it.
+ */
+#if defined(static_assert) && !defined(__FreeBSD__)
+#define MBEDTLS_STATIC_ASSERT(expr, msg)    static_assert(expr, msg);
+#else
+#define MBEDTLS_STATIC_ASSERT(expr, msg)
+#endif
+
 #endif /* MBEDTLS_LIBRARY_COMMON_H */
diff --git a/library/ecp_curves.c b/library/ecp_curves.c
index f60f8b1..db21d7d 100644
--- a/library/ecp_curves.c
+++ b/library/ecp_curves.c
@@ -4580,6 +4580,8 @@
 #endif
 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
 static int ecp_mod_p256(mbedtls_mpi *);
+MBEDTLS_STATIC_TESTABLE
+int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs);
 #endif
 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
 static int ecp_mod_p384(mbedtls_mpi *);
@@ -5098,6 +5100,87 @@
 
 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
 
+#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
+
+/*
+ * Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
+ */
+static int ecp_mod_p256(mbedtls_mpi *N)
+{
+    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+    size_t expected_width = 2 * 256 / biL;
+    MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
+    ret = mbedtls_ecp_mod_p256_raw(N->p, expected_width);
+cleanup:
+    return ret;
+}
+
+MBEDTLS_STATIC_TESTABLE
+int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs)
+{
+    if (X_limbs != 2 * 256 / biL) {
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
+    }
+
+    INIT(256);
+
+    ADD(8);  ADD(9);
+    SUB(11); SUB(12); SUB(13); SUB(14);                   NEXT; // A0
+
+    ADD(9);  ADD(10);
+    SUB(12); SUB(13); SUB(14); SUB(15);                   NEXT; // A1
+
+    ADD(10); ADD(11);
+    SUB(13); SUB(14); SUB(15);                            NEXT; // A2
+
+    ADD(11); ADD(11); ADD(12); ADD(12); ADD(13);
+    SUB(15); SUB(8);  SUB(9);                             NEXT; // A3
+
+    ADD(12); ADD(12); ADD(13); ADD(13); ADD(14);
+    SUB(9);  SUB(10);                                     NEXT; // A4
+
+    ADD(13); ADD(13); ADD(14); ADD(14); ADD(15);
+    SUB(10); SUB(11);                                     NEXT; // A5
+
+    ADD(14); ADD(14); ADD(15); ADD(15); ADD(14); ADD(13);
+    SUB(8);  SUB(9);                                      NEXT; // A6
+
+    ADD(15); ADD(15); ADD(15); ADD(8);
+    SUB(10); SUB(11); SUB(12); SUB(13);                         // A7
+
+    RESET;
+
+    /* Use 2^224 * (2^32 - 1) + 2^192 + 2^96 - 1
+     * to modulo reduce the final carry. */
+    ADD_LAST; NEXT;                                             // A0
+    ;         NEXT;                                             // A1
+    ;         NEXT;                                             // A2
+    SUB_LAST; NEXT;                                             // A3
+    ;         NEXT;                                             // A4
+    ;         NEXT;                                             // A5
+    SUB_LAST; NEXT;                                             // A6
+    ADD_LAST;                                                   // A7
+
+    RESET;
+
+    /* Use 2^224 * (2^32 - 1) + 2^192 + 2^96 - 1
+     * to modulo reduce the carry generated by the previous reduction. */
+    ADD_LAST; NEXT;                                             // A0
+    ;         NEXT;                                             // A1
+    ;         NEXT;                                             // A2
+    SUB_LAST; NEXT;                                             // A3
+    ;         NEXT;                                             // A4
+    ;         NEXT;                                             // A5
+    SUB_LAST; NEXT;                                             // A6
+    ADD_LAST;                                                   // A7
+
+    LAST;
+
+    return 0;
+}
+
+#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
+
 #undef LOAD32
 #undef MAX32
 #undef A
@@ -5118,8 +5201,7 @@
           MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
           MBEDTLS_ECP_DP_SECP384R1_ENABLED */
 
-#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ||   \
-    defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
+#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
 /*
  * The reader is advised to first understand ecp_mod_p192() since the same
  * general structure is used here, but with additional complications:
@@ -5240,43 +5322,6 @@
     N->p[bits / 8 / sizeof(mbedtls_mpi_uint)] += msw;
 }
 
-#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
-/*
- * Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
- */
-static int ecp_mod_p256(mbedtls_mpi *N)
-{
-    INIT(256);
-
-    ADD(8); ADD(9);
-    SUB(11); SUB(12); SUB(13); SUB(14);             NEXT;         // A0
-
-    ADD(9); ADD(10);
-    SUB(12); SUB(13); SUB(14); SUB(15);             NEXT;         // A1
-
-    ADD(10); ADD(11);
-    SUB(13); SUB(14); SUB(15);                        NEXT;       // A2
-
-    ADD(11); ADD(11); ADD(12); ADD(12); ADD(13);
-    SUB(15); SUB(8); SUB(9);                        NEXT;         // A3
-
-    ADD(12); ADD(12); ADD(13); ADD(13); ADD(14);
-    SUB(9); SUB(10);                                   NEXT;      // A4
-
-    ADD(13); ADD(13); ADD(14); ADD(14); ADD(15);
-    SUB(10); SUB(11);                                   NEXT;     // A5
-
-    ADD(14); ADD(14); ADD(15); ADD(15); ADD(14); ADD(13);
-    SUB(8); SUB(9);                                   NEXT;       // A6
-
-    ADD(15); ADD(15); ADD(15); ADD(8);
-    SUB(10); SUB(11); SUB(12); SUB(13);             LAST;         // A7
-
-cleanup:
-    return ret;
-}
-#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
-
 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
 /*
  * Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4)
diff --git a/library/ecp_invasive.h b/library/ecp_invasive.h
index 1972f8c..cb16d23 100644
--- a/library/ecp_invasive.h
+++ b/library/ecp_invasive.h
@@ -33,8 +33,7 @@
 
 #if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_ECP_C)
 
-#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ||   \
-    defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
+#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
 /* Preconditions:
  *   - bits is a multiple of 64 or is 224
  *   - c is -1 or -2
@@ -117,6 +116,28 @@
 
 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
 
+#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
+
+/** Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
+ *
+ * \param[in,out]   X       The address of the MPI to be converted.
+ *                          Must have exact limb size that stores a 512-bit MPI
+ *                          (double the bitlength of the modulus).
+ *                          Upon return holds the reduced value which is
+ *                          in range `0 <= X < 2 * N` (where N is the modulus).
+ *                          The bitlength of the reduced value is the same as
+ *                          that of the modulus (256 bits).
+ * \param[in]       X_limbs The length of \p X in limbs.
+ *
+ * \return          \c 0 on success.
+ * \return          #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p X_limbs is not the
+ *                  limb size that sores a 512-bit MPI.
+ */
+MBEDTLS_STATIC_TESTABLE
+int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs);
+
+#endif
+
 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
 
 /** Fast quasi-reduction modulo p521 = 2^521 - 1 (FIPS 186-3 D.2.5)
diff --git a/library/md.c b/library/md.c
index 6681f9a..bebe358 100644
--- a/library/md.c
+++ b/library/md.c
@@ -52,6 +52,11 @@
 #include "mbedtls/sha256.h"
 #include "mbedtls/sha512.h"
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+#include <psa/crypto.h>
+#include "psa_crypto_core.h"
+#endif
+
 #include "mbedtls/platform.h"
 
 #include <string.h>
@@ -60,7 +65,7 @@
 #include <stdio.h>
 #endif
 
-#if defined(MBEDTLS_MD5_C)
+#if defined(MBEDTLS_MD_CAN_MD5)
 const mbedtls_md_info_t mbedtls_md5_info = {
     "MD5",
     MBEDTLS_MD_MD5,
@@ -69,7 +74,7 @@
 };
 #endif
 
-#if defined(MBEDTLS_RIPEMD160_C)
+#if defined(MBEDTLS_MD_CAN_RIPEMD160)
 const mbedtls_md_info_t mbedtls_ripemd160_info = {
     "RIPEMD160",
     MBEDTLS_MD_RIPEMD160,
@@ -78,7 +83,7 @@
 };
 #endif
 
-#if defined(MBEDTLS_SHA1_C)
+#if defined(MBEDTLS_MD_CAN_SHA1)
 const mbedtls_md_info_t mbedtls_sha1_info = {
     "SHA1",
     MBEDTLS_MD_SHA1,
@@ -87,7 +92,7 @@
 };
 #endif
 
-#if defined(MBEDTLS_SHA224_C)
+#if defined(MBEDTLS_MD_CAN_SHA224)
 const mbedtls_md_info_t mbedtls_sha224_info = {
     "SHA224",
     MBEDTLS_MD_SHA224,
@@ -96,7 +101,7 @@
 };
 #endif
 
-#if defined(MBEDTLS_SHA256_C)
+#if defined(MBEDTLS_MD_CAN_SHA256)
 const mbedtls_md_info_t mbedtls_sha256_info = {
     "SHA256",
     MBEDTLS_MD_SHA256,
@@ -105,7 +110,7 @@
 };
 #endif
 
-#if defined(MBEDTLS_SHA384_C)
+#if defined(MBEDTLS_MD_CAN_SHA384)
 const mbedtls_md_info_t mbedtls_sha384_info = {
     "SHA384",
     MBEDTLS_MD_SHA384,
@@ -114,7 +119,7 @@
 };
 #endif
 
-#if defined(MBEDTLS_SHA512_C)
+#if defined(MBEDTLS_MD_CAN_SHA512)
 const mbedtls_md_info_t mbedtls_sha512_info = {
     "SHA512",
     MBEDTLS_MD_SHA512,
@@ -126,31 +131,31 @@
 const mbedtls_md_info_t *mbedtls_md_info_from_type(mbedtls_md_type_t md_type)
 {
     switch (md_type) {
-#if defined(MBEDTLS_MD5_C)
+#if defined(MBEDTLS_MD_CAN_MD5)
         case MBEDTLS_MD_MD5:
             return &mbedtls_md5_info;
 #endif
-#if defined(MBEDTLS_RIPEMD160_C)
+#if defined(MBEDTLS_MD_CAN_RIPEMD160)
         case MBEDTLS_MD_RIPEMD160:
             return &mbedtls_ripemd160_info;
 #endif
-#if defined(MBEDTLS_SHA1_C)
+#if defined(MBEDTLS_MD_CAN_SHA1)
         case MBEDTLS_MD_SHA1:
             return &mbedtls_sha1_info;
 #endif
-#if defined(MBEDTLS_SHA224_C)
+#if defined(MBEDTLS_MD_CAN_SHA224)
         case MBEDTLS_MD_SHA224:
             return &mbedtls_sha224_info;
 #endif
-#if defined(MBEDTLS_SHA256_C)
+#if defined(MBEDTLS_MD_CAN_SHA256)
         case MBEDTLS_MD_SHA256:
             return &mbedtls_sha256_info;
 #endif
-#if defined(MBEDTLS_SHA384_C)
+#if defined(MBEDTLS_MD_CAN_SHA384)
         case MBEDTLS_MD_SHA384:
             return &mbedtls_sha384_info;
 #endif
-#if defined(MBEDTLS_SHA512_C)
+#if defined(MBEDTLS_MD_CAN_SHA512)
         case MBEDTLS_MD_SHA512:
             return &mbedtls_sha512_info;
 #endif
@@ -159,8 +164,71 @@
     }
 }
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+static psa_algorithm_t psa_alg_of_md(const mbedtls_md_info_t *info)
+{
+    switch (info->type) {
+#if defined(MBEDTLS_MD_MD5_VIA_PSA)
+        case MBEDTLS_MD_MD5:
+            return PSA_ALG_MD5;
+#endif
+#if defined(MBEDTLS_MD_RIPEMD160_VIA_PSA)
+        case MBEDTLS_MD_RIPEMD160:
+            return PSA_ALG_RIPEMD160;
+#endif
+#if defined(MBEDTLS_MD_SHA1_VIA_PSA)
+        case MBEDTLS_MD_SHA1:
+            return PSA_ALG_SHA_1;
+#endif
+#if defined(MBEDTLS_MD_SHA224_VIA_PSA)
+        case MBEDTLS_MD_SHA224:
+            return PSA_ALG_SHA_224;
+#endif
+#if defined(MBEDTLS_MD_SHA256_VIA_PSA)
+        case MBEDTLS_MD_SHA256:
+            return PSA_ALG_SHA_256;
+#endif
+#if defined(MBEDTLS_MD_SHA384_VIA_PSA)
+        case MBEDTLS_MD_SHA384:
+            return PSA_ALG_SHA_384;
+#endif
+#if defined(MBEDTLS_MD_SHA512_VIA_PSA)
+        case MBEDTLS_MD_SHA512:
+            return PSA_ALG_SHA_512;
+#endif
+        default:
+            return PSA_ALG_NONE;
+    }
+}
+
+static int md_can_use_psa(const mbedtls_md_info_t *info)
+{
+    psa_algorithm_t alg = psa_alg_of_md(info);
+    if (alg == PSA_ALG_NONE) {
+        return 0;
+    }
+
+    return psa_can_do_hash(alg);
+}
+
+static int mbedtls_md_error_from_psa(psa_status_t status)
+{
+    switch (status) {
+        case PSA_SUCCESS:
+            return 0;
+        case PSA_ERROR_NOT_SUPPORTED:
+            return MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE;
+        case PSA_ERROR_INSUFFICIENT_MEMORY:
+            return MBEDTLS_ERR_MD_ALLOC_FAILED;
+        default:
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
+    }
+}
+#endif /* MBEDTLS_MD_SOME_PSA */
+
 void mbedtls_md_init(mbedtls_md_context_t *ctx)
 {
+    /* Note: this sets engine (if present) to MBEDTLS_MD_ENGINE_LEGACY */
     memset(ctx, 0, sizeof(mbedtls_md_context_t));
 }
 
@@ -171,6 +239,11 @@
     }
 
     if (ctx->md_ctx != NULL) {
+#if defined(MBEDTLS_MD_SOME_PSA)
+        if (ctx->engine == MBEDTLS_MD_ENGINE_PSA) {
+            psa_hash_abort(ctx->md_ctx);
+        } else
+#endif
         switch (ctx->md_info->type) {
 #if defined(MBEDTLS_MD5_C)
             case MBEDTLS_MD_MD5:
@@ -214,11 +287,13 @@
         mbedtls_free(ctx->md_ctx);
     }
 
+#if defined(MBEDTLS_MD_C)
     if (ctx->hmac_ctx != NULL) {
         mbedtls_platform_zeroize(ctx->hmac_ctx,
                                  2 * ctx->md_info->block_size);
         mbedtls_free(ctx->hmac_ctx);
     }
+#endif
 
     mbedtls_platform_zeroize(ctx, sizeof(mbedtls_md_context_t));
 }
@@ -232,6 +307,21 @@
         return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
     }
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+    if (src->engine != dst->engine) {
+        /* This can happen with src set to legacy because PSA wasn't ready
+         * yet, and dst to PSA because it became ready in the meantime.
+         * We currently don't support that case (we'd need to re-allocate
+         * md_ctx to the size of the appropriate MD context). */
+        return MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE;
+    }
+
+    if (src->engine == MBEDTLS_MD_ENGINE_PSA) {
+        psa_status_t status = psa_hash_clone(src->md_ctx, dst->md_ctx);
+        return mbedtls_md_error_from_psa(status);
+    }
+#endif
+
     switch (src->md_info->type) {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
@@ -292,8 +382,23 @@
 
     ctx->md_info = md_info;
     ctx->md_ctx = NULL;
+#if defined(MBEDTLS_MD_C)
     ctx->hmac_ctx = NULL;
+#else
+    if (hmac != 0) {
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
+    }
+#endif
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+    if (md_can_use_psa(ctx->md_info)) {
+        ctx->md_ctx = mbedtls_calloc(1, sizeof(psa_hash_operation_t));
+        if (ctx->md_ctx == NULL) {
+            return MBEDTLS_ERR_MD_ALLOC_FAILED;
+        }
+        ctx->engine = MBEDTLS_MD_ENGINE_PSA;
+    } else
+#endif
     switch (md_info->type) {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
@@ -334,6 +439,7 @@
             return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
     }
 
+#if defined(MBEDTLS_MD_C)
     if (hmac != 0) {
         ctx->hmac_ctx = mbedtls_calloc(2, md_info->block_size);
         if (ctx->hmac_ctx == NULL) {
@@ -341,6 +447,7 @@
             return MBEDTLS_ERR_MD_ALLOC_FAILED;
         }
     }
+#endif
 
     return 0;
 }
@@ -352,6 +459,15 @@
         return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
     }
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+    if (ctx->engine == MBEDTLS_MD_ENGINE_PSA) {
+        psa_algorithm_t alg = psa_alg_of_md(ctx->md_info);
+        psa_hash_abort(ctx->md_ctx);
+        psa_status_t status = psa_hash_setup(ctx->md_ctx, alg);
+        return mbedtls_md_error_from_psa(status);
+    }
+#endif
+
     switch (ctx->md_info->type) {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
@@ -392,6 +508,13 @@
         return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
     }
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+    if (ctx->engine == MBEDTLS_MD_ENGINE_PSA) {
+        psa_status_t status = psa_hash_update(ctx->md_ctx, input, ilen);
+        return mbedtls_md_error_from_psa(status);
+    }
+#endif
+
     switch (ctx->md_info->type) {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
@@ -432,6 +555,15 @@
         return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
     }
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+    if (ctx->engine == MBEDTLS_MD_ENGINE_PSA) {
+        size_t size = ctx->md_info->size;
+        psa_status_t status = psa_hash_finish(ctx->md_ctx,
+                                              output, size, &size);
+        return mbedtls_md_error_from_psa(status);
+    }
+#endif
+
     switch (ctx->md_info->type) {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
@@ -473,6 +605,16 @@
         return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
     }
 
+#if defined(MBEDTLS_MD_SOME_PSA)
+    if (md_can_use_psa(md_info)) {
+        size_t size = md_info->size;
+        psa_status_t status = psa_hash_compute(psa_alg_of_md(md_info),
+                                               input, ilen,
+                                               output, size, &size);
+        return mbedtls_md_error_from_psa(status);
+    }
+#endif
+
     switch (md_info->type) {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
@@ -536,30 +678,30 @@
  */
 static const int supported_digests[] = {
 
-#if defined(MBEDTLS_SHA512_C)
+#if defined(MBEDTLS_MD_CAN_SHA512)
     MBEDTLS_MD_SHA512,
 #endif
 
-#if defined(MBEDTLS_SHA384_C)
+#if defined(MBEDTLS_MD_CAN_SHA384)
     MBEDTLS_MD_SHA384,
 #endif
 
-#if defined(MBEDTLS_SHA256_C)
+#if defined(MBEDTLS_MD_CAN_SHA256)
     MBEDTLS_MD_SHA256,
 #endif
-#if defined(MBEDTLS_SHA224_C)
+#if defined(MBEDTLS_MD_CAN_SHA224)
     MBEDTLS_MD_SHA224,
 #endif
 
-#if defined(MBEDTLS_SHA1_C)
+#if defined(MBEDTLS_MD_CAN_SHA1)
     MBEDTLS_MD_SHA1,
 #endif
 
-#if defined(MBEDTLS_RIPEMD160_C)
+#if defined(MBEDTLS_MD_CAN_RIPEMD160)
     MBEDTLS_MD_RIPEMD160,
 #endif
 
-#if defined(MBEDTLS_MD5_C)
+#if defined(MBEDTLS_MD_CAN_MD5)
     MBEDTLS_MD_MD5,
 #endif
 
@@ -578,37 +720,37 @@
     }
 
     /* Get the appropriate digest information */
-#if defined(MBEDTLS_MD5_C)
+#if defined(MBEDTLS_MD_CAN_MD5)
     if (!strcmp("MD5", md_name)) {
         return mbedtls_md_info_from_type(MBEDTLS_MD_MD5);
     }
 #endif
-#if defined(MBEDTLS_RIPEMD160_C)
+#if defined(MBEDTLS_MD_CAN_RIPEMD160)
     if (!strcmp("RIPEMD160", md_name)) {
         return mbedtls_md_info_from_type(MBEDTLS_MD_RIPEMD160);
     }
 #endif
-#if defined(MBEDTLS_SHA1_C)
+#if defined(MBEDTLS_MD_CAN_SHA1)
     if (!strcmp("SHA1", md_name) || !strcmp("SHA", md_name)) {
         return mbedtls_md_info_from_type(MBEDTLS_MD_SHA1);
     }
 #endif
-#if defined(MBEDTLS_SHA224_C)
+#if defined(MBEDTLS_MD_CAN_SHA224)
     if (!strcmp("SHA224", md_name)) {
         return mbedtls_md_info_from_type(MBEDTLS_MD_SHA224);
     }
 #endif
-#if defined(MBEDTLS_SHA256_C)
+#if defined(MBEDTLS_MD_CAN_SHA256)
     if (!strcmp("SHA256", md_name)) {
         return mbedtls_md_info_from_type(MBEDTLS_MD_SHA256);
     }
 #endif
-#if defined(MBEDTLS_SHA384_C)
+#if defined(MBEDTLS_MD_CAN_SHA384)
     if (!strcmp("SHA384", md_name)) {
         return mbedtls_md_info_from_type(MBEDTLS_MD_SHA384);
     }
 #endif
-#if defined(MBEDTLS_SHA512_C)
+#if defined(MBEDTLS_MD_CAN_SHA512)
     if (!strcmp("SHA512", md_name)) {
         return mbedtls_md_info_from_type(MBEDTLS_MD_SHA512);
     }
diff --git a/library/oid.c b/library/oid.c
index 86214b2..63b3df3 100644
--- a/library/oid.c
+++ b/library/oid.c
@@ -813,65 +813,26 @@
                  cipher_alg)
 #endif /* MBEDTLS_PKCS12_C */
 
-#define OID_SAFE_SNPRINTF                               \
-    do {                                                \
-        if (ret < 0 || (size_t) ret >= n)              \
-        return MBEDTLS_ERR_OID_BUF_TOO_SMALL;    \
-                                                      \
-        n -= (size_t) ret;                              \
-        p += (size_t) ret;                              \
-    } while (0)
-
 /* Return the x.y.z.... style numeric string for the given OID */
 int mbedtls_oid_get_numeric_string(char *buf, size_t size,
                                    const mbedtls_asn1_buf *oid)
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
-    size_t i, n;
-    unsigned int value;
-    char *p;
+    char *p = buf;
+    size_t n = size;
+    unsigned int value = 0;
 
-    p = buf;
-    n = size;
-
-    /* First subidentifier contains first two OID components */
-    i = 0;
-    value = 0;
-    if ((oid->p[0]) == 0x80) {
-        /* Overlong encoding is not allowed */
-        return MBEDTLS_ERR_ASN1_INVALID_DATA;
+    if (size > INT_MAX) {
+        /* Avoid overflow computing return value */
+        return MBEDTLS_ERR_ASN1_INVALID_LENGTH;
     }
 
-    while (i < oid->len && ((oid->p[i] & 0x80) != 0)) {
-        /* Prevent overflow in value. */
-        if (value > (UINT_MAX >> 7)) {
-            return MBEDTLS_ERR_ASN1_INVALID_DATA;
-        }
-
-        value |= oid->p[i] & 0x7F;
-        value <<= 7;
-        i++;
-    }
-    if (i >= oid->len) {
+    if (oid->len <= 0) {
+        /* OID must not be empty */
         return MBEDTLS_ERR_ASN1_OUT_OF_DATA;
     }
-    /* Last byte of first subidentifier */
-    value |= oid->p[i] & 0x7F;
-    i++;
 
-    unsigned int component1 = value / 40;
-    if (component1 > 2) {
-        /* The first component can only be 0, 1 or 2.
-         * If oid->p[0] / 40 is greater than 2, the leftover belongs to
-         * the second component. */
-        component1 = 2;
-    }
-    unsigned int component2 = value - (40 * component1);
-    ret = mbedtls_snprintf(p, n, "%u.%u", component1, component2);
-    OID_SAFE_SNPRINTF;
-
-    value = 0;
-    for (; i < oid->len; i++) {
+    for (size_t i = 0; i < oid->len; i++) {
         /* Prevent overflow in value. */
         if (value > (UINT_MAX >> 7)) {
             return MBEDTLS_ERR_ASN1_INVALID_DATA;
@@ -886,12 +847,38 @@
 
         if (!(oid->p[i] & 0x80)) {
             /* Last byte */
-            ret = mbedtls_snprintf(p, n, ".%u", value);
-            OID_SAFE_SNPRINTF;
+            if (n == size) {
+                int component1;
+                unsigned int component2;
+                /* First subidentifier contains first two OID components */
+                if (value >= 80) {
+                    component1 = '2';
+                    component2 = value - 80;
+                } else if (value >= 40) {
+                    component1 = '1';
+                    component2 = value - 40;
+                } else {
+                    component1 = '0';
+                    component2 = value;
+                }
+                ret = mbedtls_snprintf(p, n, "%c.%u", component1, component2);
+            } else {
+                ret = mbedtls_snprintf(p, n, ".%u", value);
+            }
+            if (ret < 2 || (size_t) ret >= n) {
+                return MBEDTLS_ERR_OID_BUF_TOO_SMALL;
+            }
+            n -= (size_t) ret;
+            p += ret;
             value = 0;
         }
     }
 
+    if (value != 0) {
+        /* Unterminated subidentifier */
+        return MBEDTLS_ERR_ASN1_OUT_OF_DATA;
+    }
+
     return (int) (size - n);
 }
 
diff --git a/library/pem.c b/library/pem.c
index 9f14052..84bbb3d 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -25,7 +25,7 @@
 #include "mbedtls/base64.h"
 #include "mbedtls/des.h"
 #include "mbedtls/aes.h"
-#include "mbedtls/md5.h"
+#include "mbedtls/md.h"
 #include "mbedtls/cipher.h"
 #include "mbedtls/platform_util.h"
 #include "mbedtls/error.h"
@@ -99,26 +99,33 @@
                       unsigned char *iv,
                       const unsigned char *pwd, size_t pwdlen)
 {
-    mbedtls_md5_context md5_ctx;
+    mbedtls_md_context_t md5_ctx;
+    const mbedtls_md_info_t *md5_info;
     unsigned char md5sum[16];
     size_t use_len;
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
-    mbedtls_md5_init(&md5_ctx);
+    mbedtls_md_init(&md5_ctx);
+
+    /* Prepare the context. (setup() errors gracefully on NULL info.) */
+    md5_info = mbedtls_md_info_from_type(MBEDTLS_MD_MD5);
+    if ((ret = mbedtls_md_setup(&md5_ctx, md5_info, 0)) != 0) {
+        goto exit;
+    }
 
     /*
      * key[ 0..15] = MD5(pwd || IV)
      */
-    if ((ret = mbedtls_md5_starts(&md5_ctx)) != 0) {
+    if ((ret = mbedtls_md_starts(&md5_ctx)) != 0) {
         goto exit;
     }
-    if ((ret = mbedtls_md5_update(&md5_ctx, pwd, pwdlen)) != 0) {
+    if ((ret = mbedtls_md_update(&md5_ctx, pwd, pwdlen)) != 0) {
         goto exit;
     }
-    if ((ret = mbedtls_md5_update(&md5_ctx, iv,  8)) != 0) {
+    if ((ret = mbedtls_md_update(&md5_ctx, iv,  8)) != 0) {
         goto exit;
     }
-    if ((ret = mbedtls_md5_finish(&md5_ctx, md5sum)) != 0) {
+    if ((ret = mbedtls_md_finish(&md5_ctx, md5sum)) != 0) {
         goto exit;
     }
 
@@ -132,19 +139,19 @@
     /*
      * key[16..23] = MD5(key[ 0..15] || pwd || IV])
      */
-    if ((ret = mbedtls_md5_starts(&md5_ctx)) != 0) {
+    if ((ret = mbedtls_md_starts(&md5_ctx)) != 0) {
         goto exit;
     }
-    if ((ret = mbedtls_md5_update(&md5_ctx, md5sum, 16)) != 0) {
+    if ((ret = mbedtls_md_update(&md5_ctx, md5sum, 16)) != 0) {
         goto exit;
     }
-    if ((ret = mbedtls_md5_update(&md5_ctx, pwd, pwdlen)) != 0) {
+    if ((ret = mbedtls_md_update(&md5_ctx, pwd, pwdlen)) != 0) {
         goto exit;
     }
-    if ((ret = mbedtls_md5_update(&md5_ctx, iv, 8)) != 0) {
+    if ((ret = mbedtls_md_update(&md5_ctx, iv, 8)) != 0) {
         goto exit;
     }
-    if ((ret = mbedtls_md5_finish(&md5_ctx, md5sum)) != 0) {
+    if ((ret = mbedtls_md_finish(&md5_ctx, md5sum)) != 0) {
         goto exit;
     }
 
@@ -156,7 +163,7 @@
     memcpy(key + 16, md5sum, use_len);
 
 exit:
-    mbedtls_md5_free(&md5_ctx);
+    mbedtls_md_free(&md5_ctx);
     mbedtls_platform_zeroize(md5sum, 16);
 
     return ret;
diff --git a/library/pkcs7.c b/library/pkcs7.c
index d4059d7..cf05afd 100644
--- a/library/pkcs7.c
+++ b/library/pkcs7.c
@@ -42,7 +42,7 @@
 #endif
 
 /**
- * Initializes the pkcs7 structure.
+ * Initializes the mbedtls_pkcs7 structure.
  */
 void mbedtls_pkcs7_init(mbedtls_pkcs7 *pkcs7)
 {
diff --git a/library/platform_util.c b/library/platform_util.c
index 6d4759c..f891cd4 100644
--- a/library/platform_util.c
+++ b/library/platform_util.c
@@ -57,6 +57,15 @@
 #endif
 
 #if !defined(MBEDTLS_PLATFORM_ZEROIZE_ALT)
+
+#undef HAVE_MEMORY_SANITIZER
+#if defined(__has_feature)
+#if __has_feature(memory_sanitizer)
+#include <sanitizer/msan_interface.h>
+#define HAVE_MEMORY_SANITIZER
+#endif
+#endif
+
 /*
  * Where possible, we try to detect the presence of a platform-provided
  * secure memset, such as explicit_bzero(), that is safe against being optimized
@@ -100,6 +109,15 @@
     if (len > 0) {
 #if defined(MBEDTLS_PLATFORM_HAS_EXPLICIT_BZERO)
         explicit_bzero(buf, len);
+#if defined(HAVE_MEMORY_SANITIZER)
+        /* You'd think that Msan would recognize explicit_bzero() as
+         * equivalent to bzero(), but it actually doesn't on several
+         * platforms, including Linux (Ubuntu 20.04).
+         * https://github.com/google/sanitizers/issues/1507
+         * https://github.com/openssh/openssh-portable/commit/74433a19bb6f4cef607680fa4d1d7d81ca3826aa
+         */
+        __msan_unpoison(buf, len);
+#endif
 #elif defined(__STDC_LIB_EXT1__)
         memset_s(buf, len, 0, len);
 #elif defined(_WIN32)
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 5724025..bc19ed0 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -48,7 +48,6 @@
 
 #include "psa_crypto_random_impl.h"
 
-#include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 #include "mbedtls/platform.h"
@@ -91,6 +90,10 @@
 #define BUILTIN_ALG_ANY_HKDF 1
 #endif
 
+/* The only two JPAKE user/peer identifiers supported for the time being. */
+static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
+static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
+
 /****************************************************************/
 /* Global data, support functions and library management */
 /****************************************************************/
@@ -108,6 +111,7 @@
 typedef struct {
     unsigned initialized : 1;
     unsigned rng_state : 2;
+    unsigned drivers_initialized : 1;
     mbedtls_psa_random_context_t rng;
 } psa_global_data_t;
 
@@ -122,6 +126,12 @@
     if (global_data.initialized == 0)  \
     return PSA_ERROR_BAD_STATE;
 
+int psa_can_do_hash(psa_algorithm_t hash_alg)
+{
+    (void) hash_alg;
+    return global_data.drivers_initialized;
+}
+
 psa_status_t mbedtls_to_psa_error(int ret)
 {
     /* Mbed TLS error codes can combine a high-level error code and a
@@ -367,8 +377,8 @@
 /* Key management */
 /****************************************************************/
 
-#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
-    defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
+#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \
+    defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
@@ -463,8 +473,8 @@
     (void) bits_is_sloppy;
     return MBEDTLS_ECP_DP_NONE;
 }
-#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
-          defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
+#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) ||
+          defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
@@ -1484,14 +1494,15 @@
     return (status == PSA_SUCCESS) ? unlock_status : status;
 }
 
-#if defined(static_assert)
-static_assert((MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
-              "One or more key attribute flag is listed as both external-only and dual-use");
-static_assert((PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
-              "One or more key attribute flag is listed as both internal-only and dual-use");
-static_assert((PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0,
-              "One or more key attribute flag is listed as both internal-only and external-only");
-#endif
+MBEDTLS_STATIC_ASSERT(
+    (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
+    "One or more key attribute flag is listed as both external-only and dual-use")
+MBEDTLS_STATIC_ASSERT(
+    (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
+    "One or more key attribute flag is listed as both internal-only and dual-use")
+MBEDTLS_STATIC_ASSERT(
+    (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0,
+    "One or more key attribute flag is listed as both internal-only and external-only")
 
 /** Validate that a key policy is internally well-formed.
  *
@@ -1755,11 +1766,10 @@
             psa_key_slot_number_t slot_number =
                 psa_key_slot_get_slot_number(slot);
 
-#if defined(static_assert)
-            static_assert(sizeof(slot_number) ==
-                          sizeof(data.slot_number),
-                          "Slot number size does not match psa_se_key_data_storage_t");
-#endif
+            MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
+                                  sizeof(data.slot_number),
+                                  "Slot number size does not match psa_se_key_data_storage_t");
+
             memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
             status = psa_save_persistent_key(&slot->attr,
                                              (uint8_t *) &data,
@@ -5537,8 +5547,8 @@
  * Note: Function allocates memory for *data buffer, so given *data should be
  *       always NULL.
  */
-#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
-    defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
+#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \
+    defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
@@ -5549,6 +5559,7 @@
     uint8_t **data
     )
 {
+#if defined(MBEDTLS_ECP_C)
     unsigned key_out_of_range = 1;
     mbedtls_mpi k;
     mbedtls_mpi diff_N_2;
@@ -5632,6 +5643,13 @@
     mbedtls_mpi_free(&k);
     mbedtls_mpi_free(&diff_N_2);
     return status;
+#else /* MBEDTLS_ECP_C */
+    (void) slot;
+    (void) bits;
+    (void) operation;
+    (void) data;
+    return PSA_ERROR_NOT_SUPPORTED;
+#endif /* MBEDTLS_ECP_C */
 }
 
 /* ECC keys on a Montgomery elliptic curve draws a byte string whose length
@@ -5698,8 +5716,8 @@
 
     return status;
 }
-#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
-          defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
+#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) ||
+          defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
@@ -5718,8 +5736,8 @@
         return PSA_ERROR_INVALID_ARGUMENT;
     }
 
-#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
-    defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
+#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \
+    defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
@@ -5739,8 +5757,8 @@
             }
         }
     } else
-#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
-          defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
+#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) ||
+          defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
           defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
@@ -7121,6 +7139,13 @@
         return PSA_SUCCESS;
     }
 
+    /* Init drivers */
+    status = psa_driver_wrapper_init();
+    if (status != PSA_SUCCESS) {
+        goto exit;
+    }
+    global_data.drivers_initialized = 1;
+
     /* Initialize and seed the random generator. */
     mbedtls_psa_random_init(&global_data.rng);
     global_data.rng_state = RNG_INITIALIZED;
@@ -7135,12 +7160,6 @@
         goto exit;
     }
 
-    /* Init drivers */
-    status = psa_driver_wrapper_init();
-    if (status != PSA_SUCCESS) {
-        goto exit;
-    }
-
 #if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
     status = psa_crypto_load_transaction();
     if (status == PSA_SUCCESS) {
@@ -7209,6 +7228,68 @@
     return PSA_SUCCESS;
 }
 
+psa_status_t psa_crypto_driver_pake_get_user_len(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    size_t *user_len)
+{
+    if (inputs->user_len == 0) {
+        return PSA_ERROR_BAD_STATE;
+    }
+
+    *user_len = inputs->user_len;
+
+    return PSA_SUCCESS;
+}
+
+psa_status_t psa_crypto_driver_pake_get_user(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
+{
+    if (inputs->user_len == 0) {
+        return PSA_ERROR_BAD_STATE;
+    }
+
+    if (user_id_size < inputs->user_len) {
+        return PSA_ERROR_BUFFER_TOO_SMALL;
+    }
+
+    memcpy(user_id, inputs->user, inputs->user_len);
+    *user_id_len = inputs->user_len;
+
+    return PSA_SUCCESS;
+}
+
+psa_status_t psa_crypto_driver_pake_get_peer_len(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    size_t *peer_len)
+{
+    if (inputs->peer_len == 0) {
+        return PSA_ERROR_BAD_STATE;
+    }
+
+    *peer_len = inputs->peer_len;
+
+    return PSA_SUCCESS;
+}
+
+psa_status_t psa_crypto_driver_pake_get_peer(
+    const psa_crypto_driver_pake_inputs_t *inputs,
+    uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
+{
+    if (inputs->peer_len == 0) {
+        return PSA_ERROR_BAD_STATE;
+    }
+
+    if (peer_id_size < inputs->peer_len) {
+        return PSA_ERROR_BUFFER_TOO_SMALL;
+    }
+
+    memcpy(peer_id, inputs->peer, inputs->peer_len);
+    *peer_id_length = inputs->peer_len;
+
+    return PSA_SUCCESS;
+}
+
 psa_status_t psa_crypto_driver_pake_get_cipher_suite(
     const psa_crypto_driver_pake_inputs_t *inputs,
     psa_pake_cipher_suite_t *cipher_suite)
@@ -7323,7 +7404,6 @@
     size_t user_id_len)
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
-    (void) user_id;
 
     if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
         status = PSA_ERROR_BAD_STATE;
@@ -7335,7 +7415,30 @@
         goto exit;
     }
 
-    return PSA_ERROR_NOT_SUPPORTED;
+    if (operation->data.inputs.user_len != 0) {
+        status = PSA_ERROR_BAD_STATE;
+        goto exit;
+    }
+
+    /* Allow only "client" or "server" values (temporary restriction). */
+    if ((user_id_len != sizeof(jpake_server_id) ||
+         memcmp(user_id, jpake_server_id, user_id_len) != 0) &&
+        (user_id_len != sizeof(jpake_client_id) ||
+         memcmp(user_id, jpake_client_id, user_id_len) != 0)) {
+        status = PSA_ERROR_NOT_SUPPORTED;
+        goto exit;
+    }
+
+    operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
+    if (operation->data.inputs.user == NULL) {
+        status = PSA_ERROR_INSUFFICIENT_MEMORY;
+        goto exit;
+    }
+
+    memcpy(operation->data.inputs.user, user_id, user_id_len);
+    operation->data.inputs.user_len = user_id_len;
+
+    return PSA_SUCCESS;
 exit:
     psa_pake_abort(operation);
     return status;
@@ -7347,7 +7450,6 @@
     size_t peer_id_len)
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
-    (void) peer_id;
 
     if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
         status = PSA_ERROR_BAD_STATE;
@@ -7359,7 +7461,30 @@
         goto exit;
     }
 
-    return PSA_ERROR_NOT_SUPPORTED;
+    if (operation->data.inputs.peer_len != 0) {
+        status = PSA_ERROR_BAD_STATE;
+        goto exit;
+    }
+
+    /* Allow only "client" or "server" values (temporary restriction). */
+    if ((peer_id_len != sizeof(jpake_server_id) ||
+         memcmp(peer_id, jpake_server_id, peer_id_len) != 0) &&
+        (peer_id_len != sizeof(jpake_client_id) ||
+         memcmp(peer_id, jpake_client_id, peer_id_len) != 0)) {
+        status = PSA_ERROR_NOT_SUPPORTED;
+        goto exit;
+    }
+
+    operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
+    if (operation->data.inputs.peer == NULL) {
+        status = PSA_ERROR_INSUFFICIENT_MEMORY;
+        goto exit;
+    }
+
+    memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
+    operation->data.inputs.peer_len = peer_id_len;
+
+    return PSA_SUCCESS;
 exit:
     psa_pake_abort(operation);
     return status;
@@ -7372,22 +7497,24 @@
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
 
     if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
-        status =  PSA_ERROR_BAD_STATE;
+        status = PSA_ERROR_BAD_STATE;
         goto exit;
     }
 
-    if (role != PSA_PAKE_ROLE_NONE &&
-        role != PSA_PAKE_ROLE_FIRST &&
-        role != PSA_PAKE_ROLE_SECOND &&
-        role != PSA_PAKE_ROLE_CLIENT &&
-        role != PSA_PAKE_ROLE_SERVER) {
-        status = PSA_ERROR_INVALID_ARGUMENT;
-        goto exit;
+    switch (operation->alg) {
+#if defined(PSA_WANT_ALG_JPAKE)
+        case PSA_ALG_JPAKE:
+            if (role == PSA_PAKE_ROLE_NONE) {
+                return PSA_SUCCESS;
+            }
+            status = PSA_ERROR_INVALID_ARGUMENT;
+            break;
+#endif
+        default:
+            (void) role;
+            status = PSA_ERROR_NOT_SUPPORTED;
+            goto exit;
     }
-
-    operation->data.inputs.role = role;
-
-    return PSA_SUCCESS;
 exit:
     psa_pake_abort(operation);
     return status;
@@ -7457,15 +7584,27 @@
        with the driver context which will be setup by the driver. */
     psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
 
-    if (inputs.password_len == 0 ||
-        inputs.role == PSA_PAKE_ROLE_NONE) {
+    if (inputs.password_len == 0) {
         return PSA_ERROR_BAD_STATE;
     }
 
-    if (operation->alg == PSA_ALG_JPAKE &&
-        inputs.role != PSA_PAKE_ROLE_CLIENT &&
-        inputs.role != PSA_PAKE_ROLE_SERVER) {
-        return PSA_ERROR_NOT_SUPPORTED;
+    if (operation->alg == PSA_ALG_JPAKE) {
+        if (inputs.user_len == 0 || inputs.peer_len == 0) {
+            return PSA_ERROR_BAD_STATE;
+        }
+        if (memcmp(inputs.user, jpake_client_id, inputs.user_len) == 0 &&
+            memcmp(inputs.peer, jpake_server_id, inputs.peer_len) == 0) {
+            inputs.role = PSA_PAKE_ROLE_CLIENT;
+        } else
+        if (memcmp(inputs.user, jpake_server_id, inputs.user_len) == 0 &&
+            memcmp(inputs.peer, jpake_client_id, inputs.peer_len) == 0) {
+            inputs.role = PSA_PAKE_ROLE_SERVER;
+        }
+
+        if (inputs.role != PSA_PAKE_ROLE_CLIENT &&
+            inputs.role != PSA_PAKE_ROLE_SERVER) {
+            return PSA_ERROR_NOT_SUPPORTED;
+        }
     }
 
     /* Clear driver context */
@@ -7477,6 +7616,10 @@
     mbedtls_platform_zeroize(inputs.password, inputs.password_len);
     mbedtls_free(inputs.password);
 
+    /* User and peer are translated to role. */
+    mbedtls_free(inputs.user);
+    mbedtls_free(inputs.peer);
+
     if (status == PSA_SUCCESS) {
 #if defined(PSA_WANT_ALG_JPAKE)
         if (operation->alg == PSA_ALG_JPAKE) {
@@ -7885,13 +8028,19 @@
         status = psa_driver_wrapper_pake_abort(operation);
     }
 
-    if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS &&
-        operation->data.inputs.password != NULL) {
-        mbedtls_platform_zeroize(operation->data.inputs.password,
-                                 operation->data.inputs.password_len);
-        mbedtls_free(operation->data.inputs.password);
+    if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
+        if (operation->data.inputs.password != NULL) {
+            mbedtls_platform_zeroize(operation->data.inputs.password,
+                                     operation->data.inputs.password_len);
+            mbedtls_free(operation->data.inputs.password);
+        }
+        if (operation->data.inputs.user != NULL) {
+            mbedtls_free(operation->data.inputs.user);
+        }
+        if (operation->data.inputs.peer != NULL) {
+            mbedtls_free(operation->data.inputs.peer);
+        }
     }
-
     memset(operation, 0, sizeof(psa_pake_operation_t));
 
     return status;
diff --git a/library/psa_crypto_core.h b/library/psa_crypto_core.h
index d3d0188..8bc1b64 100644
--- a/library/psa_crypto_core.h
+++ b/library/psa_crypto_core.h
@@ -26,6 +26,18 @@
 #include "psa/crypto.h"
 #include "psa/crypto_se_driver.h"
 
+/**
+ * Tell if PSA is ready for this hash.
+ *
+ * \note            For now, only checks the state of the driver subsystem,
+ *                  not the algorithm. Might do more in the future.
+ *
+ * \param hash_alg  The hash algorithm (ignored for now).
+ *
+ * \return 1 if the driver subsytem is ready, 0 otherwise.
+ */
+int psa_can_do_hash(psa_algorithm_t hash_alg);
+
 /** Constant-time buffer comparison
  *
  * \param[in]  a    Left-hand buffer for comparison.
diff --git a/library/psa_crypto_se.c b/library/psa_crypto_se.c
index dee780f..9db3ded 100644
--- a/library/psa_crypto_se.c
+++ b/library/psa_crypto_se.c
@@ -22,7 +22,6 @@
 
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
 
-#include <assert.h>
 #include <stdint.h>
 #include <string.h>
 
@@ -313,10 +312,9 @@
     }
     /* Driver table entries are 0-initialized. 0 is not a valid driver
      * location because it means a transparent key. */
-#if defined(static_assert)
-    static_assert(PSA_KEY_LOCATION_LOCAL_STORAGE == 0,
-                  "Secure element support requires 0 to mean a local key");
-#endif
+    MBEDTLS_STATIC_ASSERT(PSA_KEY_LOCATION_LOCAL_STORAGE == 0,
+                          "Secure element support requires 0 to mean a local key");
+
     if (location == PSA_KEY_LOCATION_LOCAL_STORAGE) {
         return PSA_ERROR_INVALID_ARGUMENT;
     }
diff --git a/library/rsa.c b/library/rsa.c
index 7159588..584b363 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -2344,7 +2344,7 @@
 
 #if defined(MBEDTLS_SELF_TEST)
 
-#include "mbedtls/sha1.h"
+#include "mbedtls/md.h"
 
 /*
  * Example RSA-1024 keypair, for test purposes
@@ -2508,7 +2508,8 @@
         mbedtls_printf("  PKCS#1 data sign  : ");
     }
 
-    if (mbedtls_sha1(rsa_plaintext, PT_LEN, sha1sum) != 0) {
+    if (mbedtls_md(mbedtls_md_info_from_type(MBEDTLS_MD_SHA1),
+                   rsa_plaintext, PT_LEN, sha1sum) != 0) {
         if (verbose != 0) {
             mbedtls_printf("failed\n");
         }
diff --git a/library/sha256.c b/library/sha256.c
index ca3fa5d..08822f4 100644
--- a/library/sha256.c
+++ b/library/sha256.c
@@ -23,7 +23,7 @@
  */
 
 #if defined(__aarch64__) && !defined(__ARM_FEATURE_CRYPTO) && \
-    defined(__clang__) &&  __clang_major__ < 18 && __clang_major__ > 3
+    defined(__clang__) && __clang_major__ >= 4
 /* TODO: Re-consider above after https://reviews.llvm.org/D131064 merged.
  *
  * The intrinsic declaration are guarded by predefined ACLE macros in clang:
@@ -35,9 +35,14 @@
  * at the top of this file, before any includes.
  */
 #define __ARM_FEATURE_CRYPTO 1
-#define NEED_TARGET_OPTIONS
-#endif /* __aarch64__ && __clang__ &&
-          !__ARM_FEATURE_CRYPTO && __clang_major__ < 18 && __clang_major__ > 3 */
+/* See: https://arm-software.github.io/acle/main/acle.html#cryptographic-extensions
+ *
+ * `__ARM_FEATURE_CRYPTO` is deprecated, but we need to continue to specify it
+ * for older compilers.
+ */
+#define __ARM_FEATURE_SHA2   1
+#define MBEDTLS_ENABLE_ARM_CRYPTO_EXTENSIONS_COMPILER_FLAG
+#endif
 
 #include "common.h"
 
@@ -55,7 +60,7 @@
 #  if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT) || \
     defined(MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY)
 /* *INDENT-OFF* */
-#    if !defined(__ARM_FEATURE_CRYPTO) || defined(NEED_TARGET_OPTIONS)
+#    if !defined(__ARM_FEATURE_CRYPTO) || defined(MBEDTLS_ENABLE_ARM_CRYPTO_EXTENSIONS_COMPILER_FLAG)
 #      if defined(__clang__)
 #        if __clang_major__ < 4
 #          error "A more recent Clang is required for MBEDTLS_SHA256_USE_A64_CRYPTO_*"
diff --git a/library/sha512.c b/library/sha512.c
index bc92a8d..67acfee 100644
--- a/library/sha512.c
+++ b/library/sha512.c
@@ -23,8 +23,7 @@
  */
 
 #if defined(__aarch64__) && !defined(__ARM_FEATURE_SHA512) && \
-    defined(__clang__) &&  __clang_major__ < 18 && \
-    __clang_major__ >= 13 && __clang_minor__ > 0 && __clang_patchlevel__ > 0
+    defined(__clang__) && __clang_major__ >= 7
 /* TODO: Re-consider above after https://reviews.llvm.org/D131064 merged.
  *
  * The intrinsic declaration are guarded by predefined ACLE macros in clang:
@@ -36,11 +35,8 @@
  * at the top of this file, before any includes.
  */
 #define __ARM_FEATURE_SHA512 1
-#define NEED_TARGET_OPTIONS
-#endif /* __aarch64__ && __clang__ &&
-          !__ARM_FEATURE_SHA512 && __clang_major__ < 18 &&
-          __clang_major__ >= 13 && __clang_minor__ > 0 &&
-          __clang_patchlevel__ > 0 */
+#define MBEDTLS_ENABLE_ARM_SHA3_EXTENSIONS_COMPILER_FLAG
+#endif
 
 #include "common.h"
 
@@ -78,15 +74,11 @@
  * Clang == 13.0.0 same as clang 12 (only seen on macOS)
  * Clang >= 13.0.1 has __ARM_FEATURE_SHA512 and intrinsics
  */
-#    if !defined(__ARM_FEATURE_SHA512) || defined(NEED_TARGET_OPTIONS)
+#    if !defined(__ARM_FEATURE_SHA512) || defined(MBEDTLS_ENABLE_ARM_SHA3_EXTENSIONS_COMPILER_FLAG)
        /* Test Clang first, as it defines __GNUC__ */
 #      if defined(__clang__)
 #        if __clang_major__ < 7
 #          error "A more recent Clang is required for MBEDTLS_SHA512_USE_A64_CRYPTO_*"
-#        elif __clang_major__ < 13 || \
-              (__clang_major__ == 13 && __clang_minor__ == 0 && \
-               __clang_patchlevel__ == 0)
-           /* We implement the intrinsics with inline assembler, so don't error */
 #        else
 #          pragma clang attribute push (__attribute__((target("sha3"))), apply_to=function)
 #          define MBEDTLS_POP_TARGET_PRAGMA
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index 7c16e10..048c21d 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -92,8 +92,8 @@
     mbedtls_ssl_cache_entry *entry;
 
 #if defined(MBEDTLS_THREADING_C)
-    if (mbedtls_mutex_lock(&cache->mutex) != 0) {
-        return 1;
+    if ((ret = mbedtls_mutex_lock(&cache->mutex)) != 0) {
+        return ret;
     }
 #endif
 
@@ -114,13 +114,30 @@
 exit:
 #if defined(MBEDTLS_THREADING_C)
     if (mbedtls_mutex_unlock(&cache->mutex) != 0) {
-        ret = 1;
+        ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
     }
 #endif
 
     return ret;
 }
 
+/* zeroize a cache entry */
+static void ssl_cache_entry_zeroize(mbedtls_ssl_cache_entry *entry)
+{
+    if (entry == NULL) {
+        return;
+    }
+
+    /* zeroize and free session structure */
+    if (entry->session != NULL) {
+        mbedtls_platform_zeroize(entry->session, entry->session_len);
+        mbedtls_free(entry->session);
+    }
+
+    /* zeroize the whole entry structure */
+    mbedtls_platform_zeroize(entry, sizeof(mbedtls_ssl_cache_entry));
+}
+
 MBEDTLS_CHECK_RETURN_CRITICAL
 static int ssl_cache_pick_writing_slot(mbedtls_ssl_cache_context *cache,
                                        unsigned char const *session_id,
@@ -220,19 +237,19 @@
 
 found:
 
+    /* If we're reusing an entry, free it first. */
+    if (cur->session != NULL) {
+        /* `ssl_cache_entry_zeroize` would break the chain,
+         * so we reuse `old` to record `next` temporarily. */
+        old = cur->next;
+        ssl_cache_entry_zeroize(cur);
+        cur->next = old;
+    }
+
 #if defined(MBEDTLS_HAVE_TIME)
     cur->timestamp = t;
 #endif
 
-    /* If we're reusing an entry, free it first. */
-    if (cur->session != NULL) {
-        mbedtls_free(cur->session);
-        cur->session = NULL;
-        cur->session_len = 0;
-        memset(cur->session_id, 0, sizeof(cur->session_id));
-        cur->session_id_len = 0;
-    }
-
     *dst = cur;
     return 0;
 }
@@ -301,7 +318,7 @@
 exit:
 #if defined(MBEDTLS_THREADING_C)
     if (mbedtls_mutex_unlock(&cache->mutex) != 0) {
-        ret = 1;
+        ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
     }
 #endif
 
@@ -314,6 +331,55 @@
     return ret;
 }
 
+int mbedtls_ssl_cache_remove(void *data,
+                             unsigned char const *session_id,
+                             size_t session_id_len)
+{
+    int ret = 1;
+    mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
+    mbedtls_ssl_cache_entry *entry;
+    mbedtls_ssl_cache_entry *prev;
+
+#if defined(MBEDTLS_THREADING_C)
+    if ((ret = mbedtls_mutex_lock(&cache->mutex)) != 0) {
+        return ret;
+    }
+#endif
+
+    ret = ssl_cache_find_entry(cache, session_id, session_id_len, &entry);
+    /* No valid entry found, exit with success */
+    if (ret != 0) {
+        ret = 0;
+        goto exit;
+    }
+
+    /* Now we remove the entry from the chain */
+    if (entry == cache->chain) {
+        cache->chain = entry->next;
+        goto free;
+    }
+    for (prev = cache->chain; prev->next != NULL; prev = prev->next) {
+        if (prev->next == entry) {
+            prev->next = entry->next;
+            break;
+        }
+    }
+
+free:
+    ssl_cache_entry_zeroize(entry);
+    mbedtls_free(entry);
+    ret = 0;
+
+exit:
+#if defined(MBEDTLS_THREADING_C)
+    if (mbedtls_mutex_unlock(&cache->mutex) != 0) {
+        ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
+    }
+#endif
+
+    return ret;
+}
+
 #if defined(MBEDTLS_HAVE_TIME)
 void mbedtls_ssl_cache_set_timeout(mbedtls_ssl_cache_context *cache, int timeout)
 {
@@ -344,7 +410,7 @@
         prv = cur;
         cur = cur->next;
 
-        mbedtls_free(prv->session);
+        ssl_cache_entry_zeroize(prv);
         mbedtls_free(prv);
     }
 
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index 4cdd87e..6fe0414 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -107,6 +107,7 @@
 #define MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC           25
 #define MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET     26
 #define MBEDTLS_SSL_EXT_ID_SESSION_TICKET             27
+#define MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT          28
 
 /* Utility for translating IANA extension type. */
 uint32_t mbedtls_ssl_get_extension_id(unsigned int extension_type);
@@ -167,6 +168,7 @@
      MBEDTLS_SSL_EXT_MASK(CERT_AUTH)                              | \
      MBEDTLS_SSL_EXT_MASK(POST_HANDSHAKE_AUTH)                    | \
      MBEDTLS_SSL_EXT_MASK(SIG_ALG_CERT)                           | \
+     MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT)                      | \
      MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED)
 
 /* RFC 8446 section 4.2. Allowed extensions for EncryptedExtensions */
@@ -179,7 +181,8 @@
      MBEDTLS_SSL_EXT_MASK(ALPN)                                   | \
      MBEDTLS_SSL_EXT_MASK(CLI_CERT_TYPE)                          | \
      MBEDTLS_SSL_EXT_MASK(SERV_CERT_TYPE)                         | \
-     MBEDTLS_SSL_EXT_MASK(EARLY_DATA))
+     MBEDTLS_SSL_EXT_MASK(EARLY_DATA)                             | \
+     MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT))
 
 /* RFC 8446 section 4.2. Allowed extensions for CertificateRequest */
 #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CR                                  \
@@ -2662,6 +2665,16 @@
                                       const unsigned char *end);
 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
+#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
+#define MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH (2)
+#define MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN (64)
+
+MBEDTLS_CHECK_RETURN_CRITICAL
+int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl,
+                                                  const unsigned char *buf,
+                                                  const unsigned char *end);
+#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
+
 #if defined(MBEDTLS_SSL_ALPN)
 MBEDTLS_CHECK_RETURN_CRITICAL
 int mbedtls_ssl_parse_alpn_ext(mbedtls_ssl_context *ssl,
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 5d8a761..a6129da 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -25,8 +25,6 @@
 
 #if defined(MBEDTLS_SSL_TLS_C)
 
-#include <assert.h>
-
 #include "mbedtls/platform.h"
 
 #include "mbedtls/ssl.h"
@@ -593,6 +591,9 @@
         case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
             return MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET;
 
+        case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
+            return MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT;
+
         case MBEDTLS_TLS_EXT_SESSION_TICKET:
             return MBEDTLS_SSL_EXT_ID_SESSION_TICKET;
 
@@ -635,7 +636,8 @@
     [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = "supported_point_formats",
     [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = "encrypt_then_mac",
     [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = "extended_master_secret",
-    [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = "session_ticket"
+    [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = "session_ticket",
+    [MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT] = "record_size_limit"
 };
 
 static unsigned int extension_type_table[] = {
@@ -666,7 +668,8 @@
     [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS,
     [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC,
     [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET,
-    [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = MBEDTLS_TLS_EXT_SESSION_TICKET
+    [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = MBEDTLS_TLS_EXT_SESSION_TICKET,
+    [MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT] = MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT
 };
 
 const char *mbedtls_ssl_get_extension_name(unsigned int extension_type)
@@ -1196,11 +1199,9 @@
         size_t sig_algs_len = 0;
         uint16_t *p;
 
-#if defined(static_assert)
-        static_assert(MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
-                      <= (SIZE_MAX - (2 * sizeof(uint16_t))),
-                      "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big");
-#endif
+        MBEDTLS_STATIC_ASSERT(MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
+                              <= (SIZE_MAX - (2 * sizeof(uint16_t))),
+                              "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big");
 
         for (md = sig_hashes; *md != MBEDTLS_MD_NONE; md++) {
             if (mbedtls_ssl_hash_from_md_alg(*md) == MBEDTLS_SSL_HASH_NONE) {
@@ -1949,14 +1950,19 @@
 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
+static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
+static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
+
 static psa_status_t mbedtls_ssl_set_hs_ecjpake_password_common(
     mbedtls_ssl_context *ssl,
     mbedtls_svc_key_id_t pwd)
 {
     psa_status_t status;
-    psa_pake_role_t psa_role;
     psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
-
+    const uint8_t *user = NULL;
+    size_t user_len = 0;
+    const uint8_t *peer = NULL;
+    size_t peer_len = 0;
     psa_pake_cs_set_algorithm(&cipher_suite, PSA_ALG_JPAKE);
     psa_pake_cs_set_primitive(&cipher_suite,
                               PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC,
@@ -1970,12 +1976,23 @@
     }
 
     if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
-        psa_role = PSA_PAKE_ROLE_SERVER;
+        user = jpake_server_id;
+        user_len = sizeof(jpake_server_id);
+        peer = jpake_client_id;
+        peer_len = sizeof(jpake_client_id);
     } else {
-        psa_role = PSA_PAKE_ROLE_CLIENT;
+        user = jpake_client_id;
+        user_len = sizeof(jpake_client_id);
+        peer = jpake_server_id;
+        peer_len = sizeof(jpake_server_id);
     }
 
-    status = psa_pake_set_role(&ssl->handshake->psa_pake_ctx, psa_role);
+    status = psa_pake_set_user(&ssl->handshake->psa_pake_ctx, user, user_len);
+    if (status != PSA_SUCCESS) {
+        return status;
+    }
+
+    status = psa_pake_set_peer(&ssl->handshake->psa_pake_ctx, peer, peer_len);
     if (status != PSA_SUCCESS) {
         return status;
     }
diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c
index 0806f7f..631331d 100644
--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
@@ -1510,10 +1510,9 @@
             MBEDTLS_TLS_SIG_NONE
         };
 
-#if defined(static_assert)
-        static_assert(sizeof(default_sig_algs) / sizeof(default_sig_algs[0]) <=
-                      MBEDTLS_RECEIVED_SIG_ALGS_SIZE, "default_sig_algs is too big");
-#endif
+        MBEDTLS_STATIC_ASSERT(sizeof(default_sig_algs) / sizeof(default_sig_algs[0])
+                              <= MBEDTLS_RECEIVED_SIG_ALGS_SIZE,
+                              "default_sig_algs is too big");
 
         memcpy(received_sig_algs, default_sig_algs, sizeof(default_sig_algs));
     }
diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index a72f770..a7feced 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -2117,10 +2117,11 @@
     extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
     p += 2;
 
-    MBEDTLS_SSL_DEBUG_BUF(3, "encrypted extensions", p, extensions_len);
     MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, extensions_len);
     extensions_end = p + extensions_len;
 
+    MBEDTLS_SSL_DEBUG_BUF(3, "encrypted extensions", p, extensions_len);
+
     handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
 
     while (p < extensions_end) {
@@ -2172,6 +2173,19 @@
                 break;
 #endif /* MBEDTLS_SSL_EARLY_DATA */
 
+#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
+            case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
+                MBEDTLS_SSL_DEBUG_MSG(3, ("found record_size_limit extension"));
+
+                ret = mbedtls_ssl_tls13_parse_record_size_limit_ext(ssl, p, p + extension_data_len);
+
+                /* TODO: Return unconditionally here until we handle the record size limit correctly.
+                 *            Once handled correctly, only return in case of errors. */
+                return ret;
+
+                break;
+#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
+
             default:
                 MBEDTLS_SSL_PRINT_EXT(
                     3, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index 512656e..669a90a 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -1567,4 +1567,61 @@
     return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
 }
 
+#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
+/* RFC 8449, section 4:
+ *
+ * The ExtensionData of the "record_size_limit" extension is
+ * RecordSizeLimit:
+ *     uint16 RecordSizeLimit;
+ */
+MBEDTLS_CHECK_RETURN_CRITICAL
+int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl,
+                                                  const unsigned char *buf,
+                                                  const unsigned char *end)
+{
+    const unsigned char *p = buf;
+    uint16_t record_size_limit;
+    const size_t extension_data_len = end - buf;
+
+    if (extension_data_len != MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH) {
+        MBEDTLS_SSL_DEBUG_MSG(2,
+                              ("record_size_limit extension has invalid length: %"
+                               MBEDTLS_PRINTF_SIZET " Bytes",
+                               extension_data_len));
+
+        MBEDTLS_SSL_PEND_FATAL_ALERT(
+            MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+            MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
+    }
+
+    MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
+    record_size_limit = MBEDTLS_GET_UINT16_BE(p, 0);
+
+    MBEDTLS_SSL_DEBUG_MSG(2, ("RecordSizeLimit: %u Bytes", record_size_limit));
+
+    /* RFC 8449, section 4
+     *
+     * Endpoints MUST NOT send a "record_size_limit" extension with a value
+     * smaller than 64.  An endpoint MUST treat receipt of a smaller value
+     * as a fatal error and generate an "illegal_parameter" alert.
+     */
+    if (record_size_limit < MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN) {
+        MBEDTLS_SSL_PEND_FATAL_ALERT(
+            MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+            MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
+    }
+
+    MBEDTLS_SSL_DEBUG_MSG(2,
+                          (
+                              "record_size_limit extension is still in development. Aborting handshake."));
+
+    MBEDTLS_SSL_PEND_FATAL_ALERT(
+        MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
+        MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION);
+    return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
+}
+#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
+
 #endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */
diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c
index 6b1c4c5..bccf9ab 100644
--- a/library/ssl_tls13_server.c
+++ b/library/ssl_tls13_server.c
@@ -1585,6 +1585,19 @@
                 break;
 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
 
+#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
+            case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
+                MBEDTLS_SSL_DEBUG_MSG(3, ("found record_size_limit extension"));
+
+                ret = mbedtls_ssl_tls13_parse_record_size_limit_ext(ssl, p, extension_data_end);
+
+                /* TODO: Return unconditionally here until we handle the record size limit correctly.
+                 *            Once handled correctly, only return in case of errors. */
+                return ret;
+
+                break;
+#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
+
             default:
                 MBEDTLS_SSL_PRINT_EXT(
                     3, MBEDTLS_SSL_HS_CLIENT_HELLO,
diff --git a/library/x509write_csr.c b/library/x509write_csr.c
index d8d8e99..deb6617 100644
--- a/library/x509write_csr.c
+++ b/library/x509write_csr.c
@@ -26,6 +26,7 @@
 
 #if defined(MBEDTLS_X509_CSR_WRITE_C)
 
+#include "mbedtls/x509.h"
 #include "mbedtls/x509_csr.h"
 #include "mbedtls/asn1write.h"
 #include "mbedtls/error.h"
@@ -85,6 +86,105 @@
                                       critical, val, val_len);
 }
 
+int mbedtls_x509write_csr_set_subject_alternative_name(mbedtls_x509write_csr *ctx,
+                                                       const mbedtls_x509_san_list *san_list)
+{
+    int ret = 0;
+    const mbedtls_x509_san_list *cur;
+    unsigned char *buf;
+    unsigned char *p;
+    size_t len;
+    size_t buflen = 0;
+
+    /* Determine the maximum size of the SubjectAltName list */
+    for (cur = san_list; cur != NULL; cur = cur->next) {
+        /* Calculate size of the required buffer */
+        switch (cur->node.type) {
+            case MBEDTLS_X509_SAN_DNS_NAME:
+            case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER:
+            case MBEDTLS_X509_SAN_IP_ADDRESS:
+                /* length of value for each name entry,
+                 * maximum 4 bytes for the length field,
+                 * 1 byte for the tag/type.
+                 */
+                buflen += cur->node.san.unstructured_name.len + 4 + 1;
+                break;
+
+            default:
+                /* Not supported - skip. */
+                break;
+        }
+    }
+
+    /* Add the extra length field and tag */
+    buflen += 4 + 1;
+
+    /* Allocate buffer */
+    buf = mbedtls_calloc(1, buflen);
+    if (buf == NULL) {
+        return MBEDTLS_ERR_ASN1_ALLOC_FAILED;
+    }
+
+    mbedtls_platform_zeroize(buf, buflen);
+    p = buf + buflen;
+
+    /* Write ASN.1-based structure */
+    cur = san_list;
+    len = 0;
+    while (cur != NULL) {
+        switch (cur->node.type) {
+            case MBEDTLS_X509_SAN_DNS_NAME:
+            case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER:
+            case MBEDTLS_X509_SAN_IP_ADDRESS:
+            {
+                const unsigned char *unstructured_name =
+                    (const unsigned char *) cur->node.san.unstructured_name.p;
+                size_t unstructured_name_len = cur->node.san.unstructured_name.len;
+
+                MBEDTLS_ASN1_CHK_CLEANUP_ADD(len,
+                                             mbedtls_asn1_write_raw_buffer(
+                                                 &p, buf,
+                                                 unstructured_name, unstructured_name_len));
+                MBEDTLS_ASN1_CHK_CLEANUP_ADD(len, mbedtls_asn1_write_len(
+                                                 &p, buf, unstructured_name_len));
+                MBEDTLS_ASN1_CHK_CLEANUP_ADD(len,
+                                             mbedtls_asn1_write_tag(
+                                                 &p, buf,
+                                                 MBEDTLS_ASN1_CONTEXT_SPECIFIC | cur->node.type));
+            }
+            break;
+            default:
+                /* Skip unsupported names. */
+                break;
+        }
+        cur = cur->next;
+    }
+
+    MBEDTLS_ASN1_CHK_CLEANUP_ADD(len, mbedtls_asn1_write_len(&p, buf, len));
+    MBEDTLS_ASN1_CHK_CLEANUP_ADD(len,
+                                 mbedtls_asn1_write_tag(&p, buf,
+                                                        MBEDTLS_ASN1_CONSTRUCTED |
+                                                        MBEDTLS_ASN1_SEQUENCE));
+
+    ret = mbedtls_x509write_csr_set_extension(
+        ctx,
+        MBEDTLS_OID_SUBJECT_ALT_NAME,
+        MBEDTLS_OID_SIZE(MBEDTLS_OID_SUBJECT_ALT_NAME),
+        0,
+        buf + buflen - len,
+        len);
+
+    /* If we exceeded the allocated buffer it means that maximum size of the SubjectAltName list
+     * was incorrectly calculated and memory is corrupted. */
+    if (p < buf) {
+        ret = MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
+    }
+
+cleanup:
+    mbedtls_free(buf);
+    return ret;
+}
+
 int mbedtls_x509write_csr_set_key_usage(mbedtls_x509write_csr *ctx, unsigned char key_usage)
 {
     unsigned char buf[4] = { 0 };
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 88c2192..1c34861 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -129,6 +129,7 @@
 #define DFL_TICKET_AEAD         MBEDTLS_CIPHER_AES_256_GCM
 #define DFL_CACHE_MAX           -1
 #define DFL_CACHE_TIMEOUT       -1
+#define DFL_CACHE_REMOVE        0
 #define DFL_SNI                 NULL
 #define DFL_ALPN_STRING         NULL
 #define DFL_CURVES              NULL
@@ -321,7 +322,8 @@
 
 #if defined(MBEDTLS_SSL_CACHE_C)
 #define USAGE_CACHE                                             \
-    "    cache_max=%%d        default: cache default (50)\n"
+    "    cache_max=%%d        default: cache default (50)\n"    \
+    "    cache_remove=%%d     default: 0 (don't remove)\n"
 #if defined(MBEDTLS_HAVE_TIME)
 #define USAGE_CACHE_TIME \
     "    cache_timeout=%%d    default: cache default (1d)\n"
@@ -669,6 +671,7 @@
 #if defined(MBEDTLS_HAVE_TIME)
     int cache_timeout;          /* expiration delay of session cache entries*/
 #endif
+    int cache_remove;           /* enable / disable cache removement        */
     char *sni;                  /* string describing sni information        */
     const char *curves;         /* list of supported elliptic curves        */
     const char *sig_algs;       /* supported TLS 1.3 signature algorithms   */
@@ -1731,6 +1734,7 @@
 #if defined(MBEDTLS_HAVE_TIME)
     opt.cache_timeout       = DFL_CACHE_TIMEOUT;
 #endif
+    opt.cache_remove        = DFL_CACHE_REMOVE;
     opt.sni                 = DFL_SNI;
     opt.alpn_string         = DFL_ALPN_STRING;
     opt.curves              = DFL_CURVES;
@@ -2144,7 +2148,12 @@
             }
         }
 #endif
-        else if (strcmp(p, "cookies") == 0) {
+        else if (strcmp(p, "cache_remove") == 0) {
+            opt.cache_remove = atoi(q);
+            if (opt.cache_remove < 0 || opt.cache_remove > 1) {
+                goto usage;
+            }
+        } else if (strcmp(p, "cookies") == 0) {
             opt.cookies = atoi(q);
             if (opt.cookies < -1 || opt.cookies > 1) {
                 goto usage;
@@ -4127,6 +4136,12 @@
 
     mbedtls_printf(" done\n");
 
+#if defined(MBEDTLS_SSL_CACHE_C)
+    if (opt.cache_remove > 0) {
+        mbedtls_ssl_cache_remove(&cache, ssl.session->id, ssl.session->id_len);
+    }
+#endif
+
     goto reset;
 
     /*
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index 8ef5932..5241438 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -63,6 +63,11 @@
     "    debug_level=%%d      default: 0 (disabled)\n"  \
     "    output_file=%%s      default: cert.req\n"      \
     "    subject_name=%%s     default: CN=Cert,O=mbed TLS,C=UK\n"   \
+    "    san=%%s              default: (none)\n"       \
+    "                        Comma-separated-list of values:\n"     \
+    "                          DNS:value\n"            \
+    "                          URI:value\n"            \
+    "                          IP:value (Only IPv4 is supported)\n"             \
     "    key_usage=%%s        default: (empty)\n"       \
     "                        Comma-separated-list of values:\n"     \
     "                          digital_signature\n"     \
@@ -96,18 +101,31 @@
  * global options
  */
 struct options {
-    const char *filename;       /* filename of the key file             */
-    const char *password;       /* password for the key file            */
-    int debug_level;            /* level of debugging                   */
-    const char *output_file;    /* where to store the constructed key file  */
-    const char *subject_name;   /* subject name for certificate request */
-    unsigned char key_usage;    /* key usage flags                      */
-    int force_key_usage;        /* Force adding the KeyUsage extension  */
-    unsigned char ns_cert_type; /* NS cert type                         */
-    int force_ns_cert_type;     /* Force adding NsCertType extension    */
-    mbedtls_md_type_t md_alg;   /* Hash algorithm used for signature.   */
+    const char *filename;             /* filename of the key file             */
+    const char *password;             /* password for the key file            */
+    int debug_level;                  /* level of debugging                   */
+    const char *output_file;          /* where to store the constructed key file  */
+    const char *subject_name;         /* subject name for certificate request   */
+    mbedtls_x509_san_list *san_list;  /* subjectAltName for certificate request */
+    unsigned char key_usage;          /* key usage flags                      */
+    int force_key_usage;              /* Force adding the KeyUsage extension  */
+    unsigned char ns_cert_type;       /* NS cert type                         */
+    int force_ns_cert_type;           /* Force adding NsCertType extension    */
+    mbedtls_md_type_t md_alg;         /* Hash algorithm used for signature.   */
 } opt;
 
+static void ip_string_to_bytes(const char *str, uint8_t *bytes, int maxBytes)
+{
+    for (int i = 0; i < maxBytes; i++) {
+        bytes[i] = (uint8_t) strtoul(str, NULL, 16);
+        str = strchr(str, '.');
+        if (str == NULL || *str == '\0') {
+            break;
+        }
+        str++;
+    }
+}
+
 int write_certificate_request(mbedtls_x509write_csr *req, const char *output_file,
                               int (*f_rng)(void *, unsigned char *, size_t),
                               void *p_rng)
@@ -145,11 +163,12 @@
     mbedtls_pk_context key;
     char buf[1024];
     int i;
-    char *p, *q, *r;
+    char *p, *q, *r, *r2;
     mbedtls_x509write_csr req;
     mbedtls_entropy_context entropy;
     mbedtls_ctr_drbg_context ctr_drbg;
     const char *pers = "csr example app";
+    mbedtls_x509_san_list *cur, *prev;
 
     /*
      * Set to sane values
@@ -175,15 +194,14 @@
     opt.ns_cert_type        = DFL_NS_CERT_TYPE;
     opt.force_ns_cert_type  = DFL_FORCE_NS_CERT_TYPE;
     opt.md_alg              = DFL_MD_ALG;
+    opt.san_list            = NULL;
 
     for (i = 1; i < argc; i++) {
-
         p = argv[i];
         if ((q = strchr(p, '=')) == NULL) {
             goto usage;
         }
         *q++ = '\0';
-
         if (strcmp(p, "filename") == 0) {
             opt.filename = q;
         } else if (strcmp(p, "password") == 0) {
@@ -197,6 +215,59 @@
             }
         } else if (strcmp(p, "subject_name") == 0) {
             opt.subject_name = q;
+        } else if (strcmp(p, "san") == 0) {
+            prev = NULL;
+
+            while (q != NULL) {
+                uint8_t ip[4] = { 0 };
+
+                if ((r = strchr(q, ';')) != NULL) {
+                    *r++ = '\0';
+                }
+
+                cur = mbedtls_calloc(1, sizeof(mbedtls_x509_san_list));
+                if (cur == NULL) {
+                    mbedtls_printf("Not enough memory for subjectAltName list\n");
+                    goto usage;
+                }
+
+                cur->next = NULL;
+
+                if ((r2 = strchr(q, ':')) != NULL) {
+                    *r2++ = '\0';
+                }
+
+                if (strcmp(q, "URI") == 0) {
+                    cur->node.type = MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER;
+                } else if (strcmp(q, "DNS") == 0) {
+                    cur->node.type = MBEDTLS_X509_SAN_DNS_NAME;
+                } else if (strcmp(q, "IP") == 0) {
+                    cur->node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
+                    ip_string_to_bytes(r2, ip, 4);
+                } else {
+                    mbedtls_free(cur);
+                    goto usage;
+                }
+
+                if (strcmp(q, "IP") == 0) {
+                    cur->node.san.unstructured_name.p = (unsigned char *) ip;
+                    cur->node.san.unstructured_name.len = sizeof(ip);
+                } else {
+                    q = r2;
+                    cur->node.san.unstructured_name.p = (unsigned char *) q;
+                    cur->node.san.unstructured_name.len = strlen(q);
+                }
+
+                if (prev == NULL) {
+                    opt.san_list = cur;
+                } else {
+                    prev->next = cur;
+                }
+
+                prev = cur;
+                q = r;
+            }
+
         } else if (strcmp(p, "md") == 0) {
             const mbedtls_md_info_t *md_info =
                 mbedtls_md_info_from_string(q);
@@ -274,14 +345,39 @@
         }
     }
 
+    /* Set the MD algorithm to use for the signature in the CSR */
     mbedtls_x509write_csr_set_md_alg(&req, opt.md_alg);
 
+    /* Set the Key Usage Extension flags in the CSR */
     if (opt.key_usage || opt.force_key_usage == 1) {
-        mbedtls_x509write_csr_set_key_usage(&req, opt.key_usage);
+        ret = mbedtls_x509write_csr_set_key_usage(&req, opt.key_usage);
+
+        if (ret != 0) {
+            mbedtls_printf(" failed\n  !  mbedtls_x509write_csr_set_key_usage returned %d", ret);
+            goto exit;
+        }
     }
 
+    /* Set the Cert Type flags in the CSR */
     if (opt.ns_cert_type || opt.force_ns_cert_type == 1) {
-        mbedtls_x509write_csr_set_ns_cert_type(&req, opt.ns_cert_type);
+        ret = mbedtls_x509write_csr_set_ns_cert_type(&req, opt.ns_cert_type);
+
+        if (ret != 0) {
+            mbedtls_printf(" failed\n  !  mbedtls_x509write_csr_set_ns_cert_type returned %d", ret);
+            goto exit;
+        }
+    }
+
+    /* Set the SubjectAltName in the CSR */
+    if (opt.san_list != NULL) {
+        ret = mbedtls_x509write_csr_set_subject_alternative_name(&req, opt.san_list);
+
+        if (ret != 0) {
+            mbedtls_printf(
+                " failed\n  !  mbedtls_x509write_csr_set_subject_alternative_name returned %d",
+                ret);
+            goto exit;
+        }
     }
 
     /*
@@ -363,6 +459,14 @@
     mbedtls_ctr_drbg_free(&ctr_drbg);
     mbedtls_entropy_free(&entropy);
 
+    cur = opt.san_list;
+    while (cur != NULL) {
+        prev = cur;
+        cur = cur->next;
+        mbedtls_free(prev);
+    }
+
+
     mbedtls_exit(exit_code);
 }
 #endif /* MBEDTLS_X509_CSR_WRITE_C && MBEDTLS_PK_PARSE_C && MBEDTLS_FS_IO &&
diff --git a/scripts/config.py b/scripts/config.py
index a53c470..404a5ef 100755
--- a/scripts/config.py
+++ b/scripts/config.py
@@ -215,6 +215,7 @@
     'MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN', # build dependency (clang+memsan)
     'MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND', # build dependency (valgrind headers)
     'MBEDTLS_X509_REMOVE_INFO', # removes a feature
+    'MBEDTLS_SSL_RECORD_SIZE_LIMIT', # in development, currently breaks other tests
 ])
 
 def is_seamless_alt(name):
diff --git a/scripts/mbedtls_dev/ecp.py b/scripts/mbedtls_dev/ecp.py
index 354b234..ffe48fc 100644
--- a/scripts/mbedtls_dev/ecp.py
+++ b/scripts/mbedtls_dev/ecp.py
@@ -145,6 +145,79 @@
         return True
 
 
+class EcpP256R1Raw(bignum_common.ModOperationCommon,
+                   EcpTarget):
+    """Test cases for ECP P256 fast reduction."""
+    symbol = "-"
+    test_function = "ecp_mod_p256_raw"
+    test_name = "ecp_mod_p256_raw"
+    input_style = "fixed"
+    arity = 1
+
+    moduli = ["ffffffff00000001000000000000000000000000ffffffffffffffffffffffff"] # type: List[str]
+
+    input_values = [
+        "0", "1",
+
+        # Modulus - 1
+        "ffffffff00000001000000000000000000000000fffffffffffffffffffffffe",
+
+        # Maximum canonical P256 multiplication result
+        ("fffffffe00000002fffffffe0000000100000001fffffffe00000001fffffffc"
+         "00000003fffffffcfffffffffffffffffffffffc000000000000000000000004"),
+
+        # Generate an overflow during reduction
+        ("0000000000000000000000010000000000000000000000000000000000000000"
+         "00000000000000000000000000000000000000000000000000000000ffffffff"),
+
+        # Generate an underflow during reduction
+        ("0000000000000000000000000000000000000000000000000000000000000010"
+         "ffffffff00000000000000000000000000000000000000000000000000000000"),
+
+        # Generate an overflow during carry reduction
+        ("aaaaaaaa00000000000000000000000000000000000000000000000000000000"
+         "00000000000000000000000000000000aaaaaaacaaaaaaaaaaaaaaaa00000000"),
+
+        # Generate an underflow during carry reduction
+        ("000000000000000000000001ffffffff00000000000000000000000000000000"
+         "0000000000000000000000000000000000000002000000020000000100000002"),
+
+        # First 8 number generated by random.getrandbits(512) - seed(2,2)
+        ("4067c3584ee207f8da94e3e8ab73738fcf1822ffbc6887782b491044d5e34124"
+         "5c6e433715ba2bdd177219d30e7a269fd95bafc8f2a4d27bdcf4bb99f4bea973"),
+        ("82523e86feac7eb7dc38f519b91751dacdbd47d364be8049a372db8f6e405d93"
+         "ffed9235288bc781ae66267594c9c9500925e4749b575bd13653f8dd9b1f282e"),
+        ("e8624fab5186ee32ee8d7ee9770348a05d300cb90706a045defc044a09325626"
+         "e6b58de744ab6cce80877b6f71e1f6d2ef8acd128b4f2fc15f3f57ebf30b94fa"),
+        ("829a48d422fe99a22c70501e533c91352d3d854e061b90303b08c6e33c729578"
+         "2d6c797f8f7d9b782a1be9cd8697bbd0e2520e33e44c50556c71c4a66148a86f"),
+        ("e89204e2e8168561867e5e15bc01bfce6a27e0dfcbf8754472154e76e4c11ab2"
+         "fec3f6b32e8d4b8a8f54f8ceacaab39e83844b40ffa9b9f15c14bc4a829e07b0"),
+        ("bd143fa9b714210c665d7435c1066932f4767f26294365b2721dea3bf63f23d0"
+         "dbe53fcafb2147df5ca495fa5a91c89b97eeab64ca2ce6bc5d3fd983c34c769f"),
+        ("74667bffe202849da9643a295a9ac6decbd4d3e2d4dec9ef83f0be4e80371eb9"
+         "7f81375eecc1cb6347733e847d718d733ff98ff387c56473a7a83ee0761ebfd2"),
+        ("d08f1bb2531d6460f0caeef038c89b38a8acb5137c9260dc74e088a9b9492f25"
+         "8ebdbfe3eb9ac688b9d39cca91551e8259cc60b17604e4b4e73695c3e652c71a"),
+
+        # Next 2 number generated by random.getrandbits(256)
+        "c5e2486c44a4a8f69dc8db48e86ec9c6e06f291b2a838af8d5c44a4eb3172062",
+        "d4c0dca8b4c9e755cc9c3adcf515a8234da4daeb4f3f87777ad1f45ae9500ec9"
+    ]
+
+    @property
+    def arg_a(self) -> str:
+        return super().format_arg('{:x}'.format(self.int_a)).zfill(2 * self.hex_digits)
+
+    def result(self) -> List[str]:
+        result = self.int_a % self.int_n
+        return [self.format_result(result)]
+
+    @property
+    def is_valid(self) -> bool:
+        return True
+
+
 class EcpP521R1Raw(bignum_common.ModOperationCommon,
                    EcpTarget):
     """Test cases for ecp quasi_reduction()."""
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 4549a7a..9bd93f1 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -237,7 +237,9 @@
             test_suite_${data_name}.datax
     )
 
-    add_executable(test_suite_${data_name} test_suite_${data_name}.c $<TARGET_OBJECTS:mbedtls_test>)
+    add_executable(test_suite_${data_name} test_suite_${data_name}.c
+                   $<TARGET_OBJECTS:mbedtls_test>
+                   $<TARGET_OBJECTS:mbedtls_test_helpers>)
     add_dependencies(test_suite_${data_name} ${dependency})
     target_link_libraries(test_suite_${data_name} ${libs})
     # Include test-specific header files from ./include and private header
diff --git a/tests/Makefile b/tests/Makefile
index 26947f4..75dc3c6 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -160,7 +160,7 @@
 $(MBEDLIBS):
 	$(MAKE) -C ../library
 
-MBEDTLS_TEST_OBJS=$(patsubst %.c,%.o,$(wildcard src/*.c src/drivers/*.c))
+MBEDTLS_TEST_OBJS=$(patsubst %.c,%.o,$(wildcard src/*.c src/drivers/*.c src/test_helpers/*.c))
 
 mbedtls_test: $(MBEDTLS_TEST_OBJS)
 
@@ -181,6 +181,10 @@
 	echo "  CC    $<"
 	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) -o $@ -c $<
 
+src/test_helpers/%.o : src/test_helpers/%.c
+	echo "  CC    $<"
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) -o $@ -c $<
+
 C_FILES := $(addsuffix .c,$(APPS))
 c: $(C_FILES)
 
@@ -217,7 +221,7 @@
 clean:
 ifndef WINDOWS
 	rm -rf $(BINARIES) *.c *.datax
-	rm -f src/*.o src/drivers/*.o src/libmbed*
+	rm -f src/*.o src/drivers/*.o src/test_helpers/*.o src/libmbed*
 	rm -f include/test/instrument_record_status.h
 	rm -f include/alt-extra/*/*_alt.h
 	rm -rf libtestdriver1
@@ -228,6 +232,7 @@
 	if exist *.datax del /Q /F *.datax
 	if exist src/*.o del /Q /F src/*.o
 	if exist src/drivers/*.o del /Q /F src/drivers/*.o
+	if exist src/test_helpers/*.o del /Q /F src/test_helpers/*.o
 	if exist src/libmbed* del /Q /F src/libmed*
 	if exist include/test/instrument_record_status.h del /Q /F include/test/instrument_record_status.h
 endif
diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile
index e638caf..7cdbd24 100644
--- a/tests/data_files/Makefile
+++ b/tests/data_files/Makefile
@@ -1006,7 +1006,7 @@
 
 server1.req.sha256.ext: server1.key
 	# Generating this with OpenSSL as a comparison point to test we're getting the same result
-	openssl req -new -out $@ -key $< -subj '/C=NL/O=PolarSSL/CN=PolarSSL Server 1' -sha256 -addext "extendedKeyUsage=serverAuth"
+	openssl req -new -out $@ -key $< -subj '/C=NL/O=PolarSSL/CN=PolarSSL Server 1' -sha256 -addext "extendedKeyUsage=serverAuth" -addext "subjectAltName=URI:http://pki.example.com/,IP:127.1.1.0,DNS:example.com"
 all_final += server1.req.sha256.ext
 
 server1.req.sha384: server1.key
diff --git a/tests/data_files/server1.req.sha256.ext b/tests/data_files/server1.req.sha256.ext
index 3f26f09..c5ff5c5 100644
--- a/tests/data_files/server1.req.sha256.ext
+++ b/tests/data_files/server1.req.sha256.ext
@@ -1,17 +1,18 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICpzCCAY8CAQAwPDELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRow
+MIIC3jCCAcYCAQAwPDELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRow
 GAYDVQQDDBFQb2xhclNTTCBTZXJ2ZXIgMTCCASIwDQYJKoZIhvcNAQEBBQADggEP
 ADCCAQoCggEBAKkCHz1AatVVU4v9Nu6CZS4VYV6Jv7joRZDb7ogWUtPxQ1BHlhJZ
 ZIdr/SvgRvlzvt3PkuGRW+1moG+JKXlFgNCDatVBQ3dfOXwJBEeCsFc5cO2j7BUZ
 HqgzCEfBBUKp/UzDtN/dBh9NEFFAZ3MTD0D4bYElXwqxU8YwfhU5rPla7n+SnqYF
 W+cTl4W1I5LZ1CQG1QkliXUH3aYajz8JGb6tZSxk65Wb3P5BXhem2mxbacwCuhQs
 FiScStzN0PdSZ3PxLaAj/X70McotcMqJCwTbLqZPcG6ezr1YieJTWZ5uWpJl4og/
-DJQZo93l6J2VE+0p26twEtxaymsXq1KCVLECAwEAAaAmMCQGCSqGSIb3DQEJDjEX
-MBUwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggEBAHi0yEGu
-Fh5tuLiLuT95UrRnly55+lTY9xchFiKtlcoEdSheybYxqk3JHuSSqojOFKZBlRdk
-oG6Azg56/aMHPWyvtCMSRQX4b+FgjeQsm9IfhYNMquQOxyPxm62vjuU3MfZIofXH
-hKdI6Ci2CDF4Fyvw50KBWniV38eE9+kjsvDLdXD3ESZJGhjjuFl8ReUiA2wdBTcP
-XEZaXUIc6B4tUnlPeqn/2zp4GBqqWzNZx6TXBpApASGG3BEJnM52FVPC7E9p+8YZ
-qIGuiF5Cz/rYZkpwffBWIfS2zZakHLm5TB8FgZkWlyReJU9Ihk2Tl/sZ1kllFdYa
-xLPnLCL82KFL1Co=
+DJQZo93l6J2VE+0p26twEtxaymsXq1KCVLECAwEAAaBdMFsGCSqGSIb3DQEJDjFO
+MEwwEwYDVR0lBAwwCgYIKwYBBQUHAwEwNQYDVR0RBC4wLIYXaHR0cDovL3BraS5l
+eGFtcGxlLmNvbS+HBH8BAQCCC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4IB
+AQCGmTIXEUvTqwChkzRtxPIQDDchrMnCXgUrTSxre5nvUOpjVlcIIPGWAwxRovfe
+pW6OaGZ/3xD0dRAcOW08sTD6GRUazFrubPA1eZiNC7vYdWV59qm84N5yRR/s8Hm+
+okwI47m7W9C0pfaNXchgFUQBn16TrZxPXklbCpBJ/TFV+1ODY0sJPHYiCFpYI+Jz
+YuJmadP2BHucl8wv2RyVHywOmV1sDc74i9igVrBCAh8wu+kqImMtrnkGZDxrnj/L
+5P1eDfdqG2cN+s40RnMQMosh3UfqpNV/bTgAqBPP2uluT9L1KpWcjZeuvisOgVTq
+XwFI5s34fen2DUVw6MWNfbDK
 -----END CERTIFICATE REQUEST-----
diff --git a/tests/include/test/psa_crypto_helpers.h b/tests/include/test/psa_crypto_helpers.h
index 19a0483..38a60b4 100644
--- a/tests/include/test/psa_crypto_helpers.h
+++ b/tests/include/test/psa_crypto_helpers.h
@@ -24,15 +24,43 @@
 #include "test/helpers.h"
 
 #if defined(MBEDTLS_PSA_CRYPTO_C)
-
 #include "test/psa_helpers.h"
-
 #include <psa/crypto.h>
+#endif
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
 #include "mbedtls/psa_util.h"
 #endif
 
+#if defined(MBEDTLS_PSA_CRYPTO_C)
+/** Initialize the PSA Crypto subsystem. */
+#define PSA_INIT() PSA_ASSERT(psa_crypto_init())
+
+/** Shut down the PSA Crypto subsystem and destroy persistent keys.
+ * Expect a clean shutdown, with no slots in use.
+ *
+ * If some key slots are still in use, record the test case as failed,
+ * but continue executing. This macro is suitable (and primarily intended)
+ * for use in the cleanup section of test functions.
+ *
+ * \note Persistent keys must be recorded with #TEST_USES_KEY_ID before
+ *       creating them.
+ */
+#define PSA_DONE()                                                      \
+    do                                                                  \
+    {                                                                   \
+        mbedtls_test_fail_if_psa_leaking(__LINE__, __FILE__);           \
+        mbedtls_test_psa_purge_key_storage();                           \
+        mbedtls_psa_crypto_free();                                      \
+    }                                                                   \
+    while (0)
+#else /*MBEDTLS_PSA_CRYPTO_C */
+#define PSA_INIT() ((void) 0)
+#define PSA_DONE() ((void) 0)
+#endif /* MBEDTLS_PSA_CRYPTO_C */
+
+#if defined(MBEDTLS_PSA_CRYPTO_C)
+
 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
 
 /* Internal function for #TEST_USES_KEY_ID. Return 1 on success, 0 on failure. */
@@ -86,8 +114,6 @@
 
 #endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C */
 
-#define PSA_INIT() PSA_ASSERT(psa_crypto_init())
-
 /** Check for things that have not been cleaned up properly in the
  * PSA subsystem.
  *
@@ -104,30 +130,11 @@
  * `TEST_ASSERT( ! mbedtls_test_helper_is_psa_leaking( ) )`
  * but with a more informative message.
  */
-#define ASSERT_PSA_PRISTINE()                                          \
+#define ASSERT_PSA_PRISTINE()                                           \
     do                                                                  \
     {                                                                   \
-        if (test_fail_if_psa_leaking(__LINE__, __FILE__))            \
-        goto exit;                                                  \
-    }                                                                   \
-    while (0)
-
-/** Shut down the PSA Crypto subsystem and destroy persistent keys.
- * Expect a clean shutdown, with no slots in use.
- *
- * If some key slots are still in use, record the test case as failed,
- * but continue executing. This macro is suitable (and primarily intended)
- * for use in the cleanup section of test functions.
- *
- * \note Persistent keys must be recorded with #TEST_USES_KEY_ID before
- *       creating them.
- */
-#define PSA_DONE()                                                     \
-    do                                                                  \
-    {                                                                   \
-        test_fail_if_psa_leaking(__LINE__, __FILE__);                 \
-        mbedtls_test_psa_purge_key_storage();                          \
-        mbedtls_psa_crypto_free();                                     \
+        if (mbedtls_test_fail_if_psa_leaking(__LINE__, __FILE__))       \
+        goto exit;                                                      \
     }                                                                   \
     while (0)
 
@@ -193,6 +200,14 @@
  */
 psa_key_usage_t mbedtls_test_update_key_usage_flags(psa_key_usage_t usage_flags);
 
+/** Check that no PSA Crypto key slots are in use.
+ *
+ * If any slots are in use, mark the current test as failed.
+ *
+ * \return 0 if the key store is empty, 1 otherwise.
+ */
+int mbedtls_test_fail_if_psa_leaking(int line_no, const char *filename);
+
 /** Skip a test case if the given key is a 192 bits AES key and the AES
  *  implementation is at least partially provided by an accelerator or
  *  alternative implementation.
@@ -287,6 +302,7 @@
 #define PSA_INIT_IF_NO_MD() ((void) 0)
 #define PSA_DONE_IF_NO_MD() ((void) 0)
 #endif
+
 /** \def USE_PSA_INIT
  *
  * Call this macro to initialize the PSA subsystem if #MBEDTLS_USE_PSA_CRYPTO
diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h
new file mode 100644
index 0000000..b38c58a
--- /dev/null
+++ b/tests/include/test/ssl_helpers.h
@@ -0,0 +1,581 @@
+/** \file ssl_helpers.h
+ *
+ * \brief This file contains helper functions to set up a TLS connection.
+ */
+
+/*
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+#ifndef SSL_HELPERS_H
+#define SSL_HELPERS_H
+
+#include "mbedtls/build_info.h"
+
+#include <string.h>
+
+#include <test/helpers.h>
+#include <test/macros.h>
+#include <test/random.h>
+#include <test/psa_crypto_helpers.h>
+
+#if defined(MBEDTLS_SSL_TLS_C)
+#include <ssl_misc.h>
+#include <mbedtls/timing.h>
+#include <mbedtls/debug.h>
+#include "hash_info.h"
+
+#include "test/certs.h"
+
+#if defined(MBEDTLS_SSL_CACHE_C)
+#include "mbedtls/ssl_cache.h"
+#endif
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+#define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
+                                                           psa_to_ssl_errors, \
+                                                           psa_generic_status_to_mbedtls)
+#endif
+
+#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||    \
+    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||  \
+    defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
+#define MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
+#endif
+enum {
+#define MBEDTLS_SSL_TLS1_3_LABEL(name, string)          \
+    tls13_label_ ## name,
+    MBEDTLS_SSL_TLS1_3_LABEL_LIST
+#undef MBEDTLS_SSL_TLS1_3_LABEL
+};
+
+typedef struct mbedtls_test_ssl_log_pattern {
+    const char *pattern;
+    size_t counter;
+} mbedtls_test_ssl_log_pattern;
+
+typedef struct mbedtls_test_handshake_test_options {
+    const char *cipher;
+    mbedtls_ssl_protocol_version client_min_version;
+    mbedtls_ssl_protocol_version client_max_version;
+    mbedtls_ssl_protocol_version server_min_version;
+    mbedtls_ssl_protocol_version server_max_version;
+    mbedtls_ssl_protocol_version expected_negotiated_version;
+    int expected_handshake_result;
+    int expected_ciphersuite;
+    int pk_alg;
+    int opaque_alg;
+    int opaque_alg2;
+    int opaque_usage;
+    data_t *psk_str;
+    int dtls;
+    int srv_auth_mode;
+    int serialize;
+    int mfl;
+    int cli_msg_len;
+    int srv_msg_len;
+    int expected_cli_fragments;
+    int expected_srv_fragments;
+    int renegotiate;
+    int legacy_renegotiation;
+    void *srv_log_obj;
+    void *cli_log_obj;
+    void (*srv_log_fun)(void *, int, const char *, int, const char *);
+    void (*cli_log_fun)(void *, int, const char *, int, const char *);
+    int resize_buffers;
+#if defined(MBEDTLS_SSL_CACHE_C)
+    mbedtls_ssl_cache_context *cache;
+#endif
+} mbedtls_test_handshake_test_options;
+
+typedef struct mbedtls_test_ssl_buffer {
+    size_t start;
+    size_t content_length;
+    size_t capacity;
+    unsigned char *buffer;
+} mbedtls_test_ssl_buffer;
+
+/*
+ * Context for a message metadata queue (fifo) that is on top of the ring buffer.
+ */
+typedef struct mbedtls_test_ssl_message_queue {
+    size_t *messages;
+    int pos;
+    int num;
+    int capacity;
+} mbedtls_test_ssl_message_queue;
+
+/*
+ * Context for the I/O callbacks simulating network connection.
+ */
+
+#define MBEDTLS_MOCK_SOCKET_CONNECTED 1
+
+typedef struct mbedtls_test_mock_socket {
+    int status;
+    mbedtls_test_ssl_buffer *input;
+    mbedtls_test_ssl_buffer *output;
+    struct mbedtls_test_mock_socket *peer;
+} mbedtls_test_mock_socket;
+
+/* Errors used in the message socket mocks */
+
+#define MBEDTLS_TEST_ERROR_CONTEXT_ERROR -55
+#define MBEDTLS_TEST_ERROR_SEND_FAILED -66
+#define MBEDTLS_TEST_ERROR_RECV_FAILED -77
+
+/*
+ * Structure used as an addon, or a wrapper, around the mocked sockets.
+ * Contains an input queue, to which the other socket pushes metadata,
+ * and an output queue, to which this one pushes metadata. This context is
+ * considered as an owner of the input queue only, which is initialized and
+ * freed in the respective setup and free calls.
+ */
+typedef struct mbedtls_test_message_socket_context {
+    mbedtls_test_ssl_message_queue *queue_input;
+    mbedtls_test_ssl_message_queue *queue_output;
+    mbedtls_test_mock_socket *socket;
+} mbedtls_test_message_socket_context;
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+
+/*
+ * Structure with endpoint's certificates for SSL communication tests.
+ */
+typedef struct mbedtls_test_ssl_endpoint_certificate {
+    mbedtls_x509_crt *ca_cert;
+    mbedtls_x509_crt *cert;
+    mbedtls_pk_context *pkey;
+} mbedtls_test_ssl_endpoint_certificate;
+
+/*
+ * Endpoint structure for SSL communication tests.
+ */
+typedef struct mbedtls_test_ssl_endpoint {
+    const char *name;
+    mbedtls_ssl_context ssl;
+    mbedtls_ssl_config conf;
+    mbedtls_test_mock_socket socket;
+    mbedtls_test_ssl_endpoint_certificate cert;
+} mbedtls_test_ssl_endpoint;
+
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
+/*
+ * This function can be passed to mbedtls to receive output logs from it. In
+ * this case, it will count the instances of a mbedtls_test_ssl_log_pattern
+ * in the received logged messages.
+ */
+void mbedtls_test_ssl_log_analyzer(void *ctx, int level,
+                                   const char *file, int line,
+                                   const char *str);
+
+void mbedtls_test_init_handshake_options(
+    mbedtls_test_handshake_test_options *opts);
+
+void mbedtls_test_free_handshake_options(
+    mbedtls_test_handshake_test_options *opts);
+
+/*
+ * Initialises \p buf. After calling this function it is safe to call
+ * `mbedtls_test_ssl_buffer_free()` on \p buf.
+ */
+void mbedtls_test_ssl_buffer_init(mbedtls_test_ssl_buffer *buf);
+
+/*
+ * Sets up \p buf. After calling this function it is safe to call
+ * `mbedtls_test_ssl_buffer_put()` and `mbedtls_test_ssl_buffer_get()`
+ * on \p buf.
+ */
+int mbedtls_test_ssl_buffer_setup(mbedtls_test_ssl_buffer *buf,
+                                  size_t capacity);
+
+void mbedtls_test_ssl_buffer_free(mbedtls_test_ssl_buffer *buf);
+
+/*
+ * Puts \p input_len bytes from the \p input buffer into the ring buffer \p buf.
+ *
+ * \p buf must have been initialized and set up by calling
+ * `mbedtls_test_ssl_buffer_init()` and `mbedtls_test_ssl_buffer_setup()`.
+ *
+ * \retval  \p input_len, if the data fits.
+ * \retval  0 <= value < \p input_len, if the data does not fit.
+ * \retval  -1, if \p buf is NULL, it hasn't been set up or \p input_len is not
+ *          zero and \p input is NULL.
+ */
+int mbedtls_test_ssl_buffer_put(mbedtls_test_ssl_buffer *buf,
+                                const unsigned char *input, size_t input_len);
+
+/*
+ * Gets \p output_len bytes from the ring buffer \p buf into the
+ * \p output buffer. The output buffer can be NULL, in this case a part of the
+ * ring buffer will be dropped, if the requested length is available.
+ *
+ * \p buf must have been initialized and set up by calling
+ * `mbedtls_test_ssl_buffer_init()` and `mbedtls_test_ssl_buffer_setup()`.
+ *
+ * \retval  \p output_len, if the data is available.
+ * \retval  0 <= value < \p output_len, if the data is not available.
+ * \retval  -1, if \buf is NULL or it hasn't been set up.
+ */
+int mbedtls_test_ssl_buffer_get(mbedtls_test_ssl_buffer *buf,
+                                unsigned char *output, size_t output_len);
+
+/*
+ * Errors used in the message transport mock tests
+ */
+ #define MBEDTLS_TEST_ERROR_ARG_NULL -11
+ #define MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED -44
+
+/*
+ * Setup and free functions for the message metadata queue.
+ *
+ * \p capacity describes the number of message metadata chunks that can be held
+ *    within the queue.
+ *
+ * \retval  0, if a metadata queue of a given length can be allocated.
+ * \retval  MBEDTLS_ERR_SSL_ALLOC_FAILED, if allocation failed.
+ */
+int mbedtls_test_ssl_message_queue_setup(
+    mbedtls_test_ssl_message_queue *queue, size_t capacity);
+
+void mbedtls_test_ssl_message_queue_free(
+    mbedtls_test_ssl_message_queue *queue);
+
+/*
+ * Push message length information onto the message metadata queue.
+ * This will become the last element to leave it (fifo).
+ *
+ * \retval  MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null.
+ * \retval  MBEDTLS_ERR_SSL_WANT_WRITE, if the queue is full.
+ * \retval  \p len, if the push was successful.
+ */
+int mbedtls_test_ssl_message_queue_push_info(
+    mbedtls_test_ssl_message_queue *queue, size_t len);
+
+/*
+ * Pop information about the next message length from the queue. This will be
+ * the oldest inserted message length(fifo). \p msg_len can be null, in which
+ * case the data will be popped from the queue but not copied anywhere.
+ *
+ * \retval  MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null.
+ * \retval  MBEDTLS_ERR_SSL_WANT_READ, if the queue is empty.
+ * \retval  message length, if the pop was successful, up to the given
+            \p buf_len.
+ */
+int mbedtls_test_ssl_message_queue_pop_info(
+    mbedtls_test_ssl_message_queue *queue, size_t buf_len);
+
+/*
+ * Setup and teardown functions for mock sockets.
+ */
+void mbedtls_mock_socket_init(mbedtls_test_mock_socket *socket);
+
+/*
+ * Closes the socket \p socket.
+ *
+ * \p socket must have been previously initialized by calling
+ * mbedtls_mock_socket_init().
+ *
+ * This function frees all allocated resources and both sockets are aware of the
+ * new connection state.
+ *
+ * That is, this function does not simulate half-open TCP connections and the
+ * phenomenon that when closing a UDP connection the peer is not aware of the
+ * connection having been closed.
+ */
+void mbedtls_test_mock_socket_close(mbedtls_test_mock_socket *socket);
+
+/*
+ * Establishes a connection between \p peer1 and \p peer2.
+ *
+ * \p peer1 and \p peer2 must have been previously initialized by calling
+ * mbedtls_mock_socket_init().
+ *
+ * The capacities of the internal buffers are set to \p bufsize. Setting this to
+ * the correct value allows for simulation of MTU, sanity testing the mock
+ * implementation and mocking TCP connections with lower memory cost.
+ */
+int mbedtls_test_mock_socket_connect(mbedtls_test_mock_socket *peer1,
+                                     mbedtls_test_mock_socket *peer2,
+                                     size_t bufsize);
+
+
+/*
+ * Callbacks for simulating blocking I/O over connection-oriented transport.
+ */
+int mbedtls_test_mock_tcp_send_b(void *ctx,
+                                 const unsigned char *buf, size_t len);
+
+int mbedtls_test_mock_tcp_recv_b(void *ctx, unsigned char *buf, size_t len);
+
+/*
+ * Callbacks for simulating non-blocking I/O over connection-oriented transport.
+ */
+int mbedtls_test_mock_tcp_send_nb(void *ctx,
+                                  const unsigned char *buf, size_t len);
+
+int mbedtls_test_mock_tcp_recv_nb(void *ctx, unsigned char *buf, size_t len);
+
+void mbedtls_test_message_socket_init(
+    mbedtls_test_message_socket_context *ctx);
+
+/*
+ * Setup a given message socket context including initialization of
+ * input/output queues to a chosen capacity of messages. Also set the
+ * corresponding mock socket.
+ *
+ * \retval  0, if everything succeeds.
+ * \retval  MBEDTLS_ERR_SSL_ALLOC_FAILED, if allocation of a message
+ *          queue failed.
+ */
+int mbedtls_test_message_socket_setup(
+    mbedtls_test_ssl_message_queue *queue_input,
+    mbedtls_test_ssl_message_queue *queue_output,
+    size_t queue_capacity, mbedtls_test_mock_socket *socket,
+    mbedtls_test_message_socket_context *ctx);
+
+/*
+ * Close a given message socket context, along with the socket itself. Free the
+ * memory allocated by the input queue.
+ */
+void mbedtls_test_message_socket_close(
+    mbedtls_test_message_socket_context *ctx);
+
+/*
+ * Send one message through a given message socket context.
+ *
+ * \retval  \p len, if everything succeeds.
+ * \retval  MBEDTLS_TEST_ERROR_CONTEXT_ERROR, if any of the needed context
+ *          elements or the context itself is null.
+ * \retval  MBEDTLS_TEST_ERROR_SEND_FAILED if
+ *          mbedtls_test_mock_tcp_send_b failed.
+ * \retval  MBEDTLS_ERR_SSL_WANT_WRITE, if the output queue is full.
+ *
+ * This function will also return any error from
+ * mbedtls_test_ssl_message_queue_push_info.
+ */
+int mbedtls_test_mock_tcp_send_msg(void *ctx,
+                                   const unsigned char *buf, size_t len);
+
+/*
+ * Receive one message from a given message socket context and return message
+ * length or an error.
+ *
+ * \retval  message length, if everything succeeds.
+ * \retval  MBEDTLS_TEST_ERROR_CONTEXT_ERROR, if any of the needed context
+ *          elements or the context itself is null.
+ * \retval  MBEDTLS_TEST_ERROR_RECV_FAILED if
+ *          mbedtls_test_mock_tcp_recv_b failed.
+ *
+ * This function will also return any error other than
+ * MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED from
+ * mbedtls_test_message_queue_peek_info.
+ */
+int mbedtls_test_mock_tcp_recv_msg(void *ctx,
+                                   unsigned char *buf, size_t buf_len);
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+
+/*
+ * Initializes \p ep_cert structure and assigns it to endpoint
+ * represented by \p ep.
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int mbedtls_test_ssl_endpoint_certificate_init(mbedtls_test_ssl_endpoint *ep,
+                                               int pk_alg,
+                                               int opaque_alg, int opaque_alg2,
+                                               int opaque_usage);
+
+/*
+ * Initializes \p ep structure. It is important to call
+ * `mbedtls_test_ssl_endpoint_free()` after calling this function
+ * even if it fails.
+ *
+ * \p endpoint_type must be set as MBEDTLS_SSL_IS_SERVER or
+ * MBEDTLS_SSL_IS_CLIENT.
+ * \p pk_alg the algorithm to use, currently only MBEDTLS_PK_RSA and
+ * MBEDTLS_PK_ECDSA are supported.
+ * \p dtls_context - in case of DTLS - this is the context handling metadata.
+ * \p input_queue - used only in case of DTLS.
+ * \p output_queue - used only in case of DTLS.
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int mbedtls_test_ssl_endpoint_init(
+    mbedtls_test_ssl_endpoint *ep, int endpoint_type,
+    mbedtls_test_handshake_test_options *options,
+    mbedtls_test_message_socket_context *dtls_context,
+    mbedtls_test_ssl_message_queue *input_queue,
+    mbedtls_test_ssl_message_queue *output_queue,
+    uint16_t *group_list);
+
+/*
+ * Deinitializes endpoint represented by \p ep.
+ */
+void mbedtls_test_ssl_endpoint_free(
+    mbedtls_test_ssl_endpoint *ep,
+    mbedtls_test_message_socket_context *context);
+
+/*
+ * This function moves ssl handshake from \p ssl to prescribed \p state.
+ * /p second_ssl is used as second endpoint and their sockets have to be
+ * connected before calling this function.
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int mbedtls_test_move_handshake_to_state(mbedtls_ssl_context *ssl,
+                                         mbedtls_ssl_context *second_ssl,
+                                         int state);
+
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
+/*
+ * Helper function setting up inverse record transformations
+ * using given cipher, hash, EtM mode, authentication tag length,
+ * and version.
+ */
+#define CHK(x)                                  \
+    do                                          \
+    {                                           \
+        if (!(x))                               \
+        {                                       \
+            ret = -1;                           \
+            goto cleanup;                       \
+        }                                       \
+    } while (0)
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
+    defined(MBEDTLS_CIPHER_MODE_CBC) && defined(MBEDTLS_AES_C)
+int mbedtls_test_psa_cipher_encrypt_helper(mbedtls_ssl_transform *transform,
+                                           const unsigned char *iv,
+                                           size_t iv_len,
+                                           const unsigned char *input,
+                                           size_t ilen,
+                                           unsigned char *output,
+                                           size_t *olen);
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_CIPHER_MODE_CBC &&
+          MBEDTLS_AES_C */
+
+int mbedtls_test_ssl_build_transforms(mbedtls_ssl_transform *t_in,
+                                      mbedtls_ssl_transform *t_out,
+                                      int cipher_type, int hash_id,
+                                      int etm, int tag_mode,
+                                      mbedtls_ssl_protocol_version tls_version,
+                                      size_t cid0_len,
+                                      size_t cid1_len);
+
+/*
+ * Populate a session structure for serialization tests.
+ * Choose dummy values, mostly non-0 to distinguish from the init default.
+ */
+int mbedtls_test_ssl_tls12_populate_session(mbedtls_ssl_session *session,
+                                            int ticket_len,
+                                            const char *crt_file);
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+int mbedtls_test_ssl_tls13_populate_session(mbedtls_ssl_session *session,
+                                            int ticket_len,
+                                            int endpoint_type);
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
+/*
+ * Perform data exchanging between \p ssl_1 and \p ssl_2 and check if the
+ * message was sent in the correct number of fragments.
+ *
+ * /p ssl_1 and /p ssl_2    Endpoints represented by mbedtls_ssl_context. Both
+ *                          of them must be initialized and connected
+ *                          beforehand.
+ * /p msg_len_1 and /p msg_len_2 specify the size of the message to send.
+ * /p expected_fragments_1 and /p expected_fragments_2 determine in how many
+ *                          fragments the message should be sent.
+ *      expected_fragments is 0: can be used for DTLS testing while the message
+ *                          size is larger than MFL. In that case the message
+ *                          cannot be fragmented and sent to the second
+ *                          endpoint.
+ *                          This value can be used for negative tests.
+ *      expected_fragments is 1: can be used for TLS/DTLS testing while the
+ *                          message size is below MFL
+ *      expected_fragments > 1: can be used for TLS testing while the message
+ *                          size is larger than MFL
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int mbedtls_exchange_data(mbedtls_ssl_context *ssl_1,
+                          int msg_len_1, const int expected_fragments_1,
+                          mbedtls_ssl_context *ssl_2,
+                          int msg_len_2, const int expected_fragments_2);
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+void mbedtls_test_ssl_perform_handshake(
+    mbedtls_test_handshake_test_options *options);
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
+#if defined(MBEDTLS_TEST_HOOKS)
+/*
+ * Tweak vector lengths in a TLS 1.3 Certificate message
+ *
+ * \param[in]       buf    Buffer containing the Certificate message to tweak
+ * \param[in]]out]  end    End of the buffer to parse
+ * \param           tweak  Tweak identifier (from 1 to the number of tweaks).
+ * \param[out]  expected_result  Error code expected from the parsing function
+ * \param[out]  args  Arguments of the MBEDTLS_SSL_CHK_BUF_READ_PTR call that
+ *                    is expected to fail. All zeroes if no
+ *                    MBEDTLS_SSL_CHK_BUF_READ_PTR failure is expected.
+ */
+int tweak_tls13_certificate_msg_vector_len(
+    unsigned char *buf, unsigned char **end, int tweak,
+    int *expected_result, mbedtls_ssl_chk_buf_ptr_args *args);
+#endif /* MBEDTLS_TEST_HOOKS */
+
+#define ECJPAKE_TEST_PWD        "bla"
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+#define ECJPAKE_TEST_SET_PASSWORD(exp_ret_val)                            \
+    ret = (use_opaque_arg) ?                                              \
+          mbedtls_ssl_set_hs_ecjpake_password_opaque(&ssl, pwd_slot) :    \
+          mbedtls_ssl_set_hs_ecjpake_password(&ssl, pwd_string, pwd_len); \
+    TEST_EQUAL(ret, exp_ret_val)
+#else
+#define ECJPAKE_TEST_SET_PASSWORD(exp_ret_val)                            \
+    ret = mbedtls_ssl_set_hs_ecjpake_password(&ssl,                       \
+                                              pwd_string, pwd_len);       \
+    TEST_EQUAL(ret, exp_ret_val)
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
+#define TEST_AVAILABLE_ECC(tls_id_, group_id_, psa_family_, psa_bits_)   \
+    TEST_EQUAL(mbedtls_ssl_get_ecp_group_id_from_tls_id(tls_id_),        \
+               group_id_);                                               \
+    TEST_EQUAL(mbedtls_ssl_get_tls_id_from_ecp_group_id(group_id_),      \
+               tls_id_);                                                 \
+    TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_,       \
+                                                          &psa_family, &psa_bits), PSA_SUCCESS);                \
+    TEST_EQUAL(psa_family_, psa_family);                                 \
+    TEST_EQUAL(psa_bits_, psa_bits);
+
+#define TEST_UNAVAILABLE_ECC(tls_id_, group_id_, psa_family_, psa_bits_) \
+    TEST_EQUAL(mbedtls_ssl_get_ecp_group_id_from_tls_id(tls_id_),        \
+               MBEDTLS_ECP_DP_NONE);                                     \
+    TEST_EQUAL(mbedtls_ssl_get_tls_id_from_ecp_group_id(group_id_),      \
+               0);                                                       \
+    TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_,       \
+                                                          &psa_family, &psa_bits), \
+               PSA_ERROR_NOT_SUPPORTED);
+
+#endif /* MBEDTLS_SSL_TLS_C */
+
+#endif /* SSL_HELPERS_H */
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index fef88c4..7ba99ec 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -1230,8 +1230,9 @@
     scripts/config.py unset MBEDTLS_PKCS7_C
     # Disable indirect dependencies of MD
     scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # needs HMAC_DRBG
-    # Enable "light" subset of MD
-    make CFLAGS="$ASAN_CFLAGS -DMBEDTLS_MD_LIGHT" LDFLAGS="$ASAN_CFLAGS"
+    # Note: MD-light is auto-enabled in build_info.h by modules that need it,
+    # which we haven't disabled, so no need to explicitly enable it.
+    make CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
 
     # Make sure we don't have the HMAC functions, but the hashing functions
     not grep mbedtls_md_hmac library/md.o
@@ -2062,12 +2063,12 @@
     scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
     scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
 
-    # These hashes are needed for some ECDSA signature tests.
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA224_C
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA384_C
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA512_C
-
     loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
+    # These hashes are needed for some ECDSA signature tests.
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_224"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_256"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_384"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_512"
     make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
 
     # Configure and build the main libraries
@@ -2135,14 +2136,13 @@
     scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
     scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
 
-    # SHA-1 and all variants of SHA-2 are needed for ECDSA and X.509 tests,
-    # but only SHA-256 is enabled by default, so enable the others.
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA1_C
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA224_C
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA384_C
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA512_C
-
     loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
+    # SHA-1 and all variants of SHA-2 are needed for ECDSA and X.509 tests
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_1"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_224"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_256"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_384"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_512"
     make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
 
     # Configure and build the main libraries with drivers enabled
@@ -2312,7 +2312,8 @@
     msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDH + USE_PSA"
     make test
 
-    # ssl-opt.sh later (probably doesn't pass right now)
+    msg "test: ssl-opt.sh"
+    tests/ssl-opt.sh
 }
 
 # Keep in sync with component_test_psa_crypto_config_accel_ecdh_use_psa.
@@ -2331,7 +2332,8 @@
     msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with reference ECDH + USE_PSA"
     make test
 
-    # ssl-opt.sh later when the accel component is ready
+    msg "test: ssl-opt.sh"
+    tests/ssl-opt.sh
 }
 
 # Auxiliary function to build config for EC JPAKE with and without drivers.
@@ -2376,7 +2378,7 @@
     scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
 
     loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
-    make -C tests libtestdriver1.a CFLAGS="-O0 -g $ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
+    make -C tests libtestdriver1.a CFLAGS=" $ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
 
     # Configure and build the main libraries
     # --------------------------------------
@@ -2386,8 +2388,7 @@
 
     # Build the main library
     loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
-    #make CFLAGS="$ASAN_CFLAGS -O -Werror -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
-    make CFLAGS="$ASAN_CFLAGS -O0 -g -Werror -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
+    make CFLAGS="$ASAN_CFLAGS -O -Werror -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
 
     # Make sure this was not re-enabled by accident (additive config)
     not grep mbedtls_ecjpake_ library/ecjpake.o
@@ -2422,6 +2423,64 @@
     tests/ssl-opt.sh
 }
 
+component_test_psa_crypto_config_accel_ecc () {
+    msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECC"
+
+    # Algorithms and key types to accelerate
+    loc_accel_list="ALG_ECDH ALG_ECDSA ALG_DETERMINISTIC_ECDSA ALG_JPAKE KEY_TYPE_ECC_KEY_PAIR KEY_TYPE_ECC_PUBLIC_KEY"
+
+    # Configure and build the test driver library
+    # --------------------------------------------
+
+    # Disable ALG_STREAM_CIPHER and ALG_ECB_NO_PADDING to avoid having
+    # partial support for cipher operations in the driver test library.
+    scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
+    scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
+
+    loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
+    # These hashes are needed for some ECDSA signature tests.
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_224"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_256"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_384"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_512"
+    make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
+
+    # Configure and build the main libraries
+    # ---------------------------------------
+
+    # start with default + driver support
+    scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS
+    scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
+
+    # disable modules for which we have drivers
+    scripts/config.py unset MBEDTLS_ECDSA_C
+    scripts/config.py unset MBEDTLS_ECDH_C
+    scripts/config.py unset MBEDTLS_ECJPAKE_C
+
+    # dependencies
+    #scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 # not in default anyway
+    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
+    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+    scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
+
+    # build and link with test drivers
+    loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
+    make CFLAGS="$ASAN_CFLAGS -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
+
+    # make sure these were not auto-re-enabled by accident
+    not grep mbedtls_ecdh_ library/ecdh.o
+    not grep mbedtls_ecdsa_ library/ecdsa.o
+    not grep mbedtls_ecjpake_ library/ecjpake.o
+
+    # Run the tests
+    # -------------
+
+    msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECC"
+    make test
+}
+
 component_test_psa_crypto_config_accel_rsa_signature () {
     msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated RSA signature"
 
@@ -2450,14 +2509,10 @@
     #   PSA_ALG_ANY_HASH as algorithm to test with the key, the chosen hash
     #   algorithm based on the hashes supported by the library is also
     #   supported by the test library.
+    # Disabled unwanted hashes here, we'll enable hashes we want in loc_accel_flags.
     scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_MD5
     scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_RIPEMD160_C
 
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA1_C
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA224_C
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_SHA512_C
-    # We need to define either MD_C or all of the PSA_WANT_ALG_SHAxxx.
-    scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_MD_C
     # We need PEM parsing in the test library as well to support the import
     # of PEM encoded RSA keys.
     scripts/config.py -f tests/include/test/drivers/config_test_driver.h set MBEDTLS_PEM_PARSE_C
@@ -2465,6 +2520,12 @@
 
     loc_accel_list="ALG_RSA_PKCS1V15_SIGN ALG_RSA_PSS KEY_TYPE_RSA_KEY_PAIR KEY_TYPE_RSA_PUBLIC_KEY"
     loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
+    # These hashes are needed for some RSA-PSS signature tests.
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_1"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_224"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_256"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_384"
+    loc_accel_flags="$loc_accel_flags -DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_ALG_SHA_512"
     make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
 
     # Mbed TLS library build
@@ -2528,6 +2589,29 @@
     make test
 }
 
+component_test_psa_crypto_config_accel_hash_keep_builtins () {
+    msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated+builtin hash"
+    # This component ensures that all the test cases for
+    # md_psa_dynamic_dispatch with legacy+driver in test_suite_md are run.
+
+    # Disable ALG_STREAM_CIPHER and ALG_ECB_NO_PADDING to avoid having
+    # partial support for cipher operations in the driver test library.
+    scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_STREAM_CIPHER
+    scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_ECB_NO_PADDING
+
+    loc_accel_list="ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512"
+    loc_accel_flags=$( echo "$loc_accel_list" | sed 's/[^ ]* */-DLIBTESTDRIVER1_MBEDTLS_PSA_ACCEL_&/g' )
+    make -C tests libtestdriver1.a CFLAGS="$ASAN_CFLAGS $loc_accel_flags" LDFLAGS="$ASAN_CFLAGS"
+
+    scripts/config.py set MBEDTLS_PSA_CRYPTO_DRIVERS
+    scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
+    loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
+    make CFLAGS="$ASAN_CFLAGS -Werror -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS"
+
+    msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated+builtin hash"
+    make test
+}
+
 # Auxiliary function to build config for hashes with and without drivers
 config_psa_crypto_hash_use_psa () {
     DRIVER_ONLY="$1"
@@ -2591,8 +2675,9 @@
     make CFLAGS="$ASAN_CFLAGS -Werror -I../tests/include -I../tests -I../../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS" all
 
     # There's a risk of something getting re-enabled via config_psa.h;
-    # make sure it did not happen.
-    not grep mbedtls_md library/md.o
+    # make sure it did not happen. Note: it's OK for MD_LIGHT to be enabled,
+    # but not the full MD_C (for now), so check mbedtls_md_hmac for that.
+    not grep mbedtls_md_hmac library/md.o
     not grep mbedtls_md5 library/md5.o
     not grep mbedtls_sha1 library/sha1.o
     not grep mbedtls_sha256 library/sha256.o
@@ -3785,6 +3870,11 @@
     # ARM Compiler 6 - Target ARMv8.2-A - AArch64
     armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8.2-a+crypto"
 }
+support_build_armcc () {
+    armc5_cc="$ARMC5_BIN_DIR/armcc"
+    armc6_cc="$ARMC6_BIN_DIR/armclang"
+    (check_tools "$armc5_cc" "$armc6_cc" > /dev/null 2>&1)
+}
 
 component_test_tls13_only () {
     msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3, without MBEDTLS_SSL_PROTO_TLS1_2"
@@ -3913,6 +4003,21 @@
     tests/ssl-opt.sh
 }
 
+component_test_tls13_only_record_size_limit () {
+    msg "build: TLS 1.3 only from default, record size limit extension enabled"
+    scripts/config.py set MBEDTLS_SSL_RECORD_SIZE_LIMIT
+    make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
+
+    msg "test_suite_ssl: TLS 1.3 only, record size limit extension enabled"
+    cd tests; ./test_suite_ssl; cd ..
+
+    msg "ssl-opt.sh: (TLS 1.3 only, record size limit extension tests only)"
+    # Both the server and the client will currently abort the handshake when they encounter the
+    # record size limit extension. There is no way to prevent gnutls-cli from sending the extension
+    # which makes all G_NEXT_CLI + P_SRV tests fail. Thus, run only the tests for the this extension.
+    tests/ssl-opt.sh -f "Record Size Limit"
+}
+
 component_build_mingw () {
     msg "build: Windows cross build - mingw64, make (Link Library)" # ~ 30s
     make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 lib programs
@@ -3927,8 +4032,8 @@
     make WINDOWS_BUILD=1 clean
 }
 support_build_mingw() {
-    case $(i686-w64-mingw32-gcc -dumpversion) in
-        [0-5]*) false;;
+    case $(i686-w64-mingw32-gcc -dumpversion 2>/dev/null) in
+        [0-5]*|"") false;;
         *) true;;
     esac
 }
diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py
index 2228b72..61f6bb9 100755
--- a/tests/scripts/analyze_outcomes.py
+++ b/tests/scripts/analyze_outcomes.py
@@ -96,7 +96,7 @@
             if component_ref in entry:
                 reference_test_passed = True
         if(reference_test_passed and not driver_test_passed):
-            print(key)
+            Results.log(key)
             result = False
     return result
 
@@ -131,7 +131,7 @@
     """Perform coverage analysis."""
     del args # unused
     outcomes = read_outcome_file(outcome_file)
-    print("\n*** Analyze coverage ***\n")
+    Results.log("\n*** Analyze coverage ***\n")
     results = analyze_outcomes(outcomes)
     return results.error_count == 0
 
@@ -140,7 +140,7 @@
     ignored_suites = ['test_suite_' + x for x in args['ignored_suites']]
 
     outcomes = read_outcome_file(outcome_file)
-    print("\n*** Analyze driver {} vs reference {} ***\n".format(
+    Results.log("\n*** Analyze driver {} vs reference {} ***\n".format(
         args['component_driver'], args['component_ref']))
     return analyze_driver_vs_reference(outcomes, args['component_ref'],
                                        args['component_driver'], ignored_suites,
@@ -225,7 +225,7 @@
 
         if options.list:
             for task in TASKS:
-                print(task)
+                Results.log(task)
             sys.exit(0)
 
         result = True
@@ -237,7 +237,7 @@
 
             for task in tasks:
                 if task not in TASKS:
-                    print('Error: invalid task: {}'.format(task))
+                    Results.log('Error: invalid task: {}'.format(task))
                     sys.exit(1)
 
         for task in TASKS:
@@ -247,7 +247,7 @@
 
         if result is False:
             sys.exit(1)
-        print("SUCCESS :-)")
+        Results.log("SUCCESS :-)")
     except Exception: # pylint: disable=broad-except
         # Print the backtrace and exit explicitly with our chosen status.
         traceback.print_exc()
diff --git a/tests/src/psa_crypto_helpers.c b/tests/src/psa_crypto_helpers.c
index 06274d3..77c2f89 100644
--- a/tests/src/psa_crypto_helpers.c
+++ b/tests/src/psa_crypto_helpers.c
@@ -138,4 +138,15 @@
     return updated_usage;
 }
 
+int mbedtls_test_fail_if_psa_leaking(int line_no, const char *filename)
+{
+    const char *msg = mbedtls_test_helper_is_psa_leaking();
+    if (msg == NULL) {
+        return 0;
+    } else {
+        mbedtls_test_fail(msg, line_no, filename);
+        return 1;
+    }
+}
+
 #endif /* MBEDTLS_PSA_CRYPTO_C */
diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c
new file mode 100644
index 0000000..d248e29
--- /dev/null
+++ b/tests/src/test_helpers/ssl_helpers.c
@@ -0,0 +1,2231 @@
+/** \file ssl_helpers.c
+ *
+ * \brief Helper functions to set up a TLS connection.
+ */
+
+/*
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+
+#include <test/ssl_helpers.h>
+
+#if defined(MBEDTLS_SSL_TLS_C)
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+static int rng_seed = 0xBEEF;
+static int rng_get(void *p_rng, unsigned char *output, size_t output_len)
+{
+    (void) p_rng;
+    for (size_t i = 0; i < output_len; i++) {
+        output[i] = rand();
+    }
+
+    return 0;
+}
+#endif
+
+void mbedtls_test_ssl_log_analyzer(void *ctx, int level,
+                                   const char *file, int line,
+                                   const char *str)
+{
+    mbedtls_test_ssl_log_pattern *p = (mbedtls_test_ssl_log_pattern *) ctx;
+
+    (void) level;
+    (void) line;
+    (void) file;
+
+    if (NULL != p &&
+        NULL != p->pattern &&
+        NULL != strstr(str, p->pattern)) {
+        p->counter++;
+    }
+}
+
+void mbedtls_test_init_handshake_options(
+    mbedtls_test_handshake_test_options *opts)
+{
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+    srand(rng_seed);
+    rng_seed += 0xD0;
+#endif
+    opts->cipher = "";
+    opts->client_min_version = MBEDTLS_SSL_VERSION_UNKNOWN;
+    opts->client_max_version = MBEDTLS_SSL_VERSION_UNKNOWN;
+    opts->server_min_version = MBEDTLS_SSL_VERSION_UNKNOWN;
+    opts->server_max_version = MBEDTLS_SSL_VERSION_UNKNOWN;
+    opts->expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_2;
+    opts->expected_handshake_result = 0;
+    opts->expected_ciphersuite = 0;
+    opts->pk_alg = MBEDTLS_PK_RSA;
+    opts->opaque_alg = 0;
+    opts->opaque_alg2 = 0;
+    opts->opaque_usage = 0;
+    opts->psk_str = NULL;
+    opts->dtls = 0;
+    opts->srv_auth_mode = MBEDTLS_SSL_VERIFY_NONE;
+    opts->serialize = 0;
+    opts->mfl = MBEDTLS_SSL_MAX_FRAG_LEN_NONE;
+    opts->cli_msg_len = 100;
+    opts->srv_msg_len = 100;
+    opts->expected_cli_fragments = 1;
+    opts->expected_srv_fragments = 1;
+    opts->renegotiate = 0;
+    opts->legacy_renegotiation = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION;
+    opts->srv_log_obj = NULL;
+    opts->srv_log_obj = NULL;
+    opts->srv_log_fun = NULL;
+    opts->cli_log_fun = NULL;
+    opts->resize_buffers = 1;
+#if defined(MBEDTLS_SSL_CACHE_C)
+    opts->cache = NULL;
+    ASSERT_ALLOC(opts->cache, 1);
+    mbedtls_ssl_cache_init(opts->cache);
+exit:
+    return;
+#endif
+}
+
+void mbedtls_test_free_handshake_options(
+    mbedtls_test_handshake_test_options *opts)
+{
+#if defined(MBEDTLS_SSL_CACHE_C)
+    mbedtls_ssl_cache_free(opts->cache);
+    mbedtls_free(opts->cache);
+#else
+    (void) opts;
+#endif
+}
+
+#if defined(MBEDTLS_TEST_HOOKS)
+static void set_chk_buf_ptr_args(
+    mbedtls_ssl_chk_buf_ptr_args *args,
+    unsigned char *cur, unsigned char *end, size_t need)
+{
+    args->cur = cur;
+    args->end = end;
+    args->need = need;
+}
+
+static void reset_chk_buf_ptr_args(mbedtls_ssl_chk_buf_ptr_args *args)
+{
+    memset(args, 0, sizeof(*args));
+}
+#endif /* MBEDTLS_TEST_HOOKS */
+
+/*
+ * Buffer structure for custom I/O callbacks.
+ */
+
+void mbedtls_test_ssl_buffer_init(mbedtls_test_ssl_buffer *buf)
+{
+    memset(buf, 0, sizeof(*buf));
+}
+
+int mbedtls_test_ssl_buffer_setup(mbedtls_test_ssl_buffer *buf,
+                                  size_t capacity)
+{
+    buf->buffer = (unsigned char *) mbedtls_calloc(capacity,
+                                                   sizeof(unsigned char));
+    if (NULL == buf->buffer) {
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED;
+    }
+    buf->capacity = capacity;
+
+    return 0;
+}
+
+void mbedtls_test_ssl_buffer_free(mbedtls_test_ssl_buffer *buf)
+{
+    if (buf->buffer != NULL) {
+        mbedtls_free(buf->buffer);
+    }
+
+    memset(buf, 0, sizeof(*buf));
+}
+
+int mbedtls_test_ssl_buffer_put(mbedtls_test_ssl_buffer *buf,
+                                const unsigned char *input, size_t input_len)
+{
+    size_t overflow = 0;
+
+    if ((buf == NULL) || (buf->buffer == NULL)) {
+        return -1;
+    }
+
+    /* Reduce input_len to a number that fits in the buffer. */
+    if ((buf->content_length + input_len) > buf->capacity) {
+        input_len = buf->capacity - buf->content_length;
+    }
+
+    if (input == NULL) {
+        return (input_len == 0) ? 0 : -1;
+    }
+
+    /* Check if the buffer has not come full circle and free space is not in
+     * the middle */
+    if (buf->start + buf->content_length < buf->capacity) {
+
+        /* Calculate the number of bytes that need to be placed at lower memory
+         * address */
+        if (buf->start + buf->content_length + input_len
+            > buf->capacity) {
+            overflow = (buf->start + buf->content_length + input_len)
+                       % buf->capacity;
+        }
+
+        memcpy(buf->buffer + buf->start + buf->content_length, input,
+               input_len - overflow);
+        memcpy(buf->buffer, input + input_len - overflow, overflow);
+
+    } else {
+        /* The buffer has come full circle and free space is in the middle */
+        memcpy(buf->buffer + buf->start + buf->content_length - buf->capacity,
+               input, input_len);
+    }
+
+    buf->content_length += input_len;
+    return (input_len > INT_MAX) ? INT_MAX : (int) input_len;
+}
+
+int mbedtls_test_ssl_buffer_get(mbedtls_test_ssl_buffer *buf,
+                                unsigned char *output, size_t output_len)
+{
+    size_t overflow = 0;
+
+    if ((buf == NULL) || (buf->buffer == NULL)) {
+        return -1;
+    }
+
+    if (output == NULL && output_len == 0) {
+        return 0;
+    }
+
+    if (buf->content_length < output_len) {
+        output_len = buf->content_length;
+    }
+
+    /* Calculate the number of bytes that need to be drawn from lower memory
+     * address */
+    if (buf->start + output_len > buf->capacity) {
+        overflow = (buf->start + output_len) % buf->capacity;
+    }
+
+    if (output != NULL) {
+        memcpy(output, buf->buffer + buf->start, output_len - overflow);
+        memcpy(output + output_len - overflow, buf->buffer, overflow);
+    }
+
+    buf->content_length -= output_len;
+    buf->start = (buf->start + output_len) % buf->capacity;
+
+    return (output_len > INT_MAX) ? INT_MAX : (int) output_len;
+}
+
+int mbedtls_test_ssl_message_queue_setup(mbedtls_test_ssl_message_queue *queue,
+                                         size_t capacity)
+{
+    queue->messages = (size_t *) mbedtls_calloc(capacity, sizeof(size_t));
+    if (NULL == queue->messages) {
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED;
+    }
+
+    queue->capacity = (capacity > INT_MAX) ? INT_MAX : (int) capacity;
+    queue->pos = 0;
+    queue->num = 0;
+
+    return 0;
+}
+
+void mbedtls_test_ssl_message_queue_free(mbedtls_test_ssl_message_queue *queue)
+{
+    if (queue == NULL) {
+        return;
+    }
+
+    if (queue->messages != NULL) {
+        mbedtls_free(queue->messages);
+    }
+
+    memset(queue, 0, sizeof(*queue));
+}
+
+int mbedtls_test_ssl_message_queue_push_info(
+    mbedtls_test_ssl_message_queue *queue, size_t len)
+{
+    int place;
+    if (queue == NULL) {
+        return MBEDTLS_TEST_ERROR_ARG_NULL;
+    }
+
+    if (queue->num >= queue->capacity) {
+        return MBEDTLS_ERR_SSL_WANT_WRITE;
+    }
+
+    place = (queue->pos + queue->num) % queue->capacity;
+    queue->messages[place] = len;
+    queue->num++;
+    return (len > INT_MAX) ? INT_MAX : (int) len;
+}
+
+int mbedtls_test_ssl_message_queue_pop_info(
+    mbedtls_test_ssl_message_queue *queue, size_t buf_len)
+{
+    size_t message_length;
+    if (queue == NULL) {
+        return MBEDTLS_TEST_ERROR_ARG_NULL;
+    }
+    if (queue->num == 0) {
+        return MBEDTLS_ERR_SSL_WANT_READ;
+    }
+
+    message_length = queue->messages[queue->pos];
+    queue->messages[queue->pos] = 0;
+    queue->num--;
+    queue->pos++;
+    queue->pos %= queue->capacity;
+    if (queue->pos < 0) {
+        queue->pos += queue->capacity;
+    }
+
+    return (message_length > INT_MAX && buf_len > INT_MAX) ? INT_MAX :
+           (message_length > buf_len) ? (int) buf_len : (int) message_length;
+}
+
+/*
+ * Take a peek on the info about the next message length from the queue.
+ * This will be the oldest inserted message length(fifo).
+ *
+ * \retval  MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null.
+ * \retval  MBEDTLS_ERR_SSL_WANT_READ, if the queue is empty.
+ * \retval  0, if the peek was successful.
+ * \retval  MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED, if the given buffer length is
+ *          too small to fit the message. In this case the \p msg_len will be
+ *          set to the full message length so that the
+ *          caller knows what portion of the message can be dropped.
+ */
+int mbedtls_test_message_queue_peek_info(mbedtls_test_ssl_message_queue *queue,
+                                         size_t buf_len, size_t *msg_len)
+{
+    if (queue == NULL || msg_len == NULL) {
+        return MBEDTLS_TEST_ERROR_ARG_NULL;
+    }
+    if (queue->num == 0) {
+        return MBEDTLS_ERR_SSL_WANT_READ;
+    }
+
+    *msg_len = queue->messages[queue->pos];
+    return (*msg_len > buf_len) ? MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED : 0;
+}
+
+void mbedtls_mock_socket_init(mbedtls_test_mock_socket *socket)
+{
+    memset(socket, 0, sizeof(*socket));
+}
+
+void mbedtls_test_mock_socket_close(mbedtls_test_mock_socket *socket)
+{
+    if (socket == NULL) {
+        return;
+    }
+
+    if (socket->input != NULL) {
+        mbedtls_test_ssl_buffer_free(socket->input);
+        mbedtls_free(socket->input);
+    }
+
+    if (socket->output != NULL) {
+        mbedtls_test_ssl_buffer_free(socket->output);
+        mbedtls_free(socket->output);
+    }
+
+    if (socket->peer != NULL) {
+        memset(socket->peer, 0, sizeof(*socket->peer));
+    }
+
+    memset(socket, 0, sizeof(*socket));
+}
+
+int mbedtls_test_mock_socket_connect(mbedtls_test_mock_socket *peer1,
+                                     mbedtls_test_mock_socket *peer2,
+                                     size_t bufsize)
+{
+    int ret = -1;
+
+    peer1->output =
+        (mbedtls_test_ssl_buffer *) mbedtls_calloc(
+            1, sizeof(mbedtls_test_ssl_buffer));
+    if (peer1->output == NULL) {
+        ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
+        goto exit;
+    }
+    mbedtls_test_ssl_buffer_init(peer1->output);
+    if (0 != (ret = mbedtls_test_ssl_buffer_setup(peer1->output, bufsize))) {
+        goto exit;
+    }
+
+    peer2->output =
+        (mbedtls_test_ssl_buffer *) mbedtls_calloc(
+            1, sizeof(mbedtls_test_ssl_buffer));
+    if (peer2->output == NULL) {
+        ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
+        goto exit;
+    }
+    mbedtls_test_ssl_buffer_init(peer2->output);
+    if (0 != (ret = mbedtls_test_ssl_buffer_setup(peer2->output, bufsize))) {
+        goto exit;
+    }
+
+    peer1->peer = peer2;
+    peer2->peer = peer1;
+    peer1->input = peer2->output;
+    peer2->input = peer1->output;
+
+    peer1->status = peer2->status = MBEDTLS_MOCK_SOCKET_CONNECTED;
+    ret = 0;
+
+exit:
+
+    if (ret != 0) {
+        mbedtls_test_mock_socket_close(peer1);
+        mbedtls_test_mock_socket_close(peer2);
+    }
+
+    return ret;
+}
+
+int mbedtls_test_mock_tcp_send_b(void *ctx,
+                                 const unsigned char *buf, size_t len)
+{
+    mbedtls_test_mock_socket *socket = (mbedtls_test_mock_socket *) ctx;
+
+    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
+        return -1;
+    }
+
+    return mbedtls_test_ssl_buffer_put(socket->output, buf, len);
+}
+
+int mbedtls_test_mock_tcp_recv_b(void *ctx, unsigned char *buf, size_t len)
+{
+    mbedtls_test_mock_socket *socket = (mbedtls_test_mock_socket *) ctx;
+
+    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
+        return -1;
+    }
+
+    return mbedtls_test_ssl_buffer_get(socket->input, buf, len);
+}
+
+int mbedtls_test_mock_tcp_send_nb(void *ctx,
+                                  const unsigned char *buf, size_t len)
+{
+    mbedtls_test_mock_socket *socket = (mbedtls_test_mock_socket *) ctx;
+
+    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
+        return -1;
+    }
+
+    if (socket->output->capacity == socket->output->content_length) {
+        return MBEDTLS_ERR_SSL_WANT_WRITE;
+    }
+
+    return mbedtls_test_ssl_buffer_put(socket->output, buf, len);
+}
+
+int mbedtls_test_mock_tcp_recv_nb(void *ctx, unsigned char *buf, size_t len)
+{
+    mbedtls_test_mock_socket *socket = (mbedtls_test_mock_socket *) ctx;
+
+    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
+        return -1;
+    }
+
+    if (socket->input->content_length == 0) {
+        return MBEDTLS_ERR_SSL_WANT_READ;
+    }
+
+    return mbedtls_test_ssl_buffer_get(socket->input, buf, len);
+}
+
+void mbedtls_test_message_socket_init(mbedtls_test_message_socket_context *ctx)
+{
+    ctx->queue_input = NULL;
+    ctx->queue_output = NULL;
+    ctx->socket = NULL;
+}
+
+int mbedtls_test_message_socket_setup(
+    mbedtls_test_ssl_message_queue *queue_input,
+    mbedtls_test_ssl_message_queue *queue_output,
+    size_t queue_capacity,
+    mbedtls_test_mock_socket *socket,
+    mbedtls_test_message_socket_context *ctx)
+{
+    int ret = mbedtls_test_ssl_message_queue_setup(queue_input, queue_capacity);
+    if (ret != 0) {
+        return ret;
+    }
+    ctx->queue_input = queue_input;
+    ctx->queue_output = queue_output;
+    ctx->socket = socket;
+    mbedtls_mock_socket_init(socket);
+
+    return 0;
+}
+
+void mbedtls_test_message_socket_close(mbedtls_test_message_socket_context *ctx)
+{
+    if (ctx == NULL) {
+        return;
+    }
+
+    mbedtls_test_ssl_message_queue_free(ctx->queue_input);
+    mbedtls_test_mock_socket_close(ctx->socket);
+    memset(ctx, 0, sizeof(*ctx));
+}
+
+int mbedtls_test_mock_tcp_send_msg(void *ctx,
+                                   const unsigned char *buf, size_t len)
+{
+    mbedtls_test_ssl_message_queue *queue;
+    mbedtls_test_mock_socket *socket;
+    mbedtls_test_message_socket_context *context =
+        (mbedtls_test_message_socket_context *) ctx;
+
+    if (context == NULL || context->socket == NULL
+        || context->queue_output == NULL) {
+        return MBEDTLS_TEST_ERROR_CONTEXT_ERROR;
+    }
+
+    queue = context->queue_output;
+    socket = context->socket;
+
+    if (queue->num >= queue->capacity) {
+        return MBEDTLS_ERR_SSL_WANT_WRITE;
+    }
+
+    if (mbedtls_test_mock_tcp_send_b(socket, buf, len) != (int) len) {
+        return MBEDTLS_TEST_ERROR_SEND_FAILED;
+    }
+
+    return mbedtls_test_ssl_message_queue_push_info(queue, len);
+}
+
+int mbedtls_test_mock_tcp_recv_msg(void *ctx,
+                                   unsigned char *buf, size_t buf_len)
+{
+    mbedtls_test_ssl_message_queue *queue;
+    mbedtls_test_mock_socket *socket;
+    mbedtls_test_message_socket_context *context =
+        (mbedtls_test_message_socket_context *) ctx;
+    size_t drop_len = 0;
+    size_t msg_len;
+    int ret;
+
+    if (context == NULL || context->socket == NULL
+        || context->queue_input == NULL) {
+        return MBEDTLS_TEST_ERROR_CONTEXT_ERROR;
+    }
+
+    queue = context->queue_input;
+    socket = context->socket;
+
+    /* Peek first, so that in case of a socket error the data remains in
+     * the queue. */
+    ret = mbedtls_test_message_queue_peek_info(queue, buf_len, &msg_len);
+    if (ret == MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED) {
+        /* Calculate how much to drop */
+        drop_len = msg_len - buf_len;
+
+        /* Set the requested message len to be buffer length */
+        msg_len = buf_len;
+    } else if (ret != 0) {
+        return ret;
+    }
+
+    if (mbedtls_test_mock_tcp_recv_b(socket, buf, msg_len) != (int) msg_len) {
+        return MBEDTLS_TEST_ERROR_RECV_FAILED;
+    }
+
+    if (ret == MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED) {
+        /* Drop the remaining part of the message */
+        if (mbedtls_test_mock_tcp_recv_b(socket, NULL, drop_len) !=
+            (int) drop_len) {
+            /* Inconsistent state - part of the message was read,
+             * and a part couldn't. Not much we can do here, but it should not
+             * happen in test environment, unless forced manually. */
+        }
+    }
+    mbedtls_test_ssl_message_queue_pop_info(queue, buf_len);
+
+    return (msg_len > INT_MAX) ? INT_MAX : (int) msg_len;
+}
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+
+/*
+ * Deinitializes certificates from endpoint represented by \p ep.
+ */
+void mbedtls_endpoint_certificate_free(mbedtls_test_ssl_endpoint *ep)
+{
+    mbedtls_test_ssl_endpoint_certificate *cert = &(ep->cert);
+    if (cert != NULL) {
+        if (cert->ca_cert != NULL) {
+            mbedtls_x509_crt_free(cert->ca_cert);
+            mbedtls_free(cert->ca_cert);
+            cert->ca_cert = NULL;
+        }
+        if (cert->cert != NULL) {
+            mbedtls_x509_crt_free(cert->cert);
+            mbedtls_free(cert->cert);
+            cert->cert = NULL;
+        }
+        if (cert->pkey != NULL) {
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+            if (mbedtls_pk_get_type(cert->pkey) == MBEDTLS_PK_OPAQUE) {
+                mbedtls_svc_key_id_t *key_slot = cert->pkey->pk_ctx;
+                psa_destroy_key(*key_slot);
+            }
+#endif
+            mbedtls_pk_free(cert->pkey);
+            mbedtls_free(cert->pkey);
+            cert->pkey = NULL;
+        }
+    }
+}
+
+int mbedtls_test_ssl_endpoint_certificate_init(mbedtls_test_ssl_endpoint *ep,
+                                               int pk_alg,
+                                               int opaque_alg, int opaque_alg2,
+                                               int opaque_usage)
+{
+    int i = 0;
+    int ret = -1;
+    mbedtls_test_ssl_endpoint_certificate *cert = NULL;
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+    mbedtls_svc_key_id_t key_slot = MBEDTLS_SVC_KEY_ID_INIT;
+#endif
+
+    if (ep == NULL) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    cert = &(ep->cert);
+    ASSERT_ALLOC(cert->ca_cert, 1);
+    ASSERT_ALLOC(cert->cert, 1);
+    ASSERT_ALLOC(cert->pkey, 1);
+
+    mbedtls_x509_crt_init(cert->ca_cert);
+    mbedtls_x509_crt_init(cert->cert);
+    mbedtls_pk_init(cert->pkey);
+
+    /* Load the trusted CA */
+
+    for (i = 0; mbedtls_test_cas_der[i] != NULL; i++) {
+        ret = mbedtls_x509_crt_parse_der(
+            cert->ca_cert,
+            (const unsigned char *) mbedtls_test_cas_der[i],
+            mbedtls_test_cas_der_len[i]);
+        TEST_ASSERT(ret == 0);
+    }
+
+    /* Load own certificate and private key */
+
+    if (ep->conf.endpoint == MBEDTLS_SSL_IS_SERVER) {
+        if (pk_alg == MBEDTLS_PK_RSA) {
+            ret = mbedtls_x509_crt_parse(
+                cert->cert,
+                (const unsigned char *) mbedtls_test_srv_crt_rsa_sha256_der,
+                mbedtls_test_srv_crt_rsa_sha256_der_len);
+            TEST_ASSERT(ret == 0);
+
+            ret = mbedtls_pk_parse_key(
+                cert->pkey,
+                (const unsigned char *) mbedtls_test_srv_key_rsa_der,
+                mbedtls_test_srv_key_rsa_der_len, NULL, 0,
+                mbedtls_test_rnd_std_rand, NULL);
+            TEST_ASSERT(ret == 0);
+        } else {
+            ret = mbedtls_x509_crt_parse(
+                cert->cert,
+                (const unsigned char *) mbedtls_test_srv_crt_ec_der,
+                mbedtls_test_srv_crt_ec_der_len);
+            TEST_ASSERT(ret == 0);
+
+            ret = mbedtls_pk_parse_key(
+                cert->pkey,
+                (const unsigned char *) mbedtls_test_srv_key_ec_der,
+                mbedtls_test_srv_key_ec_der_len, NULL, 0,
+                mbedtls_test_rnd_std_rand, NULL);
+            TEST_ASSERT(ret == 0);
+        }
+    } else {
+        if (pk_alg == MBEDTLS_PK_RSA) {
+            ret = mbedtls_x509_crt_parse(
+                cert->cert,
+                (const unsigned char *) mbedtls_test_cli_crt_rsa_der,
+                mbedtls_test_cli_crt_rsa_der_len);
+            TEST_ASSERT(ret == 0);
+
+            ret = mbedtls_pk_parse_key(
+                cert->pkey,
+                (const unsigned char *) mbedtls_test_cli_key_rsa_der,
+                mbedtls_test_cli_key_rsa_der_len, NULL, 0,
+                mbedtls_test_rnd_std_rand, NULL);
+            TEST_ASSERT(ret == 0);
+        } else {
+            ret = mbedtls_x509_crt_parse(
+                cert->cert,
+                (const unsigned char *) mbedtls_test_cli_crt_ec_der,
+                mbedtls_test_cli_crt_ec_len);
+            TEST_ASSERT(ret == 0);
+
+            ret = mbedtls_pk_parse_key(
+                cert->pkey,
+                (const unsigned char *) mbedtls_test_cli_key_ec_der,
+                mbedtls_test_cli_key_ec_der_len, NULL, 0,
+                mbedtls_test_rnd_std_rand, NULL);
+            TEST_ASSERT(ret == 0);
+        }
+    }
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+    if (opaque_alg != 0) {
+        TEST_EQUAL(mbedtls_pk_wrap_as_opaque(cert->pkey, &key_slot,
+                                             opaque_alg, opaque_usage,
+                                             opaque_alg2), 0);
+    }
+#else
+    (void) opaque_alg;
+    (void) opaque_alg2;
+    (void) opaque_usage;
+#endif
+
+    mbedtls_ssl_conf_ca_chain(&(ep->conf), cert->ca_cert, NULL);
+
+    ret = mbedtls_ssl_conf_own_cert(&(ep->conf), cert->cert,
+                                    cert->pkey);
+    TEST_ASSERT(ret == 0);
+    TEST_ASSERT(ep->conf.key_cert != NULL);
+
+    ret = mbedtls_ssl_conf_own_cert(&(ep->conf), NULL, NULL);
+    TEST_ASSERT(ret == 0);
+    TEST_ASSERT(ep->conf.key_cert == NULL);
+
+    ret = mbedtls_ssl_conf_own_cert(&(ep->conf), cert->cert,
+                                    cert->pkey);
+    TEST_ASSERT(ret == 0);
+
+exit:
+    if (ret != 0) {
+        mbedtls_endpoint_certificate_free(ep);
+    }
+
+    return ret;
+}
+
+int mbedtls_test_ssl_endpoint_init(
+    mbedtls_test_ssl_endpoint *ep, int endpoint_type,
+    mbedtls_test_handshake_test_options *options,
+    mbedtls_test_message_socket_context *dtls_context,
+    mbedtls_test_ssl_message_queue *input_queue,
+    mbedtls_test_ssl_message_queue *output_queue,
+    uint16_t *group_list)
+{
+    int ret = -1;
+    uintptr_t user_data_n;
+
+    if (dtls_context != NULL &&
+        (input_queue == NULL || output_queue == NULL)) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+
+    }
+
+    if (ep == NULL) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    memset(ep, 0, sizeof(*ep));
+
+    ep->name = (endpoint_type == MBEDTLS_SSL_IS_SERVER) ? "Server" : "Client";
+
+    mbedtls_ssl_init(&(ep->ssl));
+    mbedtls_ssl_config_init(&(ep->conf));
+    mbedtls_ssl_conf_rng(&(ep->conf), rng_get, NULL);
+
+    TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&ep->conf) == NULL);
+    TEST_EQUAL(mbedtls_ssl_conf_get_user_data_n(&ep->conf), 0);
+    TEST_ASSERT(mbedtls_ssl_get_user_data_p(&ep->ssl) == NULL);
+    TEST_EQUAL(mbedtls_ssl_get_user_data_n(&ep->ssl), 0);
+
+    (void) mbedtls_test_rnd_std_rand(NULL,
+                                     (void *) &user_data_n,
+                                     sizeof(user_data_n));
+    mbedtls_ssl_conf_set_user_data_n(&ep->conf, user_data_n);
+    mbedtls_ssl_set_user_data_n(&ep->ssl, user_data_n);
+
+    if (dtls_context != NULL) {
+        TEST_ASSERT(mbedtls_test_message_socket_setup(input_queue, output_queue,
+                                                      100, &(ep->socket),
+                                                      dtls_context) == 0);
+    } else {
+        mbedtls_mock_socket_init(&(ep->socket));
+    }
+
+    /* Non-blocking callbacks without timeout */
+    if (dtls_context != NULL) {
+        mbedtls_ssl_set_bio(&(ep->ssl), dtls_context,
+                            mbedtls_test_mock_tcp_send_msg,
+                            mbedtls_test_mock_tcp_recv_msg,
+                            NULL);
+    } else {
+        mbedtls_ssl_set_bio(&(ep->ssl), &(ep->socket),
+                            mbedtls_test_mock_tcp_send_nb,
+                            mbedtls_test_mock_tcp_recv_nb,
+                            NULL);
+    }
+
+    ret = mbedtls_ssl_config_defaults(&(ep->conf), endpoint_type,
+                                      (dtls_context != NULL) ?
+                                      MBEDTLS_SSL_TRANSPORT_DATAGRAM :
+                                      MBEDTLS_SSL_TRANSPORT_STREAM,
+                                      MBEDTLS_SSL_PRESET_DEFAULT);
+    TEST_ASSERT(ret == 0);
+
+    if (group_list != NULL) {
+        mbedtls_ssl_conf_groups(&(ep->conf), group_list);
+    }
+
+    mbedtls_ssl_conf_authmode(&(ep->conf), MBEDTLS_SSL_VERIFY_REQUIRED);
+
+#if defined(MBEDTLS_SSL_CACHE_C) && defined(MBEDTLS_SSL_SRV_C)
+    if (endpoint_type == MBEDTLS_SSL_IS_SERVER && options->cache != NULL) {
+        mbedtls_ssl_conf_session_cache(&(ep->conf), options->cache,
+                                       mbedtls_ssl_cache_get,
+                                       mbedtls_ssl_cache_set);
+    }
+#endif
+
+    ret = mbedtls_ssl_setup(&(ep->ssl), &(ep->conf));
+    TEST_ASSERT(ret == 0);
+
+#if defined(MBEDTLS_SSL_PROTO_DTLS) && defined(MBEDTLS_SSL_SRV_C)
+    if (endpoint_type == MBEDTLS_SSL_IS_SERVER && dtls_context != NULL) {
+        mbedtls_ssl_conf_dtls_cookies(&(ep->conf), NULL, NULL, NULL);
+    }
+#endif
+
+    ret = mbedtls_test_ssl_endpoint_certificate_init(ep, options->pk_alg,
+                                                     options->opaque_alg,
+                                                     options->opaque_alg2,
+                                                     options->opaque_usage);
+    TEST_ASSERT(ret == 0);
+
+    TEST_EQUAL(mbedtls_ssl_conf_get_user_data_n(&ep->conf), user_data_n);
+    mbedtls_ssl_conf_set_user_data_p(&ep->conf, ep);
+    TEST_EQUAL(mbedtls_ssl_get_user_data_n(&ep->ssl), user_data_n);
+    mbedtls_ssl_set_user_data_p(&ep->ssl, ep);
+
+exit:
+    return ret;
+}
+
+void mbedtls_test_ssl_endpoint_free(
+    mbedtls_test_ssl_endpoint *ep,
+    mbedtls_test_message_socket_context *context)
+{
+    mbedtls_endpoint_certificate_free(ep);
+
+    mbedtls_ssl_free(&(ep->ssl));
+    mbedtls_ssl_config_free(&(ep->conf));
+
+    if (context != NULL) {
+        mbedtls_test_message_socket_close(context);
+    } else {
+        mbedtls_test_mock_socket_close(&(ep->socket));
+    }
+}
+
+int mbedtls_test_move_handshake_to_state(mbedtls_ssl_context *ssl,
+                                         mbedtls_ssl_context *second_ssl,
+                                         int state)
+{
+    enum { BUFFSIZE = 1024 };
+    int max_steps = 1000;
+    int ret = 0;
+
+    if (ssl == NULL || second_ssl == NULL) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    /* Perform communication via connected sockets */
+    while ((ssl->state != state) && (--max_steps >= 0)) {
+        /* If /p second_ssl ends the handshake procedure before /p ssl then
+         * there is no need to call the next step */
+        if (!mbedtls_ssl_is_handshake_over(second_ssl)) {
+            ret = mbedtls_ssl_handshake_step(second_ssl);
+            if (ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
+                return ret;
+            }
+        }
+
+        /* We only care about the \p ssl state and returns, so we call it last,
+         * to leave the iteration as soon as the state is as expected. */
+        ret = mbedtls_ssl_handshake_step(ssl);
+        if (ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ &&
+            ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
+            return ret;
+        }
+    }
+
+    return (max_steps >= 0) ? ret : -1;
+}
+
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
+/*
+ * Write application data. Increase write counter if necessary.
+ */
+int mbedtls_ssl_write_fragment(mbedtls_ssl_context *ssl,
+                               unsigned char *buf, int buf_len,
+                               int *written,
+                               const int expected_fragments)
+{
+    /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is
+     * a valid no-op for TLS connections. */
+    if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
+        TEST_ASSERT(mbedtls_ssl_write(ssl, NULL, 0) == 0);
+    }
+
+    int ret = mbedtls_ssl_write(ssl, buf + *written, buf_len - *written);
+    if (ret > 0) {
+        *written += ret;
+    }
+
+    if (expected_fragments == 0) {
+        /* Used for DTLS and the message size larger than MFL. In that case
+         * the message can not be fragmented and the library should return
+         * MBEDTLS_ERR_SSL_BAD_INPUT_DATA error. This error must be returned
+         * to prevent a dead loop inside mbedtls_exchange_data(). */
+        return ret;
+    } else if (expected_fragments == 1) {
+        /* Used for TLS/DTLS and the message size lower than MFL */
+        TEST_ASSERT(ret == buf_len ||
+                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
+                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
+    } else {
+        /* Used for TLS and the message size larger than MFL */
+        TEST_ASSERT(expected_fragments > 1);
+        TEST_ASSERT((ret >= 0 && ret <= buf_len) ||
+                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
+                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
+    }
+
+    return 0;
+
+exit:
+    /* Some of the tests failed */
+    return -1;
+}
+
+/*
+ * Read application data and increase read counter and fragments counter
+ * if necessary.
+ */
+int mbedtls_ssl_read_fragment(mbedtls_ssl_context *ssl,
+                              unsigned char *buf, int buf_len,
+                              int *read, int *fragments,
+                              const int expected_fragments)
+{
+    /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is
+     * a valid no-op for TLS connections. */
+    if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
+        TEST_ASSERT(mbedtls_ssl_read(ssl, NULL, 0) == 0);
+    }
+
+    int ret = mbedtls_ssl_read(ssl, buf + *read, buf_len - *read);
+    if (ret > 0) {
+        (*fragments)++;
+        *read += ret;
+    }
+
+    if (expected_fragments == 0) {
+        TEST_ASSERT(ret == 0);
+    } else if (expected_fragments == 1) {
+        TEST_ASSERT(ret == buf_len ||
+                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
+                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
+    } else {
+        TEST_ASSERT(expected_fragments > 1);
+        TEST_ASSERT((ret >= 0 && ret <= buf_len) ||
+                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
+                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
+    }
+
+    return 0;
+
+exit:
+    /* Some of the tests failed */
+    return -1;
+}
+
+void set_ciphersuite(mbedtls_ssl_config *conf, const char *cipher,
+                     int *forced_ciphersuite)
+{
+    const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
+    forced_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id(cipher);
+    forced_ciphersuite[1] = 0;
+
+    ciphersuite_info =
+        mbedtls_ssl_ciphersuite_from_id(forced_ciphersuite[0]);
+
+    TEST_ASSERT(ciphersuite_info != NULL);
+    TEST_ASSERT(ciphersuite_info->min_tls_version <= conf->max_tls_version);
+    TEST_ASSERT(ciphersuite_info->max_tls_version >= conf->min_tls_version);
+
+    if (conf->max_tls_version > ciphersuite_info->max_tls_version) {
+        conf->max_tls_version = ciphersuite_info->max_tls_version;
+    }
+    if (conf->min_tls_version < ciphersuite_info->min_tls_version) {
+        conf->min_tls_version = ciphersuite_info->min_tls_version;
+    }
+
+    mbedtls_ssl_conf_ciphersuites(conf, forced_ciphersuite);
+
+exit:
+    return;
+}
+
+int psk_dummy_callback(void *p_info, mbedtls_ssl_context *ssl,
+                       const unsigned char *name, size_t name_len)
+{
+    (void) p_info;
+    (void) ssl;
+    (void) name;
+    (void) name_len;
+
+    return 0;
+}
+
+#if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX
+#define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_IN_LEN_MAX
+#else
+#define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_OUT_LEN_MAX
+#endif
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
+    defined(MBEDTLS_CIPHER_MODE_CBC) && defined(MBEDTLS_AES_C)
+int mbedtls_test_psa_cipher_encrypt_helper(mbedtls_ssl_transform *transform,
+                                           const unsigned char *iv,
+                                           size_t iv_len,
+                                           const unsigned char *input,
+                                           size_t ilen,
+                                           unsigned char *output,
+                                           size_t *olen)
+{
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+    psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT;
+    size_t part_len;
+
+    status = psa_cipher_encrypt_setup(&cipher_op,
+                                      transform->psa_key_enc,
+                                      transform->psa_alg);
+
+    if (status != PSA_SUCCESS) {
+        return PSA_TO_MBEDTLS_ERR(status);
+    }
+
+    status = psa_cipher_set_iv(&cipher_op, iv, iv_len);
+
+    if (status != PSA_SUCCESS) {
+        return PSA_TO_MBEDTLS_ERR(status);
+    }
+
+    status = psa_cipher_update(&cipher_op, input, ilen, output, ilen, olen);
+
+    if (status != PSA_SUCCESS) {
+        return PSA_TO_MBEDTLS_ERR(status);
+    }
+
+    status = psa_cipher_finish(&cipher_op, output + *olen, ilen - *olen,
+                               &part_len);
+
+    if (status != PSA_SUCCESS) {
+        return PSA_TO_MBEDTLS_ERR(status);
+    }
+
+    *olen += part_len;
+    return 0;
+#else
+    return mbedtls_cipher_crypt(&transform->cipher_ctx_enc,
+                                iv, iv_len, input, ilen, output, olen);
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+}
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_CIPHER_MODE_CBC &&
+          MBEDTLS_AES_C */
+
+int mbedtls_test_ssl_build_transforms(mbedtls_ssl_transform *t_in,
+                                      mbedtls_ssl_transform *t_out,
+                                      int cipher_type, int hash_id,
+                                      int etm, int tag_mode,
+                                      mbedtls_ssl_protocol_version tls_version,
+                                      size_t cid0_len,
+                                      size_t cid1_len)
+{
+    mbedtls_cipher_info_t const *cipher_info;
+    int ret = 0;
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+    psa_key_type_t key_type;
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    psa_algorithm_t alg;
+    size_t key_bits;
+    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+#endif
+
+    size_t keylen, maclen, ivlen;
+    unsigned char *key0 = NULL, *key1 = NULL;
+    unsigned char *md0 = NULL, *md1 = NULL;
+    unsigned char iv_enc[16], iv_dec[16];
+
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
+    unsigned char cid0[SSL_CID_LEN_MIN];
+    unsigned char cid1[SSL_CID_LEN_MIN];
+
+    mbedtls_test_rnd_std_rand(NULL, cid0, sizeof(cid0));
+    mbedtls_test_rnd_std_rand(NULL, cid1, sizeof(cid1));
+#else
+    ((void) cid0_len);
+    ((void) cid1_len);
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
+
+    maclen = 0;
+
+    /* Pick cipher */
+    cipher_info = mbedtls_cipher_info_from_type(cipher_type);
+    CHK(cipher_info != NULL);
+    CHK(cipher_info->iv_size <= 16);
+    CHK(cipher_info->key_bitlen % 8 == 0);
+
+    /* Pick keys */
+    keylen = cipher_info->key_bitlen / 8;
+    /* Allocate `keylen + 1` bytes to ensure that we get
+     * a non-NULL pointers from `mbedtls_calloc` even if
+     * `keylen == 0` in the case of the NULL cipher. */
+    CHK((key0 = mbedtls_calloc(1, keylen + 1)) != NULL);
+    CHK((key1 = mbedtls_calloc(1, keylen + 1)) != NULL);
+    memset(key0, 0x1, keylen);
+    memset(key1, 0x2, keylen);
+
+#if !defined(MBEDTLS_USE_PSA_CRYPTO)
+    /* Setup cipher contexts */
+    CHK(mbedtls_cipher_setup(&t_in->cipher_ctx_enc,  cipher_info) == 0);
+    CHK(mbedtls_cipher_setup(&t_in->cipher_ctx_dec,  cipher_info) == 0);
+    CHK(mbedtls_cipher_setup(&t_out->cipher_ctx_enc, cipher_info) == 0);
+    CHK(mbedtls_cipher_setup(&t_out->cipher_ctx_dec, cipher_info) == 0);
+
+#if defined(MBEDTLS_CIPHER_MODE_CBC)
+    if (cipher_info->mode == MBEDTLS_MODE_CBC) {
+        CHK(mbedtls_cipher_set_padding_mode(&t_in->cipher_ctx_enc,
+                                            MBEDTLS_PADDING_NONE) == 0);
+        CHK(mbedtls_cipher_set_padding_mode(&t_in->cipher_ctx_dec,
+                                            MBEDTLS_PADDING_NONE) == 0);
+        CHK(mbedtls_cipher_set_padding_mode(&t_out->cipher_ctx_enc,
+                                            MBEDTLS_PADDING_NONE) == 0);
+        CHK(mbedtls_cipher_set_padding_mode(&t_out->cipher_ctx_dec,
+                                            MBEDTLS_PADDING_NONE) == 0);
+    }
+#endif /* MBEDTLS_CIPHER_MODE_CBC */
+
+    CHK(mbedtls_cipher_setkey(&t_in->cipher_ctx_enc, key0,
+                              (keylen << 3 > INT_MAX) ? INT_MAX : (int) keylen << 3,
+                              MBEDTLS_ENCRYPT)
+        == 0);
+    CHK(mbedtls_cipher_setkey(&t_in->cipher_ctx_dec, key1,
+                              (keylen << 3 > INT_MAX) ? INT_MAX : (int) keylen << 3,
+                              MBEDTLS_DECRYPT)
+        == 0);
+    CHK(mbedtls_cipher_setkey(&t_out->cipher_ctx_enc, key1,
+                              (keylen << 3 > INT_MAX) ? INT_MAX : (int) keylen << 3,
+                              MBEDTLS_ENCRYPT)
+        == 0);
+    CHK(mbedtls_cipher_setkey(&t_out->cipher_ctx_dec, key0,
+                              (keylen << 3 > INT_MAX) ? INT_MAX : (int) keylen << 3,
+                              MBEDTLS_DECRYPT)
+        == 0);
+#endif
+
+    /* Setup MAC contexts */
+#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
+    if (cipher_info->mode == MBEDTLS_MODE_CBC ||
+        cipher_info->mode == MBEDTLS_MODE_STREAM) {
+#if !defined(MBEDTLS_USE_PSA_CRYPTO)
+        mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type(hash_id);
+        CHK(md_info != NULL);
+#endif
+        maclen = mbedtls_hash_info_get_size(hash_id);
+        CHK(maclen != 0);
+        /* Pick hash keys */
+        CHK((md0 = mbedtls_calloc(1, maclen)) != NULL);
+        CHK((md1 = mbedtls_calloc(1, maclen)) != NULL);
+        memset(md0, 0x5, maclen);
+        memset(md1, 0x6, maclen);
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+        alg = mbedtls_hash_info_psa_from_md(hash_id);
+
+        CHK(alg != 0);
+
+        t_out->psa_mac_alg = PSA_ALG_HMAC(alg);
+        t_in->psa_mac_alg = PSA_ALG_HMAC(alg);
+        t_in->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
+        t_out->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
+        t_in->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
+        t_out->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
+
+        psa_reset_key_attributes(&attributes);
+        psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
+        psa_set_key_algorithm(&attributes, PSA_ALG_HMAC(alg));
+        psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
+
+        CHK(psa_import_key(&attributes,
+                           md0, maclen,
+                           &t_in->psa_mac_enc) == PSA_SUCCESS);
+
+        CHK(psa_import_key(&attributes,
+                           md1, maclen,
+                           &t_out->psa_mac_enc) == PSA_SUCCESS);
+
+        if (cipher_info->mode == MBEDTLS_MODE_STREAM ||
+            etm == MBEDTLS_SSL_ETM_DISABLED) {
+            /* mbedtls_ct_hmac() requires the key to be exportable */
+            psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT |
+                                    PSA_KEY_USAGE_VERIFY_HASH);
+        } else {
+            psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_VERIFY_HASH);
+        }
+
+        CHK(psa_import_key(&attributes,
+                           md1, maclen,
+                           &t_in->psa_mac_dec) == PSA_SUCCESS);
+
+        CHK(psa_import_key(&attributes,
+                           md0, maclen,
+                           &t_out->psa_mac_dec) == PSA_SUCCESS);
+#else
+        CHK(mbedtls_md_setup(&t_out->md_ctx_enc, md_info, 1) == 0);
+        CHK(mbedtls_md_setup(&t_out->md_ctx_dec, md_info, 1) == 0);
+        CHK(mbedtls_md_setup(&t_in->md_ctx_enc,  md_info, 1) == 0);
+        CHK(mbedtls_md_setup(&t_in->md_ctx_dec,  md_info, 1) == 0);
+
+        CHK(mbedtls_md_hmac_starts(&t_in->md_ctx_enc,
+                                   md0, maclen) == 0);
+        CHK(mbedtls_md_hmac_starts(&t_in->md_ctx_dec,
+                                   md1, maclen) == 0);
+        CHK(mbedtls_md_hmac_starts(&t_out->md_ctx_enc,
+                                   md1, maclen) == 0);
+        CHK(mbedtls_md_hmac_starts(&t_out->md_ctx_dec,
+                                   md0, maclen) == 0);
+#endif
+    }
+#else
+    ((void) hash_id);
+#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
+
+
+    /* Pick IV's (regardless of whether they
+     * are being used by the transform). */
+    ivlen = cipher_info->iv_size;
+    memset(iv_enc, 0x3, sizeof(iv_enc));
+    memset(iv_dec, 0x4, sizeof(iv_dec));
+
+    /*
+     * Setup transforms
+     */
+
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
+    defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
+    t_out->encrypt_then_mac = etm;
+    t_in->encrypt_then_mac = etm;
+#else
+    ((void) etm);
+#endif
+
+    t_out->tls_version = tls_version;
+    t_in->tls_version = tls_version;
+    t_out->ivlen = ivlen;
+    t_in->ivlen = ivlen;
+
+    switch (cipher_info->mode) {
+        case MBEDTLS_MODE_GCM:
+        case MBEDTLS_MODE_CCM:
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+            if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
+                t_out->fixed_ivlen = 12;
+                t_in->fixed_ivlen  = 12;
+            } else
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+            {
+                t_out->fixed_ivlen = 4;
+                t_in->fixed_ivlen = 4;
+            }
+            t_out->maclen = 0;
+            t_in->maclen = 0;
+            switch (tag_mode) {
+                case 0: /* Full tag */
+                    t_out->taglen = 16;
+                    t_in->taglen = 16;
+                    break;
+                case 1: /* Partial tag */
+                    t_out->taglen = 8;
+                    t_in->taglen = 8;
+                    break;
+                default:
+                    ret = 1;
+                    goto cleanup;
+            }
+            break;
+
+        case MBEDTLS_MODE_CHACHAPOLY:
+            t_out->fixed_ivlen = 12;
+            t_in->fixed_ivlen = 12;
+            t_out->maclen = 0;
+            t_in->maclen = 0;
+            switch (tag_mode) {
+                case 0: /* Full tag */
+                    t_out->taglen = 16;
+                    t_in->taglen = 16;
+                    break;
+                case 1: /* Partial tag */
+                    t_out->taglen = 8;
+                    t_in->taglen = 8;
+                    break;
+                default:
+                    ret = 1;
+                    goto cleanup;
+            }
+            break;
+
+        case MBEDTLS_MODE_STREAM:
+        case MBEDTLS_MODE_CBC:
+            t_out->fixed_ivlen = 0; /* redundant, must be 0 */
+            t_in->fixed_ivlen = 0;  /* redundant, must be 0 */
+            t_out->taglen = 0;
+            t_in->taglen = 0;
+            switch (tag_mode) {
+                case 0: /* Full tag */
+                    t_out->maclen = maclen;
+                    t_in->maclen = maclen;
+                    break;
+                default:
+                    ret = 1;
+                    goto cleanup;
+            }
+            break;
+        default:
+            ret = 1;
+            goto cleanup;
+            break;
+    }
+
+    /* Setup IV's */
+
+    memcpy(&t_in->iv_dec, iv_dec, sizeof(iv_dec));
+    memcpy(&t_in->iv_enc, iv_enc, sizeof(iv_enc));
+    memcpy(&t_out->iv_dec, iv_enc, sizeof(iv_enc));
+    memcpy(&t_out->iv_enc, iv_dec, sizeof(iv_dec));
+
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
+    /* Add CID */
+    memcpy(&t_in->in_cid,  cid0, cid0_len);
+    memcpy(&t_in->out_cid, cid1, cid1_len);
+    t_in->in_cid_len = (uint8_t) cid0_len;
+    t_in->out_cid_len = (uint8_t) cid1_len;
+    memcpy(&t_out->in_cid,  cid1, cid1_len);
+    memcpy(&t_out->out_cid, cid0, cid0_len);
+    t_out->in_cid_len = (uint8_t) cid1_len;
+    t_out->out_cid_len = (uint8_t) cid0_len;
+#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+    status = mbedtls_ssl_cipher_to_psa(cipher_type,
+                                       t_in->taglen,
+                                       &alg,
+                                       &key_type,
+                                       &key_bits);
+
+    if (status != PSA_SUCCESS) {
+        ret = PSA_TO_MBEDTLS_ERR(status);
+        goto cleanup;
+    }
+
+    t_in->psa_alg = alg;
+    t_out->psa_alg = alg;
+
+    if (alg != MBEDTLS_SSL_NULL_CIPHER) {
+        psa_reset_key_attributes(&attributes);
+        psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
+        psa_set_key_algorithm(&attributes, alg);
+        psa_set_key_type(&attributes, key_type);
+
+        status = psa_import_key(&attributes,
+                                key0,
+                                PSA_BITS_TO_BYTES(key_bits),
+                                &t_in->psa_key_enc);
+
+        if (status != PSA_SUCCESS) {
+            ret = PSA_TO_MBEDTLS_ERR(status);
+            goto cleanup;
+        }
+
+        status = psa_import_key(&attributes,
+                                key1,
+                                PSA_BITS_TO_BYTES(key_bits),
+                                &t_out->psa_key_enc);
+
+        if (status != PSA_SUCCESS) {
+            ret = PSA_TO_MBEDTLS_ERR(status);
+            goto cleanup;
+        }
+
+        psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
+
+        status = psa_import_key(&attributes,
+                                key1,
+                                PSA_BITS_TO_BYTES(key_bits),
+                                &t_in->psa_key_dec);
+
+        if (status != PSA_SUCCESS) {
+            ret = PSA_TO_MBEDTLS_ERR(status);
+            goto cleanup;
+        }
+
+        status = psa_import_key(&attributes,
+                                key0,
+                                PSA_BITS_TO_BYTES(key_bits),
+                                &t_out->psa_key_dec);
+
+        if (status != PSA_SUCCESS) {
+            ret = PSA_TO_MBEDTLS_ERR(status);
+            goto cleanup;
+        }
+    }
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
+cleanup:
+
+    mbedtls_free(key0);
+    mbedtls_free(key1);
+
+    mbedtls_free(md0);
+    mbedtls_free(md1);
+
+    return ret;
+}
+
+int mbedtls_test_ssl_tls12_populate_session(mbedtls_ssl_session *session,
+                                            int ticket_len,
+                                            const char *crt_file)
+{
+#if defined(MBEDTLS_HAVE_TIME)
+    session->start = mbedtls_time(NULL) - 42;
+#endif
+    session->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
+    session->ciphersuite = 0xabcd;
+    session->id_len = sizeof(session->id);
+    memset(session->id, 66, session->id_len);
+    memset(session->master, 17, sizeof(session->master));
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && defined(MBEDTLS_FS_IO)
+    if (crt_file != NULL && strlen(crt_file) != 0) {
+        mbedtls_x509_crt tmp_crt;
+        int ret;
+
+        mbedtls_x509_crt_init(&tmp_crt);
+        ret = mbedtls_x509_crt_parse_file(&tmp_crt, crt_file);
+        if (ret != 0) {
+            return ret;
+        }
+
+#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
+        /* Move temporary CRT. */
+        session->peer_cert = mbedtls_calloc(1, sizeof(*session->peer_cert));
+        if (session->peer_cert == NULL) {
+            return -1;
+        }
+        *session->peer_cert = tmp_crt;
+        memset(&tmp_crt, 0, sizeof(tmp_crt));
+#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
+        /* Calculate digest of temporary CRT. */
+        session->peer_cert_digest =
+            mbedtls_calloc(1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN);
+        if (session->peer_cert_digest == NULL) {
+            return -1;
+        }
+
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+        psa_algorithm_t psa_alg = mbedtls_hash_info_psa_from_md(
+            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE);
+        size_t hash_size = 0;
+        psa_status_t status = psa_hash_compute(
+            psa_alg, tmp_crt.raw.p,
+            tmp_crt.raw.len,
+            session->peer_cert_digest,
+            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN,
+            &hash_size);
+        ret = PSA_TO_MBEDTLS_ERR(status);
+#else
+        ret = mbedtls_md(mbedtls_md_info_from_type(
+                             MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE),
+                         tmp_crt.raw.p, tmp_crt.raw.len,
+                         session->peer_cert_digest);
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
+        if (ret != 0) {
+            return ret;
+        }
+        session->peer_cert_digest_type =
+            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
+        session->peer_cert_digest_len =
+            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
+#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
+
+        mbedtls_x509_crt_free(&tmp_crt);
+    }
+#else /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED && MBEDTLS_FS_IO */
+    (void) crt_file;
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED && MBEDTLS_FS_IO */
+    session->verify_result = 0xdeadbeef;
+
+#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
+    if (ticket_len != 0) {
+        session->ticket = mbedtls_calloc(1, ticket_len);
+        if (session->ticket == NULL) {
+            return -1;
+        }
+        memset(session->ticket, 33, ticket_len);
+    }
+    session->ticket_len = ticket_len;
+    session->ticket_lifetime = 86401;
+#else
+    (void) ticket_len;
+#endif
+
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
+    session->mfl_code = 1;
+#endif
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
+    session->encrypt_then_mac = 1;
+#endif
+
+    return 0;
+}
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+int mbedtls_test_ssl_tls13_populate_session(mbedtls_ssl_session *session,
+                                            int ticket_len,
+                                            int endpoint_type)
+{
+    ((void) ticket_len);
+    session->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
+    session->endpoint = endpoint_type == MBEDTLS_SSL_IS_CLIENT ?
+                        MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER;
+    session->ciphersuite = 0xabcd;
+    session->ticket_age_add = 0x87654321;
+    session->ticket_flags = 0x7;
+
+    session->resumption_key_len = 32;
+    memset(session->resumption_key, 0x99, sizeof(session->resumption_key));
+
+#if defined(MBEDTLS_HAVE_TIME)
+    if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
+        session->start = mbedtls_time(NULL) - 42;
+    }
+#endif
+
+#if defined(MBEDTLS_SSL_CLI_C)
+    if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
+#if defined(MBEDTLS_HAVE_TIME)
+        session->ticket_received = mbedtls_time(NULL) - 40;
+#endif
+        session->ticket_lifetime = 0xfedcba98;
+
+        session->ticket_len = ticket_len;
+        if (ticket_len != 0) {
+            session->ticket = mbedtls_calloc(1, ticket_len);
+            if (session->ticket == NULL) {
+                return -1;
+            }
+            memset(session->ticket, 33, ticket_len);
+        }
+    }
+#endif /* MBEDTLS_SSL_CLI_C */
+
+    return 0;
+}
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
+int mbedtls_exchange_data(mbedtls_ssl_context *ssl_1,
+                          int msg_len_1, const int expected_fragments_1,
+                          mbedtls_ssl_context *ssl_2,
+                          int msg_len_2, const int expected_fragments_2)
+{
+    unsigned char *msg_buf_1 = malloc(msg_len_1);
+    unsigned char *msg_buf_2 = malloc(msg_len_2);
+    unsigned char *in_buf_1  = malloc(msg_len_2);
+    unsigned char *in_buf_2  = malloc(msg_len_1);
+    int msg_type, ret = -1;
+
+    /* Perform this test with two message types. At first use a message
+     * consisting of only 0x00 for the client and only 0xFF for the server.
+     * At the second time use message with generated data */
+    for (msg_type = 0; msg_type < 2; msg_type++) {
+        int written_1 = 0;
+        int written_2 = 0;
+        int read_1 = 0;
+        int read_2 = 0;
+        int fragments_1 = 0;
+        int fragments_2 = 0;
+
+        if (msg_type == 0) {
+            memset(msg_buf_1, 0x00, msg_len_1);
+            memset(msg_buf_2, 0xff, msg_len_2);
+        } else {
+            int i, j = 0;
+            for (i = 0; i < msg_len_1; i++) {
+                msg_buf_1[i] = j++ & 0xFF;
+            }
+            for (i = 0; i < msg_len_2; i++) {
+                msg_buf_2[i] = (j -= 5) & 0xFF;
+            }
+        }
+
+        while (read_1 < msg_len_2 || read_2 < msg_len_1) {
+            /* ssl_1 sending */
+            if (msg_len_1 > written_1) {
+                ret = mbedtls_ssl_write_fragment(ssl_1, msg_buf_1,
+                                                 msg_len_1, &written_1,
+                                                 expected_fragments_1);
+                if (expected_fragments_1 == 0) {
+                    /* This error is expected when the message is too large and
+                     * cannot be fragmented */
+                    TEST_ASSERT(ret == MBEDTLS_ERR_SSL_BAD_INPUT_DATA);
+                    msg_len_1 = 0;
+                } else {
+                    TEST_ASSERT(ret == 0);
+                }
+            }
+
+            /* ssl_2 sending */
+            if (msg_len_2 > written_2) {
+                ret = mbedtls_ssl_write_fragment(ssl_2, msg_buf_2,
+                                                 msg_len_2, &written_2,
+                                                 expected_fragments_2);
+                if (expected_fragments_2 == 0) {
+                    /* This error is expected when the message is too large and
+                     * cannot be fragmented */
+                    TEST_ASSERT(ret == MBEDTLS_ERR_SSL_BAD_INPUT_DATA);
+                    msg_len_2 = 0;
+                } else {
+                    TEST_ASSERT(ret == 0);
+                }
+            }
+
+            /* ssl_1 reading */
+            if (read_1 < msg_len_2) {
+                ret = mbedtls_ssl_read_fragment(ssl_1, in_buf_1,
+                                                msg_len_2, &read_1,
+                                                &fragments_2,
+                                                expected_fragments_2);
+                TEST_ASSERT(ret == 0);
+            }
+
+            /* ssl_2 reading */
+            if (read_2 < msg_len_1) {
+                ret = mbedtls_ssl_read_fragment(ssl_2, in_buf_2,
+                                                msg_len_1, &read_2,
+                                                &fragments_1,
+                                                expected_fragments_1);
+                TEST_ASSERT(ret == 0);
+            }
+        }
+
+        ret = -1;
+        TEST_ASSERT(0 == memcmp(msg_buf_1, in_buf_2, msg_len_1));
+        TEST_ASSERT(0 == memcmp(msg_buf_2, in_buf_1, msg_len_2));
+        TEST_ASSERT(fragments_1 == expected_fragments_1);
+        TEST_ASSERT(fragments_2 == expected_fragments_2);
+    }
+
+    ret = 0;
+
+exit:
+    free(msg_buf_1);
+    free(in_buf_1);
+    free(msg_buf_2);
+    free(in_buf_2);
+
+    return ret;
+}
+
+/*
+ * Perform data exchanging between \p ssl_1 and \p ssl_2. Both of endpoints
+ * must be initialized and connected beforehand.
+ *
+ * \retval  0 on success, otherwise error code.
+ */
+int exchange_data(mbedtls_ssl_context *ssl_1,
+                  mbedtls_ssl_context *ssl_2)
+{
+    return mbedtls_exchange_data(ssl_1, 256, 1,
+                                 ssl_2, 256, 1);
+}
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+static int check_ssl_version(
+    mbedtls_ssl_protocol_version expected_negotiated_version,
+    const mbedtls_ssl_context *ssl)
+{
+    const char *version_string = mbedtls_ssl_get_version(ssl);
+    mbedtls_ssl_protocol_version version_number =
+        mbedtls_ssl_get_version_number(ssl);
+
+    TEST_EQUAL(ssl->tls_version, expected_negotiated_version);
+
+    if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
+        TEST_EQUAL(version_string[0], 'D');
+        ++version_string;
+    }
+
+    switch (expected_negotiated_version) {
+        case MBEDTLS_SSL_VERSION_TLS1_2:
+            TEST_EQUAL(version_number, MBEDTLS_SSL_VERSION_TLS1_2);
+            TEST_ASSERT(strcmp(version_string, "TLSv1.2") == 0);
+            break;
+
+        case MBEDTLS_SSL_VERSION_TLS1_3:
+            TEST_EQUAL(version_number, MBEDTLS_SSL_VERSION_TLS1_3);
+            TEST_ASSERT(strcmp(version_string, "TLSv1.3") == 0);
+            break;
+
+        default:
+            TEST_ASSERT(
+                !"Version check not implemented for this protocol version");
+    }
+
+    return 1;
+
+exit:
+    return 0;
+}
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
+void mbedtls_test_ssl_perform_handshake(
+    mbedtls_test_handshake_test_options *options)
+{
+    /* forced_ciphersuite needs to last until the end of the handshake */
+    int forced_ciphersuite[2];
+    enum { BUFFSIZE = 17000 };
+    mbedtls_test_ssl_endpoint client, server;
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
+    const char *psk_identity = "foo";
+#endif
+#if defined(MBEDTLS_TIMING_C)
+    mbedtls_timing_delay_context timer_client, timer_server;
+#endif
+#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
+    unsigned char *context_buf = NULL;
+    size_t context_buf_len;
+#endif
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    int ret = -1;
+#endif
+    int expected_handshake_result = options->expected_handshake_result;
+
+    USE_PSA_INIT();
+    mbedtls_platform_zeroize(&client, sizeof(client));
+    mbedtls_platform_zeroize(&server, sizeof(server));
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
+    mbedtls_test_message_socket_context server_context, client_context;
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
+
+    /* Client side */
+    if (options->dtls != 0) {
+        TEST_ASSERT(mbedtls_test_ssl_endpoint_init(&client,
+                                                   MBEDTLS_SSL_IS_CLIENT,
+                                                   options, &client_context,
+                                                   &client_queue,
+                                                   &server_queue, NULL) == 0);
+#if defined(MBEDTLS_TIMING_C)
+        mbedtls_ssl_set_timer_cb(&client.ssl, &timer_client,
+                                 mbedtls_timing_set_delay,
+                                 mbedtls_timing_get_delay);
+#endif
+    } else {
+        TEST_ASSERT(mbedtls_test_ssl_endpoint_init(&client,
+                                                   MBEDTLS_SSL_IS_CLIENT,
+                                                   options, NULL, NULL,
+                                                   NULL, NULL) == 0);
+    }
+
+    if (options->client_min_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
+        mbedtls_ssl_conf_min_tls_version(&client.conf,
+                                         options->client_min_version);
+    }
+
+    if (options->client_max_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
+        mbedtls_ssl_conf_max_tls_version(&client.conf,
+                                         options->client_max_version);
+    }
+
+    if (strlen(options->cipher) > 0) {
+        set_ciphersuite(&client.conf, options->cipher, forced_ciphersuite);
+    }
+
+#if defined(MBEDTLS_DEBUG_C)
+    if (options->cli_log_fun) {
+        mbedtls_debug_set_threshold(4);
+        mbedtls_ssl_conf_dbg(&client.conf, options->cli_log_fun,
+                             options->cli_log_obj);
+    }
+#endif
+
+    /* Server side */
+    if (options->dtls != 0) {
+        TEST_ASSERT(mbedtls_test_ssl_endpoint_init(&server,
+                                                   MBEDTLS_SSL_IS_SERVER,
+                                                   options, &server_context,
+                                                   &server_queue,
+                                                   &client_queue, NULL) == 0);
+#if defined(MBEDTLS_TIMING_C)
+        mbedtls_ssl_set_timer_cb(&server.ssl, &timer_server,
+                                 mbedtls_timing_set_delay,
+                                 mbedtls_timing_get_delay);
+#endif
+    } else {
+        TEST_ASSERT(mbedtls_test_ssl_endpoint_init(&server,
+                                                   MBEDTLS_SSL_IS_SERVER,
+                                                   options, NULL, NULL, NULL,
+                                                   NULL) == 0);
+    }
+
+    mbedtls_ssl_conf_authmode(&server.conf, options->srv_auth_mode);
+
+    if (options->server_min_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
+        mbedtls_ssl_conf_min_tls_version(&server.conf,
+                                         options->server_min_version);
+    }
+
+    if (options->server_max_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
+        mbedtls_ssl_conf_max_tls_version(&server.conf,
+                                         options->server_max_version);
+    }
+
+#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
+    TEST_ASSERT(mbedtls_ssl_conf_max_frag_len(&(server.conf),
+                                              (unsigned char) options->mfl)
+                == 0);
+    TEST_ASSERT(mbedtls_ssl_conf_max_frag_len(&(client.conf),
+                                              (unsigned char) options->mfl)
+                == 0);
+#else
+    TEST_ASSERT(MBEDTLS_SSL_MAX_FRAG_LEN_NONE == options->mfl);
+#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
+
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
+    if (options->psk_str != NULL && options->psk_str->len > 0) {
+        TEST_ASSERT(mbedtls_ssl_conf_psk(
+                        &client.conf, options->psk_str->x,
+                        options->psk_str->len,
+                        (const unsigned char *) psk_identity,
+                        strlen(psk_identity)) == 0);
+
+        TEST_ASSERT(mbedtls_ssl_conf_psk(
+                        &server.conf, options->psk_str->x,
+                        options->psk_str->len,
+                        (const unsigned char *) psk_identity,
+                        strlen(psk_identity)) == 0);
+#if defined(MBEDTLS_SSL_SRV_C)
+        mbedtls_ssl_conf_psk_cb(&server.conf, psk_dummy_callback, NULL);
+#endif
+    }
+#endif
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if (options->renegotiate) {
+        mbedtls_ssl_conf_renegotiation(&(server.conf),
+                                       MBEDTLS_SSL_RENEGOTIATION_ENABLED);
+        mbedtls_ssl_conf_renegotiation(&(client.conf),
+                                       MBEDTLS_SSL_RENEGOTIATION_ENABLED);
+
+        mbedtls_ssl_conf_legacy_renegotiation(&(server.conf),
+                                              options->legacy_renegotiation);
+        mbedtls_ssl_conf_legacy_renegotiation(&(client.conf),
+                                              options->legacy_renegotiation);
+    }
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
+
+#if defined(MBEDTLS_DEBUG_C)
+    if (options->srv_log_fun) {
+        mbedtls_debug_set_threshold(4);
+        mbedtls_ssl_conf_dbg(&server.conf, options->srv_log_fun,
+                             options->srv_log_obj);
+    }
+#endif
+
+    TEST_ASSERT(mbedtls_test_mock_socket_connect(&(client.socket),
+                                                 &(server.socket),
+                                                 BUFFSIZE) == 0);
+
+#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
+    if (options->resize_buffers != 0) {
+        /* Ensure that the buffer sizes are appropriate before resizes */
+        TEST_ASSERT(client.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
+        TEST_ASSERT(client.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
+        TEST_ASSERT(server.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
+        TEST_ASSERT(server.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
+    }
+#endif
+
+    if (options->expected_negotiated_version == MBEDTLS_SSL_VERSION_UNKNOWN) {
+        expected_handshake_result = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
+    }
+
+    TEST_ASSERT(mbedtls_test_move_handshake_to_state(&(client.ssl),
+                                                     &(server.ssl),
+                                                     MBEDTLS_SSL_HANDSHAKE_OVER)
+                ==  expected_handshake_result);
+
+    if (expected_handshake_result != 0) {
+        /* Connection will have failed by this point, skip to cleanup */
+        goto exit;
+    }
+
+    TEST_ASSERT(mbedtls_ssl_is_handshake_over(&client.ssl) == 1);
+
+    /* Make sure server state is moved to HANDSHAKE_OVER also. */
+    TEST_EQUAL(mbedtls_test_move_handshake_to_state(&(server.ssl),
+                                                    &(client.ssl),
+                                                    MBEDTLS_SSL_HANDSHAKE_OVER),
+               0);
+
+    TEST_ASSERT(mbedtls_ssl_is_handshake_over(&server.ssl) == 1);
+    /* Check that both sides have negotiated the expected version. */
+    mbedtls_test_set_step(0);
+    if (!check_ssl_version(options->expected_negotiated_version,
+                           &client.ssl)) {
+        goto exit;
+    }
+
+    mbedtls_test_set_step(1);
+    if (!check_ssl_version(options->expected_negotiated_version,
+                           &server.ssl)) {
+        goto exit;
+    }
+
+    if (options->expected_ciphersuite != 0) {
+        TEST_EQUAL(server.ssl.session->ciphersuite,
+                   options->expected_ciphersuite);
+    }
+
+#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
+    if (options->resize_buffers != 0) {
+        /* A server, when using DTLS, might delay a buffer resize to happen
+         * after it receives a message, so we force it. */
+        TEST_ASSERT(exchange_data(&(client.ssl), &(server.ssl)) == 0);
+
+        TEST_ASSERT(client.ssl.out_buf_len ==
+                    mbedtls_ssl_get_output_buflen(&client.ssl));
+        TEST_ASSERT(client.ssl.in_buf_len ==
+                    mbedtls_ssl_get_input_buflen(&client.ssl));
+        TEST_ASSERT(server.ssl.out_buf_len ==
+                    mbedtls_ssl_get_output_buflen(&server.ssl));
+        TEST_ASSERT(server.ssl.in_buf_len ==
+                    mbedtls_ssl_get_input_buflen(&server.ssl));
+    }
+#endif
+
+    if (options->cli_msg_len != 0 || options->srv_msg_len != 0) {
+        /* Start data exchanging test */
+        TEST_ASSERT(mbedtls_exchange_data(&(client.ssl), options->cli_msg_len,
+                                          options->expected_cli_fragments,
+                                          &(server.ssl), options->srv_msg_len,
+                                          options->expected_srv_fragments)
+                    == 0);
+    }
+#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
+    if (options->serialize == 1) {
+        TEST_ASSERT(options->dtls == 1);
+
+        TEST_ASSERT(mbedtls_ssl_context_save(&(server.ssl), NULL,
+                                             0, &context_buf_len)
+                    == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL);
+
+        context_buf = mbedtls_calloc(1, context_buf_len);
+        TEST_ASSERT(context_buf != NULL);
+
+        TEST_ASSERT(mbedtls_ssl_context_save(&(server.ssl), context_buf,
+                                             context_buf_len,
+                                             &context_buf_len)
+                    == 0);
+
+        mbedtls_ssl_free(&(server.ssl));
+        mbedtls_ssl_init(&(server.ssl));
+
+        TEST_ASSERT(mbedtls_ssl_setup(&(server.ssl), &(server.conf)) == 0);
+
+        mbedtls_ssl_set_bio(&(server.ssl), &server_context,
+                            mbedtls_test_mock_tcp_send_msg,
+                            mbedtls_test_mock_tcp_recv_msg,
+                            NULL);
+
+        mbedtls_ssl_set_user_data_p(&server.ssl, &server);
+
+#if defined(MBEDTLS_TIMING_C)
+        mbedtls_ssl_set_timer_cb(&server.ssl, &timer_server,
+                                 mbedtls_timing_set_delay,
+                                 mbedtls_timing_get_delay);
+#endif
+#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
+        if (options->resize_buffers != 0) {
+            /* Ensure that the buffer sizes are appropriate before resizes */
+            TEST_ASSERT(server.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
+            TEST_ASSERT(server.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
+        }
+#endif
+        TEST_ASSERT(mbedtls_ssl_context_load(&(server.ssl), context_buf,
+                                             context_buf_len) == 0);
+
+#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
+        /* Validate buffer sizes after context deserialization */
+        if (options->resize_buffers != 0) {
+            TEST_ASSERT(server.ssl.out_buf_len ==
+                        mbedtls_ssl_get_output_buflen(&server.ssl));
+            TEST_ASSERT(server.ssl.in_buf_len ==
+                        mbedtls_ssl_get_input_buflen(&server.ssl));
+        }
+#endif
+        /* Retest writing/reading */
+        if (options->cli_msg_len != 0 || options->srv_msg_len != 0) {
+            TEST_ASSERT(mbedtls_exchange_data(
+                            &(client.ssl),
+                            options->cli_msg_len,
+                            options->expected_cli_fragments,
+                            &(server.ssl),
+                            options->srv_msg_len,
+                            options->expected_srv_fragments)
+                        == 0);
+        }
+    }
+#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
+
+#if defined(MBEDTLS_SSL_RENEGOTIATION)
+    if (options->renegotiate) {
+        /* Start test with renegotiation */
+        TEST_ASSERT(server.ssl.renego_status ==
+                    MBEDTLS_SSL_INITIAL_HANDSHAKE);
+        TEST_ASSERT(client.ssl.renego_status ==
+                    MBEDTLS_SSL_INITIAL_HANDSHAKE);
+
+        /* After calling this function for the server, it only sends a handshake
+         * request. All renegotiation should happen during data exchanging */
+        TEST_ASSERT(mbedtls_ssl_renegotiate(&(server.ssl)) == 0);
+        TEST_ASSERT(server.ssl.renego_status ==
+                    MBEDTLS_SSL_RENEGOTIATION_PENDING);
+        TEST_ASSERT(client.ssl.renego_status ==
+                    MBEDTLS_SSL_INITIAL_HANDSHAKE);
+
+        TEST_ASSERT(exchange_data(&(client.ssl), &(server.ssl)) == 0);
+        TEST_ASSERT(server.ssl.renego_status ==
+                    MBEDTLS_SSL_RENEGOTIATION_DONE);
+        TEST_ASSERT(client.ssl.renego_status ==
+                    MBEDTLS_SSL_RENEGOTIATION_DONE);
+
+        /* After calling mbedtls_ssl_renegotiate for the client,
+         * all renegotiation should happen inside this function.
+         * However in this test, we cannot perform simultaneous communication
+         * between client and server so this function will return waiting error
+         * on the socket. All rest of renegotiation should happen
+         * during data exchanging */
+        ret = mbedtls_ssl_renegotiate(&(client.ssl));
+#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
+        if (options->resize_buffers != 0) {
+            /* Ensure that the buffer sizes are appropriate before resizes */
+            TEST_ASSERT(client.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
+            TEST_ASSERT(client.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
+        }
+#endif
+        TEST_ASSERT(ret == 0 ||
+                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
+                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
+        TEST_ASSERT(server.ssl.renego_status ==
+                    MBEDTLS_SSL_RENEGOTIATION_DONE);
+        TEST_ASSERT(client.ssl.renego_status ==
+                    MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS);
+
+        TEST_ASSERT(exchange_data(&(client.ssl), &(server.ssl)) == 0);
+        TEST_ASSERT(server.ssl.renego_status ==
+                    MBEDTLS_SSL_RENEGOTIATION_DONE);
+        TEST_ASSERT(client.ssl.renego_status ==
+                    MBEDTLS_SSL_RENEGOTIATION_DONE);
+#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
+        /* Validate buffer sizes after renegotiation */
+        if (options->resize_buffers != 0) {
+            TEST_ASSERT(client.ssl.out_buf_len ==
+                        mbedtls_ssl_get_output_buflen(&client.ssl));
+            TEST_ASSERT(client.ssl.in_buf_len ==
+                        mbedtls_ssl_get_input_buflen(&client.ssl));
+            TEST_ASSERT(server.ssl.out_buf_len ==
+                        mbedtls_ssl_get_output_buflen(&server.ssl));
+            TEST_ASSERT(server.ssl.in_buf_len ==
+                        mbedtls_ssl_get_input_buflen(&server.ssl));
+        }
+#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
+    }
+#endif /* MBEDTLS_SSL_RENEGOTIATION */
+
+    TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&client.conf) == &client);
+    TEST_ASSERT(mbedtls_ssl_get_user_data_p(&client.ssl) == &client);
+    TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&server.conf) == &server);
+    TEST_ASSERT(mbedtls_ssl_get_user_data_p(&server.ssl) == &server);
+
+exit:
+    mbedtls_test_ssl_endpoint_free(&client,
+                                   options->dtls != 0 ? &client_context : NULL);
+    mbedtls_test_ssl_endpoint_free(&server,
+                                   options->dtls != 0 ? &server_context : NULL);
+#if defined(MBEDTLS_DEBUG_C)
+    if (options->cli_log_fun || options->srv_log_fun) {
+        mbedtls_debug_set_threshold(0);
+    }
+#endif
+#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
+    if (context_buf != NULL) {
+        mbedtls_free(context_buf);
+    }
+#endif
+    USE_PSA_DONE();
+}
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
+#if defined(MBEDTLS_TEST_HOOKS)
+int tweak_tls13_certificate_msg_vector_len(
+    unsigned char *buf, unsigned char **end, int tweak,
+    int *expected_result, mbedtls_ssl_chk_buf_ptr_args *args)
+{
+/*
+ * The definition of the tweaks assume that the certificate list contains only
+ * one certificate.
+ */
+
+/*
+ * struct {
+ *     opaque cert_data<1..2^24-1>;
+ *     Extension extensions<0..2^16-1>;
+ * } CertificateEntry;
+ *
+ * struct {
+ *     opaque certificate_request_context<0..2^8-1>;
+ *     CertificateEntry certificate_list<0..2^24-1>;
+ * } Certificate;
+ */
+    unsigned char *p_certificate_request_context_len = buf;
+    size_t certificate_request_context_len = buf[0];
+
+    unsigned char *p_certificate_list_len =
+        buf + 1 + certificate_request_context_len;
+    unsigned char *certificate_list = p_certificate_list_len + 3;
+    size_t certificate_list_len =
+        MBEDTLS_GET_UINT24_BE(p_certificate_list_len, 0);
+
+    unsigned char *p_cert_data_len = certificate_list;
+    unsigned char *cert_data = p_cert_data_len + 3;
+    size_t cert_data_len = MBEDTLS_GET_UINT24_BE(p_cert_data_len, 0);
+
+    unsigned char *p_extensions_len = cert_data + cert_data_len;
+    unsigned char *extensions = p_extensions_len + 2;
+    size_t extensions_len = MBEDTLS_GET_UINT16_BE(p_extensions_len, 0);
+
+    *expected_result = MBEDTLS_ERR_SSL_DECODE_ERROR;
+
+    switch (tweak) {
+        case 1:
+            /* Failure when checking if the certificate request context length
+             * and certificate list length can be read
+             */
+            *end = buf + 3;
+            set_chk_buf_ptr_args(args, buf, *end, 4);
+            break;
+
+        case 2:
+            /* Invalid certificate request context length.
+             */
+            *p_certificate_request_context_len =
+                (unsigned char) certificate_request_context_len + 1;
+            reset_chk_buf_ptr_args(args);
+            break;
+
+        case 3:
+            /* Failure when checking if certificate_list data can be read. */
+            MBEDTLS_PUT_UINT24_BE(certificate_list_len + 1,
+                                  p_certificate_list_len, 0);
+            set_chk_buf_ptr_args(args, certificate_list, *end,
+                                 certificate_list_len + 1);
+            break;
+
+        case 4:
+            /* Failure when checking if the cert_data length can be read. */
+            MBEDTLS_PUT_UINT24_BE(2, p_certificate_list_len, 0);
+            set_chk_buf_ptr_args(args, p_cert_data_len, certificate_list + 2, 3);
+            break;
+
+        case 5:
+            /* Failure when checking if cert_data data can be read. */
+            MBEDTLS_PUT_UINT24_BE(certificate_list_len - 3 + 1,
+                                  p_cert_data_len, 0);
+            set_chk_buf_ptr_args(args, cert_data,
+                                 certificate_list + certificate_list_len,
+                                 certificate_list_len - 3 + 1);
+            break;
+
+        case 6:
+            /* Failure when checking if the extensions length can be read. */
+            MBEDTLS_PUT_UINT24_BE(certificate_list_len - extensions_len - 1,
+                                  p_certificate_list_len, 0);
+            set_chk_buf_ptr_args(
+                args, p_extensions_len,
+                certificate_list + certificate_list_len - extensions_len - 1, 2);
+            break;
+
+        case 7:
+            /* Failure when checking if extensions data can be read. */
+            MBEDTLS_PUT_UINT16_BE(extensions_len + 1, p_extensions_len, 0);
+
+            set_chk_buf_ptr_args(
+                args, extensions,
+                certificate_list + certificate_list_len, extensions_len + 1);
+            break;
+
+        default:
+            return -1;
+    }
+
+    return 0;
+}
+#endif /* MBEDTLS_TEST_HOOKS */
+#endif /* MBEDTLS_SSL_TLS_C */
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index d73ef0f..bae9ee5 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -395,7 +395,8 @@
 
     case "$1" in
         *server5*|\
-        *server7*)
+        *server7*|\
+        *dir-maxpath*)
             if [ "$3" = "TLS13" ]; then
                 # In case of TLS13 the support for ECDSA is enough
                 requires_pk_alg "ECDSA"
@@ -1965,6 +1966,7 @@
 requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
 requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
 requires_config_enabled MBEDTLS_RSA_C
+requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 requires_hash_alg SHA_256
 run_test    "Opaque key for client authentication: ECDHE-RSA" \
             "$P_SRV auth_mode=required crt_file=data_files/server2-sha256.crt \
@@ -2244,6 +2246,7 @@
 requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
 requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
 requires_config_enabled MBEDTLS_RSA_C
+requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 requires_hash_alg SHA_256
 run_test    "Opaque key for server authentication: ECDHE-RSA" \
             "$P_SRV key_opaque=1 crt_file=data_files/server2-sha256.crt \
@@ -2330,6 +2333,7 @@
 requires_config_enabled MBEDTLS_RSA_C
 requires_hash_alg SHA_256
 requires_config_disabled MBEDTLS_X509_REMOVE_INFO
+requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 run_test    "Opaque keys for server authentication: RSA keys with different algs" \
             "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server2-sha256.crt \
              key_file=data_files/server2.key key_opaque_algs=rsa-sign-pss,none \
@@ -2394,6 +2398,7 @@
 requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
 requires_config_enabled MBEDTLS_RSA_C
 requires_hash_alg SHA_256
+requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 run_test    "Opaque key for client/server authentication: ECDHE-RSA" \
             "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server2-sha256.crt \
              key_file=data_files/server2.key  key_opaque_algs=rsa-sign-pkcs1,none" \
@@ -4137,6 +4142,22 @@
 
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
 requires_config_enabled MBEDTLS_SSL_CACHE_C
+run_test    "Session resume using cache: cache removed" \
+            "$P_SRV debug_level=3 tickets=0 cache_remove=1" \
+            "$P_CLI debug_level=3 tickets=0 reconnect=1" \
+            0 \
+            -C "client hello, adding session ticket extension" \
+            -S "found session ticket extension" \
+            -S "server hello, adding session ticket extension" \
+            -C "found session_ticket extension" \
+            -C "parse new session ticket" \
+            -S "session successfully restored from cache" \
+            -S "session successfully restored from ticket" \
+            -S "a session has been resumed" \
+            -C "a session has been resumed"
+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_config_enabled MBEDTLS_SSL_CACHE_C
 run_test    "Session resume using cache: timeout > delay" \
             "$P_SRV debug_level=3 tickets=0" \
             "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \
@@ -4727,32 +4748,37 @@
 
 # Tests for Record Size Limit extension
 
-# gnutls feature tests: check if the record size limit extension is supported with TLS 1.2.
-requires_gnutls_record_size_limit
-run_test    "Record Size Limit: Test gnutls record size limit feature" \
-            "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:+CIPHER-ALL --disable-client-cert -d 4" \
-            "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2 -V -d 4" \
-            0 \
-            -c "Preparing extension (Record Size Limit/28) for 'client hello'"\
-            -s "Parsing extension 'Record Size Limit/28' (2 bytes)" \
-            -s "Preparing extension (Record Size Limit/28) for 'TLS 1.2 server hello'" \
-            -c "Parsing extension 'Record Size Limit/28' (2 bytes)" \
-            -s "Version: TLS1.2" \
-            -c "Version: TLS1.2"
-
-# gnutls feature tests: check if the record size limit extension is supported with TLS 1.3.
 requires_gnutls_tls1_3
 requires_gnutls_record_size_limit
-run_test    "Record Size Limit: TLS 1.3: Test gnutls record size limit feature" \
-            "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL --disable-client-cert -d 4" \
+requires_config_enabled MBEDTLS_SSL_RECORD_SIZE_LIMIT
+run_test    "Record Size Limit: TLS 1.3: Server-side parsing, debug output and fatal alert" \
+            "$P_SRV debug_level=3 force_version=tls13" \
             "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3 -V -d 4" \
+            1 \
+            -c "Preparing extension (Record Size Limit/28) for 'client hello'" \
+            -c "Sending extension Record Size Limit/28 (2 bytes)" \
+            -s "ClientHello: record_size_limit(28) extension received."\
+            -s "found record_size_limit extension" \
+            -s "RecordSizeLimit: 16385 Bytes" \
+            -c "Received alert \[110]: An unsupported extension was sent"
+
+requires_gnutls_tls1_3
+requires_gnutls_record_size_limit
+requires_gnutls_next_disable_tls13_compat
+requires_config_enabled MBEDTLS_SSL_RECORD_SIZE_LIMIT
+run_test    "Record Size Limit: TLS 1.3: Client-side parsing, debug output and fatal alert" \
+            "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%DISABLE_TLS13_COMPAT_MODE --disable-client-cert -d 4" \
+            "$P_CLI debug_level=4 force_version=tls13" \
             0 \
-            -c "Preparing extension (Record Size Limit/28) for 'client hello'"\
-            -s "Parsing extension 'Record Size Limit/28' (2 bytes)" \
-            -s "Preparing extension (Record Size Limit/28) for 'encrypted extensions'" \
-            -c "Parsing extension 'Record Size Limit/28' (2 bytes)" \
-            -s "Version: TLS1.3" \
-            -c "Version: TLS1.3"
+            -s "Preparing extension (Record Size Limit/28) for 'encrypted extensions'"
+# The P_CLI can not yet send the Record Size Limit extension. Thus, the G_NEXT_SRV does not send
+# a response in its EncryptedExtensions record.
+#            -s "Parsing extension 'Record Size Limit/28 (2 bytes)" \
+#            -s "Sending extension Record Size Limit/28 (2 bytes)" \
+#            -c "EncryptedExtensions: record_size_limit(28) extension received."\
+#            -c "found record_size_limit extension" \
+#            -c "RecordSizeLimit: 16385 Bytes" \
+#            -s "Received alert \[110]: An unsupported extension was sent"
 
 # Tests for renegotiation
 
@@ -5622,7 +5648,6 @@
 # are in place so that the semantics are consistent with the test description.
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
 run_test    "Authentication: server max_int chain, client default" \
             "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \
                     key_file=data_files/dir-maxpath/09.key" \
@@ -5632,7 +5657,6 @@
 
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
 run_test    "Authentication: server max_int+1 chain, client default" \
             "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
                     key_file=data_files/dir-maxpath/10.key" \
@@ -5642,8 +5666,6 @@
 
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication: server max_int+1 chain, client optional" \
             "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
                     key_file=data_files/dir-maxpath/10.key" \
@@ -5654,8 +5676,6 @@
 
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication: server max_int+1 chain, client none" \
             "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
                     key_file=data_files/dir-maxpath/10.key" \
@@ -5666,7 +5686,6 @@
 
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
 run_test    "Authentication: client max_int+1 chain, server default" \
             "$P_SRV ca_file=data_files/dir-maxpath/00.crt" \
             "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
@@ -5676,7 +5695,6 @@
 
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
 run_test    "Authentication: client max_int+1 chain, server optional" \
             "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \
             "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
@@ -5686,7 +5704,6 @@
 
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
 run_test    "Authentication: client max_int+1 chain, server required" \
             "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \
             "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
@@ -5696,7 +5713,6 @@
 
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
 run_test    "Authentication: client max_int chain, server required" \
             "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \
             "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \
@@ -5928,8 +5944,6 @@
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
 requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: server max_int chain, client default" \
             "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \
                     key_file=data_files/dir-maxpath/09.key" \
@@ -5941,8 +5955,6 @@
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
 requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: server max_int+1 chain, client default" \
             "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
                     key_file=data_files/dir-maxpath/10.key" \
@@ -5954,8 +5966,6 @@
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
 requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: server max_int+1 chain, client optional" \
             "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
                     key_file=data_files/dir-maxpath/10.key" \
@@ -5968,8 +5978,6 @@
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
 requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: client max_int+1 chain, server optional" \
             "$P_SRV ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \
             "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
@@ -5981,8 +5989,6 @@
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
 requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: client max_int+1 chain, server required" \
             "$P_SRV ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \
             "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
@@ -5994,8 +6000,6 @@
 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
 requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
-requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
-requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: client max_int chain, server required" \
             "$P_SRV ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \
             "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \
diff --git a/tests/suites/helpers.function b/tests/suites/helpers.function
index 313459e..60eae9a 100644
--- a/tests/suites/helpers.function
+++ b/tests/suites/helpers.function
@@ -76,25 +76,6 @@
 /*----------------------------------------------------------------------------*/
 /* Helper Functions */
 
-#if defined(MBEDTLS_PSA_CRYPTO_C)
-/** Check that no PSA Crypto key slots are in use.
- *
- * If any slots are in use, mark the current test as failed.
- *
- * \return 0 if the key store is empty, 1 otherwise.
- */
-int test_fail_if_psa_leaking(int line_no, const char *filename)
-{
-    const char *msg = mbedtls_test_helper_is_psa_leaking();
-    if (msg == NULL) {
-        return 0;
-    } else {
-        mbedtls_test_fail(msg, line_no, filename);
-        return 1;
-    }
-}
-#endif /* defined(MBEDTLS_PSA_CRYPTO_C) */
-
 #if defined(__unix__) || (defined(__APPLE__) && defined(__MACH__))
 static int redirect_output(FILE *out_stream, const char *path)
 {
diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function
index ee9f157..ecb3546 100644
--- a/tests/suites/test_suite_ecp.function
+++ b/tests/suites/test_suite_ecp.function
@@ -9,8 +9,7 @@
 #include "bignum_mod_raw_invasive.h"
 
 #if defined(MBEDTLS_TEST_HOOKS) &&                  \
-    (defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ||  \
-    defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED))
+    defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
 #define HAVE_FIX_NEGATIVE
 #endif
 
@@ -1389,6 +1388,49 @@
 /* END_CASE */
 
 /* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
+void ecp_mod_p256_raw(char *input_N,
+                      char *input_X,
+                      char *result)
+{
+    mbedtls_mpi_uint *X = NULL;
+    mbedtls_mpi_uint *N = NULL;
+    mbedtls_mpi_uint *res = NULL;
+    size_t limbs_X;
+    size_t limbs_N;
+    size_t limbs_res;
+
+    mbedtls_mpi_mod_modulus m;
+    mbedtls_mpi_mod_modulus_init(&m);
+
+    TEST_EQUAL(mbedtls_test_read_mpi_core(&X,   &limbs_X,   input_X), 0);
+    TEST_EQUAL(mbedtls_test_read_mpi_core(&N,   &limbs_N,   input_N), 0);
+    TEST_EQUAL(mbedtls_test_read_mpi_core(&res, &limbs_res, result),  0);
+
+    size_t limbs = limbs_N;
+    size_t bytes = limbs * sizeof(mbedtls_mpi_uint);
+
+    TEST_EQUAL(limbs_X, 2 * limbs);
+    TEST_EQUAL(limbs_res, limbs);
+
+    TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(
+                   &m, N, limbs,
+                   MBEDTLS_MPI_MOD_REP_MONTGOMERY), 0);
+
+    TEST_EQUAL(mbedtls_ecp_mod_p256_raw(X, limbs_X), 0);
+    TEST_LE_U(mbedtls_mpi_core_bitlen(X, limbs_X), 256);
+    mbedtls_mpi_mod_raw_fix_quasi_reduction(X, &m);
+    ASSERT_COMPARE(X, bytes, res, bytes);
+
+exit:
+    mbedtls_free(X);
+    mbedtls_free(res);
+
+    mbedtls_mpi_mod_modulus_free(&m);
+    mbedtls_free(N);
+}
+/* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
 void ecp_mod_p521_raw(char *input_N,
                       char *input_X,
                       char *result)
diff --git a/tests/suites/test_suite_md.data b/tests/suites/test_suite_md.data
index 79b8376..24dd39b 100644
--- a/tests/suites/test_suite_md.data
+++ b/tests/suites/test_suite_md.data
@@ -1016,3 +1016,87 @@
 generic SHA-512 Hash file #4
 depends_on:MBEDTLS_SHA512_C
 mbedtls_md_file:MBEDTLS_MD_SHA512:"data_files/hash_file_4":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"
+
+PSA dispatch MD5 legacy only
+depends_on:MBEDTLS_MD5_C:!MBEDTLS_MD_MD5_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_MD5:0:MBEDTLS_MD_ENGINE_LEGACY
+
+PSA dispatch MD5 driver only
+depends_on:!MBEDTLS_MD5_C:MBEDTLS_MD_MD5_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_MD5:MBEDTLS_ERR_MD_BAD_INPUT_DATA:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch MD5 legacy+driver
+depends_on:MBEDTLS_MD5_C:MBEDTLS_MD_MD5_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_MD5:0:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch RIPEMD160 legacy only
+depends_on:MBEDTLS_RIPEMD160_C:!MBEDTLS_MD_RIPEMD160_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_RIPEMD160:0:MBEDTLS_MD_ENGINE_LEGACY
+
+PSA dispatch RIPEMD160 driver only
+depends_on:!MBEDTLS_RIPEMD160_C:MBEDTLS_MD_RIPEMD160_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_RIPEMD160:MBEDTLS_ERR_MD_BAD_INPUT_DATA:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch RIPEMD160 legacy+driver
+depends_on:MBEDTLS_RIPEMD160_C:MBEDTLS_MD_RIPEMD160_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_RIPEMD160:0:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA1 legacy only
+depends_on:MBEDTLS_SHA1_C:!MBEDTLS_MD_SHA1_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA1:0:MBEDTLS_MD_ENGINE_LEGACY
+
+PSA dispatch SHA1 driver only
+depends_on:!MBEDTLS_SHA1_C:MBEDTLS_MD_SHA1_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA1:MBEDTLS_ERR_MD_BAD_INPUT_DATA:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA1 legacy+driver
+depends_on:MBEDTLS_SHA1_C:MBEDTLS_MD_SHA1_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA1:0:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA224 legacy only
+depends_on:MBEDTLS_SHA224_C:!MBEDTLS_MD_SHA224_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA224:0:MBEDTLS_MD_ENGINE_LEGACY
+
+PSA dispatch SHA224 driver only
+depends_on:!MBEDTLS_SHA224_C:MBEDTLS_MD_SHA224_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA224:MBEDTLS_ERR_MD_BAD_INPUT_DATA:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA224 legacy+driver
+depends_on:MBEDTLS_SHA224_C:MBEDTLS_MD_SHA224_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA224:0:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA256 legacy only
+depends_on:MBEDTLS_SHA256_C:!MBEDTLS_MD_SHA256_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA256:0:MBEDTLS_MD_ENGINE_LEGACY
+
+PSA dispatch SHA256 driver only
+depends_on:!MBEDTLS_SHA256_C:MBEDTLS_MD_SHA256_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA256:MBEDTLS_ERR_MD_BAD_INPUT_DATA:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA256 legacy+driver
+depends_on:MBEDTLS_SHA256_C:MBEDTLS_MD_SHA256_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA256:0:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA384 legacy only
+depends_on:MBEDTLS_SHA384_C:!MBEDTLS_MD_SHA384_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA384:0:MBEDTLS_MD_ENGINE_LEGACY
+
+PSA dispatch SHA384 driver only
+depends_on:!MBEDTLS_SHA384_C:MBEDTLS_MD_SHA384_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA384:MBEDTLS_ERR_MD_BAD_INPUT_DATA:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA384 legacy+driver
+depends_on:MBEDTLS_SHA384_C:MBEDTLS_MD_SHA384_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA384:0:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA512 legacy only
+depends_on:MBEDTLS_SHA512_C:!MBEDTLS_MD_SHA512_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA512:0:MBEDTLS_MD_ENGINE_LEGACY
+
+PSA dispatch SHA512 driver only
+depends_on:!MBEDTLS_SHA512_C:MBEDTLS_MD_SHA512_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA512:MBEDTLS_ERR_MD_BAD_INPUT_DATA:MBEDTLS_MD_ENGINE_PSA
+
+PSA dispatch SHA512 legacy+driver
+depends_on:MBEDTLS_SHA512_C:MBEDTLS_MD_SHA512_VIA_PSA
+md_psa_dynamic_dispatch:MBEDTLS_MD_SHA512:0:MBEDTLS_MD_ENGINE_PSA
diff --git a/tests/suites/test_suite_md.function b/tests/suites/test_suite_md.function
index 1e8622b..32c9c8c 100644
--- a/tests/suites/test_suite_md.function
+++ b/tests/suites/test_suite_md.function
@@ -1,5 +1,13 @@
 /* BEGIN_HEADER */
 #include "mbedtls/md.h"
+
+#if defined(MBEDTLS_MD_SOME_PSA)
+#define MD_PSA_INIT()   PSA_INIT()
+#define MD_PSA_DONE()   PSA_DONE()
+#else /* MBEDTLS_MD_SOME_PSA */
+#define MD_PSA_INIT() ((void) 0)
+#define MD_PSA_DONE() ((void) 0)
+#endif /* MBEDTLS_MD_SOME_PSA */
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
@@ -15,6 +23,7 @@
     mbedtls_md_context_t ctx;
     unsigned char out[MBEDTLS_MD_MAX_SIZE] = { 0 };
 
+    MD_PSA_INIT();
     mbedtls_md_init(&ctx);
 
     /*
@@ -31,6 +40,7 @@
 
 exit:
     mbedtls_md_free(&ctx);
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -43,6 +53,7 @@
 #endif
     unsigned char buf[1] = { 0 };
 
+    MD_PSA_INIT();
     mbedtls_md_init(&ctx);
 
     TEST_EQUAL(0, mbedtls_md_get_size(NULL));
@@ -101,6 +112,9 @@
 #if defined(MBEDTLS_MD_C)
     TEST_ASSERT(mbedtls_md_info_from_string("no such md") == NULL);
 #endif
+
+exit:
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -114,6 +128,8 @@
     (void) md_name;
 #endif
 
+    /* Note: PSA Crypto init not needed for info functions */
+
     md_info = mbedtls_md_info_from_type(md_type);
     TEST_ASSERT(md_info != NULL);
 #if defined(MBEDTLS_MD_C)
@@ -144,12 +160,17 @@
     unsigned char output[MBEDTLS_MD_MAX_SIZE] = { 0 };
     const mbedtls_md_info_t *md_info = NULL;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_type);
     TEST_ASSERT(md_info != NULL);
 
     TEST_EQUAL(0, mbedtls_md(md_info, src, src_len, output));
 
     ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+
+exit:
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -159,6 +180,8 @@
     unsigned char output[MBEDTLS_MD_MAX_SIZE] = { 0 };
     const mbedtls_md_info_t *md_info = NULL;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_type);
     TEST_ASSERT(md_info != NULL);
 
@@ -166,6 +189,9 @@
 
 
     ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+
+exit:
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -181,6 +207,8 @@
     const mbedtls_md_info_t *md_info = NULL;
     mbedtls_md_context_t ctx, ctx_copy;
 
+    MD_PSA_INIT();
+
     mbedtls_md_init(&ctx);
     mbedtls_md_init(&ctx_copy);
 
@@ -214,6 +242,7 @@
 exit:
     mbedtls_md_free(&ctx);
     mbedtls_md_free(&ctx_copy);
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -225,6 +254,8 @@
     mbedtls_md_context_t ctx, ctx_copy;
     int halfway;
 
+    MD_PSA_INIT();
+
     mbedtls_md_init(&ctx);
     mbedtls_md_init(&ctx_copy);
 
@@ -258,6 +289,7 @@
 exit:
     mbedtls_md_free(&ctx);
     mbedtls_md_free(&ctx_copy);
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -269,6 +301,8 @@
     unsigned char output[MBEDTLS_MD_MAX_SIZE] = { 0 };
     const mbedtls_md_info_t *md_info = NULL;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_type);
     TEST_ASSERT(md_info != NULL);
 
@@ -277,6 +311,9 @@
                                   src_str->x, src_str->len, output));
 
     ASSERT_COMPARE(output, trunc_size, hash->x, hash->len);
+
+exit:
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -289,6 +326,8 @@
     mbedtls_md_context_t ctx;
     int halfway;
 
+    MD_PSA_INIT();
+
     mbedtls_md_init(&ctx);
 
     md_info = mbedtls_md_info_from_type(md_type);
@@ -320,6 +359,7 @@
 
 exit:
     mbedtls_md_free(&ctx);
+    MD_PSA_DONE();
 }
 /* END_CASE */
 
@@ -330,11 +370,65 @@
     unsigned char output[MBEDTLS_MD_MAX_SIZE] = { 0 };
     const mbedtls_md_info_t *md_info = NULL;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_type);
     TEST_ASSERT(md_info != NULL);
 
     TEST_EQUAL(0, mbedtls_md_file(md_info, filename, output));
 
     ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len);
+
+exit:
+    MD_PSA_DONE();
+}
+/* END_CASE */
+
+/* BEGIN_CASE */
+void md_psa_dynamic_dispatch(int md_type, int pre_psa_ret, int post_psa_engine)
+{
+    const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
+    TEST_ASSERT(md_info != NULL);
+    mbedtls_md_context_t ctx1, ctx2;
+
+    /* Intentionally no PSA init here! (Will be done later.) */
+
+    mbedtls_md_init(&ctx1);
+    mbedtls_md_init(&ctx2);
+
+    /* Before PSA crypto init */
+    TEST_EQUAL(pre_psa_ret, mbedtls_md_setup(&ctx1, md_info, 0));
+    TEST_EQUAL(pre_psa_ret, mbedtls_md_setup(&ctx2, md_info, 0));
+
+#if defined(MBEDTLS_MD_SOME_PSA)
+    TEST_EQUAL(ctx1.engine, MBEDTLS_MD_ENGINE_LEGACY);
+    TEST_EQUAL(ctx2.engine, MBEDTLS_MD_ENGINE_LEGACY);
+#endif
+
+    /* Reset ctx1 but keep ctx2 for the cloning test */
+    mbedtls_md_free(&ctx1);
+    mbedtls_md_init(&ctx1);
+
+    /* Now initilize PSA Crypto */
+    MD_PSA_INIT();
+
+    /* After PSA Crypto init */
+    TEST_EQUAL(0, mbedtls_md_setup(&ctx1, md_info, 0));
+#if defined(MBEDTLS_MD_SOME_PSA)
+    TEST_EQUAL(ctx1.engine, post_psa_engine);
+#endif
+
+    /* Cloning test */
+    if (pre_psa_ret == 0) {
+        int exp_clone_ret = post_psa_engine == MBEDTLS_MD_ENGINE_PSA
+                          ? MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE
+                          : 0;
+        TEST_EQUAL(exp_clone_ret, mbedtls_md_clone(&ctx2, &ctx1));
+    }
+
+exit:
+    mbedtls_md_free(&ctx1);
+    mbedtls_md_free(&ctx2);
+    MD_PSA_DONE();
 }
 /* END_CASE */
diff --git a/tests/suites/test_suite_oid.data b/tests/suites/test_suite_oid.data
index b9fa654..75213e9 100644
--- a/tests/suites/test_suite_oid.data
+++ b/tests/suites/test_suite_oid.data
@@ -101,12 +101,30 @@
 OID get numeric string - multi-byte first subidentifier
 oid_get_numeric_string:"8837":0:"2.999"
 
+OID get numeric string - second subidentifier not terminated
+oid_get_numeric_string:"0081":MBEDTLS_ERR_ASN1_OUT_OF_DATA:""
+
 OID get numeric string - empty oid buffer
 oid_get_numeric_string:"":MBEDTLS_ERR_ASN1_OUT_OF_DATA:""
 
 OID get numeric string - no final / all bytes have top bit set
 oid_get_numeric_string:"818181":MBEDTLS_ERR_ASN1_OUT_OF_DATA:""
 
+OID get numeric string - 0.39
+oid_get_numeric_string:"27":0:"0.39"
+
+OID get numeric string - 1.0
+oid_get_numeric_string:"28":0:"1.0"
+
+OID get numeric string - 1.39
+oid_get_numeric_string:"4f":0:"1.39"
+
+OID get numeric string - 2.0
+oid_get_numeric_string:"50":0:"2.0"
+
+OID get numeric string - 1 byte first subidentifier beyond 2.39
+oid_get_numeric_string:"7f":0:"2.47"
+
 # Encodes the number 0x0400000000 as a subidentifier which overflows 32-bits
 OID get numeric string - 32-bit overflow
 oid_get_numeric_string:"C080808000":MBEDTLS_ERR_ASN1_INVALID_DATA:""
diff --git a/tests/suites/test_suite_oid.function b/tests/suites/test_suite_oid.function
index 3004b65..5fbc9b5 100644
--- a/tests/suites/test_suite_oid.function
+++ b/tests/suites/test_suite_oid.function
@@ -105,13 +105,16 @@
     int ret;
 
     input_oid.tag = MBEDTLS_ASN1_OID;
-    input_oid.p = oid->x;
+    /* Test that an empty OID is not dereferenced */
+    input_oid.p = oid->len ? oid->x : (void *) 1;
     input_oid.len = oid->len;
 
     ret = mbedtls_oid_get_numeric_string(buf, sizeof(buf), &input_oid);
 
     if (error_ret == 0) {
-        TEST_ASSERT(strcmp(buf, result_str) == 0);
+        TEST_EQUAL(ret, strlen(result_str));
+        TEST_ASSERT(ret >= 3);
+        TEST_EQUAL(strcmp(buf, result_str), 0);
     } else {
         TEST_EQUAL(ret, error_ret);
     }
diff --git a/tests/suites/test_suite_pkcs7.data b/tests/suites/test_suite_pkcs7.data
index 89c223d..13fcaa6 100644
--- a/tests/suites/test_suite_pkcs7.data
+++ b/tests/suites/test_suite_pkcs7.data
@@ -23,13 +23,17 @@
 pkcs7_parse:"data_files/pkcs7_data_signed_badcert.der":MBEDTLS_ERR_PKCS7_INVALID_CERT
 
 PKCS7 Signed Data Parse Fail with disabled alg #5.1
-depends_on:MBEDTLS_RSA_C:!MBEDTLS_SHA512_C
+depends_on:MBEDTLS_RSA_C:!MBEDTLS_HAS_ALG_SHA_512_VIA_LOWLEVEL_OR_PSA
 pkcs7_parse:"data_files/pkcs7_data_cert_signed_sha512.der":MBEDTLS_ERR_PKCS7_INVALID_ALG
 
 PKCS7 Parse Fail with Inlined Content Info #5.2
 depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
 pkcs7_parse:"data_files/pkcs7_data_with_signature.der":MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE
 
+PKCS7 Signed Data Parse Fail with no RSA #5.3
+depends_on:MBEDTLS_SHA256_C:!MBEDTLS_RSA_C
+pkcs7_parse:"data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_ERR_PKCS7_INVALID_CERT
+
 PKCS7 Signed Data Parse Fail with corrupted signer info #6
 depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
 pkcs7_parse:"data_files/pkcs7_data_signed_badsigner.der":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO,MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)
@@ -71,7 +75,7 @@
 pkcs7_verify:"data_files/pkcs7_zerolendata_detached.der":"data_files/pkcs7-rsa-sha256-1.der":"data_files/pkcs7_zerolendata.bin":0:0
 
 PKCS7 Signed Data Verification Fail zero-len data
-depends_on:MBEDTLS_SHA1_C:MBEDTLS_SHA256_C
+depends_on:MBEDTLS_SHA1_C:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
 pkcs7_verify:"data_files/pkcs7_zerolendata_detached.der":"data_files/pkcs7-rsa-sha256-2.der":"data_files/pkcs7_zerolendata.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED
 
 PKCS7 Signed Data Verification Pass SHA256 #9
@@ -91,19 +95,19 @@
 pkcs7_verify:"data_files/pkcs7_data_cert_signed_sha512.der":"data_files/pkcs7-rsa-sha256-1.der":"data_files/pkcs7_data.bin":0:0
 
 PKCS7 Signed Data Verification Fail because of different certificate #12
-depends_on:MBEDTLS_SHA256_C
+depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
 pkcs7_verify:"data_files/pkcs7_data_cert_signed_sha256.der":"data_files/pkcs7-rsa-sha256-2.der":"data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED
 
 PKCS7 Signed Data Verification Fail because of different data hash #13
-depends_on:MBEDTLS_SHA256_C
+depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
 pkcs7_verify:"data_files/pkcs7_data_cert_signed_sha256.der":"data_files/pkcs7-rsa-sha256-1.der":"data_files/pkcs7_data_1.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED
 
 PKCS7 Signed Data Parse Failure Corrupt signerInfo.issuer #15.1
-depends_on:MBEDTLS_SHA256_C
+depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
 pkcs7_parse:"data_files/pkcs7_signerInfo_issuer_invalid_size.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO
 
 PKCS7 Signed Data Parse Failure Corrupt signerInfo.serial #15.2
-depends_on:MBEDTLS_SHA256_C
+depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C
 pkcs7_parse:"data_files/pkcs7_signerInfo_serial_invalid_size.der":MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO
 
 PKCS7 Signed Data Parse Fail Corrupt signerInfos[2] (6213931373035520)
@@ -123,7 +127,7 @@
 pkcs7_verify:"data_files/pkcs7_data_multiple_signed.der":"data_files/pkcs7-rsa-sha256-1.crt data_files/pkcs7-rsa-sha256-2.crt":"data_files/pkcs7_data.bin":0:0
 
 PKCS7 Signed Data Verify with multiple(3) signers #16.1
-depends_on:MBEDTLS_SHA256_C
+depends_on:MBEDTLS_SHA256_C:!MBEDTLS_MEMORY_BUFFER_ALLOC_C
 pkcs7_verify:"data_files/pkcs7_data_3_signed.der":"data_files/pkcs7-rsa-sha256-1.crt data_files/pkcs7-rsa-sha256-2.crt data_files/pkcs7-rsa-sha256-3.crt":"data_files/pkcs7_data.bin":0:0
 
 PKCS7 Signed Data Hash Verify with multiple signers #17
@@ -143,11 +147,11 @@
 pkcs7_verify:"data_files/pkcs7_data_cert_signed_sha256.der":"data_files/pkcs7-rsa-expired.crt":"data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_CERT_DATE_INVALID
 
 PKCS7 Signed Data Verify Fail Expired Cert #19 no DATE_TIME 1
-depends_on:MBEDTLS_SHA256_C:!MBEDTLS_HAVE_TIME_DATE
+depends_on:MBEDTLS_SHA256_C:!MBEDTLS_HAVE_TIME_DATE:MBEDTLS_RSA_C
 pkcs7_verify:"data_files/pkcs7_data_cert_signed_sha256.der":"data_files/pkcs7-rsa-expired.crt":"data_files/pkcs7_data.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED
 
 PKCS7 Signed Data Verify Fail Expired Cert #19 no TIME_DATE 2
-depends_on:MBEDTLS_SHA256_C:!MBEDTLS_HAVE_TIME_DATE
+depends_on:MBEDTLS_SHA256_C:!MBEDTLS_HAVE_TIME_DATE:MBEDTLS_RSA_C
 pkcs7_verify:"data_files/pkcs7_data_rsa_expired.der":"data_files/pkcs7-rsa-expired.crt":"data_files/pkcs7_data_1.bin":0:MBEDTLS_ERR_RSA_VERIFY_FAILED
 
 PKCS7 Parse Failure Invalid ASN1: Add null byte to start #20.0
diff --git a/tests/suites/test_suite_pkcs7.function b/tests/suites/test_suite_pkcs7.function
index 91fe47b..cc032ac 100644
--- a/tests/suites/test_suite_pkcs7.function
+++ b/tests/suites/test_suite_pkcs7.function
@@ -7,10 +7,11 @@
 #include "mbedtls/oid.h"
 #include "sys/types.h"
 #include "sys/stat.h"
+#include "mbedtls/rsa.h"
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
- * depends_on:MBEDTLS_PKCS7_C:MBEDTLS_RSA_C
+ * depends_on:MBEDTLS_PKCS7_C
  * END_DEPENDENCIES
  */
 /* BEGIN_SUITE_HELPERS */
diff --git a/tests/suites/test_suite_platform_util.data b/tests/suites/test_suite_platform_util.data
index 948543a..b820293 100644
--- a/tests/suites/test_suite_platform_util.data
+++ b/tests/suites/test_suite_platform_util.data
@@ -21,3 +21,27 @@
 
 Zeroize len 128
 mbedtls_platform_zeroize:128:0
+
+Zeroize uninitialised 1 0
+mbedtls_platform_zeroize_uninitialised:1:0
+
+Zeroize uninitialised 16 0
+mbedtls_platform_zeroize_uninitialised:16:0
+
+Zeroize uninitialised 16 1
+mbedtls_platform_zeroize_uninitialised:16:1
+
+Zeroize uninitialised 16 10
+mbedtls_platform_zeroize_uninitialised:16:10
+
+Zeroize uninitialised 16 15
+mbedtls_platform_zeroize_uninitialised:16:15
+
+Zeroize uninitialised 128 0
+mbedtls_platform_zeroize_uninitialised:128:0
+
+Zeroize uninitialised 128 64
+mbedtls_platform_zeroize_uninitialised:128:64
+
+Zeroize uninitialised 128 127
+mbedtls_platform_zeroize_uninitialised:128:127
diff --git a/tests/suites/test_suite_platform_util.function b/tests/suites/test_suite_platform_util.function
index e5464e0..a4c1143 100644
--- a/tests/suites/test_suite_platform_util.function
+++ b/tests/suites/test_suite_platform_util.function
@@ -39,3 +39,23 @@
     TEST_EQUAL(buf[len + 1], 2);
 }
 /* END_CASE */
+
+/* BEGIN_CASE */
+void mbedtls_platform_zeroize_uninitialised(int len, int p)
+{
+    /*
+     * As per #7301: on some platforms, including modern Linux, Clang with Msan
+     * does not recognize that explicit_bzero() writes well-defined content to
+     * its output buffer. For us, this causes CMAC operations to fail in Msan
+     * builds when mbedtls_platform_zeroize() is implemented over
+     * explicit_bzero().
+     *
+     * This test ensures we have a simple/obvious MSan test rather than
+     * spurious errors in crypto code that are hard to track down.
+     */
+    char buf[128];
+    mbedtls_platform_zeroize(buf, len);
+
+    TEST_EQUAL(buf[p], 0);
+}
+/* END_CASE */
diff --git a/tests/suites/test_suite_psa_crypto.data b/tests/suites/test_suite_psa_crypto.data
index eddac7f..86b2f66 100644
--- a/tests/suites/test_suite_psa_crypto.data
+++ b/tests/suites/test_suite_psa_crypto.data
@@ -1,3 +1,6 @@
+PSA can_do_hash
+psa_can_do_hash:
+
 PSA compile-time sanity checks
 static_checks:
 
diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function
index 231b47f..41a3237 100644
--- a/tests/suites/test_suite_psa_crypto.function
+++ b/tests/suites/test_suite_psa_crypto.function
@@ -13,6 +13,9 @@
 #include "psa/crypto.h"
 #include "psa_crypto_slot_management.h"
 
+/* For psa_can_do_hash() */
+#include "psa_crypto_core.h"
+
 #include "test/asn1_helpers.h"
 #include "test/psa_crypto_helpers.h"
 #include "test/psa_exercise_key.h"
@@ -1256,6 +1259,18 @@
  */
 
 /* BEGIN_CASE */
+void psa_can_do_hash()
+{
+    /* We can't test that this is specific to drivers until partial init has
+     * been implemented, but we can at least test before/after full init. */
+    TEST_EQUAL(0, psa_can_do_hash(PSA_ALG_NONE));
+    PSA_INIT();
+    TEST_EQUAL(1, psa_can_do_hash(PSA_ALG_NONE));
+    PSA_DONE();
+}
+/* END_CASE */
+
+/* BEGIN_CASE */
 void static_checks()
 {
     size_t max_truncated_mac_size =
diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function
index ab09fa0..56f4d1d 100644
--- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function
+++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function
@@ -5,6 +5,11 @@
    Global to silent the compiler when unused. */
 size_t pake_expected_hit_count = 0;
 int pake_in_driver = 0;
+
+/* The only two JPAKE user/peer identifiers supported for the time being. */
+static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
+static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
+
 #if defined(PSA_WANT_ALG_JPAKE) && defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) && \
     defined(PSA_WANT_ECC_SECP_R1_256) && defined(PSA_WANT_ALG_SHA_256)
 static void ecjpake_do_round(psa_algorithm_t alg, unsigned int primitive,
@@ -3035,8 +3040,8 @@
     TEST_EQUAL(psa_pake_setup(&operation, &cipher_suite),
                PSA_SUCCESS);
 
-    TEST_EQUAL(psa_pake_set_role(&operation, PSA_PAKE_ROLE_SERVER),
-               PSA_SUCCESS);
+    PSA_ASSERT(psa_pake_set_user(&operation, jpake_server_id, sizeof(jpake_server_id)));
+    PSA_ASSERT(psa_pake_set_peer(&operation, jpake_client_id, sizeof(jpake_client_id)));
 
     TEST_EQUAL(psa_pake_set_password_key(&operation, key),
                PSA_SUCCESS);
@@ -3229,9 +3234,11 @@
     TEST_EQUAL(mbedtls_test_driver_pake_hooks.hits.total, 0);
 
 
-    PSA_ASSERT(psa_pake_set_role(&server, PSA_PAKE_ROLE_SERVER));
+    PSA_ASSERT(psa_pake_set_user(&server, jpake_server_id, sizeof(jpake_server_id)));
+    PSA_ASSERT(psa_pake_set_peer(&server, jpake_client_id, sizeof(jpake_client_id)));
     TEST_EQUAL(mbedtls_test_driver_pake_hooks.hits.total, 0);
-    PSA_ASSERT(psa_pake_set_role(&client, PSA_PAKE_ROLE_CLIENT));
+    PSA_ASSERT(psa_pake_set_user(&client, jpake_client_id, sizeof(jpake_client_id)));
+    PSA_ASSERT(psa_pake_set_peer(&client, jpake_server_id, sizeof(jpake_server_id)));
     TEST_EQUAL(mbedtls_test_driver_pake_hooks.hits.total, 0);
     PSA_ASSERT(psa_pake_set_password_key(&server, key));
     TEST_EQUAL(mbedtls_test_driver_pake_hooks.hits.total, 0);
diff --git a/tests/suites/test_suite_psa_crypto_pake.data b/tests/suites/test_suite_psa_crypto_pake.data
index 7640e3a..6215703 100644
--- a/tests/suites/test_suite_psa_crypto_pake.data
+++ b/tests/suites/test_suite_psa_crypto_pake.data
@@ -1,90 +1,106 @@
 PSA PAKE: uninitialized access to psa_pake_operation_t
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_UNINITIALIZED_ACCESS:PSA_ERROR_BAD_STATE
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_INJECT_UNINITIALIZED_ACCESS:PSA_ERROR_BAD_STATE
 
 PSA PAKE: invalid alg
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_SHA_256:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_IN_SETUP:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_SHA_256:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_IN_SETUP:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: invalid primitive type
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_DH, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_DH, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
 
 PSA PAKE: invalid primitive family
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_K1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_K1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
 
 PSA PAKE: invalid primitive bits
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 128):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 128):PSA_ALG_SHA_256:"client":"server":0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
 
 PSA PAKE: invalid hash
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_1:PSA_PAKE_ROLE_SERVER:0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_1:"client":"server":0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
 
 PSA PAKE: duplicate a valid setup
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_DUPLICATE_SETUP:PSA_ERROR_BAD_STATE
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_INJECT_DUPLICATE_SETUP:PSA_ERROR_BAD_STATE
 
-PSA PAKE: ecjpake setup invalid role NONE
+PSA PAKE: ecjpake setup role
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_NONE:0:ERR_IN_OUTPUT:PSA_ERROR_BAD_STATE
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_INJECT_SET_ROLE:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: wrong password key type
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_HMAC:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_IN_SET_PASSWORD_KEY:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_HMAC:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_IN_SET_PASSWORD_KEY:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: wrong password key usage
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_ENCRYPT:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_IN_SET_PASSWORD_KEY:PSA_ERROR_NOT_PERMITTED
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_ENCRYPT:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_IN_SET_PASSWORD_KEY:PSA_ERROR_NOT_PERMITTED
+
+PSA PAKE: set empty user
+depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"":"server":0:ERR_IN_SET_USER:PSA_ERROR_INVALID_ARGUMENT
+
+PSA PAKE: set empty peer
+depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"":0:ERR_IN_SET_PEER:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: set invalid user
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_INVALID_USER:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"aaaa":"server":0:ERR_IN_SET_USER:PSA_ERROR_NOT_SUPPORTED
 
 PSA PAKE: set invalid peer
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_INVALID_PEER:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"aaaa":0:ERR_IN_SET_PEER:PSA_ERROR_NOT_SUPPORTED
 
-PSA PAKE: set user
+PSA PAKE: user already set
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_SET_USER:PSA_ERROR_NOT_SUPPORTED
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_DUPLICATE_SET_USER:PSA_ERROR_BAD_STATE
 
-PSA PAKE: set peer
+PSA PAKE: peer already set
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_SET_PEER:PSA_ERROR_NOT_SUPPORTED
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_DUPLICATE_SET_PEER:PSA_ERROR_BAD_STATE
+
+PSA PAKE: user and peer both servers
+depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"server":"server":0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
+
+PSA PAKE: user and peer both clients
+depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"client":0:ERR_IN_OUTPUT:PSA_ERROR_NOT_SUPPORTED
 
 PSA PAKE: invalid input
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:1:ERR_INJECT_EMPTY_IO_BUFFER:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":1:ERR_INJECT_EMPTY_IO_BUFFER:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: unkown input step
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:1:ERR_INJECT_UNKNOWN_STEP:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":1:ERR_INJECT_UNKNOWN_STEP:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: invalid first input step
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:1:ERR_INJECT_INVALID_FIRST_STEP:PSA_ERROR_BAD_STATE
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":1:ERR_INJECT_INVALID_FIRST_STEP:PSA_ERROR_BAD_STATE
 
 PSA PAKE: input buffer too large
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:1:ERR_INJECT_WRONG_BUFFER_SIZE:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":1:ERR_INJECT_WRONG_BUFFER_SIZE:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: invalid output
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_EMPTY_IO_BUFFER:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_INJECT_EMPTY_IO_BUFFER:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: unkown output step
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_UNKNOWN_STEP:PSA_ERROR_INVALID_ARGUMENT
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_INJECT_UNKNOWN_STEP:PSA_ERROR_INVALID_ARGUMENT
 
 PSA PAKE: invalid first output step
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_INVALID_FIRST_STEP:PSA_ERROR_BAD_STATE
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_INJECT_INVALID_FIRST_STEP:PSA_ERROR_BAD_STATE
 
 PSA PAKE: output buffer too small
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:PSA_PAKE_ROLE_SERVER:0:ERR_INJECT_WRONG_BUFFER_SIZE:PSA_ERROR_BUFFER_TOO_SMALL
+ecjpake_setup:PSA_ALG_JPAKE:PSA_KEY_TYPE_PASSWORD:PSA_KEY_USAGE_DERIVE:PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, 256):PSA_ALG_SHA_256:"client":"server":0:ERR_INJECT_WRONG_BUFFER_SIZE:PSA_ERROR_BUFFER_TOO_SMALL
 
 PSA PAKE: check rounds w/o forced errors
 depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_TLS12_PSK_TO_MS
@@ -202,3 +218,9 @@
 
 PSA PAKE: input getters: role
 pake_input_getters_role
+
+PSA PAKE: input getters: user
+pake_input_getters_user
+
+PSA PAKE: input getters: peer
+pake_input_getters_peer
diff --git a/tests/suites/test_suite_psa_crypto_pake.function b/tests/suites/test_suite_psa_crypto_pake.function
index 2bed45a..88f24dd 100644
--- a/tests/suites/test_suite_psa_crypto_pake.function
+++ b/tests/suites/test_suite_psa_crypto_pake.function
@@ -8,10 +8,11 @@
     /* errors forced internally in the code */
     ERR_INJECT_UNINITIALIZED_ACCESS,
     ERR_INJECT_DUPLICATE_SETUP,
-    ERR_INJECT_INVALID_USER,
-    ERR_INJECT_INVALID_PEER,
     ERR_INJECT_SET_USER,
     ERR_INJECT_SET_PEER,
+    ERR_INJECT_SET_ROLE,
+    ERR_DUPLICATE_SET_USER,
+    ERR_DUPLICATE_SET_PEER,
     ERR_INJECT_EMPTY_IO_BUFFER,
     ERR_INJECT_UNKNOWN_STEP,
     ERR_INJECT_INVALID_FIRST_STEP,
@@ -39,6 +40,8 @@
     ERR_INJECT_ROUND2_SERVER_ZK_PROOF,
     /* erros issued from the .data file */
     ERR_IN_SETUP,
+    ERR_IN_SET_USER,
+    ERR_IN_SET_PEER,
     ERR_IN_SET_ROLE,
     ERR_IN_SET_PASSWORD_KEY,
     ERR_IN_INPUT,
@@ -50,6 +53,10 @@
     PAKE_ROUND_TWO
 } pake_round_t;
 
+/* The only two JPAKE user/peer identifiers supported for the time being. */
+static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
+static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
+
 /*
  * Inject an error on the specified buffer ONLY it this is the correct stage.
  * Offset 7 is arbitrary, but chosen because it's "in the middle" of the part
@@ -537,7 +544,7 @@
 
 /* BEGIN_CASE depends_on:PSA_WANT_ALG_JPAKE */
 void ecjpake_setup(int alg_arg, int key_type_pw_arg, int key_usage_pw_arg,
-                   int primitive_arg, int hash_arg, int role_arg,
+                   int primitive_arg, int hash_arg, char *user_arg, char *peer_arg,
                    int test_input,
                    int err_stage_arg,
                    int expected_error_arg)
@@ -549,7 +556,6 @@
     psa_key_type_t key_type_pw = key_type_pw_arg;
     psa_key_usage_t key_usage_pw = key_usage_pw_arg;
     psa_algorithm_t hash_alg = hash_arg;
-    psa_pake_role_t role = role_arg;
     mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
     psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
     ecjpake_error_stage_t err_stage = err_stage_arg;
@@ -557,8 +563,12 @@
     psa_status_t status;
     unsigned char *output_buffer = NULL;
     size_t output_len = 0;
-    const uint8_t unsupp_id[] = "abcd";
     const uint8_t password[] = "abcd";
+    uint8_t *user = (uint8_t *) user_arg;
+    uint8_t *peer = (uint8_t *) peer_arg;
+    size_t user_len = strlen(user_arg);
+    size_t peer_len = strlen(peer_arg);
+
     psa_key_derivation_operation_t key_derivation =
         PSA_KEY_DERIVATION_OPERATION_INIT;
 
@@ -581,13 +591,13 @@
     PSA_ASSERT(psa_pake_abort(&operation));
 
     if (err_stage == ERR_INJECT_UNINITIALIZED_ACCESS) {
-        TEST_EQUAL(psa_pake_set_user(&operation, NULL, 0),
+        TEST_EQUAL(psa_pake_set_user(&operation, user, user_len),
                    expected_error);
-        TEST_EQUAL(psa_pake_set_peer(&operation, NULL, 0),
+        TEST_EQUAL(psa_pake_set_peer(&operation, peer, peer_len),
                    expected_error);
         TEST_EQUAL(psa_pake_set_password_key(&operation, key),
                    expected_error);
-        TEST_EQUAL(psa_pake_set_role(&operation, role),
+        TEST_EQUAL(psa_pake_set_role(&operation, PSA_PAKE_ROLE_SERVER),
                    expected_error);
         TEST_EQUAL(psa_pake_output(&operation, PSA_PAKE_STEP_KEY_SHARE,
                                    output_buffer, 0, &output_len),
@@ -606,24 +616,27 @@
     SETUP_CONDITIONAL_CHECK_STEP(psa_pake_setup(&operation, &cipher_suite),
                                  ERR_INJECT_DUPLICATE_SETUP);
 
-    SETUP_ALWAYS_CHECK_STEP(psa_pake_set_role(&operation, role),
+    SETUP_CONDITIONAL_CHECK_STEP(psa_pake_set_role(&operation, PSA_PAKE_ROLE_SERVER),
+                                 ERR_INJECT_SET_ROLE);
+
+    SETUP_ALWAYS_CHECK_STEP(psa_pake_set_role(&operation, PSA_PAKE_ROLE_NONE),
                             ERR_IN_SET_ROLE);
 
+    SETUP_ALWAYS_CHECK_STEP(psa_pake_set_user(&operation, user, user_len),
+                            ERR_IN_SET_USER);
+
+    SETUP_ALWAYS_CHECK_STEP(psa_pake_set_peer(&operation, peer, peer_len),
+                            ERR_IN_SET_PEER);
+
+    SETUP_CONDITIONAL_CHECK_STEP(psa_pake_set_user(&operation, user, user_len),
+                                 ERR_DUPLICATE_SET_USER);
+
+    SETUP_CONDITIONAL_CHECK_STEP(psa_pake_set_peer(&operation, peer, peer_len),
+                                 ERR_DUPLICATE_SET_PEER);
+
     SETUP_ALWAYS_CHECK_STEP(psa_pake_set_password_key(&operation, key),
                             ERR_IN_SET_PASSWORD_KEY);
 
-    SETUP_CONDITIONAL_CHECK_STEP(psa_pake_set_user(&operation, NULL, 0),
-                                 ERR_INJECT_INVALID_USER);
-
-    SETUP_CONDITIONAL_CHECK_STEP(psa_pake_set_peer(&operation, NULL, 0),
-                                 ERR_INJECT_INVALID_PEER);
-
-    SETUP_CONDITIONAL_CHECK_STEP(psa_pake_set_user(&operation, unsupp_id, 4),
-                                 ERR_INJECT_SET_USER);
-
-    SETUP_CONDITIONAL_CHECK_STEP(psa_pake_set_peer(&operation, unsupp_id, 4),
-                                 ERR_INJECT_SET_PEER);
-
     const size_t size_key_share = PSA_PAKE_INPUT_SIZE(alg, primitive,
                                                       PSA_PAKE_STEP_KEY_SHARE);
     const size_t size_zk_public = PSA_PAKE_INPUT_SIZE(alg, primitive,
@@ -741,8 +754,10 @@
     PSA_ASSERT(psa_pake_setup(&server, &cipher_suite));
     PSA_ASSERT(psa_pake_setup(&client, &cipher_suite));
 
-    PSA_ASSERT(psa_pake_set_role(&server, PSA_PAKE_ROLE_SERVER));
-    PSA_ASSERT(psa_pake_set_role(&client, PSA_PAKE_ROLE_CLIENT));
+    PSA_ASSERT(psa_pake_set_user(&server, jpake_server_id, sizeof(jpake_server_id)));
+    PSA_ASSERT(psa_pake_set_peer(&server, jpake_client_id, sizeof(jpake_client_id)));
+    PSA_ASSERT(psa_pake_set_user(&client, jpake_client_id, sizeof(jpake_client_id)));
+    PSA_ASSERT(psa_pake_set_peer(&client, jpake_server_id, sizeof(jpake_server_id)));
 
     PSA_ASSERT(psa_pake_set_password_key(&server, key));
     PSA_ASSERT(psa_pake_set_password_key(&client, key));
@@ -816,8 +831,10 @@
     PSA_ASSERT(psa_pake_setup(&server, &cipher_suite));
     PSA_ASSERT(psa_pake_setup(&client, &cipher_suite));
 
-    PSA_ASSERT(psa_pake_set_role(&server, PSA_PAKE_ROLE_SERVER));
-    PSA_ASSERT(psa_pake_set_role(&client, PSA_PAKE_ROLE_CLIENT));
+    PSA_ASSERT(psa_pake_set_user(&server, jpake_server_id, sizeof(jpake_server_id)));
+    PSA_ASSERT(psa_pake_set_peer(&server, jpake_client_id, sizeof(jpake_client_id)));
+    PSA_ASSERT(psa_pake_set_user(&client, jpake_client_id, sizeof(jpake_client_id)));
+    PSA_ASSERT(psa_pake_set_peer(&client, jpake_server_id, sizeof(jpake_server_id)));
 
     PSA_ASSERT(psa_pake_set_password_key(&server, key));
     PSA_ASSERT(psa_pake_set_password_key(&client, key));
@@ -1030,8 +1047,9 @@
     TEST_EQUAL(psa_crypto_driver_pake_get_role(&operation.data.inputs, &role_ret),
                PSA_ERROR_BAD_STATE);
 
-    PSA_ASSERT(psa_pake_set_role(&operation, PSA_PAKE_ROLE_SERVER));
-
+    /* Role can not be set directly using psa_pake_set_role(). It is set by the core
+       based on given user/peer identifiers. Simulate that Role is already set. */
+    operation.data.inputs.role = PSA_PAKE_ROLE_SERVER;
     TEST_EQUAL(psa_crypto_driver_pake_get_role(&operation.data.inputs, &role_ret),
                PSA_SUCCESS);
 
@@ -1041,3 +1059,119 @@
     PSA_DONE();
 }
 /* END_CASE */
+
+/* BEGIN_CASE depends_on:PSA_WANT_ALG_JPAKE */
+void pake_input_getters_user()
+{
+    psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
+    psa_pake_operation_t operation = psa_pake_operation_init();
+    const uint8_t user[] = { 's', 'e', 'r', 'v', 'e', 'r' };
+    const size_t user_len = sizeof(user);
+    uint8_t user_ret[20] = { 0 }; // max user length is 20 bytes
+    size_t user_len_ret = 0;
+    size_t buffer_len_ret = 0;
+
+    psa_pake_primitive_t primitive = PSA_PAKE_PRIMITIVE(
+        PSA_PAKE_PRIMITIVE_TYPE_ECC,
+        PSA_ECC_FAMILY_SECP_R1, 256);
+
+    PSA_INIT();
+
+    psa_pake_cs_set_algorithm(&cipher_suite, PSA_ALG_JPAKE);
+    psa_pake_cs_set_primitive(&cipher_suite, primitive);
+    psa_pake_cs_set_hash(&cipher_suite, PSA_ALG_SHA_256);
+
+    PSA_ASSERT(psa_pake_setup(&operation, &cipher_suite));
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_user(&operation.data.inputs,
+                                               (uint8_t *) &user_ret,
+                                               10, &buffer_len_ret),
+               PSA_ERROR_BAD_STATE);
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_user_len(&operation.data.inputs, &user_len_ret),
+               PSA_ERROR_BAD_STATE);
+
+    PSA_ASSERT(psa_pake_set_user(&operation, user, user_len));
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_user_len(&operation.data.inputs, &user_len_ret),
+               PSA_SUCCESS);
+
+    TEST_EQUAL(user_len_ret, user_len);
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_user(&operation.data.inputs,
+                                               (uint8_t *) &user_ret,
+                                               user_len_ret - 1,
+                                               &buffer_len_ret),
+               PSA_ERROR_BUFFER_TOO_SMALL);
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_user(&operation.data.inputs,
+                                               (uint8_t *) &user_ret,
+                                               user_len_ret,
+                                               &buffer_len_ret),
+               PSA_SUCCESS);
+
+    TEST_EQUAL(buffer_len_ret, user_len);
+    PSA_ASSERT(memcmp(user_ret, user, buffer_len_ret));
+exit:
+    PSA_ASSERT(psa_pake_abort(&operation));
+    PSA_DONE();
+}
+/* END_CASE */
+
+/* BEGIN_CASE depends_on:PSA_WANT_ALG_JPAKE */
+void pake_input_getters_peer()
+{
+    psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
+    psa_pake_operation_t operation = psa_pake_operation_init();
+    const uint8_t peer[] = { 's', 'e', 'r', 'v', 'e', 'r' };
+    const size_t peer_len = sizeof(peer);
+    uint8_t peer_ret[20] = { 0 }; // max peer length is 20 bytes
+    size_t peer_len_ret = 0;
+    size_t buffer_len_ret = 0;
+
+    psa_pake_primitive_t primitive = PSA_PAKE_PRIMITIVE(
+        PSA_PAKE_PRIMITIVE_TYPE_ECC,
+        PSA_ECC_FAMILY_SECP_R1, 256);
+
+    PSA_INIT();
+
+    psa_pake_cs_set_algorithm(&cipher_suite, PSA_ALG_JPAKE);
+    psa_pake_cs_set_primitive(&cipher_suite, primitive);
+    psa_pake_cs_set_hash(&cipher_suite, PSA_ALG_SHA_256);
+
+    PSA_ASSERT(psa_pake_setup(&operation, &cipher_suite));
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_peer(&operation.data.inputs,
+                                               (uint8_t *) &peer_ret,
+                                               10, &buffer_len_ret),
+               PSA_ERROR_BAD_STATE);
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_peer_len(&operation.data.inputs, &peer_len_ret),
+               PSA_ERROR_BAD_STATE);
+
+    PSA_ASSERT(psa_pake_set_peer(&operation, peer, peer_len));
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_peer_len(&operation.data.inputs, &peer_len_ret),
+               PSA_SUCCESS);
+
+    TEST_EQUAL(peer_len_ret, peer_len);
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_peer(&operation.data.inputs,
+                                               (uint8_t *) &peer_ret,
+                                               peer_len_ret - 1,
+                                               &buffer_len_ret),
+               PSA_ERROR_BUFFER_TOO_SMALL);
+
+    TEST_EQUAL(psa_crypto_driver_pake_get_peer(&operation.data.inputs,
+                                               (uint8_t *) &peer_ret,
+                                               peer_len_ret,
+                                               &buffer_len_ret),
+               PSA_SUCCESS);
+
+    TEST_EQUAL(buffer_len_ret, peer_len);
+    PSA_ASSERT(memcmp(peer_ret, peer, buffer_len_ret));
+exit:
+    PSA_ASSERT(psa_pake_abort(&operation));
+    PSA_DONE();
+}
+/* END_CASE */
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index 9dfb7ed..f03cd6a 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -1,16 +1,11 @@
 /* BEGIN_HEADER */
-#include <mbedtls/ssl.h>
 #include <ssl_misc.h>
 #include <mbedtls/timing.h>
 #include <mbedtls/debug.h>
 #include <mbedtls/pk.h>
 #include <ssl_tls13_keys.h>
 #include <ssl_tls13_invasive.h>
-#include "test/certs.h"
-
-#if defined(MBEDTLS_SSL_CACHE_C)
-#include "mbedtls/ssl_cache.h"
-#endif
+#include <test/ssl_helpers.h>
 
 #include <mbedtls/legacy_or_psa.h>
 #include "hash_info.h"
@@ -18,2527 +13,6 @@
 #include <constant_time_internal.h>
 #include <test/constant_flow.h>
 
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-#define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
-                                                           psa_to_ssl_errors, \
-                                                           psa_generic_status_to_mbedtls)
-#endif
-
-#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
-    defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
-    defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
-#define MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
-#endif
-enum {
-#define MBEDTLS_SSL_TLS1_3_LABEL(name, string)   \
-    tls13_label_ ## name,
-    MBEDTLS_SSL_TLS1_3_LABEL_LIST
-#undef MBEDTLS_SSL_TLS1_3_LABEL
-};
-
-typedef struct log_pattern {
-    const char *pattern;
-    size_t counter;
-} log_pattern;
-
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
-static int rng_seed = 0xBEEF;
-static int rng_get(void *p_rng, unsigned char *output, size_t output_len)
-{
-    (void) p_rng;
-    for (size_t i = 0; i < output_len; i++) {
-        output[i] = rand();
-    }
-
-    return 0;
-}
-#endif
-
-/*
- * This function can be passed to mbedtls to receive output logs from it. In
- * this case, it will count the instances of a log_pattern in the received
- * logged messages.
- */
-void log_analyzer(void *ctx, int level,
-                  const char *file, int line,
-                  const char *str)
-{
-    log_pattern *p = (log_pattern *) ctx;
-
-    (void) level;
-    (void) line;
-    (void) file;
-
-    if (NULL != p &&
-        NULL != p->pattern &&
-        NULL != strstr(str, p->pattern)) {
-        p->counter++;
-    }
-}
-
-typedef struct handshake_test_options {
-    const char *cipher;
-    mbedtls_ssl_protocol_version client_min_version;
-    mbedtls_ssl_protocol_version client_max_version;
-    mbedtls_ssl_protocol_version server_min_version;
-    mbedtls_ssl_protocol_version server_max_version;
-    mbedtls_ssl_protocol_version expected_negotiated_version;
-    int expected_handshake_result;
-    int expected_ciphersuite;
-    int pk_alg;
-    int opaque_alg;
-    int opaque_alg2;
-    int opaque_usage;
-    data_t *psk_str;
-    int dtls;
-    int srv_auth_mode;
-    int serialize;
-    int mfl;
-    int cli_msg_len;
-    int srv_msg_len;
-    int expected_cli_fragments;
-    int expected_srv_fragments;
-    int renegotiate;
-    int legacy_renegotiation;
-    void *srv_log_obj;
-    void *cli_log_obj;
-    void (*srv_log_fun)(void *, int, const char *, int, const char *);
-    void (*cli_log_fun)(void *, int, const char *, int, const char *);
-    int resize_buffers;
-#if defined(MBEDTLS_SSL_CACHE_C)
-    mbedtls_ssl_cache_context *cache;
-#endif
-} handshake_test_options;
-
-void init_handshake_options(handshake_test_options *opts)
-{
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
-    srand(rng_seed);
-    rng_seed += 0xD0;
-#endif
-    opts->cipher = "";
-    opts->client_min_version = MBEDTLS_SSL_VERSION_UNKNOWN;
-    opts->client_max_version = MBEDTLS_SSL_VERSION_UNKNOWN;
-    opts->server_min_version = MBEDTLS_SSL_VERSION_UNKNOWN;
-    opts->server_max_version = MBEDTLS_SSL_VERSION_UNKNOWN;
-    opts->expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_2;
-    opts->expected_handshake_result = 0;
-    opts->expected_ciphersuite = 0;
-    opts->pk_alg = MBEDTLS_PK_RSA;
-    opts->opaque_alg = 0;
-    opts->opaque_alg2 = 0;
-    opts->opaque_usage = 0;
-    opts->psk_str = NULL;
-    opts->dtls = 0;
-    opts->srv_auth_mode = MBEDTLS_SSL_VERIFY_NONE;
-    opts->serialize = 0;
-    opts->mfl = MBEDTLS_SSL_MAX_FRAG_LEN_NONE;
-    opts->cli_msg_len = 100;
-    opts->srv_msg_len = 100;
-    opts->expected_cli_fragments = 1;
-    opts->expected_srv_fragments = 1;
-    opts->renegotiate = 0;
-    opts->legacy_renegotiation = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION;
-    opts->srv_log_obj = NULL;
-    opts->srv_log_obj = NULL;
-    opts->srv_log_fun = NULL;
-    opts->cli_log_fun = NULL;
-    opts->resize_buffers = 1;
-#if defined(MBEDTLS_SSL_CACHE_C)
-    opts->cache = NULL;
-    ASSERT_ALLOC(opts->cache, 1);
-    mbedtls_ssl_cache_init(opts->cache);
-exit:
-    return;
-#endif
-}
-
-void free_handshake_options(handshake_test_options *opts)
-{
-#if defined(MBEDTLS_SSL_CACHE_C)
-    mbedtls_ssl_cache_free(opts->cache);
-    mbedtls_free(opts->cache);
-#else
-    (void) opts;
-#endif
-}
-
-#if defined(MBEDTLS_TEST_HOOKS)
-static void set_chk_buf_ptr_args(
-    mbedtls_ssl_chk_buf_ptr_args *args,
-    unsigned char *cur, unsigned char *end, size_t need)
-{
-    args->cur = cur;
-    args->end = end;
-    args->need = need;
-}
-
-static void reset_chk_buf_ptr_args(mbedtls_ssl_chk_buf_ptr_args *args)
-{
-    memset(args, 0, sizeof(*args));
-}
-#endif /* MBEDTLS_TEST_HOOKS */
-
-/*
- * Buffer structure for custom I/O callbacks.
- */
-
-typedef struct mbedtls_test_buffer {
-    size_t start;
-    size_t content_length;
-    size_t capacity;
-    unsigned char *buffer;
-} mbedtls_test_buffer;
-
-/*
- * Initialises \p buf. After calling this function it is safe to call
- * `mbedtls_test_buffer_free()` on \p buf.
- */
-void mbedtls_test_buffer_init(mbedtls_test_buffer *buf)
-{
-    memset(buf, 0, sizeof(*buf));
-}
-
-/*
- * Sets up \p buf. After calling this function it is safe to call
- * `mbedtls_test_buffer_put()` and `mbedtls_test_buffer_get()` on \p buf.
- */
-int mbedtls_test_buffer_setup(mbedtls_test_buffer *buf, size_t capacity)
-{
-    buf->buffer = (unsigned char *) mbedtls_calloc(capacity,
-                                                   sizeof(unsigned char));
-    if (NULL == buf->buffer) {
-        return MBEDTLS_ERR_SSL_ALLOC_FAILED;
-    }
-    buf->capacity = capacity;
-
-    return 0;
-}
-
-void mbedtls_test_buffer_free(mbedtls_test_buffer *buf)
-{
-    if (buf->buffer != NULL) {
-        mbedtls_free(buf->buffer);
-    }
-
-    memset(buf, 0, sizeof(*buf));
-}
-
-/*
- * Puts \p input_len bytes from the \p input buffer into the ring buffer \p buf.
- *
- * \p buf must have been initialized and set up by calling
- * `mbedtls_test_buffer_init()` and `mbedtls_test_buffer_setup()`.
- *
- * \retval  \p input_len, if the data fits.
- * \retval  0 <= value < \p input_len, if the data does not fit.
- * \retval  -1, if \p buf is NULL, it hasn't been set up or \p input_len is not
- *          zero and \p input is NULL.
- */
-int mbedtls_test_buffer_put(mbedtls_test_buffer *buf,
-                            const unsigned char *input, size_t input_len)
-{
-    size_t overflow = 0;
-
-    if ((buf == NULL) || (buf->buffer == NULL)) {
-        return -1;
-    }
-
-    /* Reduce input_len to a number that fits in the buffer. */
-    if ((buf->content_length + input_len) > buf->capacity) {
-        input_len = buf->capacity - buf->content_length;
-    }
-
-    if (input == NULL) {
-        return (input_len == 0) ? 0 : -1;
-    }
-
-    /* Check if the buffer has not come full circle and free space is not in
-     * the middle */
-    if (buf->start + buf->content_length < buf->capacity) {
-
-        /* Calculate the number of bytes that need to be placed at lower memory
-         * address */
-        if (buf->start + buf->content_length + input_len
-            > buf->capacity) {
-            overflow = (buf->start + buf->content_length + input_len)
-                       % buf->capacity;
-        }
-
-        memcpy(buf->buffer + buf->start + buf->content_length, input,
-               input_len - overflow);
-        memcpy(buf->buffer, input + input_len - overflow, overflow);
-
-    } else {
-        /* The buffer has come full circle and free space is in the middle */
-        memcpy(buf->buffer + buf->start + buf->content_length - buf->capacity,
-               input, input_len);
-    }
-
-    buf->content_length += input_len;
-    return input_len;
-}
-
-/*
- * Gets \p output_len bytes from the ring buffer \p buf into the
- * \p output buffer. The output buffer can be NULL, in this case a part of the
- * ring buffer will be dropped, if the requested length is available.
- *
- * \p buf must have been initialized and set up by calling
- * `mbedtls_test_buffer_init()` and `mbedtls_test_buffer_setup()`.
- *
- * \retval  \p output_len, if the data is available.
- * \retval  0 <= value < \p output_len, if the data is not available.
- * \retval  -1, if \buf is NULL or it hasn't been set up.
- */
-int mbedtls_test_buffer_get(mbedtls_test_buffer *buf,
-                            unsigned char *output, size_t output_len)
-{
-    size_t overflow = 0;
-
-    if ((buf == NULL) || (buf->buffer == NULL)) {
-        return -1;
-    }
-
-    if (output == NULL && output_len == 0) {
-        return 0;
-    }
-
-    if (buf->content_length < output_len) {
-        output_len = buf->content_length;
-    }
-
-    /* Calculate the number of bytes that need to be drawn from lower memory
-     * address */
-    if (buf->start + output_len > buf->capacity) {
-        overflow = (buf->start + output_len) % buf->capacity;
-    }
-
-    if (output != NULL) {
-        memcpy(output, buf->buffer + buf->start, output_len - overflow);
-        memcpy(output + output_len - overflow, buf->buffer, overflow);
-    }
-
-    buf->content_length -= output_len;
-    buf->start = (buf->start + output_len) % buf->capacity;
-
-    return output_len;
-}
-
-/*
- * Errors used in the message transport mock tests
- */
- #define MBEDTLS_TEST_ERROR_ARG_NULL -11
- #define MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED -44
-
-/*
- * Context for a message metadata queue (fifo) that is on top of the ring buffer.
- */
-typedef struct mbedtls_test_message_queue {
-    size_t *messages;
-    int pos;
-    int num;
-    int capacity;
-} mbedtls_test_message_queue;
-
-/*
- * Setup and free functions for the message metadata queue.
- *
- * \p capacity describes the number of message metadata chunks that can be held
- *    within the queue.
- *
- * \retval  0, if a metadata queue of a given length can be allocated.
- * \retval  MBEDTLS_ERR_SSL_ALLOC_FAILED, if allocation failed.
- */
-int mbedtls_test_message_queue_setup(mbedtls_test_message_queue *queue,
-                                     size_t capacity)
-{
-    queue->messages = (size_t *) mbedtls_calloc(capacity, sizeof(size_t));
-    if (NULL == queue->messages) {
-        return MBEDTLS_ERR_SSL_ALLOC_FAILED;
-    }
-
-    queue->capacity = capacity;
-    queue->pos = 0;
-    queue->num = 0;
-
-    return 0;
-}
-
-void mbedtls_test_message_queue_free(mbedtls_test_message_queue *queue)
-{
-    if (queue == NULL) {
-        return;
-    }
-
-    if (queue->messages != NULL) {
-        mbedtls_free(queue->messages);
-    }
-
-    memset(queue, 0, sizeof(*queue));
-}
-
-/*
- * Push message length information onto the message metadata queue.
- * This will become the last element to leave it (fifo).
- *
- * \retval  MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null.
- * \retval  MBEDTLS_ERR_SSL_WANT_WRITE, if the queue is full.
- * \retval  \p len, if the push was successful.
- */
-int mbedtls_test_message_queue_push_info(mbedtls_test_message_queue *queue,
-                                         size_t len)
-{
-    int place;
-    if (queue == NULL) {
-        return MBEDTLS_TEST_ERROR_ARG_NULL;
-    }
-
-    if (queue->num >= queue->capacity) {
-        return MBEDTLS_ERR_SSL_WANT_WRITE;
-    }
-
-    place = (queue->pos + queue->num) % queue->capacity;
-    queue->messages[place] = len;
-    queue->num++;
-    return len;
-}
-
-/*
- * Pop information about the next message length from the queue. This will be
- * the oldest inserted message length(fifo). \p msg_len can be null, in which
- * case the data will be popped from the queue but not copied anywhere.
- *
- * \retval  MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null.
- * \retval  MBEDTLS_ERR_SSL_WANT_READ, if the queue is empty.
- * \retval  message length, if the pop was successful, up to the given
-            \p buf_len.
- */
-int mbedtls_test_message_queue_pop_info(mbedtls_test_message_queue *queue,
-                                        size_t buf_len)
-{
-    size_t message_length;
-    if (queue == NULL) {
-        return MBEDTLS_TEST_ERROR_ARG_NULL;
-    }
-    if (queue->num == 0) {
-        return MBEDTLS_ERR_SSL_WANT_READ;
-    }
-
-    message_length = queue->messages[queue->pos];
-    queue->messages[queue->pos] = 0;
-    queue->num--;
-    queue->pos++;
-    queue->pos %= queue->capacity;
-    if (queue->pos < 0) {
-        queue->pos += queue->capacity;
-    }
-
-    return (message_length > buf_len) ? buf_len : message_length;
-}
-
-/*
- * Take a peek on the info about the next message length from the queue.
- * This will be the oldest inserted message length(fifo).
- *
- * \retval  MBEDTLS_TEST_ERROR_ARG_NULL, if the queue is null.
- * \retval  MBEDTLS_ERR_SSL_WANT_READ, if the queue is empty.
- * \retval  0, if the peek was successful.
- * \retval  MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED, if the given buffer length is
- *          too small to fit the message. In this case the \p msg_len will be
- *          set to the full message length so that the
- *          caller knows what portion of the message can be dropped.
- */
-int mbedtls_test_message_queue_peek_info(mbedtls_test_message_queue *queue,
-                                         size_t buf_len, size_t *msg_len)
-{
-    if (queue == NULL || msg_len == NULL) {
-        return MBEDTLS_TEST_ERROR_ARG_NULL;
-    }
-    if (queue->num == 0) {
-        return MBEDTLS_ERR_SSL_WANT_READ;
-    }
-
-    *msg_len = queue->messages[queue->pos];
-    return (*msg_len > buf_len) ? MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED : 0;
-}
-/*
- * Context for the I/O callbacks simulating network connection.
- */
-
-#define MBEDTLS_MOCK_SOCKET_CONNECTED 1
-
-typedef struct mbedtls_mock_socket {
-    int status;
-    mbedtls_test_buffer *input;
-    mbedtls_test_buffer *output;
-    struct mbedtls_mock_socket *peer;
-} mbedtls_mock_socket;
-
-/*
- * Setup and teardown functions for mock sockets.
- */
-void mbedtls_mock_socket_init(mbedtls_mock_socket *socket)
-{
-    memset(socket, 0, sizeof(*socket));
-}
-
-/*
- * Closes the socket \p socket.
- *
- * \p socket must have been previously initialized by calling
- * mbedtls_mock_socket_init().
- *
- * This function frees all allocated resources and both sockets are aware of the
- * new connection state.
- *
- * That is, this function does not simulate half-open TCP connections and the
- * phenomenon that when closing a UDP connection the peer is not aware of the
- * connection having been closed.
- */
-void mbedtls_mock_socket_close(mbedtls_mock_socket *socket)
-{
-    if (socket == NULL) {
-        return;
-    }
-
-    if (socket->input != NULL) {
-        mbedtls_test_buffer_free(socket->input);
-        mbedtls_free(socket->input);
-    }
-
-    if (socket->output != NULL) {
-        mbedtls_test_buffer_free(socket->output);
-        mbedtls_free(socket->output);
-    }
-
-    if (socket->peer != NULL) {
-        memset(socket->peer, 0, sizeof(*socket->peer));
-    }
-
-    memset(socket, 0, sizeof(*socket));
-}
-
-/*
- * Establishes a connection between \p peer1 and \p peer2.
- *
- * \p peer1 and \p peer2 must have been previously initialized by calling
- * mbedtls_mock_socket_init().
- *
- * The capacities of the internal buffers are set to \p bufsize. Setting this to
- * the correct value allows for simulation of MTU, sanity testing the mock
- * implementation and mocking TCP connections with lower memory cost.
- */
-int mbedtls_mock_socket_connect(mbedtls_mock_socket *peer1,
-                                mbedtls_mock_socket *peer2,
-                                size_t bufsize)
-{
-    int ret = -1;
-
-    peer1->output =
-        (mbedtls_test_buffer *) mbedtls_calloc(1, sizeof(mbedtls_test_buffer));
-    if (peer1->output == NULL) {
-        ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
-        goto exit;
-    }
-    mbedtls_test_buffer_init(peer1->output);
-    if (0 != (ret = mbedtls_test_buffer_setup(peer1->output, bufsize))) {
-        goto exit;
-    }
-
-    peer2->output =
-        (mbedtls_test_buffer *) mbedtls_calloc(1, sizeof(mbedtls_test_buffer));
-    if (peer2->output == NULL) {
-        ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
-        goto exit;
-    }
-    mbedtls_test_buffer_init(peer2->output);
-    if (0 != (ret = mbedtls_test_buffer_setup(peer2->output, bufsize))) {
-        goto exit;
-    }
-
-    peer1->peer = peer2;
-    peer2->peer = peer1;
-    peer1->input = peer2->output;
-    peer2->input = peer1->output;
-
-    peer1->status = peer2->status = MBEDTLS_MOCK_SOCKET_CONNECTED;
-    ret = 0;
-
-exit:
-
-    if (ret != 0) {
-        mbedtls_mock_socket_close(peer1);
-        mbedtls_mock_socket_close(peer2);
-    }
-
-    return ret;
-}
-
-/*
- * Callbacks for simulating blocking I/O over connection-oriented transport.
- */
-
-int mbedtls_mock_tcp_send_b(void *ctx, const unsigned char *buf, size_t len)
-{
-    mbedtls_mock_socket *socket = (mbedtls_mock_socket *) ctx;
-
-    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
-        return -1;
-    }
-
-    return mbedtls_test_buffer_put(socket->output, buf, len);
-}
-
-int mbedtls_mock_tcp_recv_b(void *ctx, unsigned char *buf, size_t len)
-{
-    mbedtls_mock_socket *socket = (mbedtls_mock_socket *) ctx;
-
-    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
-        return -1;
-    }
-
-    return mbedtls_test_buffer_get(socket->input, buf, len);
-}
-
-/*
- * Callbacks for simulating non-blocking I/O over connection-oriented transport.
- */
-
-int mbedtls_mock_tcp_send_nb(void *ctx, const unsigned char *buf, size_t len)
-{
-    mbedtls_mock_socket *socket = (mbedtls_mock_socket *) ctx;
-
-    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
-        return -1;
-    }
-
-    if (socket->output->capacity == socket->output->content_length) {
-        return MBEDTLS_ERR_SSL_WANT_WRITE;
-    }
-
-    return mbedtls_test_buffer_put(socket->output, buf, len);
-}
-
-int mbedtls_mock_tcp_recv_nb(void *ctx, unsigned char *buf, size_t len)
-{
-    mbedtls_mock_socket *socket = (mbedtls_mock_socket *) ctx;
-
-    if (socket == NULL || socket->status != MBEDTLS_MOCK_SOCKET_CONNECTED) {
-        return -1;
-    }
-
-    if (socket->input->content_length == 0) {
-        return MBEDTLS_ERR_SSL_WANT_READ;
-    }
-
-    return mbedtls_test_buffer_get(socket->input, buf, len);
-}
-
-/* Errors used in the message socket mocks */
-
-#define MBEDTLS_TEST_ERROR_CONTEXT_ERROR -55
-#define MBEDTLS_TEST_ERROR_SEND_FAILED -66
-#define MBEDTLS_TEST_ERROR_RECV_FAILED -77
-
-/*
- * Structure used as an addon, or a wrapper, around the mocked sockets.
- * Contains an input queue, to which the other socket pushes metadata,
- * and an output queue, to which this one pushes metadata. This context is
- * considered as an owner of the input queue only, which is initialized and
- * freed in the respective setup and free calls.
- */
-typedef struct mbedtls_test_message_socket_context {
-    mbedtls_test_message_queue *queue_input;
-    mbedtls_test_message_queue *queue_output;
-    mbedtls_mock_socket *socket;
-} mbedtls_test_message_socket_context;
-
-void mbedtls_message_socket_init(mbedtls_test_message_socket_context *ctx)
-{
-    ctx->queue_input = NULL;
-    ctx->queue_output = NULL;
-    ctx->socket = NULL;
-}
-
-/*
- * Setup a given message socket context including initialization of
- * input/output queues to a chosen capacity of messages. Also set the
- * corresponding mock socket.
- *
- * \retval  0, if everything succeeds.
- * \retval  MBEDTLS_ERR_SSL_ALLOC_FAILED, if allocation of a message
- *          queue failed.
- */
-int mbedtls_message_socket_setup(mbedtls_test_message_queue *queue_input,
-                                 mbedtls_test_message_queue *queue_output,
-                                 size_t queue_capacity,
-                                 mbedtls_mock_socket *socket,
-                                 mbedtls_test_message_socket_context *ctx)
-{
-    int ret = mbedtls_test_message_queue_setup(queue_input, queue_capacity);
-    if (ret != 0) {
-        return ret;
-    }
-    ctx->queue_input = queue_input;
-    ctx->queue_output = queue_output;
-    ctx->socket = socket;
-    mbedtls_mock_socket_init(socket);
-
-    return 0;
-}
-
-/*
- * Close a given message socket context, along with the socket itself. Free the
- * memory allocated by the input queue.
- */
-void mbedtls_message_socket_close(mbedtls_test_message_socket_context *ctx)
-{
-    if (ctx == NULL) {
-        return;
-    }
-
-    mbedtls_test_message_queue_free(ctx->queue_input);
-    mbedtls_mock_socket_close(ctx->socket);
-    memset(ctx, 0, sizeof(*ctx));
-}
-
-/*
- * Send one message through a given message socket context.
- *
- * \retval  \p len, if everything succeeds.
- * \retval  MBEDTLS_TEST_ERROR_CONTEXT_ERROR, if any of the needed context
- *          elements or the context itself is null.
- * \retval  MBEDTLS_TEST_ERROR_SEND_FAILED if mbedtls_mock_tcp_send_b failed.
- * \retval  MBEDTLS_ERR_SSL_WANT_WRITE, if the output queue is full.
- *
- * This function will also return any error from
- * mbedtls_test_message_queue_push_info.
- */
-int mbedtls_mock_tcp_send_msg(void *ctx, const unsigned char *buf, size_t len)
-{
-    mbedtls_test_message_queue *queue;
-    mbedtls_mock_socket *socket;
-    mbedtls_test_message_socket_context *context = (mbedtls_test_message_socket_context *) ctx;
-
-    if (context == NULL || context->socket == NULL
-        || context->queue_output == NULL) {
-        return MBEDTLS_TEST_ERROR_CONTEXT_ERROR;
-    }
-
-    queue = context->queue_output;
-    socket = context->socket;
-
-    if (queue->num >= queue->capacity) {
-        return MBEDTLS_ERR_SSL_WANT_WRITE;
-    }
-
-    if (mbedtls_mock_tcp_send_b(socket, buf, len) != (int) len) {
-        return MBEDTLS_TEST_ERROR_SEND_FAILED;
-    }
-
-    return mbedtls_test_message_queue_push_info(queue, len);
-}
-
-/*
- * Receive one message from a given message socket context and return message
- * length or an error.
- *
- * \retval  message length, if everything succeeds.
- * \retval  MBEDTLS_TEST_ERROR_CONTEXT_ERROR, if any of the needed context
- *          elements or the context itself is null.
- * \retval  MBEDTLS_TEST_ERROR_RECV_FAILED if mbedtls_mock_tcp_recv_b failed.
- *
- * This function will also return any error other than
- * MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED from mbedtls_test_message_queue_peek_info.
- */
-int mbedtls_mock_tcp_recv_msg(void *ctx, unsigned char *buf, size_t buf_len)
-{
-    mbedtls_test_message_queue *queue;
-    mbedtls_mock_socket *socket;
-    mbedtls_test_message_socket_context *context = (mbedtls_test_message_socket_context *) ctx;
-    size_t drop_len = 0;
-    size_t msg_len;
-    int ret;
-
-    if (context == NULL || context->socket == NULL
-        || context->queue_input == NULL) {
-        return MBEDTLS_TEST_ERROR_CONTEXT_ERROR;
-    }
-
-    queue = context->queue_input;
-    socket = context->socket;
-
-    /* Peek first, so that in case of a socket error the data remains in
-     * the queue. */
-    ret = mbedtls_test_message_queue_peek_info(queue, buf_len, &msg_len);
-    if (ret == MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED) {
-        /* Calculate how much to drop */
-        drop_len = msg_len - buf_len;
-
-        /* Set the requested message len to be buffer length */
-        msg_len = buf_len;
-    } else if (ret != 0) {
-        return ret;
-    }
-
-    if (mbedtls_mock_tcp_recv_b(socket, buf, msg_len) != (int) msg_len) {
-        return MBEDTLS_TEST_ERROR_RECV_FAILED;
-    }
-
-    if (ret == MBEDTLS_TEST_ERROR_MESSAGE_TRUNCATED) {
-        /* Drop the remaining part of the message */
-        if (mbedtls_mock_tcp_recv_b(socket, NULL, drop_len) != (int) drop_len) {
-            /* Inconsistent state - part of the message was read,
-             * and a part couldn't. Not much we can do here, but it should not
-             * happen in test environment, unless forced manually. */
-        }
-    }
-    mbedtls_test_message_queue_pop_info(queue, buf_len);
-
-    return msg_len;
-}
-
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
-
-/*
- * Structure with endpoint's certificates for SSL communication tests.
- */
-typedef struct mbedtls_endpoint_certificate {
-    mbedtls_x509_crt *ca_cert;
-    mbedtls_x509_crt *cert;
-    mbedtls_pk_context *pkey;
-} mbedtls_endpoint_certificate;
-
-/*
- * Endpoint structure for SSL communication tests.
- */
-typedef struct mbedtls_endpoint {
-    const char *name;
-    mbedtls_ssl_context ssl;
-    mbedtls_ssl_config conf;
-    mbedtls_mock_socket socket;
-    mbedtls_endpoint_certificate cert;
-} mbedtls_endpoint;
-
-/*
- * Deinitializes certificates from endpoint represented by \p ep.
- */
-void mbedtls_endpoint_certificate_free(mbedtls_endpoint *ep)
-{
-    mbedtls_endpoint_certificate *cert = &(ep->cert);
-    if (cert != NULL) {
-        if (cert->ca_cert != NULL) {
-            mbedtls_x509_crt_free(cert->ca_cert);
-            mbedtls_free(cert->ca_cert);
-            cert->ca_cert = NULL;
-        }
-        if (cert->cert != NULL) {
-            mbedtls_x509_crt_free(cert->cert);
-            mbedtls_free(cert->cert);
-            cert->cert = NULL;
-        }
-        if (cert->pkey != NULL) {
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-            if (mbedtls_pk_get_type(cert->pkey) == MBEDTLS_PK_OPAQUE) {
-                mbedtls_svc_key_id_t *key_slot = cert->pkey->pk_ctx;
-                psa_destroy_key(*key_slot);
-            }
-#endif
-            mbedtls_pk_free(cert->pkey);
-            mbedtls_free(cert->pkey);
-            cert->pkey = NULL;
-        }
-    }
-}
-
-/*
- * Initializes \p ep_cert structure and assigns it to endpoint
- * represented by \p ep.
- *
- * \retval  0 on success, otherwise error code.
- */
-int mbedtls_endpoint_certificate_init(mbedtls_endpoint *ep, int pk_alg,
-                                      int opaque_alg, int opaque_alg2,
-                                      int opaque_usage)
-{
-    int i = 0;
-    int ret = -1;
-    mbedtls_endpoint_certificate *cert = NULL;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    mbedtls_svc_key_id_t key_slot = MBEDTLS_SVC_KEY_ID_INIT;
-#endif
-
-    if (ep == NULL) {
-        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
-    }
-
-    cert = &(ep->cert);
-    ASSERT_ALLOC(cert->ca_cert, 1);
-    ASSERT_ALLOC(cert->cert, 1);
-    ASSERT_ALLOC(cert->pkey, 1);
-
-    mbedtls_x509_crt_init(cert->ca_cert);
-    mbedtls_x509_crt_init(cert->cert);
-    mbedtls_pk_init(cert->pkey);
-
-    /* Load the trusted CA */
-
-    for (i = 0; mbedtls_test_cas_der[i] != NULL; i++) {
-        ret = mbedtls_x509_crt_parse_der(cert->ca_cert,
-                                         (const unsigned char *) mbedtls_test_cas_der[i],
-                                         mbedtls_test_cas_der_len[i]);
-        TEST_ASSERT(ret == 0);
-    }
-
-    /* Load own certificate and private key */
-
-    if (ep->conf.endpoint == MBEDTLS_SSL_IS_SERVER) {
-        if (pk_alg == MBEDTLS_PK_RSA) {
-            ret = mbedtls_x509_crt_parse(cert->cert,
-                                         (const unsigned char *) mbedtls_test_srv_crt_rsa_sha256_der,
-                                         mbedtls_test_srv_crt_rsa_sha256_der_len);
-            TEST_ASSERT(ret == 0);
-
-            ret = mbedtls_pk_parse_key(cert->pkey,
-                                       (const unsigned char *) mbedtls_test_srv_key_rsa_der,
-                                       mbedtls_test_srv_key_rsa_der_len, NULL, 0,
-                                       mbedtls_test_rnd_std_rand, NULL);
-            TEST_ASSERT(ret == 0);
-        } else {
-            ret = mbedtls_x509_crt_parse(cert->cert,
-                                         (const unsigned char *) mbedtls_test_srv_crt_ec_der,
-                                         mbedtls_test_srv_crt_ec_der_len);
-            TEST_ASSERT(ret == 0);
-
-            ret = mbedtls_pk_parse_key(cert->pkey,
-                                       (const unsigned char *) mbedtls_test_srv_key_ec_der,
-                                       mbedtls_test_srv_key_ec_der_len, NULL, 0,
-                                       mbedtls_test_rnd_std_rand, NULL);
-            TEST_ASSERT(ret == 0);
-        }
-    } else {
-        if (pk_alg == MBEDTLS_PK_RSA) {
-            ret = mbedtls_x509_crt_parse(cert->cert,
-                                         (const unsigned char *) mbedtls_test_cli_crt_rsa_der,
-                                         mbedtls_test_cli_crt_rsa_der_len);
-            TEST_ASSERT(ret == 0);
-
-            ret = mbedtls_pk_parse_key(cert->pkey,
-                                       (const unsigned char *) mbedtls_test_cli_key_rsa_der,
-                                       mbedtls_test_cli_key_rsa_der_len, NULL, 0,
-                                       mbedtls_test_rnd_std_rand, NULL);
-            TEST_ASSERT(ret == 0);
-        } else {
-            ret = mbedtls_x509_crt_parse(cert->cert,
-                                         (const unsigned char *) mbedtls_test_cli_crt_ec_der,
-                                         mbedtls_test_cli_crt_ec_len);
-            TEST_ASSERT(ret == 0);
-
-            ret = mbedtls_pk_parse_key(cert->pkey,
-                                       (const unsigned char *) mbedtls_test_cli_key_ec_der,
-                                       mbedtls_test_cli_key_ec_der_len, NULL, 0,
-                                       mbedtls_test_rnd_std_rand, NULL);
-            TEST_ASSERT(ret == 0);
-        }
-    }
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    if (opaque_alg != 0) {
-        TEST_EQUAL(mbedtls_pk_wrap_as_opaque(cert->pkey, &key_slot,
-                                             opaque_alg, opaque_usage,
-                                             opaque_alg2), 0);
-    }
-#else
-    (void) opaque_alg;
-    (void) opaque_alg2;
-    (void) opaque_usage;
-#endif
-
-    mbedtls_ssl_conf_ca_chain(&(ep->conf), cert->ca_cert, NULL);
-
-    ret = mbedtls_ssl_conf_own_cert(&(ep->conf), cert->cert,
-                                    cert->pkey);
-    TEST_ASSERT(ret == 0);
-    TEST_ASSERT(ep->conf.key_cert != NULL);
-
-    ret = mbedtls_ssl_conf_own_cert(&(ep->conf), NULL, NULL);
-    TEST_ASSERT(ret == 0);
-    TEST_ASSERT(ep->conf.key_cert == NULL);
-
-    ret = mbedtls_ssl_conf_own_cert(&(ep->conf), cert->cert,
-                                    cert->pkey);
-    TEST_ASSERT(ret == 0);
-
-exit:
-    if (ret != 0) {
-        mbedtls_endpoint_certificate_free(ep);
-    }
-
-    return ret;
-}
-
-/*
- * Initializes \p ep structure. It is important to call `mbedtls_endpoint_free()`
- * after calling this function even if it fails.
- *
- * \p endpoint_type must be set as MBEDTLS_SSL_IS_SERVER or
- * MBEDTLS_SSL_IS_CLIENT.
- * \p pk_alg the algorithm to use, currently only MBEDTLS_PK_RSA and
- * MBEDTLS_PK_ECDSA are supported.
- * \p dtls_context - in case of DTLS - this is the context handling metadata.
- * \p input_queue - used only in case of DTLS.
- * \p output_queue - used only in case of DTLS.
- *
- * \retval  0 on success, otherwise error code.
- */
-int mbedtls_endpoint_init(mbedtls_endpoint *ep, int endpoint_type,
-                          handshake_test_options *options,
-                          mbedtls_test_message_socket_context *dtls_context,
-                          mbedtls_test_message_queue *input_queue,
-                          mbedtls_test_message_queue *output_queue,
-                          uint16_t *group_list)
-{
-    int ret = -1;
-    uintptr_t user_data_n;
-
-    if (dtls_context != NULL && (input_queue == NULL || output_queue == NULL)) {
-        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
-    }
-
-    if (ep == NULL) {
-        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
-    }
-
-    memset(ep, 0, sizeof(*ep));
-
-    ep->name = (endpoint_type == MBEDTLS_SSL_IS_SERVER) ? "Server" : "Client";
-
-    mbedtls_ssl_init(&(ep->ssl));
-    mbedtls_ssl_config_init(&(ep->conf));
-    mbedtls_ssl_conf_rng(&(ep->conf), rng_get, NULL);
-
-    TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&ep->conf) == NULL);
-    TEST_EQUAL(mbedtls_ssl_conf_get_user_data_n(&ep->conf), 0);
-    TEST_ASSERT(mbedtls_ssl_get_user_data_p(&ep->ssl) == NULL);
-    TEST_EQUAL(mbedtls_ssl_get_user_data_n(&ep->ssl), 0);
-
-    (void) mbedtls_test_rnd_std_rand(NULL,
-                                     (void *) &user_data_n,
-                                     sizeof(user_data_n));
-    mbedtls_ssl_conf_set_user_data_n(&ep->conf, user_data_n);
-    mbedtls_ssl_set_user_data_n(&ep->ssl, user_data_n);
-
-    if (dtls_context != NULL) {
-        TEST_ASSERT(mbedtls_message_socket_setup(input_queue, output_queue,
-                                                 100, &(ep->socket),
-                                                 dtls_context) == 0);
-    } else {
-        mbedtls_mock_socket_init(&(ep->socket));
-    }
-
-    /* Non-blocking callbacks without timeout */
-    if (dtls_context != NULL) {
-        mbedtls_ssl_set_bio(&(ep->ssl), dtls_context,
-                            mbedtls_mock_tcp_send_msg,
-                            mbedtls_mock_tcp_recv_msg,
-                            NULL);
-    } else {
-        mbedtls_ssl_set_bio(&(ep->ssl), &(ep->socket),
-                            mbedtls_mock_tcp_send_nb,
-                            mbedtls_mock_tcp_recv_nb,
-                            NULL);
-    }
-
-    ret = mbedtls_ssl_config_defaults(&(ep->conf), endpoint_type,
-                                      (dtls_context != NULL) ?
-                                      MBEDTLS_SSL_TRANSPORT_DATAGRAM :
-                                      MBEDTLS_SSL_TRANSPORT_STREAM,
-                                      MBEDTLS_SSL_PRESET_DEFAULT);
-    TEST_ASSERT(ret == 0);
-
-    if (group_list != NULL) {
-        mbedtls_ssl_conf_groups(&(ep->conf), group_list);
-    }
-
-    mbedtls_ssl_conf_authmode(&(ep->conf), MBEDTLS_SSL_VERIFY_REQUIRED);
-
-#if defined(MBEDTLS_SSL_CACHE_C) && defined(MBEDTLS_SSL_SRV_C)
-    if (endpoint_type == MBEDTLS_SSL_IS_SERVER && options->cache != NULL) {
-        mbedtls_ssl_conf_session_cache(&(ep->conf), options->cache,
-                                       mbedtls_ssl_cache_get,
-                                       mbedtls_ssl_cache_set);
-    }
-#endif
-
-    ret = mbedtls_ssl_setup(&(ep->ssl), &(ep->conf));
-    TEST_ASSERT(ret == 0);
-
-#if defined(MBEDTLS_SSL_PROTO_DTLS) && defined(MBEDTLS_SSL_SRV_C)
-    if (endpoint_type == MBEDTLS_SSL_IS_SERVER && dtls_context != NULL) {
-        mbedtls_ssl_conf_dtls_cookies(&(ep->conf), NULL, NULL, NULL);
-    }
-#endif
-
-    ret = mbedtls_endpoint_certificate_init(ep, options->pk_alg,
-                                            options->opaque_alg,
-                                            options->opaque_alg2,
-                                            options->opaque_usage);
-    TEST_ASSERT(ret == 0);
-
-    TEST_EQUAL(mbedtls_ssl_conf_get_user_data_n(&ep->conf), user_data_n);
-    mbedtls_ssl_conf_set_user_data_p(&ep->conf, ep);
-    TEST_EQUAL(mbedtls_ssl_get_user_data_n(&ep->ssl), user_data_n);
-    mbedtls_ssl_set_user_data_p(&ep->ssl, ep);
-
-exit:
-    return ret;
-}
-
-/*
- * Deinitializes endpoint represented by \p ep.
- */
-void mbedtls_endpoint_free(mbedtls_endpoint *ep,
-                           mbedtls_test_message_socket_context *context)
-{
-    mbedtls_endpoint_certificate_free(ep);
-
-    mbedtls_ssl_free(&(ep->ssl));
-    mbedtls_ssl_config_free(&(ep->conf));
-
-    if (context != NULL) {
-        mbedtls_message_socket_close(context);
-    } else {
-        mbedtls_mock_socket_close(&(ep->socket));
-    }
-}
-
-/*
- * This function moves ssl handshake from \p ssl to prescribed \p state.
- * /p second_ssl is used as second endpoint and their sockets have to be
- * connected before calling this function.
- *
- * \retval  0 on success, otherwise error code.
- */
-int mbedtls_move_handshake_to_state(mbedtls_ssl_context *ssl,
-                                    mbedtls_ssl_context *second_ssl,
-                                    int state)
-{
-    enum { BUFFSIZE = 1024 };
-    int max_steps = 1000;
-    int ret = 0;
-
-    if (ssl == NULL || second_ssl == NULL) {
-        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
-    }
-
-    /* Perform communication via connected sockets */
-    while ((ssl->state != state) && (--max_steps >= 0)) {
-        /* If /p second_ssl ends the handshake procedure before /p ssl then
-         * there is no need to call the next step */
-        if (!mbedtls_ssl_is_handshake_over(second_ssl)) {
-            ret = mbedtls_ssl_handshake_step(second_ssl);
-            if (ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ &&
-                ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
-                return ret;
-            }
-        }
-
-        /* We only care about the \p ssl state and returns, so we call it last,
-         * to leave the iteration as soon as the state is as expected. */
-        ret = mbedtls_ssl_handshake_step(ssl);
-        if (ret != 0 && ret != MBEDTLS_ERR_SSL_WANT_READ &&
-            ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
-            return ret;
-        }
-    }
-
-    return (max_steps >= 0) ? ret : -1;
-}
-
-#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
-
-/*
- * Write application data. Increase write counter if necessary.
- */
-int mbedtls_ssl_write_fragment(mbedtls_ssl_context *ssl, unsigned char *buf,
-                               int buf_len, int *written,
-                               const int expected_fragments)
-{
-    /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is
-     * a valid no-op for TLS connections. */
-    if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
-        TEST_ASSERT(mbedtls_ssl_write(ssl, NULL, 0) == 0);
-    }
-
-    int ret = mbedtls_ssl_write(ssl, buf + *written, buf_len - *written);
-    if (ret > 0) {
-        *written += ret;
-    }
-
-    if (expected_fragments == 0) {
-        /* Used for DTLS and the message size larger than MFL. In that case
-         * the message can not be fragmented and the library should return
-         * MBEDTLS_ERR_SSL_BAD_INPUT_DATA error. This error must be returned
-         * to prevent a dead loop inside mbedtls_exchange_data(). */
-        return ret;
-    } else if (expected_fragments == 1) {
-        /* Used for TLS/DTLS and the message size lower than MFL */
-        TEST_ASSERT(ret == buf_len ||
-                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
-                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
-    } else {
-        /* Used for TLS and the message size larger than MFL */
-        TEST_ASSERT(expected_fragments > 1);
-        TEST_ASSERT((ret >= 0 && ret <= buf_len) ||
-                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
-                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
-    }
-
-    return 0;
-
-exit:
-    /* Some of the tests failed */
-    return -1;
-}
-
-/*
- * Read application data and increase read counter and fragments counter if necessary.
- */
-int mbedtls_ssl_read_fragment(mbedtls_ssl_context *ssl, unsigned char *buf,
-                              int buf_len, int *read,
-                              int *fragments, const int expected_fragments)
-{
-    /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is
-     * a valid no-op for TLS connections. */
-    if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
-        TEST_ASSERT(mbedtls_ssl_read(ssl, NULL, 0) == 0);
-    }
-
-    int ret = mbedtls_ssl_read(ssl, buf + *read, buf_len - *read);
-    if (ret > 0) {
-        (*fragments)++;
-        *read += ret;
-    }
-
-    if (expected_fragments == 0) {
-        TEST_ASSERT(ret == 0);
-    } else if (expected_fragments == 1) {
-        TEST_ASSERT(ret == buf_len ||
-                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
-                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
-    } else {
-        TEST_ASSERT(expected_fragments > 1);
-        TEST_ASSERT((ret >= 0 && ret <= buf_len) ||
-                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
-                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
-    }
-
-    return 0;
-
-exit:
-    /* Some of the tests failed */
-    return -1;
-}
-
-/*
- * Helper function setting up inverse record transformations
- * using given cipher, hash, EtM mode, authentication tag length,
- * and version.
- */
-
-#define CHK(x)                                \
-    do                                          \
-    {                                           \
-        if (!(x))                            \
-        {                                       \
-            ret = -1;                           \
-            goto cleanup;                       \
-        }                                       \
-    } while (0)
-
-void set_ciphersuite(mbedtls_ssl_config *conf, const char *cipher,
-                     int *forced_ciphersuite)
-{
-    const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
-    forced_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id(cipher);
-    forced_ciphersuite[1] = 0;
-
-    ciphersuite_info =
-        mbedtls_ssl_ciphersuite_from_id(forced_ciphersuite[0]);
-
-    TEST_ASSERT(ciphersuite_info != NULL);
-    TEST_ASSERT(ciphersuite_info->min_tls_version <= conf->max_tls_version);
-    TEST_ASSERT(ciphersuite_info->max_tls_version >= conf->min_tls_version);
-
-    if (conf->max_tls_version > ciphersuite_info->max_tls_version) {
-        conf->max_tls_version = ciphersuite_info->max_tls_version;
-    }
-    if (conf->min_tls_version < ciphersuite_info->min_tls_version) {
-        conf->min_tls_version = ciphersuite_info->min_tls_version;
-    }
-
-    mbedtls_ssl_conf_ciphersuites(conf, forced_ciphersuite);
-
-exit:
-    return;
-}
-
-int psk_dummy_callback(void *p_info, mbedtls_ssl_context *ssl,
-                       const unsigned char *name, size_t name_len)
-{
-    (void) p_info;
-    (void) ssl;
-    (void) name;
-    (void) name_len;
-
-    return 0;
-}
-
-#if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX
-#define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_IN_LEN_MAX
-#else
-#define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_OUT_LEN_MAX
-#endif
-
-#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
-    defined(MBEDTLS_CIPHER_MODE_CBC) && defined(MBEDTLS_AES_C)
-static int psa_cipher_encrypt_helper(mbedtls_ssl_transform *transform,
-                                     const unsigned char *iv, size_t iv_len,
-                                     const unsigned char *input, size_t ilen,
-                                     unsigned char *output, size_t *olen)
-{
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
-    psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT;
-    size_t part_len;
-
-    status = psa_cipher_encrypt_setup(&cipher_op,
-                                      transform->psa_key_enc, transform->psa_alg);
-
-    if (status != PSA_SUCCESS) {
-        return PSA_TO_MBEDTLS_ERR(status);
-    }
-
-    status = psa_cipher_set_iv(&cipher_op, iv, iv_len);
-
-    if (status != PSA_SUCCESS) {
-        return PSA_TO_MBEDTLS_ERR(status);
-    }
-
-    status = psa_cipher_update(&cipher_op,
-                               input, ilen, output, ilen, olen);
-
-    if (status != PSA_SUCCESS) {
-        return PSA_TO_MBEDTLS_ERR(status);
-    }
-
-    status = psa_cipher_finish(&cipher_op,
-                               output + *olen, ilen - *olen, &part_len);
-
-    if (status != PSA_SUCCESS) {
-        return PSA_TO_MBEDTLS_ERR(status);
-    }
-
-    *olen += part_len;
-    return 0;
-#else
-    return mbedtls_cipher_crypt(&transform->cipher_ctx_enc,
-                                iv, iv_len, input, ilen, output, olen);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-}
-#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_CIPHER_MODE_CBC && MBEDTLS_AES_C */
-
-static int build_transforms(mbedtls_ssl_transform *t_in,
-                            mbedtls_ssl_transform *t_out,
-                            int cipher_type, int hash_id,
-                            int etm, int tag_mode,
-                            mbedtls_ssl_protocol_version tls_version,
-                            size_t cid0_len,
-                            size_t cid1_len)
-{
-    mbedtls_cipher_info_t const *cipher_info;
-    int ret = 0;
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    psa_key_type_t key_type;
-    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
-    psa_algorithm_t alg;
-    size_t key_bits;
-    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
-#endif
-
-    size_t keylen, maclen, ivlen;
-    unsigned char *key0 = NULL, *key1 = NULL;
-    unsigned char *md0 = NULL, *md1 = NULL;
-    unsigned char iv_enc[16], iv_dec[16];
-
-#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
-    unsigned char cid0[SSL_CID_LEN_MIN];
-    unsigned char cid1[SSL_CID_LEN_MIN];
-
-    mbedtls_test_rnd_std_rand(NULL, cid0, sizeof(cid0));
-    mbedtls_test_rnd_std_rand(NULL, cid1, sizeof(cid1));
-#else
-    ((void) cid0_len);
-    ((void) cid1_len);
-#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
-
-    maclen = 0;
-
-    /* Pick cipher */
-    cipher_info = mbedtls_cipher_info_from_type(cipher_type);
-    CHK(cipher_info != NULL);
-    CHK(cipher_info->iv_size <= 16);
-    CHK(cipher_info->key_bitlen % 8 == 0);
-
-    /* Pick keys */
-    keylen = cipher_info->key_bitlen / 8;
-    /* Allocate `keylen + 1` bytes to ensure that we get
-     * a non-NULL pointers from `mbedtls_calloc` even if
-     * `keylen == 0` in the case of the NULL cipher. */
-    CHK((key0 = mbedtls_calloc(1, keylen + 1)) != NULL);
-    CHK((key1 = mbedtls_calloc(1, keylen + 1)) != NULL);
-    memset(key0, 0x1, keylen);
-    memset(key1, 0x2, keylen);
-
-#if !defined(MBEDTLS_USE_PSA_CRYPTO)
-    /* Setup cipher contexts */
-    CHK(mbedtls_cipher_setup(&t_in->cipher_ctx_enc,  cipher_info) == 0);
-    CHK(mbedtls_cipher_setup(&t_in->cipher_ctx_dec,  cipher_info) == 0);
-    CHK(mbedtls_cipher_setup(&t_out->cipher_ctx_enc, cipher_info) == 0);
-    CHK(mbedtls_cipher_setup(&t_out->cipher_ctx_dec, cipher_info) == 0);
-
-#if defined(MBEDTLS_CIPHER_MODE_CBC)
-    if (cipher_info->mode == MBEDTLS_MODE_CBC) {
-        CHK(mbedtls_cipher_set_padding_mode(&t_in->cipher_ctx_enc,
-                                            MBEDTLS_PADDING_NONE) == 0);
-        CHK(mbedtls_cipher_set_padding_mode(&t_in->cipher_ctx_dec,
-                                            MBEDTLS_PADDING_NONE) == 0);
-        CHK(mbedtls_cipher_set_padding_mode(&t_out->cipher_ctx_enc,
-                                            MBEDTLS_PADDING_NONE) == 0);
-        CHK(mbedtls_cipher_set_padding_mode(&t_out->cipher_ctx_dec,
-                                            MBEDTLS_PADDING_NONE) == 0);
-    }
-#endif /* MBEDTLS_CIPHER_MODE_CBC */
-
-    CHK(mbedtls_cipher_setkey(&t_in->cipher_ctx_enc, key0,
-                              keylen << 3, MBEDTLS_ENCRYPT) == 0);
-    CHK(mbedtls_cipher_setkey(&t_in->cipher_ctx_dec, key1,
-                              keylen << 3, MBEDTLS_DECRYPT) == 0);
-    CHK(mbedtls_cipher_setkey(&t_out->cipher_ctx_enc, key1,
-                              keylen << 3, MBEDTLS_ENCRYPT) == 0);
-    CHK(mbedtls_cipher_setkey(&t_out->cipher_ctx_dec, key0,
-                              keylen << 3, MBEDTLS_DECRYPT) == 0);
-#endif
-
-    /* Setup MAC contexts */
-#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
-    if (cipher_info->mode == MBEDTLS_MODE_CBC ||
-        cipher_info->mode == MBEDTLS_MODE_STREAM) {
-#if !defined(MBEDTLS_USE_PSA_CRYPTO)
-        mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type(hash_id);
-        CHK(md_info != NULL);
-#endif
-        maclen = mbedtls_hash_info_get_size(hash_id);
-        CHK(maclen != 0);
-        /* Pick hash keys */
-        CHK((md0 = mbedtls_calloc(1, maclen)) != NULL);
-        CHK((md1 = mbedtls_calloc(1, maclen)) != NULL);
-        memset(md0, 0x5, maclen);
-        memset(md1, 0x6, maclen);
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-        alg = mbedtls_hash_info_psa_from_md(hash_id);
-
-        CHK(alg != 0);
-
-        t_out->psa_mac_alg = PSA_ALG_HMAC(alg);
-        t_in->psa_mac_alg = PSA_ALG_HMAC(alg);
-        t_in->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
-        t_out->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
-        t_in->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
-        t_out->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
-
-        psa_reset_key_attributes(&attributes);
-        psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
-        psa_set_key_algorithm(&attributes, PSA_ALG_HMAC(alg));
-        psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
-
-        CHK(psa_import_key(&attributes,
-                           md0, maclen,
-                           &t_in->psa_mac_enc) == PSA_SUCCESS);
-
-        CHK(psa_import_key(&attributes,
-                           md1, maclen,
-                           &t_out->psa_mac_enc) == PSA_SUCCESS);
-
-        if (cipher_info->mode == MBEDTLS_MODE_STREAM ||
-            etm == MBEDTLS_SSL_ETM_DISABLED) {
-            /* mbedtls_ct_hmac() requires the key to be exportable */
-            psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT |
-                                    PSA_KEY_USAGE_VERIFY_HASH);
-        } else {
-            psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_VERIFY_HASH);
-        }
-
-        CHK(psa_import_key(&attributes,
-                           md1, maclen,
-                           &t_in->psa_mac_dec) == PSA_SUCCESS);
-
-        CHK(psa_import_key(&attributes,
-                           md0, maclen,
-                           &t_out->psa_mac_dec) == PSA_SUCCESS);
-#else
-        CHK(mbedtls_md_setup(&t_out->md_ctx_enc, md_info, 1) == 0);
-        CHK(mbedtls_md_setup(&t_out->md_ctx_dec, md_info, 1) == 0);
-        CHK(mbedtls_md_setup(&t_in->md_ctx_enc,  md_info, 1) == 0);
-        CHK(mbedtls_md_setup(&t_in->md_ctx_dec,  md_info, 1) == 0);
-
-        CHK(mbedtls_md_hmac_starts(&t_in->md_ctx_enc,
-                                   md0, maclen) == 0);
-        CHK(mbedtls_md_hmac_starts(&t_in->md_ctx_dec,
-                                   md1, maclen) == 0);
-        CHK(mbedtls_md_hmac_starts(&t_out->md_ctx_enc,
-                                   md1, maclen) == 0);
-        CHK(mbedtls_md_hmac_starts(&t_out->md_ctx_dec,
-                                   md0, maclen) == 0);
-#endif
-    }
-#else
-    ((void) hash_id);
-#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
-
-
-    /* Pick IV's (regardless of whether they
-     * are being used by the transform). */
-    ivlen = cipher_info->iv_size;
-    memset(iv_enc, 0x3, sizeof(iv_enc));
-    memset(iv_dec, 0x4, sizeof(iv_dec));
-
-    /*
-     * Setup transforms
-     */
-
-#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
-    defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
-    t_out->encrypt_then_mac = etm;
-    t_in->encrypt_then_mac = etm;
-#else
-    ((void) etm);
-#endif
-
-    t_out->tls_version = tls_version;
-    t_in->tls_version = tls_version;
-    t_out->ivlen = ivlen;
-    t_in->ivlen = ivlen;
-
-    switch (cipher_info->mode) {
-        case MBEDTLS_MODE_GCM:
-        case MBEDTLS_MODE_CCM:
-#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-            if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
-                t_out->fixed_ivlen = 12;
-                t_in->fixed_ivlen  = 12;
-            } else
-#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
-            {
-                t_out->fixed_ivlen = 4;
-                t_in->fixed_ivlen = 4;
-            }
-            t_out->maclen = 0;
-            t_in->maclen = 0;
-            switch (tag_mode) {
-                case 0: /* Full tag */
-                    t_out->taglen = 16;
-                    t_in->taglen = 16;
-                    break;
-                case 1: /* Partial tag */
-                    t_out->taglen = 8;
-                    t_in->taglen = 8;
-                    break;
-                default:
-                    ret = 1;
-                    goto cleanup;
-            }
-            break;
-
-        case MBEDTLS_MODE_CHACHAPOLY:
-            t_out->fixed_ivlen = 12;
-            t_in->fixed_ivlen = 12;
-            t_out->maclen = 0;
-            t_in->maclen = 0;
-            switch (tag_mode) {
-                case 0: /* Full tag */
-                    t_out->taglen = 16;
-                    t_in->taglen = 16;
-                    break;
-                case 1: /* Partial tag */
-                    t_out->taglen = 8;
-                    t_in->taglen = 8;
-                    break;
-                default:
-                    ret = 1;
-                    goto cleanup;
-            }
-            break;
-
-        case MBEDTLS_MODE_STREAM:
-        case MBEDTLS_MODE_CBC:
-            t_out->fixed_ivlen = 0; /* redundant, must be 0 */
-            t_in->fixed_ivlen = 0;  /* redundant, must be 0 */
-            t_out->taglen = 0;
-            t_in->taglen = 0;
-            switch (tag_mode) {
-                case 0: /* Full tag */
-                    t_out->maclen = maclen;
-                    t_in->maclen = maclen;
-                    break;
-                default:
-                    ret = 1;
-                    goto cleanup;
-            }
-            break;
-        default:
-            ret = 1;
-            goto cleanup;
-            break;
-    }
-
-    /* Setup IV's */
-
-    memcpy(&t_in->iv_dec, iv_dec, sizeof(iv_dec));
-    memcpy(&t_in->iv_enc, iv_enc, sizeof(iv_enc));
-    memcpy(&t_out->iv_dec, iv_enc, sizeof(iv_enc));
-    memcpy(&t_out->iv_enc, iv_dec, sizeof(iv_dec));
-
-#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
-    /* Add CID */
-    memcpy(&t_in->in_cid,  cid0, cid0_len);
-    memcpy(&t_in->out_cid, cid1, cid1_len);
-    t_in->in_cid_len = cid0_len;
-    t_in->out_cid_len = cid1_len;
-    memcpy(&t_out->in_cid,  cid1, cid1_len);
-    memcpy(&t_out->out_cid, cid0, cid0_len);
-    t_out->in_cid_len = cid1_len;
-    t_out->out_cid_len = cid0_len;
-#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-    status = mbedtls_ssl_cipher_to_psa(cipher_type,
-                                       t_in->taglen,
-                                       &alg,
-                                       &key_type,
-                                       &key_bits);
-
-    if (status != PSA_SUCCESS) {
-        ret = PSA_TO_MBEDTLS_ERR(status);
-        goto cleanup;
-    }
-
-    t_in->psa_alg = alg;
-    t_out->psa_alg = alg;
-
-    if (alg != MBEDTLS_SSL_NULL_CIPHER) {
-        psa_reset_key_attributes(&attributes);
-        psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
-        psa_set_key_algorithm(&attributes, alg);
-        psa_set_key_type(&attributes, key_type);
-
-        status = psa_import_key(&attributes,
-                                key0,
-                                PSA_BITS_TO_BYTES(key_bits),
-                                &t_in->psa_key_enc);
-
-        if (status != PSA_SUCCESS) {
-            ret = PSA_TO_MBEDTLS_ERR(status);
-            goto cleanup;
-        }
-
-        status = psa_import_key(&attributes,
-                                key1,
-                                PSA_BITS_TO_BYTES(key_bits),
-                                &t_out->psa_key_enc);
-
-        if (status != PSA_SUCCESS) {
-            ret = PSA_TO_MBEDTLS_ERR(status);
-            goto cleanup;
-        }
-
-        psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
-
-        status = psa_import_key(&attributes,
-                                key1,
-                                PSA_BITS_TO_BYTES(key_bits),
-                                &t_in->psa_key_dec);
-
-        if (status != PSA_SUCCESS) {
-            ret = PSA_TO_MBEDTLS_ERR(status);
-            goto cleanup;
-        }
-
-        status = psa_import_key(&attributes,
-                                key0,
-                                PSA_BITS_TO_BYTES(key_bits),
-                                &t_out->psa_key_dec);
-
-        if (status != PSA_SUCCESS) {
-            ret = PSA_TO_MBEDTLS_ERR(status);
-            goto cleanup;
-        }
-    }
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
-cleanup:
-
-    mbedtls_free(key0);
-    mbedtls_free(key1);
-
-    mbedtls_free(md0);
-    mbedtls_free(md1);
-
-    return ret;
-}
-
-/*
- * Populate a session structure for serialization tests.
- * Choose dummy values, mostly non-0 to distinguish from the init default.
- */
-static int ssl_tls12_populate_session(mbedtls_ssl_session *session,
-                                      int ticket_len,
-                                      const char *crt_file)
-{
-#if defined(MBEDTLS_HAVE_TIME)
-    session->start = mbedtls_time(NULL) - 42;
-#endif
-    session->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
-    session->ciphersuite = 0xabcd;
-    session->id_len = sizeof(session->id);
-    memset(session->id, 66, session->id_len);
-    memset(session->master, 17, sizeof(session->master));
-
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && defined(MBEDTLS_FS_IO)
-    if (crt_file != NULL && strlen(crt_file) != 0) {
-        mbedtls_x509_crt tmp_crt;
-        int ret;
-
-        mbedtls_x509_crt_init(&tmp_crt);
-        ret = mbedtls_x509_crt_parse_file(&tmp_crt, crt_file);
-        if (ret != 0) {
-            return ret;
-        }
-
-#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
-        /* Move temporary CRT. */
-        session->peer_cert = mbedtls_calloc(1, sizeof(*session->peer_cert));
-        if (session->peer_cert == NULL) {
-            return -1;
-        }
-        *session->peer_cert = tmp_crt;
-        memset(&tmp_crt, 0, sizeof(tmp_crt));
-#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
-        /* Calculate digest of temporary CRT. */
-        session->peer_cert_digest =
-            mbedtls_calloc(1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN);
-        if (session->peer_cert_digest == NULL) {
-            return -1;
-        }
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-        psa_algorithm_t psa_alg = mbedtls_hash_info_psa_from_md(
-            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE);
-        size_t hash_size = 0;
-        psa_status_t status = psa_hash_compute(psa_alg, tmp_crt.raw.p,
-                                               tmp_crt.raw.len,
-                                               session->peer_cert_digest,
-                                               MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN,
-                                               &hash_size);
-        ret = PSA_TO_MBEDTLS_ERR(status);
-#else
-        ret = mbedtls_md(mbedtls_md_info_from_type(
-                             MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE),
-                         tmp_crt.raw.p, tmp_crt.raw.len,
-                         session->peer_cert_digest);
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-        if (ret != 0) {
-            return ret;
-        }
-        session->peer_cert_digest_type =
-            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
-        session->peer_cert_digest_len =
-            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
-#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
-
-        mbedtls_x509_crt_free(&tmp_crt);
-    }
-#else /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED && MBEDTLS_FS_IO */
-    (void) crt_file;
-#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED && MBEDTLS_FS_IO */
-    session->verify_result = 0xdeadbeef;
-
-#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
-    if (ticket_len != 0) {
-        session->ticket = mbedtls_calloc(1, ticket_len);
-        if (session->ticket == NULL) {
-            return -1;
-        }
-        memset(session->ticket, 33, ticket_len);
-    }
-    session->ticket_len = ticket_len;
-    session->ticket_lifetime = 86401;
-#else
-    (void) ticket_len;
-#endif
-
-#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
-    session->mfl_code = 1;
-#endif
-#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
-    session->encrypt_then_mac = 1;
-#endif
-
-    return 0;
-}
-
-#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-static int ssl_tls13_populate_session(mbedtls_ssl_session *session,
-                                      int ticket_len,
-                                      int endpoint_type)
-{
-    ((void) ticket_len);
-    session->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
-    session->endpoint = endpoint_type == MBEDTLS_SSL_IS_CLIENT ?
-                        MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER;
-    session->ciphersuite = 0xabcd;
-    session->ticket_age_add = 0x87654321;
-    session->ticket_flags = 0x7;
-
-    session->resumption_key_len = 32;
-    memset(session->resumption_key, 0x99, sizeof(session->resumption_key));
-
-#if defined(MBEDTLS_HAVE_TIME)
-    if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
-        session->start = mbedtls_time(NULL) - 42;
-    }
-#endif
-
-#if defined(MBEDTLS_SSL_CLI_C)
-    if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
-#if defined(MBEDTLS_HAVE_TIME)
-        session->ticket_received = mbedtls_time(NULL) - 40;
-#endif
-        session->ticket_lifetime = 0xfedcba98;
-
-        session->ticket_len = ticket_len;
-        if (ticket_len != 0) {
-            session->ticket = mbedtls_calloc(1, ticket_len);
-            if (session->ticket == NULL) {
-                return -1;
-            }
-            memset(session->ticket, 33, ticket_len);
-        }
-    }
-#endif /* MBEDTLS_SSL_CLI_C */
-
-    return 0;
-}
-#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
-
-/*
- * Perform data exchanging between \p ssl_1 and \p ssl_2 and check if the
- * message was sent in the correct number of fragments.
- *
- * /p ssl_1 and /p ssl_2    Endpoints represented by mbedtls_ssl_context. Both
- *                          of them must be initialized and connected beforehand.
- * /p msg_len_1 and /p msg_len_2 specify the size of the message to send.
- * /p expected_fragments_1 and /p expected_fragments_2 determine in how many
- *                          fragments the message should be sent.
- *      expected_fragments is 0: can be used for DTLS testing while the message
- *                          size is larger than MFL. In that case the message
- *                          cannot be fragmented and sent to the second endpoint.
- *                          This value can be used for negative tests.
- *      expected_fragments is 1: can be used for TLS/DTLS testing while the
- *                          message size is below MFL
- *      expected_fragments > 1: can be used for TLS testing while the message
- *                          size is larger than MFL
- *
- * \retval  0 on success, otherwise error code.
- */
-int mbedtls_exchange_data(mbedtls_ssl_context *ssl_1,
-                          int msg_len_1, const int expected_fragments_1,
-                          mbedtls_ssl_context *ssl_2,
-                          int msg_len_2, const int expected_fragments_2)
-{
-    unsigned char *msg_buf_1 = malloc(msg_len_1);
-    unsigned char *msg_buf_2 = malloc(msg_len_2);
-    unsigned char *in_buf_1  = malloc(msg_len_2);
-    unsigned char *in_buf_2  = malloc(msg_len_1);
-    int msg_type, ret = -1;
-
-    /* Perform this test with two message types. At first use a message
-     * consisting of only 0x00 for the client and only 0xFF for the server.
-     * At the second time use message with generated data */
-    for (msg_type = 0; msg_type < 2; msg_type++) {
-        int written_1 = 0;
-        int written_2 = 0;
-        int read_1 = 0;
-        int read_2 = 0;
-        int fragments_1 = 0;
-        int fragments_2 = 0;
-
-        if (msg_type == 0) {
-            memset(msg_buf_1, 0x00, msg_len_1);
-            memset(msg_buf_2, 0xff, msg_len_2);
-        } else {
-            int i, j = 0;
-            for (i = 0; i < msg_len_1; i++) {
-                msg_buf_1[i] = j++ & 0xFF;
-            }
-            for (i = 0; i < msg_len_2; i++) {
-                msg_buf_2[i] = (j -= 5) & 0xFF;
-            }
-        }
-
-        while (read_1 < msg_len_2 || read_2 < msg_len_1) {
-            /* ssl_1 sending */
-            if (msg_len_1 > written_1) {
-                ret = mbedtls_ssl_write_fragment(ssl_1, msg_buf_1,
-                                                 msg_len_1, &written_1,
-                                                 expected_fragments_1);
-                if (expected_fragments_1 == 0) {
-                    /* This error is expected when the message is too large and
-                     * cannot be fragmented */
-                    TEST_ASSERT(ret == MBEDTLS_ERR_SSL_BAD_INPUT_DATA);
-                    msg_len_1 = 0;
-                } else {
-                    TEST_ASSERT(ret == 0);
-                }
-            }
-
-            /* ssl_2 sending */
-            if (msg_len_2 > written_2) {
-                ret = mbedtls_ssl_write_fragment(ssl_2, msg_buf_2,
-                                                 msg_len_2, &written_2,
-                                                 expected_fragments_2);
-                if (expected_fragments_2 == 0) {
-                    /* This error is expected when the message is too large and
-                     * cannot be fragmented */
-                    TEST_ASSERT(ret == MBEDTLS_ERR_SSL_BAD_INPUT_DATA);
-                    msg_len_2 = 0;
-                } else {
-                    TEST_ASSERT(ret == 0);
-                }
-            }
-
-            /* ssl_1 reading */
-            if (read_1 < msg_len_2) {
-                ret = mbedtls_ssl_read_fragment(ssl_1, in_buf_1,
-                                                msg_len_2, &read_1,
-                                                &fragments_2,
-                                                expected_fragments_2);
-                TEST_ASSERT(ret == 0);
-            }
-
-            /* ssl_2 reading */
-            if (read_2 < msg_len_1) {
-                ret = mbedtls_ssl_read_fragment(ssl_2, in_buf_2,
-                                                msg_len_1, &read_2,
-                                                &fragments_1,
-                                                expected_fragments_1);
-                TEST_ASSERT(ret == 0);
-            }
-        }
-
-        ret = -1;
-        TEST_ASSERT(0 == memcmp(msg_buf_1, in_buf_2, msg_len_1));
-        TEST_ASSERT(0 == memcmp(msg_buf_2, in_buf_1, msg_len_2));
-        TEST_ASSERT(fragments_1 == expected_fragments_1);
-        TEST_ASSERT(fragments_2 == expected_fragments_2);
-    }
-
-    ret = 0;
-
-exit:
-    free(msg_buf_1);
-    free(in_buf_1);
-    free(msg_buf_2);
-    free(in_buf_2);
-
-    return ret;
-}
-
-/*
- * Perform data exchanging between \p ssl_1 and \p ssl_2. Both of endpoints
- * must be initialized and connected beforehand.
- *
- * \retval  0 on success, otherwise error code.
- */
-int exchange_data(mbedtls_ssl_context *ssl_1,
-                  mbedtls_ssl_context *ssl_2)
-{
-    return mbedtls_exchange_data(ssl_1, 256, 1,
-                                 ssl_2, 256, 1);
-}
-
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
-static int check_ssl_version(mbedtls_ssl_protocol_version expected_negotiated_version,
-                             const mbedtls_ssl_context *ssl)
-{
-    const char *version_string = mbedtls_ssl_get_version(ssl);
-    mbedtls_ssl_protocol_version version_number =
-        mbedtls_ssl_get_version_number(ssl);
-
-    TEST_EQUAL(ssl->tls_version, expected_negotiated_version);
-
-    if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
-        TEST_EQUAL(version_string[0], 'D');
-        ++version_string;
-    }
-
-    switch (expected_negotiated_version) {
-        case MBEDTLS_SSL_VERSION_TLS1_2:
-            TEST_EQUAL(version_number, MBEDTLS_SSL_VERSION_TLS1_2);
-            TEST_ASSERT(strcmp(version_string, "TLSv1.2") == 0);
-            break;
-
-        case MBEDTLS_SSL_VERSION_TLS1_3:
-            TEST_EQUAL(version_number, MBEDTLS_SSL_VERSION_TLS1_3);
-            TEST_ASSERT(strcmp(version_string, "TLSv1.3") == 0);
-            break;
-
-        default:
-            TEST_ASSERT(!"Version check not implemented for this protocol version");
-    }
-
-    return 1;
-
-exit:
-    return 0;
-}
-#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
-
-
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
-void perform_handshake(handshake_test_options *options)
-{
-    /* forced_ciphersuite needs to last until the end of the handshake */
-    int forced_ciphersuite[2];
-    enum { BUFFSIZE = 17000 };
-    mbedtls_endpoint client, server;
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
-    const char *psk_identity = "foo";
-#endif
-#if defined(MBEDTLS_TIMING_C)
-    mbedtls_timing_delay_context timer_client, timer_server;
-#endif
-#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
-    unsigned char *context_buf = NULL;
-    size_t context_buf_len;
-#endif
-#if defined(MBEDTLS_SSL_RENEGOTIATION)
-    int ret = -1;
-#endif
-    int expected_handshake_result = options->expected_handshake_result;
-
-    USE_PSA_INIT();
-    mbedtls_platform_zeroize(&client, sizeof(client));
-    mbedtls_platform_zeroize(&server, sizeof(server));
-    mbedtls_test_message_queue server_queue, client_queue;
-    mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
-
-    /* Client side */
-    if (options->dtls != 0) {
-        TEST_ASSERT(mbedtls_endpoint_init(&client, MBEDTLS_SSL_IS_CLIENT,
-                                          options, &client_context,
-                                          &client_queue,
-                                          &server_queue, NULL) == 0);
-#if defined(MBEDTLS_TIMING_C)
-        mbedtls_ssl_set_timer_cb(&client.ssl, &timer_client,
-                                 mbedtls_timing_set_delay,
-                                 mbedtls_timing_get_delay);
-#endif
-    } else {
-        TEST_ASSERT(mbedtls_endpoint_init(&client, MBEDTLS_SSL_IS_CLIENT,
-                                          options, NULL, NULL,
-                                          NULL, NULL) == 0);
-    }
-
-    if (options->client_min_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
-        mbedtls_ssl_conf_min_tls_version(&client.conf,
-                                         options->client_min_version);
-    }
-
-    if (options->client_max_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
-        mbedtls_ssl_conf_max_tls_version(&client.conf,
-                                         options->client_max_version);
-    }
-
-    if (strlen(options->cipher) > 0) {
-        set_ciphersuite(&client.conf, options->cipher, forced_ciphersuite);
-    }
-
-#if defined(MBEDTLS_DEBUG_C)
-    if (options->cli_log_fun) {
-        mbedtls_debug_set_threshold(4);
-        mbedtls_ssl_conf_dbg(&client.conf, options->cli_log_fun,
-                             options->cli_log_obj);
-    }
-#endif
-
-    /* Server side */
-    if (options->dtls != 0) {
-        TEST_ASSERT(mbedtls_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER,
-                                          options, &server_context,
-                                          &server_queue,
-                                          &client_queue, NULL) == 0);
-#if defined(MBEDTLS_TIMING_C)
-        mbedtls_ssl_set_timer_cb(&server.ssl, &timer_server,
-                                 mbedtls_timing_set_delay,
-                                 mbedtls_timing_get_delay);
-#endif
-    } else {
-        TEST_ASSERT(mbedtls_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER,
-                                          options, NULL, NULL, NULL,
-                                          NULL) == 0);
-    }
-
-    mbedtls_ssl_conf_authmode(&server.conf, options->srv_auth_mode);
-
-    if (options->server_min_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
-        mbedtls_ssl_conf_min_tls_version(&server.conf,
-                                         options->server_min_version);
-    }
-
-    if (options->server_max_version != MBEDTLS_SSL_VERSION_UNKNOWN) {
-        mbedtls_ssl_conf_max_tls_version(&server.conf,
-                                         options->server_max_version);
-    }
-
-#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
-    TEST_ASSERT(mbedtls_ssl_conf_max_frag_len(&(server.conf),
-                                              (unsigned char) options->mfl) == 0);
-    TEST_ASSERT(mbedtls_ssl_conf_max_frag_len(&(client.conf),
-                                              (unsigned char) options->mfl) == 0);
-#else
-    TEST_ASSERT(MBEDTLS_SSL_MAX_FRAG_LEN_NONE == options->mfl);
-#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
-
-#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
-    if (options->psk_str != NULL && options->psk_str->len > 0) {
-        TEST_ASSERT(mbedtls_ssl_conf_psk(&client.conf, options->psk_str->x,
-                                         options->psk_str->len,
-                                         (const unsigned char *) psk_identity,
-                                         strlen(psk_identity)) == 0);
-
-        TEST_ASSERT(mbedtls_ssl_conf_psk(&server.conf, options->psk_str->x,
-                                         options->psk_str->len,
-                                         (const unsigned char *) psk_identity,
-                                         strlen(psk_identity)) == 0);
-#if defined(MBEDTLS_SSL_SRV_C)
-        mbedtls_ssl_conf_psk_cb(&server.conf, psk_dummy_callback, NULL);
-#endif
-    }
-#endif
-#if defined(MBEDTLS_SSL_RENEGOTIATION)
-    if (options->renegotiate) {
-        mbedtls_ssl_conf_renegotiation(&(server.conf),
-                                       MBEDTLS_SSL_RENEGOTIATION_ENABLED);
-        mbedtls_ssl_conf_renegotiation(&(client.conf),
-                                       MBEDTLS_SSL_RENEGOTIATION_ENABLED);
-
-        mbedtls_ssl_conf_legacy_renegotiation(&(server.conf),
-                                              options->legacy_renegotiation);
-        mbedtls_ssl_conf_legacy_renegotiation(&(client.conf),
-                                              options->legacy_renegotiation);
-    }
-#endif /* MBEDTLS_SSL_RENEGOTIATION */
-
-#if defined(MBEDTLS_DEBUG_C)
-    if (options->srv_log_fun) {
-        mbedtls_debug_set_threshold(4);
-        mbedtls_ssl_conf_dbg(&server.conf, options->srv_log_fun,
-                             options->srv_log_obj);
-    }
-#endif
-
-    TEST_ASSERT(mbedtls_mock_socket_connect(&(client.socket),
-                                            &(server.socket),
-                                            BUFFSIZE) == 0);
-
-#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
-    if (options->resize_buffers != 0) {
-        /* Ensure that the buffer sizes are appropriate before resizes */
-        TEST_ASSERT(client.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
-        TEST_ASSERT(client.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
-        TEST_ASSERT(server.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
-        TEST_ASSERT(server.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
-    }
-#endif
-
-    if (options->expected_negotiated_version == MBEDTLS_SSL_VERSION_UNKNOWN) {
-        expected_handshake_result = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
-    }
-
-    TEST_ASSERT(mbedtls_move_handshake_to_state(&(client.ssl),
-                                                &(server.ssl),
-                                                MBEDTLS_SSL_HANDSHAKE_OVER)
-                ==  expected_handshake_result);
-
-    if (expected_handshake_result != 0) {
-        /* Connection will have failed by this point, skip to cleanup */
-        goto exit;
-    }
-
-    TEST_ASSERT(mbedtls_ssl_is_handshake_over(&client.ssl) == 1);
-
-    /* Make sure server state is moved to HANDSHAKE_OVER also. */
-    TEST_EQUAL(mbedtls_move_handshake_to_state(&(server.ssl),
-                                               &(client.ssl),
-                                               MBEDTLS_SSL_HANDSHAKE_OVER), 0);
-
-    TEST_ASSERT(mbedtls_ssl_is_handshake_over(&server.ssl) == 1);
-    /* Check that both sides have negotiated the expected version. */
-    mbedtls_test_set_step(0);
-    if (!check_ssl_version(options->expected_negotiated_version,
-                           &client.ssl)) {
-        goto exit;
-    }
-
-    mbedtls_test_set_step(1);
-    if (!check_ssl_version(options->expected_negotiated_version,
-                           &server.ssl)) {
-        goto exit;
-    }
-
-    if (options->expected_ciphersuite != 0) {
-        TEST_EQUAL(server.ssl.session->ciphersuite,
-                   options->expected_ciphersuite);
-    }
-
-#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
-    if (options->resize_buffers != 0) {
-        /* A server, when using DTLS, might delay a buffer resize to happen
-         * after it receives a message, so we force it. */
-        TEST_ASSERT(exchange_data(&(client.ssl), &(server.ssl)) == 0);
-
-        TEST_ASSERT(client.ssl.out_buf_len ==
-                    mbedtls_ssl_get_output_buflen(&client.ssl));
-        TEST_ASSERT(client.ssl.in_buf_len ==
-                    mbedtls_ssl_get_input_buflen(&client.ssl));
-        TEST_ASSERT(server.ssl.out_buf_len ==
-                    mbedtls_ssl_get_output_buflen(&server.ssl));
-        TEST_ASSERT(server.ssl.in_buf_len ==
-                    mbedtls_ssl_get_input_buflen(&server.ssl));
-    }
-#endif
-
-    if (options->cli_msg_len != 0 || options->srv_msg_len != 0) {
-        /* Start data exchanging test */
-        TEST_ASSERT(mbedtls_exchange_data(&(client.ssl), options->cli_msg_len,
-                                          options->expected_cli_fragments,
-                                          &(server.ssl), options->srv_msg_len,
-                                          options->expected_srv_fragments)
-                    == 0);
-    }
-#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
-    if (options->serialize == 1) {
-        TEST_ASSERT(options->dtls == 1);
-
-        TEST_ASSERT(mbedtls_ssl_context_save(&(server.ssl), NULL,
-                                             0, &context_buf_len)
-                    == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL);
-
-        context_buf = mbedtls_calloc(1, context_buf_len);
-        TEST_ASSERT(context_buf != NULL);
-
-        TEST_ASSERT(mbedtls_ssl_context_save(&(server.ssl), context_buf,
-                                             context_buf_len,
-                                             &context_buf_len) == 0);
-
-        mbedtls_ssl_free(&(server.ssl));
-        mbedtls_ssl_init(&(server.ssl));
-
-        TEST_ASSERT(mbedtls_ssl_setup(&(server.ssl), &(server.conf)) == 0);
-
-        mbedtls_ssl_set_bio(&(server.ssl), &server_context,
-                            mbedtls_mock_tcp_send_msg,
-                            mbedtls_mock_tcp_recv_msg,
-                            NULL);
-
-        mbedtls_ssl_set_user_data_p(&server.ssl, &server);
-
-#if defined(MBEDTLS_TIMING_C)
-        mbedtls_ssl_set_timer_cb(&server.ssl, &timer_server,
-                                 mbedtls_timing_set_delay,
-                                 mbedtls_timing_get_delay);
-#endif
-#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
-        if (options->resize_buffers != 0) {
-            /* Ensure that the buffer sizes are appropriate before resizes */
-            TEST_ASSERT(server.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
-            TEST_ASSERT(server.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
-        }
-#endif
-        TEST_ASSERT(mbedtls_ssl_context_load(&(server.ssl), context_buf,
-                                             context_buf_len) == 0);
-
-#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
-        /* Validate buffer sizes after context deserialization */
-        if (options->resize_buffers != 0) {
-            TEST_ASSERT(server.ssl.out_buf_len ==
-                        mbedtls_ssl_get_output_buflen(&server.ssl));
-            TEST_ASSERT(server.ssl.in_buf_len ==
-                        mbedtls_ssl_get_input_buflen(&server.ssl));
-        }
-#endif
-        /* Retest writing/reading */
-        if (options->cli_msg_len != 0 || options->srv_msg_len != 0) {
-            TEST_ASSERT(mbedtls_exchange_data(&(client.ssl),
-                                              options->cli_msg_len,
-                                              options->expected_cli_fragments,
-                                              &(server.ssl),
-                                              options->srv_msg_len,
-                                              options->expected_srv_fragments)
-                        == 0);
-        }
-    }
-#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
-
-#if defined(MBEDTLS_SSL_RENEGOTIATION)
-    if (options->renegotiate) {
-        /* Start test with renegotiation */
-        TEST_ASSERT(server.ssl.renego_status ==
-                    MBEDTLS_SSL_INITIAL_HANDSHAKE);
-        TEST_ASSERT(client.ssl.renego_status ==
-                    MBEDTLS_SSL_INITIAL_HANDSHAKE);
-
-        /* After calling this function for the server, it only sends a handshake
-         * request. All renegotiation should happen during data exchanging */
-        TEST_ASSERT(mbedtls_ssl_renegotiate(&(server.ssl)) == 0);
-        TEST_ASSERT(server.ssl.renego_status ==
-                    MBEDTLS_SSL_RENEGOTIATION_PENDING);
-        TEST_ASSERT(client.ssl.renego_status ==
-                    MBEDTLS_SSL_INITIAL_HANDSHAKE);
-
-        TEST_ASSERT(exchange_data(&(client.ssl), &(server.ssl)) == 0);
-        TEST_ASSERT(server.ssl.renego_status ==
-                    MBEDTLS_SSL_RENEGOTIATION_DONE);
-        TEST_ASSERT(client.ssl.renego_status ==
-                    MBEDTLS_SSL_RENEGOTIATION_DONE);
-
-        /* After calling mbedtls_ssl_renegotiate for the client all renegotiation
-         * should happen inside this function. However in this test, we cannot
-         * perform simultaneous communication between client and server so this
-         * function will return waiting error on the socket. All rest of
-         * renegotiation should happen during data exchanging */
-        ret = mbedtls_ssl_renegotiate(&(client.ssl));
-#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
-        if (options->resize_buffers != 0) {
-            /* Ensure that the buffer sizes are appropriate before resizes */
-            TEST_ASSERT(client.ssl.out_buf_len == MBEDTLS_SSL_OUT_BUFFER_LEN);
-            TEST_ASSERT(client.ssl.in_buf_len == MBEDTLS_SSL_IN_BUFFER_LEN);
-        }
-#endif
-        TEST_ASSERT(ret == 0 ||
-                    ret == MBEDTLS_ERR_SSL_WANT_READ ||
-                    ret == MBEDTLS_ERR_SSL_WANT_WRITE);
-        TEST_ASSERT(server.ssl.renego_status ==
-                    MBEDTLS_SSL_RENEGOTIATION_DONE);
-        TEST_ASSERT(client.ssl.renego_status ==
-                    MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS);
-
-        TEST_ASSERT(exchange_data(&(client.ssl), &(server.ssl)) == 0);
-        TEST_ASSERT(server.ssl.renego_status ==
-                    MBEDTLS_SSL_RENEGOTIATION_DONE);
-        TEST_ASSERT(client.ssl.renego_status ==
-                    MBEDTLS_SSL_RENEGOTIATION_DONE);
-#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
-        /* Validate buffer sizes after renegotiation */
-        if (options->resize_buffers != 0) {
-            TEST_ASSERT(client.ssl.out_buf_len ==
-                        mbedtls_ssl_get_output_buflen(&client.ssl));
-            TEST_ASSERT(client.ssl.in_buf_len ==
-                        mbedtls_ssl_get_input_buflen(&client.ssl));
-            TEST_ASSERT(server.ssl.out_buf_len ==
-                        mbedtls_ssl_get_output_buflen(&server.ssl));
-            TEST_ASSERT(server.ssl.in_buf_len ==
-                        mbedtls_ssl_get_input_buflen(&server.ssl));
-        }
-#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
-    }
-#endif /* MBEDTLS_SSL_RENEGOTIATION */
-
-    TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&client.conf) == &client);
-    TEST_ASSERT(mbedtls_ssl_get_user_data_p(&client.ssl) == &client);
-    TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&server.conf) == &server);
-    TEST_ASSERT(mbedtls_ssl_get_user_data_p(&server.ssl) == &server);
-
-exit:
-    mbedtls_endpoint_free(&client, options->dtls != 0 ? &client_context : NULL);
-    mbedtls_endpoint_free(&server, options->dtls != 0 ? &server_context : NULL);
-#if defined(MBEDTLS_DEBUG_C)
-    if (options->cli_log_fun || options->srv_log_fun) {
-        mbedtls_debug_set_threshold(0);
-    }
-#endif
-#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
-    if (context_buf != NULL) {
-        mbedtls_free(context_buf);
-    }
-#endif
-    USE_PSA_DONE();
-}
-#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
-
-#if defined(MBEDTLS_TEST_HOOKS)
-/*
- * Tweak vector lengths in a TLS 1.3 Certificate message
- *
- * \param[in]       buf    Buffer containing the Certificate message to tweak
- * \param[in]]out]  end    End of the buffer to parse
- * \param           tweak  Tweak identifier (from 1 to the number of tweaks).
- * \param[out]  expected_result  Error code expected from the parsing function
- * \param[out]  args  Arguments of the MBEDTLS_SSL_CHK_BUF_READ_PTR call that
- *                    is expected to fail. All zeroes if no
- *                    MBEDTLS_SSL_CHK_BUF_READ_PTR failure is expected.
- */
-int tweak_tls13_certificate_msg_vector_len(
-    unsigned char *buf, unsigned char **end, int tweak,
-    int *expected_result, mbedtls_ssl_chk_buf_ptr_args *args)
-{
-/*
- * The definition of the tweaks assume that the certificate list contains only
- * one certificate.
- */
-
-/*
- * struct {
- *     opaque cert_data<1..2^24-1>;
- *     Extension extensions<0..2^16-1>;
- * } CertificateEntry;
- *
- * struct {
- *     opaque certificate_request_context<0..2^8-1>;
- *     CertificateEntry certificate_list<0..2^24-1>;
- * } Certificate;
- */
-    unsigned char *p_certificate_request_context_len = buf;
-    size_t certificate_request_context_len = buf[0];
-
-    unsigned char *p_certificate_list_len = buf + 1 + certificate_request_context_len;
-    unsigned char *certificate_list = p_certificate_list_len + 3;
-    size_t certificate_list_len = MBEDTLS_GET_UINT24_BE(p_certificate_list_len, 0);
-
-    unsigned char *p_cert_data_len = certificate_list;
-    unsigned char *cert_data = p_cert_data_len + 3;
-    size_t cert_data_len = MBEDTLS_GET_UINT24_BE(p_cert_data_len, 0);
-
-    unsigned char *p_extensions_len = cert_data + cert_data_len;
-    unsigned char *extensions = p_extensions_len + 2;
-    size_t extensions_len = MBEDTLS_GET_UINT16_BE(p_extensions_len, 0);
-
-    *expected_result = MBEDTLS_ERR_SSL_DECODE_ERROR;
-
-    switch (tweak) {
-        case 1:
-            /* Failure when checking if the certificate request context length and
-             * certificate list length can be read
-             */
-            *end = buf + 3;
-            set_chk_buf_ptr_args(args, buf, *end, 4);
-            break;
-
-        case 2:
-            /* Invalid certificate request context length.
-             */
-            *p_certificate_request_context_len =
-                certificate_request_context_len + 1;
-            reset_chk_buf_ptr_args(args);
-            break;
-
-        case 3:
-            /* Failure when checking if certificate_list data can be read. */
-            MBEDTLS_PUT_UINT24_BE(certificate_list_len + 1,
-                                  p_certificate_list_len, 0);
-            set_chk_buf_ptr_args(args, certificate_list, *end,
-                                 certificate_list_len + 1);
-            break;
-
-        case 4:
-            /* Failure when checking if the cert_data length can be read. */
-            MBEDTLS_PUT_UINT24_BE(2, p_certificate_list_len, 0);
-            set_chk_buf_ptr_args(args, p_cert_data_len, certificate_list + 2, 3);
-            break;
-
-        case 5:
-            /* Failure when checking if cert_data data can be read. */
-            MBEDTLS_PUT_UINT24_BE(certificate_list_len - 3 + 1,
-                                  p_cert_data_len, 0);
-            set_chk_buf_ptr_args(args, cert_data,
-                                 certificate_list + certificate_list_len,
-                                 certificate_list_len - 3 + 1);
-            break;
-
-        case 6:
-            /* Failure when checking if the extensions length can be read. */
-            MBEDTLS_PUT_UINT24_BE(certificate_list_len - extensions_len - 1,
-                                  p_certificate_list_len, 0);
-            set_chk_buf_ptr_args(args, p_extensions_len,
-                                 certificate_list + certificate_list_len - extensions_len - 1, 2);
-            break;
-
-        case 7:
-            /* Failure when checking if extensions data can be read. */
-            MBEDTLS_PUT_UINT16_BE(extensions_len + 1, p_extensions_len, 0);
-
-            set_chk_buf_ptr_args(args, extensions,
-                                 certificate_list + certificate_list_len, extensions_len + 1);
-            break;
-
-        default:
-            return -1;
-    }
-
-    return 0;
-}
-#endif /* MBEDTLS_TEST_HOOKS */
-
-#define ECJPAKE_TEST_PWD        "bla"
-
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
-#define ECJPAKE_TEST_SET_PASSWORD(exp_ret_val)                          \
-    ret = (use_opaque_arg) ?                                            \
-          mbedtls_ssl_set_hs_ecjpake_password_opaque(&ssl, pwd_slot) :    \
-          mbedtls_ssl_set_hs_ecjpake_password(&ssl, pwd_string, pwd_len); \
-    TEST_EQUAL(ret, exp_ret_val)
-#else
-#define ECJPAKE_TEST_SET_PASSWORD(exp_ret_val)                \
-    ret = mbedtls_ssl_set_hs_ecjpake_password(&ssl,            \
-                                              pwd_string, pwd_len);  \
-    TEST_EQUAL(ret, exp_ret_val)
-#endif
-
-#define TEST_AVAILABLE_ECC(tls_id_, group_id_, psa_family_, psa_bits_)   \
-    TEST_EQUAL(mbedtls_ssl_get_ecp_group_id_from_tls_id(tls_id_),       \
-               group_id_);                                           \
-    TEST_EQUAL(mbedtls_ssl_get_tls_id_from_ecp_group_id(group_id_),     \
-               tls_id_);                                             \
-    TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_,       \
-                                                          &psa_family, &psa_bits), PSA_SUCCESS);                \
-    TEST_EQUAL(psa_family_, psa_family);                                 \
-    TEST_EQUAL(psa_bits_, psa_bits);
-
-#define TEST_UNAVAILABLE_ECC(tls_id_, group_id_, psa_family_, psa_bits_) \
-    TEST_EQUAL(mbedtls_ssl_get_ecp_group_id_from_tls_id(tls_id_),       \
-               MBEDTLS_ECP_DP_NONE);                                 \
-    TEST_EQUAL(mbedtls_ssl_get_tls_id_from_ecp_group_id(group_id_),     \
-               0);                                                   \
-    TEST_EQUAL(mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id_,       \
-                                                          &psa_family, &psa_bits), \
-               PSA_ERROR_NOT_SUPPORTED);
-
 /* END_HEADER */
 
 /* BEGIN_DEPENDENCIES
@@ -2550,65 +24,69 @@
 void test_callback_buffer_sanity()
 {
     enum { MSGLEN = 10 };
-    mbedtls_test_buffer buf;
+    mbedtls_test_ssl_buffer buf;
     unsigned char input[MSGLEN];
     unsigned char output[MSGLEN];
 
     memset(input, 0, sizeof(input));
 
     /* Make sure calling put and get on NULL buffer results in error. */
-    TEST_ASSERT(mbedtls_test_buffer_put(NULL, input, sizeof(input))
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(NULL, input, sizeof(input))
                 == -1);
-    TEST_ASSERT(mbedtls_test_buffer_get(NULL, output, sizeof(output))
+    TEST_ASSERT(mbedtls_test_ssl_buffer_get(NULL, output, sizeof(output))
                 == -1);
-    TEST_ASSERT(mbedtls_test_buffer_put(NULL, NULL, sizeof(input)) == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(NULL, NULL, sizeof(input))
+                == -1);
 
-    TEST_ASSERT(mbedtls_test_buffer_put(NULL, NULL, 0) == -1);
-    TEST_ASSERT(mbedtls_test_buffer_get(NULL, NULL, 0) == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(NULL, NULL, 0) == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_get(NULL, NULL, 0) == -1);
 
     /* Make sure calling put and get on a buffer that hasn't been set up results
      * in error. */
-    mbedtls_test_buffer_init(&buf);
+    mbedtls_test_ssl_buffer_init(&buf);
 
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, input, sizeof(input)) == -1);
-    TEST_ASSERT(mbedtls_test_buffer_get(&buf, output, sizeof(output))
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, input, sizeof(input))
                 == -1);
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, NULL, sizeof(input)) == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_get(&buf, output, sizeof(output))
+                == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, NULL, sizeof(input))
+                == -1);
 
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, NULL, 0) == -1);
-    TEST_ASSERT(mbedtls_test_buffer_get(&buf, NULL, 0) == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, NULL, 0) == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_get(&buf, NULL, 0) == -1);
 
     /* Make sure calling put and get on NULL input only results in
      * error if the length is not zero, and that a NULL output is valid for data
      * dropping.
      */
 
-    TEST_ASSERT(mbedtls_test_buffer_setup(&buf, sizeof(input)) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_setup(&buf, sizeof(input)) == 0);
 
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, NULL, sizeof(input)) == -1);
-    TEST_ASSERT(mbedtls_test_buffer_get(&buf, NULL, sizeof(output))
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, NULL, sizeof(input))
+                == -1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_get(&buf, NULL, sizeof(output))
                 == 0);
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, NULL, 0) == 0);
-    TEST_ASSERT(mbedtls_test_buffer_get(&buf, NULL, 0) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, NULL, 0) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_get(&buf, NULL, 0) == 0);
 
     /* Make sure calling put several times in the row is safe */
 
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, input, sizeof(input))
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, input, sizeof(input))
                 == sizeof(input));
-    TEST_ASSERT(mbedtls_test_buffer_get(&buf, output, 2) == 2);
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, input, 1) == 1);
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, input, 2) == 1);
-    TEST_ASSERT(mbedtls_test_buffer_put(&buf, input, 2) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_get(&buf, output, 2) == 2);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, input, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, input, 2) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_put(&buf, input, 2) == 0);
 
 
 exit:
 
-    mbedtls_test_buffer_free(&buf);
+    mbedtls_test_ssl_buffer_free(&buf);
 }
 /* END_CASE */
 
 /*
- * Test if the implementation of `mbedtls_test_buffer` related functions is
+ * Test if the implementation of `mbedtls_test_ssl_buffer` related functions is
  * correct and works as expected.
  *
  * That is
@@ -2630,15 +108,15 @@
     int put_ret[ROUNDS];
     size_t get[ROUNDS];
     int get_ret[ROUNDS];
-    mbedtls_test_buffer buf;
+    mbedtls_test_ssl_buffer buf;
     unsigned char *input = NULL;
     size_t input_len;
     unsigned char *output = NULL;
     size_t output_len;
     size_t i, j, written, read;
 
-    mbedtls_test_buffer_init(&buf);
-    TEST_ASSERT(mbedtls_test_buffer_setup(&buf, size) == 0);
+    mbedtls_test_ssl_buffer_init(&buf);
+    TEST_ASSERT(mbedtls_test_ssl_buffer_setup(&buf, size) == 0);
 
     /* Check the sanity of input parameters and initialise local variables. That
      * is, ensure that the amount of data is not negative and that we are not
@@ -2697,11 +175,11 @@
 
     written = read = 0;
     for (j = 0; j < ROUNDS; j++) {
-        TEST_ASSERT(put_ret[j] == mbedtls_test_buffer_put(&buf,
-                                                          input + written, put[j]));
+        TEST_ASSERT(put_ret[j] == mbedtls_test_ssl_buffer_put(&buf,
+                                                              input + written, put[j]));
         written += put_ret[j];
-        TEST_ASSERT(get_ret[j] == mbedtls_test_buffer_get(&buf,
-                                                          output + read, get[j]));
+        TEST_ASSERT(get_ret[j] == mbedtls_test_ssl_buffer_get(&buf,
+                                                              output + read, get[j]));
         read += get_ret[j];
         TEST_ASSERT(read <= written);
         if (get_ret[j] > 0) {
@@ -2715,13 +193,13 @@
 
     mbedtls_free(input);
     mbedtls_free(output);
-    mbedtls_test_buffer_free(&buf);
+    mbedtls_test_ssl_buffer_free(&buf);
 }
 /* END_CASE */
 
 /*
- * Test if the implementation of `mbedtls_mock_socket` related I/O functions is
- * correct and works as expected on unconnected sockets.
+ * Test if the implementation of `mbedtls_test_mock_socket` related
+ * I/O functions is correct and works as expected on unconnected sockets.
  */
 
 /* BEGIN_CASE */
@@ -2730,31 +208,31 @@
     enum { MSGLEN = 105 };
     unsigned char message[MSGLEN] = { 0 };
     unsigned char received[MSGLEN] = { 0 };
-    mbedtls_mock_socket socket;
+    mbedtls_test_mock_socket socket;
 
     mbedtls_mock_socket_init(&socket);
-    TEST_ASSERT(mbedtls_mock_tcp_send_b(&socket, message, MSGLEN) < 0);
-    mbedtls_mock_socket_close(&socket);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_b(&socket, message, MSGLEN) < 0);
+    mbedtls_test_mock_socket_close(&socket);
     mbedtls_mock_socket_init(&socket);
-    TEST_ASSERT(mbedtls_mock_tcp_recv_b(&socket, received, MSGLEN) < 0);
-    mbedtls_mock_socket_close(&socket);
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_b(&socket, received, MSGLEN) < 0);
+    mbedtls_test_mock_socket_close(&socket);
 
     mbedtls_mock_socket_init(&socket);
-    TEST_ASSERT(mbedtls_mock_tcp_send_nb(&socket, message, MSGLEN) < 0);
-    mbedtls_mock_socket_close(&socket);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_nb(&socket, message, MSGLEN) < 0);
+    mbedtls_test_mock_socket_close(&socket);
     mbedtls_mock_socket_init(&socket);
-    TEST_ASSERT(mbedtls_mock_tcp_recv_nb(&socket, received, MSGLEN) < 0);
-    mbedtls_mock_socket_close(&socket);
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_nb(&socket, received, MSGLEN) < 0);
+    mbedtls_test_mock_socket_close(&socket);
 
 exit:
 
-    mbedtls_mock_socket_close(&socket);
+    mbedtls_test_mock_socket_close(&socket);
 }
 /* END_CASE */
 
 /*
- * Test if the implementation of `mbedtls_mock_socket` related functions can
- * send a single message from the client to the server.
+ * Test if the implementation of `mbedtls_test_mock_socket` related functions
+ * can send a single message from the client to the server.
  */
 
 /* BEGIN_CASE */
@@ -2764,8 +242,8 @@
     enum { BUFLEN = MSGLEN / 5 };
     unsigned char message[MSGLEN];
     unsigned char received[MSGLEN];
-    mbedtls_mock_socket client;
-    mbedtls_mock_socket server;
+    mbedtls_test_mock_socket client;
+    mbedtls_test_mock_socket server;
     size_t written, read;
     int send_ret, recv_ret;
     mbedtls_ssl_send_t *send;
@@ -2773,11 +251,11 @@
     unsigned i;
 
     if (blocking == 0) {
-        send = mbedtls_mock_tcp_send_nb;
-        recv = mbedtls_mock_tcp_recv_nb;
+        send = mbedtls_test_mock_tcp_send_nb;
+        recv = mbedtls_test_mock_tcp_recv_nb;
     } else {
-        send = mbedtls_mock_tcp_send_b;
-        recv = mbedtls_mock_tcp_recv_b;
+        send = mbedtls_test_mock_tcp_send_b;
+        recv = mbedtls_test_mock_tcp_recv_b;
     }
 
     mbedtls_mock_socket_init(&client);
@@ -2790,7 +268,8 @@
     }
 
     /* Make sure that sending a message takes a few  iterations. */
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server, BUFLEN));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      BUFLEN));
 
     /* Send the message to the server */
     send_ret = recv_ret = 1;
@@ -2840,14 +319,14 @@
 
 exit:
 
-    mbedtls_mock_socket_close(&client);
-    mbedtls_mock_socket_close(&server);
+    mbedtls_test_mock_socket_close(&client);
+    mbedtls_test_mock_socket_close(&server);
 }
 /* END_CASE */
 
 /*
- * Test if the implementation of `mbedtls_mock_socket` related functions can
- * send messages in both direction at the same time (with the I/O calls
+ * Test if the implementation of `mbedtls_test_mock_socket` related functions
+ * can send messages in both direction at the same time (with the I/O calls
  * interleaving).
  */
 
@@ -2859,8 +338,8 @@
     enum { BUFLEN = MSGLEN / 5 };
     unsigned char message[ROUNDS][MSGLEN];
     unsigned char received[ROUNDS][MSGLEN];
-    mbedtls_mock_socket client;
-    mbedtls_mock_socket server;
+    mbedtls_test_mock_socket client;
+    mbedtls_test_mock_socket server;
     size_t written[ROUNDS];
     size_t read[ROUNDS];
     int send_ret[ROUNDS];
@@ -2870,11 +349,11 @@
     mbedtls_ssl_recv_t *recv;
 
     if (blocking == 0) {
-        send = mbedtls_mock_tcp_send_nb;
-        recv = mbedtls_mock_tcp_recv_nb;
+        send = mbedtls_test_mock_tcp_send_nb;
+        recv = mbedtls_test_mock_tcp_recv_nb;
     } else {
-        send = mbedtls_mock_tcp_send_b;
-        recv = mbedtls_mock_tcp_recv_b;
+        send = mbedtls_test_mock_tcp_send_b;
+        recv = mbedtls_test_mock_tcp_recv_b;
     }
 
     mbedtls_mock_socket_init(&client);
@@ -2889,7 +368,8 @@
     }
 
     /* Make sure that sending a message takes a few  iterations. */
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server, BUFLEN));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      BUFLEN));
 
     /* Send the message from both sides, interleaving. */
     progress = 1;
@@ -2900,7 +380,7 @@
     /* This loop does not stop as long as there was a successful write or read
      * of at least one byte on either side. */
     while (progress != 0) {
-        mbedtls_mock_socket *socket;
+        mbedtls_test_mock_socket *socket;
 
         for (i = 0; i < ROUNDS; i++) {
             /* First sending is from the client */
@@ -2967,134 +447,134 @@
 
 exit:
 
-    mbedtls_mock_socket_close(&client);
-    mbedtls_mock_socket_close(&server);
+    mbedtls_test_mock_socket_close(&client);
+    mbedtls_test_mock_socket_close(&server);
 }
 /* END_CASE */
 
 /* BEGIN_CASE */
 void ssl_message_queue_sanity()
 {
-    mbedtls_test_message_queue queue;
+    mbedtls_test_ssl_message_queue queue;
 
     /* Trying to push/pull to an empty queue */
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(NULL, 1)
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(NULL, 1)
                 == MBEDTLS_TEST_ERROR_ARG_NULL);
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(NULL, 1)
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(NULL, 1)
                 == MBEDTLS_TEST_ERROR_ARG_NULL);
 
-    TEST_ASSERT(mbedtls_test_message_queue_setup(&queue, 3) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_setup(&queue, 3) == 0);
     TEST_ASSERT(queue.capacity == 3);
     TEST_ASSERT(queue.num == 0);
 
 exit:
-    mbedtls_test_message_queue_free(&queue);
+    mbedtls_test_ssl_message_queue_free(&queue);
 }
 /* END_CASE */
 
 /* BEGIN_CASE */
 void ssl_message_queue_basic()
 {
-    mbedtls_test_message_queue queue;
+    mbedtls_test_ssl_message_queue queue;
 
-    TEST_ASSERT(mbedtls_test_message_queue_setup(&queue, 3) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_setup(&queue, 3) == 0);
 
     /* Sanity test - 3 pushes and 3 pops with sufficient space */
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 1) == 1);
     TEST_ASSERT(queue.capacity == 3);
     TEST_ASSERT(queue.num == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 1) == 1);
     TEST_ASSERT(queue.capacity == 3);
     TEST_ASSERT(queue.num == 2);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 2) == 2);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 2) == 2);
     TEST_ASSERT(queue.capacity == 3);
     TEST_ASSERT(queue.num == 3);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 2) == 2);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 2) == 2);
 
 exit:
-    mbedtls_test_message_queue_free(&queue);
+    mbedtls_test_ssl_message_queue_free(&queue);
 }
 /* END_CASE */
 
 /* BEGIN_CASE */
 void ssl_message_queue_overflow_underflow()
 {
-    mbedtls_test_message_queue queue;
+    mbedtls_test_ssl_message_queue queue;
 
-    TEST_ASSERT(mbedtls_test_message_queue_setup(&queue, 3) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_setup(&queue, 3) == 0);
 
     /* 4 pushes (last one with an error), 4 pops (last one with an error) */
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 2) == 2);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 3)
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 2) == 2);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 3)
                 == MBEDTLS_ERR_SSL_WANT_WRITE);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 2) == 2);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 2) == 2);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 1)
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 1)
                 == MBEDTLS_ERR_SSL_WANT_READ);
 
 exit:
-    mbedtls_test_message_queue_free(&queue);
+    mbedtls_test_ssl_message_queue_free(&queue);
 }
 /* END_CASE */
 
 /* BEGIN_CASE */
 void ssl_message_queue_interleaved()
 {
-    mbedtls_test_message_queue queue;
+    mbedtls_test_ssl_message_queue queue;
 
-    TEST_ASSERT(mbedtls_test_message_queue_setup(&queue, 3) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_setup(&queue, 3) == 0);
 
     /* Interleaved test - [2 pushes, 1 pop] twice, and then two pops
      * (to wrap around the buffer) */
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 1) == 1);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 1) == 1);
 
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 2) == 2);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 3) == 3);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 2) == 2);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 3) == 3);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 1) == 1);
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 2) == 2);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 1) == 1);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 2) == 2);
 
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 5) == 5);
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, 8) == 8);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 5) == 5);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, 8) == 8);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 3) == 3);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 3) == 3);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 5) == 5);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 5) == 5);
 
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, 8) == 8);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, 8) == 8);
 
 exit:
-    mbedtls_test_message_queue_free(&queue);
+    mbedtls_test_ssl_message_queue_free(&queue);
 }
 /* END_CASE */
 
 /* BEGIN_CASE */
 void ssl_message_queue_insufficient_buffer()
 {
-    mbedtls_test_message_queue queue;
+    mbedtls_test_ssl_message_queue queue;
     size_t message_len = 10;
     size_t buffer_len = 5;
 
-    TEST_ASSERT(mbedtls_test_message_queue_setup(&queue, 1) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_setup(&queue, 1) == 0);
 
     /* Popping without a sufficient buffer */
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&queue, message_len)
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&queue, message_len)
                 == (int) message_len);
-    TEST_ASSERT(mbedtls_test_message_queue_pop_info(&queue, buffer_len)
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_pop_info(&queue, buffer_len)
                 == (int) buffer_len);
 exit:
-    mbedtls_test_message_queue_free(&queue);
+    mbedtls_test_ssl_message_queue_free(&queue);
 }
 /* END_CASE */
 
@@ -3103,44 +583,50 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN] = { 0 }, received[MSGLEN];
-    mbedtls_mock_socket client, server;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_mock_socket client, server;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
     /* Send with a NULL context */
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(NULL, message, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(NULL, message, MSGLEN)
                 == MBEDTLS_TEST_ERROR_CONTEXT_ERROR);
 
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(NULL, message, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(NULL, message, MSGLEN)
                 == MBEDTLS_TEST_ERROR_CONTEXT_ERROR);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 1,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 1,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 1,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 1,
+                                                  &client,
+                                                  &client_context) == 0);
 
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN)
                 == MBEDTLS_TEST_ERROR_SEND_FAILED);
 
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MBEDTLS_ERR_SSL_WANT_READ);
 
     /* Push directly to a queue to later simulate a disconnected behavior */
-    TEST_ASSERT(mbedtls_test_message_queue_push_info(&server_queue, MSGLEN)
+    TEST_ASSERT(mbedtls_test_ssl_message_queue_push_info(&server_queue,
+                                                         MSGLEN)
                 == MSGLEN);
 
     /* Test if there's an error when trying to read from a disconnected
      * socket */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MBEDTLS_TEST_ERROR_RECV_FAILED);
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3149,52 +635,57 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN], received[MSGLEN];
-    mbedtls_mock_socket client, server;
+    mbedtls_test_mock_socket client, server;
     unsigned i;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 1,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 1,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 1,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 1,
+                                                  &client,
+                                                  &client_context) == 0);
 
     /* Fill up the buffer with structured data so that unwanted changes
      * can be detected */
     for (i = 0; i < MSGLEN; i++) {
         message[i] = i & 0xFF;
     }
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server,
-                                                 MSGLEN));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      MSGLEN));
 
     /* Send the message to the server */
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN) == MSGLEN);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN) == MSGLEN);
 
     /* Read from the server */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MSGLEN);
 
     TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
     memset(received, 0, MSGLEN);
 
     /* Send the message to the client */
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&server_context, message,
-                                          MSGLEN) == MSGLEN);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&server_context, message,
+                                               MSGLEN)
+                == MSGLEN);
 
     /* Read from the client */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&client_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&client_context, received,
+                                               MSGLEN)
                 == MSGLEN);
     TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
 
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3203,55 +694,62 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN], received[MSGLEN];
-    mbedtls_mock_socket client, server;
+    mbedtls_test_mock_socket client, server;
     unsigned i;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 2,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 2,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 2,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 2,
+                                                  &client,
+                                                  &client_context) == 0);
 
     /* Fill up the buffer with structured data so that unwanted changes
      * can be detected */
     for (i = 0; i < MSGLEN; i++) {
         message[i] = i & 0xFF;
     }
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server,
-                                                 MSGLEN*2));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      MSGLEN*2));
 
     /* Send three message to the server, last one with an error */
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN - 1) == MSGLEN - 1);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN - 1)
+                == MSGLEN - 1);
 
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN) == MSGLEN);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN)
+                == MSGLEN);
 
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN)
                 == MBEDTLS_ERR_SSL_WANT_WRITE);
 
     /* Read three messages from the server, last one with an error */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received,
-                                          MSGLEN - 1) == MSGLEN - 1);
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN - 1)
+                == MSGLEN - 1);
 
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MSGLEN);
 
     TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
 
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MBEDTLS_ERR_SSL_WANT_READ);
 
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3260,46 +758,50 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN], received[MSGLEN];
-    mbedtls_mock_socket client, server;
+    mbedtls_test_mock_socket client, server;
     unsigned i;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 2,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 2,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 2,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 2,
+                                                  &client,
+                                                  &client_context) == 0);
 
     /* Fill up the buffer with structured data so that unwanted changes
      * can be detected */
     for (i = 0; i < MSGLEN; i++) {
         message[i] = i & 0xFF;
     }
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server,
-                                                 MSGLEN));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      MSGLEN));
 
     /* Send two message to the server, second one with an error */
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN) == MSGLEN);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN)
+                == MSGLEN);
 
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN)
                 == MBEDTLS_TEST_ERROR_SEND_FAILED);
 
     /* Read the only message from the server */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MSGLEN);
 
     TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
 
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3308,20 +810,22 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN], received[MSGLEN];
-    mbedtls_mock_socket client, server;
+    mbedtls_test_mock_socket client, server;
     unsigned i;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 2,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 2,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 2,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 2,
+                                                  &client,
+                                                  &client_context) == 0);
 
     memset(received, 0, MSGLEN);
     /* Fill up the buffer with structured data so that unwanted changes
@@ -3329,17 +833,20 @@
     for (i = 0; i < MSGLEN; i++) {
         message[i] = i & 0xFF;
     }
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server,
-                                                 2 * MSGLEN));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      2 * MSGLEN));
 
     /* Send two messages to the server, the second one small enough to fit in the
      * receiver's buffer. */
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN) == MSGLEN);
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN / 2) == MSGLEN / 2);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN)
+                == MSGLEN);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN / 2)
+                == MSGLEN / 2);
     /* Read a truncated message from the server */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN/2)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN/2)
                 == MSGLEN/2);
 
     /* Test that the first half of the message is valid, and second one isn't */
@@ -3349,15 +856,16 @@
     memset(received, 0, MSGLEN);
 
     /* Read a full message from the server */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN/2)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN/2)
                 == MSGLEN / 2);
 
     /* Test that the first half of the message is valid */
     TEST_ASSERT(memcmp(message, received, MSGLEN/2) == 0);
 
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3366,35 +874,39 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN], received[MSGLEN];
-    mbedtls_mock_socket client, server;
+    mbedtls_test_mock_socket client, server;
     unsigned i;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 1,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 1,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 1,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 1,
+                                                  &client,
+                                                  &client_context) == 0);
 
     /* Fill up the buffer with structured data so that unwanted changes
      * can be detected */
     for (i = 0; i < MSGLEN; i++) {
         message[i] = i & 0xFF;
     }
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server,
-                                                 MSGLEN));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      MSGLEN));
 
-    TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                          MSGLEN) == MSGLEN);
+    TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                               MSGLEN)
+                == MSGLEN);
 
     /* Force a read error by disconnecting the socket by hand */
     server.status = 0;
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MBEDTLS_TEST_ERROR_RECV_FAILED);
     /* Return to a valid state */
     server.status = MBEDTLS_MOCK_SOCKET_CONNECTED;
@@ -3403,14 +915,15 @@
 
     /* Test that even though the server tried to read once disconnected, the
      * continuity is preserved */
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MSGLEN);
 
     TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
 
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3419,55 +932,58 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN], received[MSGLEN];
-    mbedtls_mock_socket client, server;
+    mbedtls_test_mock_socket client, server;
     unsigned i;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 3,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 3,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 3,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 3,
+                                                  &client,
+                                                  &client_context) == 0);
 
     /* Fill up the buffer with structured data so that unwanted changes
      * can be detected */
     for (i = 0; i < MSGLEN; i++) {
         message[i] = i & 0xFF;
     }
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server,
-                                                 MSGLEN*3));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      MSGLEN*3));
 
     /* Interleaved test - [2 sends, 1 read] twice, and then two reads
      * (to wrap around the buffer) */
     for (i = 0; i < 2; i++) {
-        TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                                   MSGLEN) == MSGLEN);
 
-        TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                                   MSGLEN) == MSGLEN);
 
-        TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                                   MSGLEN) == MSGLEN);
         TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
         memset(received, 0, sizeof(received));
     }
 
     for (i = 0; i < 2; i++) {
-        TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                                   MSGLEN) == MSGLEN);
 
         TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
     }
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MBEDTLS_ERR_SSL_WANT_READ);
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3476,53 +992,55 @@
 {
     enum { MSGLEN = 10 };
     unsigned char message[MSGLEN], received[MSGLEN];
-    mbedtls_mock_socket client, server;
+    mbedtls_test_mock_socket client, server;
     unsigned i;
-    mbedtls_test_message_queue server_queue, client_queue;
+    mbedtls_test_ssl_message_queue server_queue, client_queue;
     mbedtls_test_message_socket_context server_context, client_context;
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&server_queue, &client_queue, 3,
-                                             &server,
-                                             &server_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&server_queue,
+                                                  &client_queue, 3,
+                                                  &server,
+                                                  &server_context) == 0);
 
-    TEST_ASSERT(mbedtls_message_socket_setup(&client_queue, &server_queue, 3,
-                                             &client,
-                                             &client_context) == 0);
+    TEST_ASSERT(mbedtls_test_message_socket_setup(&client_queue,
+                                                  &server_queue, 3,
+                                                  &client,
+                                                  &client_context) == 0);
 
     /* Fill up the buffer with structured data so that unwanted changes
      * can be detected */
     for (i = 0; i < MSGLEN; i++) {
         message[i] = i & 0xFF;
     }
-    TEST_ASSERT(0 == mbedtls_mock_socket_connect(&client, &server,
-                                                 MSGLEN*3));
+    TEST_ASSERT(0 == mbedtls_test_mock_socket_connect(&client, &server,
+                                                      MSGLEN*3));
 
     /* Interleaved test - [2 sends, 1 read] twice, both ways, and then two reads
      * (to wrap around the buffer) both ways. */
     for (i = 0; i < 2; i++) {
-        TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                                   MSGLEN) == MSGLEN);
 
-        TEST_ASSERT(mbedtls_mock_tcp_send_msg(&client_context, message,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&client_context, message,
+                                                   MSGLEN) == MSGLEN);
 
-        TEST_ASSERT(mbedtls_mock_tcp_send_msg(&server_context, message,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&server_context, message,
+                                                   MSGLEN) == MSGLEN);
 
-        TEST_ASSERT(mbedtls_mock_tcp_send_msg(&server_context, message,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_send_msg(&server_context, message,
+                                                   MSGLEN) == MSGLEN);
 
-        TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                                   MSGLEN) == MSGLEN);
 
         TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
 
         memset(received, 0, sizeof(received));
 
-        TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&client_context, received,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&client_context, received,
+                                                   MSGLEN) == MSGLEN);
 
         TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
 
@@ -3530,27 +1048,29 @@
     }
 
     for (i = 0; i < 2; i++) {
-        TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                                   MSGLEN) == MSGLEN);
 
         TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
         memset(received, 0, sizeof(received));
 
-        TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&client_context, received,
-                                              MSGLEN) == MSGLEN);
+        TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&client_context, received,
+                                                   MSGLEN) == MSGLEN);
 
         TEST_ASSERT(memcmp(message, received, MSGLEN) == 0);
         memset(received, 0, sizeof(received));
     }
 
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&server_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&server_context, received,
+                                               MSGLEN)
                 == MBEDTLS_ERR_SSL_WANT_READ);
 
-    TEST_ASSERT(mbedtls_mock_tcp_recv_msg(&client_context, received, MSGLEN)
+    TEST_ASSERT(mbedtls_test_mock_tcp_recv_msg(&client_context, received,
+                                               MSGLEN)
                 == MBEDTLS_ERR_SSL_WANT_READ);
 exit:
-    mbedtls_message_socket_close(&server_context);
-    mbedtls_message_socket_close(&client_context);
+    mbedtls_test_message_socket_close(&server_context);
+    mbedtls_test_message_socket_close(&client_context);
 }
 /* END_CASE */
 
@@ -3623,10 +1143,10 @@
     mbedtls_ssl_init(&ssl);
     mbedtls_ssl_transform_init(&t0);
     mbedtls_ssl_transform_init(&t1);
-    ret = build_transforms(&t0, &t1, cipher_type, hash_id,
-                           etm, tag_mode, ver,
-                           (size_t) cid0_len,
-                           (size_t) cid1_len);
+    ret = mbedtls_test_ssl_build_transforms(&t0, &t1, cipher_type, hash_id,
+                                            etm, tag_mode, ver,
+                                            (size_t) cid0_len,
+                                            (size_t) cid1_len);
 
     TEST_ASSERT(ret == 0);
 
@@ -3777,10 +1297,10 @@
     mbedtls_ssl_init(&ssl);
     mbedtls_ssl_transform_init(&t0);
     mbedtls_ssl_transform_init(&t1);
-    ret = build_transforms(&t0, &t1, cipher_type, hash_id,
-                           etm, tag_mode, ver,
-                           (size_t) cid0_len,
-                           (size_t) cid1_len);
+    ret = mbedtls_test_ssl_build_transforms(&t0, &t1, cipher_type, hash_id,
+                                            etm, tag_mode, ver,
+                                            (size_t) cid0_len,
+                                            (size_t) cid1_len);
 
     TEST_ASSERT(ret == 0);
 
@@ -3940,10 +1460,10 @@
     mbedtls_ssl_transform_init(&t1);
 
     /* Set up transforms with dummy keys */
-    ret = build_transforms(&t0, &t1, cipher_type, hash_id,
-                           0, trunc_hmac,
-                           MBEDTLS_SSL_VERSION_TLS1_2,
-                           0, 0);
+    ret = mbedtls_test_ssl_build_transforms(&t0, &t1, cipher_type, hash_id,
+                                            0, trunc_hmac,
+                                            MBEDTLS_SSL_VERSION_TLS1_2,
+                                            0, 0);
 
     TEST_ASSERT(ret == 0);
 
@@ -4044,9 +1564,9 @@
     /*
      * Encrypt and decrypt the correct record, expecting success
      */
-    TEST_EQUAL(0, psa_cipher_encrypt_helper(&t0, t0.iv_enc, t0.ivlen,
-                                            rec.buf + rec.data_offset, rec.data_len,
-                                            rec.buf + rec.data_offset, &olen));
+    TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
+                   &t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
+                   rec.data_len, rec.buf + rec.data_offset, &olen));
     rec.data_offset -= t0.ivlen;
     rec.data_len    += t0.ivlen;
 
@@ -4068,9 +1588,9 @@
         rec.buf[i] ^= 0x01;
 
         /* Encrypt */
-        TEST_EQUAL(0, psa_cipher_encrypt_helper(&t0, t0.iv_enc, t0.ivlen,
-                                                rec.buf + rec.data_offset, rec.data_len,
-                                                rec.buf + rec.data_offset, &olen));
+        TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
+                       &t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
+                       rec.data_len, rec.buf + rec.data_offset, &olen));
         rec.data_offset -= t0.ivlen;
         rec.data_len    += t0.ivlen;
 
@@ -4103,9 +1623,9 @@
         memset(buf + buflen - padlen - 1, i, padlen + 1);
 
         /* Encrypt */
-        TEST_EQUAL(0, psa_cipher_encrypt_helper(&t0, t0.iv_enc, t0.ivlen,
-                                                rec.buf + rec.data_offset, rec.data_len,
-                                                rec.buf + rec.data_offset, &olen));
+        TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
+                       &t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
+                       rec.data_len, rec.buf + rec.data_offset, &olen));
         rec.data_offset -= t0.ivlen;
         rec.data_len    += t0.ivlen;
 
@@ -4181,10 +1701,12 @@
 
     /* Check sanity of test parameters. */
     TEST_ASSERT(client_secret->len == server_secret->len);
-    TEST_ASSERT(expected_client_write_iv->len == expected_server_write_iv->len &&
-                expected_client_write_iv->len == (size_t) desired_iv_len);
-    TEST_ASSERT(expected_client_write_key->len == expected_server_write_key->len &&
-                expected_client_write_key->len == (size_t) desired_key_len);
+    TEST_ASSERT(
+        expected_client_write_iv->len == expected_server_write_iv->len &&
+        expected_client_write_iv->len == (size_t) desired_iv_len);
+    TEST_ASSERT(
+        expected_client_write_key->len == expected_server_write_key->len &&
+        expected_client_write_key->len == (size_t) desired_key_len);
 
     PSA_INIT();
 
@@ -4598,12 +2120,12 @@
     ((void) tls_version);
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
-        TEST_ASSERT(ssl_tls13_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls13_populate_session(
                         &original, 0, endpoint_type) == 0);
     } else
 #endif
     {
-        TEST_ASSERT(ssl_tls12_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls12_populate_session(
                         &original, ticket_len, crt_file) == 0);
     }
 
@@ -4745,12 +2267,12 @@
     ((void) tls_version);
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
-        TEST_ASSERT(ssl_tls13_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls13_populate_session(
                         &session, 0, endpoint_type) == 0);
     } else
 #endif
     {
-        TEST_ASSERT(ssl_tls12_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls12_populate_session(
                         &session, ticket_len, crt_file) == 0);
     }
 
@@ -4807,12 +2329,12 @@
     ((void) tls_version);
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
-        TEST_ASSERT(ssl_tls13_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls13_populate_session(
                         &session, 0, endpoint_type) == 0);
     } else
 #endif
     {
-        TEST_ASSERT(ssl_tls12_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls12_populate_session(
                         &session, ticket_len, crt_file) == 0);
     }
     TEST_ASSERT(mbedtls_ssl_session_save(&session, NULL, 0, &good_len)
@@ -4854,12 +2376,12 @@
     ((void) tls_version);
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
-        TEST_ASSERT(ssl_tls13_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls13_populate_session(
                         &session, 0, endpoint_type) == 0);
     } else
 #endif
     {
-        TEST_ASSERT(ssl_tls12_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls12_populate_session(
                         &session, ticket_len, crt_file) == 0);
     }
     TEST_ASSERT(mbedtls_ssl_session_save(&session, NULL, 0, &good_len)
@@ -4911,11 +2433,12 @@
     ((void) tls_version);
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
-        TEST_ASSERT(ssl_tls13_populate_session(
+        TEST_ASSERT(mbedtls_test_ssl_tls13_populate_session(
                         &session, 0, endpoint_type) == 0);
     } else
 #endif
-    TEST_ASSERT(ssl_tls12_populate_session(&session, 0, NULL) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_tls12_populate_session(
+                    &session, 0, NULL) == 0);
 
 
     /* Infer length of serialized session. */
@@ -4966,26 +2489,27 @@
 void mbedtls_endpoint_sanity(int endpoint_type)
 {
     enum { BUFFSIZE = 1024 };
-    mbedtls_endpoint ep;
+    mbedtls_test_ssl_endpoint ep;
     int ret = -1;
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
     options.pk_alg = MBEDTLS_PK_RSA;
 
-    ret = mbedtls_endpoint_init(NULL, endpoint_type, &options,
-                                NULL, NULL, NULL, NULL);
+    ret = mbedtls_test_ssl_endpoint_init(NULL, endpoint_type, &options,
+                                         NULL, NULL, NULL, NULL);
     TEST_ASSERT(MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret);
 
-    ret = mbedtls_endpoint_certificate_init(NULL, options.pk_alg, 0, 0, 0);
+    ret = mbedtls_test_ssl_endpoint_certificate_init(NULL, options.pk_alg,
+                                                     0, 0, 0);
     TEST_ASSERT(MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret);
 
-    ret = mbedtls_endpoint_init(&ep, endpoint_type, &options,
-                                NULL, NULL, NULL, NULL);
+    ret = mbedtls_test_ssl_endpoint_init(&ep, endpoint_type, &options,
+                                         NULL, NULL, NULL, NULL);
     TEST_ASSERT(ret == 0);
 
 exit:
-    mbedtls_endpoint_free(&ep, NULL);
-    free_handshake_options(&options);
+    mbedtls_test_ssl_endpoint_free(&ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
@@ -4993,35 +2517,36 @@
 void move_handshake_to_state(int endpoint_type, int state, int need_pass)
 {
     enum { BUFFSIZE = 1024 };
-    mbedtls_endpoint base_ep, second_ep;
+    mbedtls_test_ssl_endpoint base_ep, second_ep;
     int ret = -1;
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
     options.pk_alg = MBEDTLS_PK_RSA;
 
     USE_PSA_INIT();
     mbedtls_platform_zeroize(&base_ep, sizeof(base_ep));
     mbedtls_platform_zeroize(&second_ep, sizeof(second_ep));
 
-    ret = mbedtls_endpoint_init(&base_ep, endpoint_type, &options,
-                                NULL, NULL, NULL, NULL);
+    ret = mbedtls_test_ssl_endpoint_init(&base_ep, endpoint_type, &options,
+                                         NULL, NULL, NULL, NULL);
     TEST_ASSERT(ret == 0);
 
-    ret = mbedtls_endpoint_init(&second_ep,
-                                (endpoint_type == MBEDTLS_SSL_IS_SERVER) ?
-                                MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER,
-                                &options, NULL, NULL, NULL, NULL);
+    ret = mbedtls_test_ssl_endpoint_init(
+        &second_ep,
+        (endpoint_type == MBEDTLS_SSL_IS_SERVER) ?
+        MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER,
+        &options, NULL, NULL, NULL, NULL);
 
     TEST_ASSERT(ret == 0);
 
-    ret = mbedtls_mock_socket_connect(&(base_ep.socket),
-                                      &(second_ep.socket),
-                                      BUFFSIZE);
+    ret = mbedtls_test_mock_socket_connect(&(base_ep.socket),
+                                           &(second_ep.socket),
+                                           BUFFSIZE);
     TEST_ASSERT(ret == 0);
 
-    ret = mbedtls_move_handshake_to_state(&(base_ep.ssl),
-                                          &(second_ep.ssl),
-                                          state);
+    ret = mbedtls_test_move_handshake_to_state(&(base_ep.ssl),
+                                               &(second_ep.ssl),
+                                               state);
     if (need_pass) {
         TEST_ASSERT(ret == 0 ||
                     ret == MBEDTLS_ERR_SSL_WANT_READ ||
@@ -5035,9 +2560,9 @@
     }
 
 exit:
-    free_handshake_options(&options);
-    mbedtls_endpoint_free(&base_ep, NULL);
-    mbedtls_endpoint_free(&second_ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
+    mbedtls_test_ssl_endpoint_free(&base_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&second_ep, NULL);
     USE_PSA_DONE();
 }
 /* END_CASE */
@@ -5047,8 +2572,8 @@
                        int server_min_version, int server_max_version,
                        int expected_negotiated_version)
 {
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
 
     options.client_min_version = client_min_version;
     options.client_max_version = client_max_version;
@@ -5057,34 +2582,34 @@
     options.expected_negotiated_version = expected_negotiated_version;
 
     options.dtls = dtls;
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
 
     /* The goto below is used to avoid an "unused label" warning.*/
     goto exit;
 
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
 /* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
 void handshake_psk_cipher(char *cipher, int pk_alg, data_t *psk_str, int dtls)
 {
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
 
     options.cipher = cipher;
     options.dtls = dtls;
     options.psk_str = psk_str;
     options.pk_alg = pk_alg;
 
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
 
     /* The goto below is used to avoid an "unused label" warning.*/
     goto exit;
 
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
@@ -5104,8 +2629,8 @@
                                   int expected_handshake_result,
                                   int expected_ciphersuite)
 {
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
 
     options.cipher = cipher;
     options.psk_str = psk_str;
@@ -5115,13 +2640,13 @@
     options.opaque_usage = psa_usage;
     options.expected_handshake_result = expected_handshake_result;
     options.expected_ciphersuite = expected_ciphersuite;
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
 
     /* The goto below is used to avoid an "unused label" warning.*/
     goto exit;
 
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
@@ -5130,8 +2655,8 @@
               int expected_cli_fragments,
               int expected_srv_fragments, int dtls)
 {
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
 
     options.mfl = mfl;
     options.cli_msg_len = cli_msg_len;
@@ -5143,13 +2668,13 @@
     options.expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_3;
 #endif
 
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
 
     /* The goto below is used to avoid an "unused label" warning.*/
     goto exit;
 
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
@@ -5180,16 +2705,16 @@
 /* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_CONTEXT_SERIALIZATION:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
 void handshake_serialization()
 {
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
 
     options.serialize = 1;
     options.dtls = 1;
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
     /* The goto below is used to avoid an "unused label" warning.*/
     goto exit;
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
@@ -5198,14 +2723,14 @@
                              int expected_srv_hs_fragmentation,
                              int expected_cli_hs_fragmentation)
 {
-    handshake_test_options options;
-    log_pattern srv_pattern, cli_pattern;
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_ssl_log_pattern srv_pattern, cli_pattern;
 
     srv_pattern.pattern = cli_pattern.pattern = "found fragmented DTLS handshake";
     srv_pattern.counter = 0;
     cli_pattern.counter = 0;
 
-    init_handshake_options(&options);
+    mbedtls_test_init_handshake_options(&options);
     options.dtls = 1;
     options.mfl = mfl;
     /* Set cipher to one using CBC so that record splitting can be tested */
@@ -5213,10 +2738,10 @@
     options.srv_auth_mode = MBEDTLS_SSL_VERIFY_REQUIRED;
     options.srv_log_obj = &srv_pattern;
     options.cli_log_obj = &cli_pattern;
-    options.srv_log_fun = log_analyzer;
-    options.cli_log_fun = log_analyzer;
+    options.srv_log_fun = mbedtls_test_ssl_log_analyzer;
+    options.cli_log_fun = mbedtls_test_ssl_log_analyzer;
 
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
 
     /* Test if the server received a fragmented handshake */
     if (expected_srv_hs_fragmentation) {
@@ -5228,26 +2753,26 @@
     }
 
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
 /* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
 void renegotiation(int legacy_renegotiation)
 {
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
 
     options.renegotiate = 1;
     options.legacy_renegotiation = legacy_renegotiation;
     options.dtls = 1;
 
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
 
     /* The goto below is used to avoid an "unused label" warning.*/
     goto exit;
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
@@ -5255,8 +2780,8 @@
 void resize_buffers(int mfl, int renegotiation, int legacy_renegotiation,
                     int serialize, int dtls, char *cipher)
 {
-    handshake_test_options options;
-    init_handshake_options(&options);
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_init_handshake_options(&options);
 
     options.mfl = mfl;
     options.cipher = cipher;
@@ -5266,12 +2791,12 @@
     options.dtls = dtls;
     options.resize_buffers = 1;
 
-    perform_handshake(&options);
+    mbedtls_test_ssl_perform_handshake(&options);
 
     /* The goto below is used to avoid an "unused label" warning.*/
     goto exit;
 exit:
-    free_handshake_options(&options);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */
 
@@ -5465,7 +2990,8 @@
     TEST_ASSERT(ssl.handshake != NULL && ssl.handshake->group_list != NULL);
     TEST_ASSERT(ssl.conf != NULL && ssl.conf->group_list == NULL);
 
-    TEST_EQUAL(ssl.handshake->group_list[ARRAY_LENGTH(iana_tls_group_list) - 1],
+    TEST_EQUAL(ssl.handshake->
+               group_list[ARRAY_LENGTH(iana_tls_group_list) - 1],
                MBEDTLS_SSL_IANA_TLS_GROUP_NONE);
 
     for (size_t i = 0; i < ARRAY_LENGTH(iana_tls_group_list); i++) {
@@ -5499,7 +3025,8 @@
 
     TEST_ASSERT(ssl.conf != NULL && ssl.conf->group_list != NULL);
 
-    TEST_EQUAL(ssl.conf->group_list[ARRAY_LENGTH(iana_tls_group_list) - 1],
+    TEST_EQUAL(ssl.conf->
+               group_list[ARRAY_LENGTH(iana_tls_group_list) - 1],
                MBEDTLS_SSL_IANA_TLS_GROUP_NONE);
 
     for (size_t i = 0; i < ARRAY_LENGTH(iana_tls_group_list); i++) {
@@ -5515,44 +3042,43 @@
 void force_bad_session_id_len()
 {
     enum { BUFFSIZE = 1024 };
-    handshake_test_options options;
-    mbedtls_endpoint client, server;
-    log_pattern srv_pattern, cli_pattern;
+    mbedtls_test_handshake_test_options options;
+    mbedtls_test_ssl_endpoint client, server;
+    mbedtls_test_ssl_log_pattern srv_pattern, cli_pattern;
     mbedtls_test_message_socket_context server_context, client_context;
 
     srv_pattern.pattern = cli_pattern.pattern = "cache did not store session";
     srv_pattern.counter = 0;
-    init_handshake_options(&options);
+    mbedtls_test_init_handshake_options(&options);
 
     options.srv_log_obj = &srv_pattern;
-    options.srv_log_fun = log_analyzer;
+    options.srv_log_fun = mbedtls_test_ssl_log_analyzer;
 
     USE_PSA_INIT();
     mbedtls_platform_zeroize(&client, sizeof(client));
     mbedtls_platform_zeroize(&server, sizeof(server));
 
-    mbedtls_message_socket_init(&server_context);
-    mbedtls_message_socket_init(&client_context);
+    mbedtls_test_message_socket_init(&server_context);
+    mbedtls_test_message_socket_init(&client_context);
 
-    TEST_ASSERT(mbedtls_endpoint_init(&client, MBEDTLS_SSL_IS_CLIENT,
-                                      &options, NULL, NULL,
-                                      NULL, NULL) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_endpoint_init(&client, MBEDTLS_SSL_IS_CLIENT,
+                                               &options, NULL, NULL,
+                                               NULL, NULL) == 0);
 
-    TEST_ASSERT(mbedtls_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER,
-                                      &options, NULL, NULL, NULL,
-                                      NULL) == 0);
+    TEST_ASSERT(mbedtls_test_ssl_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER,
+                                               &options, NULL, NULL, NULL,
+                                               NULL) == 0);
 
     mbedtls_debug_set_threshold(1);
     mbedtls_ssl_conf_dbg(&server.conf, options.srv_log_fun,
                          options.srv_log_obj);
 
-    TEST_ASSERT(mbedtls_mock_socket_connect(&(client.socket),
-                                            &(server.socket),
-                                            BUFFSIZE) == 0);
+    TEST_ASSERT(mbedtls_test_mock_socket_connect(&(client.socket),
+                                                 &(server.socket),
+                                                 BUFFSIZE) == 0);
 
-    TEST_ASSERT(mbedtls_move_handshake_to_state(&(client.ssl),
-                                                &(server.ssl),
-                                                MBEDTLS_SSL_HANDSHAKE_WRAPUP)
+    TEST_ASSERT(mbedtls_test_move_handshake_to_state(
+                    &(client.ssl), &(server.ssl), MBEDTLS_SSL_HANDSHAKE_WRAPUP)
                 ==  0);
     /* Force a bad session_id_len that will be read by the server in
      * mbedtls_ssl_cache_set. */
@@ -5569,9 +3095,9 @@
     /* Make sure that the cache did not store the session */
     TEST_EQUAL(srv_pattern.counter, 1);
 exit:
-    mbedtls_endpoint_free(&client, NULL);
-    mbedtls_endpoint_free(&server, NULL);
-    free_handshake_options(&options);
+    mbedtls_test_ssl_endpoint_free(&client, NULL);
+    mbedtls_test_ssl_endpoint_free(&server, NULL);
+    mbedtls_test_free_handshake_options(&options);
     mbedtls_debug_set_threshold(0);
     USE_PSA_DONE();
 }
@@ -5701,10 +3227,10 @@
 void raw_key_agreement_fail(int bad_server_ecdhe_key)
 {
     enum { BUFFSIZE = 17000 };
-    mbedtls_endpoint client, server;
+    mbedtls_test_ssl_endpoint client, server;
     mbedtls_psa_stats_t stats;
     size_t free_slots_before = -1;
-    handshake_test_options options;
+    mbedtls_test_handshake_test_options options;
 
     uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
                                        MBEDTLS_SSL_IANA_TLS_GROUP_NONE };
@@ -5712,29 +3238,28 @@
     mbedtls_platform_zeroize(&client, sizeof(client));
     mbedtls_platform_zeroize(&server, sizeof(server));
 
-    init_handshake_options(&options);
+    mbedtls_test_init_handshake_options(&options);
     options.pk_alg = MBEDTLS_PK_ECDSA;
 
     /* Client side, force SECP256R1 to make one key bitflip fail
      * the raw key agreement. Flipping the first byte makes the
      * required 0x04 identifier invalid. */
-    TEST_EQUAL(mbedtls_endpoint_init(&client, MBEDTLS_SSL_IS_CLIENT,
-                                     &options, NULL, NULL,
-                                     NULL, iana_tls_group_list), 0);
+    TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client, MBEDTLS_SSL_IS_CLIENT,
+                                              &options, NULL, NULL,
+                                              NULL, iana_tls_group_list), 0);
 
     /* Server side */
-    TEST_EQUAL(mbedtls_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER,
-                                     &options, NULL, NULL,
-                                     NULL, NULL), 0);
+    TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER,
+                                              &options, NULL, NULL,
+                                              NULL, NULL), 0);
 
-    TEST_EQUAL(mbedtls_mock_socket_connect(&(client.socket),
-                                           &(server.socket),
-                                           BUFFSIZE), 0);
+    TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client.socket),
+                                                &(server.socket),
+                                                BUFFSIZE), 0);
 
-    TEST_EQUAL(mbedtls_move_handshake_to_state(&(client.ssl),
-                                               &(server.ssl),
-                                               MBEDTLS_SSL_CLIENT_KEY_EXCHANGE)
-               , 0);
+    TEST_EQUAL(mbedtls_test_move_handshake_to_state(
+                   &(client.ssl), &(server.ssl),
+                   MBEDTLS_SSL_CLIENT_KEY_EXCHANGE), 0);
 
     mbedtls_psa_get_stats(&stats);
     /* Save the number of slots in use up to this point.
@@ -5747,9 +3272,8 @@
         (client.ssl).handshake->ecdh_psa_peerkey[0] ^= 0x02;
     }
 
-    TEST_EQUAL(mbedtls_move_handshake_to_state(&(client.ssl),
-                                               &(server.ssl),
-                                               MBEDTLS_SSL_HANDSHAKE_OVER),
+    TEST_EQUAL(mbedtls_test_move_handshake_to_state(
+                   &(client.ssl), &(server.ssl), MBEDTLS_SSL_HANDSHAKE_OVER),
                bad_server_ecdhe_key ? MBEDTLS_ERR_SSL_HW_ACCEL_FAILED : 0);
 
     mbedtls_psa_get_stats(&stats);
@@ -5761,9 +3285,9 @@
     }
 
 exit:
-    mbedtls_endpoint_free(&client, NULL);
-    mbedtls_endpoint_free(&server, NULL);
-    free_handshake_options(&options);
+    mbedtls_test_ssl_endpoint_free(&client, NULL);
+    mbedtls_test_ssl_endpoint_free(&server, NULL);
+    mbedtls_test_free_handshake_options(&options);
 
     USE_PSA_DONE();
 }
@@ -5772,14 +3296,14 @@
 void tls13_server_certificate_msg_invalid_vector_len()
 {
     int ret = -1;
-    mbedtls_endpoint client_ep, server_ep;
+    mbedtls_test_ssl_endpoint client_ep, server_ep;
     unsigned char *buf, *end;
     size_t buf_len;
     int step = 0;
     int expected_result;
     mbedtls_ssl_chk_buf_ptr_args expected_chk_buf_ptr_args;
-    handshake_test_options client_options;
-    handshake_test_options server_options;
+    mbedtls_test_handshake_test_options client_options;
+    mbedtls_test_handshake_test_options server_options;
 
     /*
      * Test set-up
@@ -5788,36 +3312,38 @@
     mbedtls_platform_zeroize(&client_ep, sizeof(client_ep));
     mbedtls_platform_zeroize(&server_ep, sizeof(server_ep));
 
-    init_handshake_options(&client_options);
+    mbedtls_test_init_handshake_options(&client_options);
     client_options.pk_alg = MBEDTLS_PK_ECDSA;
-    ret = mbedtls_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT,
-                                &client_options, NULL, NULL, NULL, NULL);
+    ret = mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT,
+                                         &client_options, NULL, NULL, NULL,
+                                         NULL);
     TEST_EQUAL(ret, 0);
 
-    init_handshake_options(&server_options);
+    mbedtls_test_init_handshake_options(&server_options);
     server_options.pk_alg = MBEDTLS_PK_ECDSA;
-    ret = mbedtls_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER,
-                                &server_options, NULL, NULL, NULL, NULL);
+    ret = mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER,
+                                         &server_options, NULL, NULL, NULL,
+                                         NULL);
     TEST_EQUAL(ret, 0);
 
-    ret = mbedtls_mock_socket_connect(&(client_ep.socket),
-                                      &(server_ep.socket), 1024);
+    ret = mbedtls_test_mock_socket_connect(&(client_ep.socket),
+                                           &(server_ep.socket), 1024);
     TEST_EQUAL(ret, 0);
 
     while (1) {
         mbedtls_test_set_step(++step);
 
-        ret = mbedtls_move_handshake_to_state(&(server_ep.ssl),
-                                              &(client_ep.ssl),
-                                              MBEDTLS_SSL_CERTIFICATE_VERIFY);
+        ret = mbedtls_test_move_handshake_to_state(
+            &(server_ep.ssl), &(client_ep.ssl),
+            MBEDTLS_SSL_CERTIFICATE_VERIFY);
         TEST_EQUAL(ret, 0);
 
         ret = mbedtls_ssl_flush_output(&(server_ep.ssl));
         TEST_EQUAL(ret, 0);
 
-        ret = mbedtls_move_handshake_to_state(&(client_ep.ssl),
-                                              &(server_ep.ssl),
-                                              MBEDTLS_SSL_SERVER_CERTIFICATE);
+        ret = mbedtls_test_move_handshake_to_state(
+            &(client_ep.ssl), &(server_ep.ssl),
+            MBEDTLS_SSL_SERVER_CERTIFICATE);
         TEST_EQUAL(ret, 0);
 
         ret = mbedtls_ssl_tls13_fetch_handshake_msg(&(client_ep.ssl),
@@ -5855,10 +3381,10 @@
 
 exit:
     mbedtls_ssl_reset_chk_buf_ptr_fail_args();
-    mbedtls_endpoint_free(&client_ep, NULL);
-    mbedtls_endpoint_free(&server_ep, NULL);
-    free_handshake_options(&client_options);
-    free_handshake_options(&server_options);
+    mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
+    mbedtls_test_free_handshake_options(&client_options);
+    mbedtls_test_free_handshake_options(&server_options);
     USE_PSA_DONE();
 }
 /* END_CASE */
diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function
index cd1f203..5e8230f 100644
--- a/tests/suites/test_suite_x509write.function
+++ b/tests/suites/test_suite_x509write.function
@@ -152,6 +152,27 @@
     int der_len = -1;
     const char *subject_name = "C=NL,O=PolarSSL,CN=PolarSSL Server 1";
     mbedtls_test_rnd_pseudo_info rnd_info;
+    mbedtls_x509_san_list san_ip;
+    mbedtls_x509_san_list san_dns;
+    mbedtls_x509_san_list san_uri;
+    mbedtls_x509_san_list *san_list = NULL;
+    const char san_ip_name[] = { 0x7f, 0x01, 0x01, 0x00 }; // 127.1.1.0
+    const char *san_dns_name = "example.com";
+    const char *san_uri_name = "http://pki.example.com/";
+
+    san_uri.node.type = MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER;
+    san_uri.node.san.unstructured_name.p = (unsigned char *) san_uri_name;
+    san_uri.node.san.unstructured_name.len = strlen(san_uri_name);
+    san_uri.next = NULL;
+    san_ip.node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
+    san_ip.node.san.unstructured_name.p = (unsigned char *) san_ip_name;
+    san_ip.node.san.unstructured_name.len = sizeof(san_ip_name);
+    san_ip.next = &san_uri;
+    san_dns.node.type = MBEDTLS_X509_SAN_DNS_NAME;
+    san_dns.node.san.unstructured_name.p = (unsigned char *) san_dns_name;
+    san_dns.node.san.unstructured_name.len = strlen(san_dns_name);
+    san_dns.next = &san_ip;
+    san_list = &san_dns;
 
     memset(&rnd_info, 0x2a, sizeof(mbedtls_test_rnd_pseudo_info));
 
@@ -175,6 +196,8 @@
     if (set_extension != 0) {
         TEST_ASSERT(csr_set_extended_key_usage(&req, MBEDTLS_OID_SERVER_AUTH,
                                                MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH)) == 0);
+
+        TEST_ASSERT(mbedtls_x509write_csr_set_subject_alternative_name(&req, san_list) == 0);
     }
 
     ret = mbedtls_x509write_csr_pem(&req, buf, sizeof(buf),