Merge pull request #326 from igortomiatti/implement-ecdhe-psk

Implementation of ECDHE_PSK cipher suites

6 files changed, 620 insertions, 493 deletions

diff --git a/crypto_libraries/src/nx_crypto_generic_ciphersuites.c b/crypto_libraries/src/nx_crypto_generic_ciphersuites.c
index 78921329..d68ea0cc 100644
--- a/crypto_libraries/src/nx_crypto_generic_ciphersuites.c
+++ b/crypto_libraries/src/nx_crypto_generic_ciphersuites.c
@@ -260,6 +260,8 @@ NX_SECURE_TLS_CIPHERSUITE_INFO _nx_crypto_ciphersuite_lookup_table_ecc[] =
 
 #ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
     {TLS_PSK_WITH_AES_128_CBC_SHA256,         &crypto_method_null,      &crypto_method_auth_psk,  &crypto_method_aes_cbc_128,     16,      16,        &crypto_method_hmac_sha256,     32,        &crypto_method_tls_prf_sha256},
+	{TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,      &crypto_method_ecdhe,     &crypto_method_auth_psk,  &crypto_method_aes_cbc_128,     16,      16,        &crypto_method_hmac_sha1,       20,        &crypto_method_tls_prf_sha256},
+	{TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,      &crypto_method_ecdhe,     &crypto_method_auth_psk,  &crypto_method_aes_cbc_256,     16,      32,        &crypto_method_hmac_sha1,       20,        &crypto_method_tls_prf_sha256},
 #ifdef NX_SECURE_ENABLE_AEAD_CIPHER
     {TLS_PSK_WITH_AES_128_CCM_8,              &crypto_method_null,      &crypto_method_auth_psk,  &crypto_method_aes_ccm_8,       16,      16,        &crypto_method_null,            0,         &crypto_method_tls_prf_sha256},
 #endif
diff --git a/nx_secure/inc/nx_secure_tls.h b/nx_secure/inc/nx_secure_tls.h
index c361f8b6..73deddb1 100644
--- a/nx_secure/inc/nx_secure_tls.h
+++ b/nx_secure/inc/nx_secure_tls.h
@@ -528,6 +528,8 @@ typedef struct NX_SECURE_VERSIONS_LIST_STRUCT
 #define TLS_RSA_WITH_AES_256_GCM_SHA384                    0x009D
 #define TLS_PSK_WITH_AES_128_CBC_SHA256                    0x00AE
 #define TLS_PSK_WITH_AES_128_CCM_8                         0xC0A8
+#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA				   0xC035
+#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA				   0xC036
 
 /* EC Ciphersuites. */
 #define TLS_ECDH_ECDSA_WITH_NULL_SHA                       0xC001
diff --git a/nx_secure/src/nx_secure_generate_client_key_exchange.c b/nx_secure/src/nx_secure_generate_client_key_exchange.c
index 12557a34..9ecbee9b 100644
--- a/nx_secure/src/nx_secure_generate_client_key_exchange.c
+++ b/nx_secure/src/nx_secure_generate_client_key_exchange.c
@@ -98,6 +98,7 @@ const NX_CRYPTO_METHOD               *public_cipher_method;
 VOID                                 *handler = NX_NULL;
 #endif
 UINT                                  data_size;
+UINT                                  key_size;
 UCHAR                                *encrypted_data_ptr;
 #ifndef NX_SECURE_DISABLE_X509
 UCHAR                                 rand_byte;
@@ -132,9 +133,42 @@ NX_CRYPTO_EXTENDED_OUTPUT             extended_output;
     if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDH ||
         ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)
     {
-        data_size = (UINT)(1 + tls_key_material -> nx_secure_tls_new_key_material_data[0]);
+    	data_size = 0;
 
-        if ((data_size > sizeof(tls_key_material -> nx_secure_tls_new_key_material_data)) ||
+    	if (ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK)
+    	{
+    		if ((tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint_size >
+    		sizeof(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint)) ||
+    				(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint_size >
+    		(buffer_length - 2)))
+    		{
+
+    			/* Packet buffer too small. */
+    			return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL);
+    		}
+
+    		/* Pointer to the output encrypted pre-master secret. */
+    		encrypted_data_ptr = &data_buffer[2];
+
+    		/* Send the PSK Identity string to the remote server along with its length. */
+    		NX_SECURE_MEMCPY(encrypted_data_ptr, tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id,
+    				tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size); /* Use case of memcpy is verified. */
+
+    		/* Make sure our size is correct. */
+    		data_size = tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size;
+
+    		/* Put the length into our outgoing packet buffer. */
+    		data_buffer[0] = (UCHAR)((data_size & 0xFF00) >> 8);
+    		data_buffer[1] = (UCHAR)(data_size & 0x00FF);
+
+    		data_size += 2;
+    		data_buffer += data_size;
+    	}
+
+        key_size = (UINT)(1 + tls_key_material -> nx_secure_tls_new_key_material_data[0]);
+        data_size += key_size;
+
+        if ((key_size > sizeof(tls_key_material -> nx_secure_tls_new_key_material_data)) ||
             (data_size > buffer_length))
         {
 
@@ -142,7 +176,7 @@ NX_CRYPTO_EXTENDED_OUTPUT             extended_output;
             return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL);
         }
 
-        NX_SECURE_MEMCPY(data_buffer, tls_key_material -> nx_secure_tls_new_key_material_data, data_size); /* Use case of memcpy is verified. */
+        NX_SECURE_MEMCPY(data_buffer, tls_key_material -> nx_secure_tls_new_key_material_data, key_size); /* Use case of memcpy is verified. */
     }
     else
 #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */
diff --git a/nx_secure/src/nx_secure_generate_premaster_secret.c b/nx_secure/src/nx_secure_generate_premaster_secret.c
index 77eb7e89..9fa1b34c 100644
--- a/nx_secure/src/nx_secure_generate_premaster_secret.c
+++ b/nx_secure/src/nx_secure_generate_premaster_secret.c
@@ -98,6 +98,8 @@ const NX_CRYPTO_METHOD    *ecdh_method;
 NX_SECURE_EC_PUBLIC_KEY   *ec_pubkey;
 VOID                      *handler = NX_NULL;
 NX_CRYPTO_EXTENDED_OUTPUT  extended_output;
+UCHAR					   pre_master_secret_cpy[NX_SECURE_TLS_PREMASTER_SIZE];
+UINT					   pre_master_secret_size;
 #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE && !NX_SECURE_DISABLE_X509 */
 
 #if !defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) || defined(NX_SECURE_DISABLE_X509)
@@ -120,7 +122,57 @@ NX_CRYPTO_EXTENDED_OUTPUT  extended_output;
 #if defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) && !defined(NX_SECURE_DISABLE_X509)
     if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)
     {
+    	if(ciphersuite->nx_secure_tls_public_auth->nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK)
+    	{
+    		/* From RFC 5489:
+				The premaster secret is formed as follows.  First, perform the ECDH
+			    computation as described in Section 5.10 of [RFC4492].  Let Z be the
+			    octet string produced by this computation.  Next, concatenate a
+			    uint16 containing the length of Z (in octets), Z itself, a uint16
+			    containing the length of the PSK (in octets), and the PSK itself.
+    		*/
 
+    		/*  Client has to search for the PSK based on the identity hint. */
+    		status = _nx_secure_tls_psk_find(tls_credentials, &psk_data, &psk_length, tls_credentials -> nx_secure_tls_remote_psk_id,
+    				tls_credentials -> nx_secure_tls_remote_psk_id_size, NX_NULL);
+
+    		if (status != NX_SUCCESS)
+    		{
+    			return(status);
+    		}
+
+    		pre_master_secret_size = tls_key_material->nx_secure_tls_pre_master_secret_size;
+
+    		if ((2 + pre_master_secret_size + 2 + psk_length) > sizeof(tls_key_material -> nx_secure_tls_pre_master_secret))
+    		{
+
+    			/* No more PSK space. */
+    			return(NX_SECURE_TLS_NO_MORE_PSK_SPACE);
+    		}
+
+    		index = 0;
+
+    		NX_SECURE_MEMCPY(pre_master_secret_cpy, tls_key_material->nx_secure_tls_pre_master_secret, pre_master_secret_size);
+
+    		tls_key_material->nx_secure_tls_pre_master_secret[index++] = (pre_master_secret_size >> 8) & 0xFF;
+    		tls_key_material->nx_secure_tls_pre_master_secret[index++] = pre_master_secret_size & 0xFF;
+    		NX_SECURE_MEMCPY(tls_key_material->nx_secure_tls_pre_master_secret + index, pre_master_secret_cpy, pre_master_secret_size);
+
+    		index += pre_master_secret_size;
+
+    		tls_key_material->nx_secure_tls_pre_master_secret[index++] = (psk_length >> 8) & 0xFF;
+    		tls_key_material->nx_secure_tls_pre_master_secret[index++] = psk_length & 0xFF;
+    		NX_SECURE_MEMCPY(tls_key_material->nx_secure_tls_pre_master_secret + index, psk_data, psk_length);
+
+    		tls_key_material->nx_secure_tls_pre_master_secret_size += (4 + psk_length);
+
+    		*received_remote_credentials = NX_TRUE;
+
+    		/* Clear out the Pre-Master Secret (we don't need it anymore and keeping it in memory is dangerous). */
+#ifdef NX_SECURE_KEY_CLEAR
+    		NX_SECURE_MEMSET(pre_master_secret_cpy, 0x0, sizeof(pre_master_secret_cpy));
+#endif /* NX_SECURE_KEY_CLEAR  */
+    	}
         return(NX_SECURE_TLS_SUCCESS);
     }
     else if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDH)
diff --git a/nx_secure/src/nx_secure_process_server_key_exchange.c b/nx_secure/src/nx_secure_process_server_key_exchange.c
index 5366ccb1..2c4e3b51 100644
--- a/nx_secure/src/nx_secure_process_server_key_exchange.c
+++ b/nx_secure/src/nx_secure_process_server_key_exchange.c
@@ -139,6 +139,7 @@ UCHAR                                *current_buffer;
 UCHAR                                 hash_algorithm;
 UCHAR                                 signature_algorithm;
 USHORT                                signature_algorithm_id;
+ULONG 								  size_param;
 #if (NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED)
 UINT                                  i;
 #endif /* NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED */
@@ -182,7 +183,9 @@ UINT                                  i;
             in client_handshake, we can do the right thing... */
         NX_SECURE_MEMCPY(tls_credentials -> nx_secure_tls_remote_psk_id, &packet_buffer[0], length); /* Use case of memcpy is verified. */
         tls_credentials -> nx_secure_tls_remote_psk_id_size = length;
-        return(NX_SECURE_TLS_SUCCESS);
+
+        if(ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_ENCRYPTION_NULL)
+        	return(NX_SECURE_TLS_SUCCESS);
 
 
     }
@@ -251,6 +254,8 @@ UINT                                  i;
             return(NX_SECURE_TLS_UNSUPPORTED_ECC_FORMAT);
         }
 
+        auth_method = ciphersuite->nx_secure_tls_public_auth;
+
         /* Find out which named curve the server is using. */
         status = _nx_secure_tls_find_curve_method((NX_SECURE_TLS_ECC *)tls_ecc_curves, (USHORT)((packet_buffer[1] << 8) + packet_buffer[2]), &curve_method, NX_NULL);
 
@@ -263,13 +268,16 @@ UINT                                  i;
 
         current_buffer = &packet_buffer[3];
 
-        /* Get reference to remote server certificate so we can get the public key for signature verification. */
-        status = _nx_secure_x509_remote_endpoint_certificate_get(&tls_credentials -> nx_secure_tls_certificate_store,
-                                                                 &certificate);
-        if (status)
+        if(auth_method ->nx_crypto_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK)
         {
-            /* No certificate found, error! */
-            return(NX_SECURE_TLS_CERTIFICATE_NOT_FOUND);
+        	/* Get reference to remote server certificate so we can get the public key for signature verification. */
+        	status = _nx_secure_x509_remote_endpoint_certificate_get(&tls_credentials -> nx_secure_tls_certificate_store,
+        															 &certificate);
+        	if (status)
+        	{
+        		/* No certificate found, error! */
+        		return(NX_SECURE_TLS_CERTIFICATE_NOT_FOUND);
+        	}
         }
 
         key_length = current_buffer[0];
@@ -287,7 +295,16 @@ UINT                                  i;
             protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1)
 #endif /* NX_SECURE_ENABLE_DTLS */
         {
-            if ((UINT)key_length + 6 > message_length)
+        	if(auth_method ->nx_crypto_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK)
+        	{
+        		size_param = 6;
+        	}
+        	else
+        	{
+        		size_param = 6 + tls_credentials -> nx_secure_tls_remote_psk_id_size;
+        	}
+
+            if ((UINT)key_length + size_param > message_length)
             {
                 return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
             }
@@ -305,574 +322,588 @@ UINT                                  i;
         else
 #endif /* NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED */
         {
-            if ((UINT)key_length + 8 > message_length)
+        	if(auth_method ->nx_crypto_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK)
+        	{
+        		size_param = 8;
+        	}
+        	else
+        	{
+        		size_param = 6 + tls_credentials -> nx_secure_tls_remote_psk_id_size;
+        	}
+
+            if ((UINT)key_length + size_param > message_length)
             {
                 return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
             }
 
-            hash_algorithm = current_buffer[0];
-            signature_algorithm = current_buffer[1];
-            current_buffer += 2;
+            if(auth_method ->nx_crypto_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK)
+            {
+            	hash_algorithm = current_buffer[0];
+            	signature_algorithm = current_buffer[1];
+            	current_buffer += 2;
+            }
         }
 
-        /* Find out the hash algorithm used for the signature. */
-        /* Map signature algorithm to internal ID. */
-        _nx_secure_tls_get_signature_algorithm_id(((UINT)(hash_algorithm << 8) + signature_algorithm),
-                                                  &signature_algorithm_id);
-
-        /* Get the cypto method. */
-        status = _nx_secure_x509_find_certificate_methods(certificate,
-                                                          signature_algorithm_id,
-                                                          &crypto_methods);
-        if (status)
+        if(auth_method ->nx_crypto_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK)
         {
-            return(NX_SECURE_TLS_UNSUPPORTED_SIGNATURE_ALGORITHM);
-        }
+        	/* Find out the hash algorithm used for the signature. */
+        	/* Map signature algorithm to internal ID. */
+        	_nx_secure_tls_get_signature_algorithm_id(((UINT)(hash_algorithm << 8) + signature_algorithm),
+        											  &signature_algorithm_id);
+
+        	/* Get the cypto method. */
+        	status = _nx_secure_x509_find_certificate_methods(certificate,
+															  signature_algorithm_id,
+															  &crypto_methods);
+        	if (status)
+        	{
+        		return(NX_SECURE_TLS_UNSUPPORTED_SIGNATURE_ALGORITHM);
+        	}
 
 #if (NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED)
 #ifdef NX_SECURE_ENABLE_DTLS
-        if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
-           (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-            protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
-            protocol_version == NX_SECURE_DTLS_VERSION_1_0))
+        	if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
+        	   (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        		protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
+				protocol_version == NX_SECURE_DTLS_VERSION_1_0))
 #else
-        if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
-           (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-            protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1))
+        		if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
+        		   (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        			protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1))
 #endif /* NX_SECURE_ENABLE_DTLS */
-        {
+        		{
 
-            /* TLS 1.0 and TLS 1.1 use MD5 + SHA1 hash for RSA signatures. */
-            hash_method = tls_crypto_table -> nx_secure_tls_handshake_hash_md5_method;
-        }
-        else
+        			/* TLS 1.0 and TLS 1.1 use MD5 + SHA1 hash for RSA signatures. */
+        			hash_method = tls_crypto_table -> nx_secure_tls_handshake_hash_md5_method;
+        		}
+        		else
 #endif /* NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED */
-        {
-            hash_method = crypto_methods -> nx_secure_x509_hash_method;
-        }
-
+        		{
+        			hash_method = crypto_methods -> nx_secure_x509_hash_method;
+        		}
 
-        /* Calculate the hash: SHA(ClientHello.random + ServerHello.random +
+        	/* Calculate the hash: SHA(ClientHello.random + ServerHello.random +
                                    ServerKeyExchange.params); */
-        if (hash_method -> nx_crypto_init)
-        {
-            status = hash_method -> nx_crypto_init((NX_CRYPTO_METHOD*)hash_method,
-                                          NX_NULL,
-                                          0,
-                                          &handler,
-                                          tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                          tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size);
+        	if (hash_method -> nx_crypto_init)
+        	{
+        		status = hash_method -> nx_crypto_init((NX_CRYPTO_METHOD*)hash_method,
+											  NX_NULL,
+											  0,
+											  &handler,
+											  tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+											  tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size);
 
-            if(status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
-        }
+        		if(status != NX_CRYPTO_SUCCESS)
+        		{
+        			return(status);
+        		}
+        	}
 
-        if (hash_method -> nx_crypto_operation != NX_NULL)
-        {
-            status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_INITIALIZE,
-                                               handler,
-                                               (NX_CRYPTO_METHOD*)hash_method,
-                                               NX_NULL,
-                                               0,
-                                               NX_NULL,
-                                               0,
-                                               NX_NULL,
-                                               NX_NULL,
-                                               0,
-                                               tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                               tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                               NX_NULL,
-                                               NX_NULL);
+        	if (hash_method -> nx_crypto_operation != NX_NULL)
+        	{
+        		status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_INITIALIZE,
+												   handler,
+												   (NX_CRYPTO_METHOD*)hash_method,
+												   NX_NULL,
+												   0,
+												   NX_NULL,
+												   0,
+												   NX_NULL,
+												   NX_NULL,
+												   0,
+												   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+												   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+												   NX_NULL,
+												   NX_NULL);
 
-            if(status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
-        }
-        else
-        {
-            return(NX_SECURE_TLS_MISSING_CRYPTO_ROUTINE);
-        }
+        		if(status != NX_CRYPTO_SUCCESS)
+        		{
+        			return(status);
+        		}
+        	}
+        	else
+        	{
+        		return(NX_SECURE_TLS_MISSING_CRYPTO_ROUTINE);
+        	}
 
-        status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
-                                           handler,
-                                           (NX_CRYPTO_METHOD*)hash_method,
-                                           NX_NULL,
-                                           0,
-                                           tls_key_material -> nx_secure_tls_client_random,
-                                           32,
-                                           NX_NULL,
-                                           NX_NULL,
-                                           0,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                           NX_NULL,
-                                           NX_NULL);
+        	status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
+											   handler,
+											   (NX_CRYPTO_METHOD*)hash_method,
+											   NX_NULL,
+											   0,
+											   tls_key_material -> nx_secure_tls_client_random,
+											   32,
+											   NX_NULL,
+											   NX_NULL,
+											   0,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+											   NX_NULL,
+											   NX_NULL);
 
-        if(status != NX_CRYPTO_SUCCESS)
-        {
-            return(status);
-        }
+        	if(status != NX_CRYPTO_SUCCESS)
+        	{
+        		return(status);
+        	}
 
-        status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
-                                           handler,
-                                           (NX_CRYPTO_METHOD*)hash_method,
-                                           NX_NULL,
-                                           0,
-                                           tls_key_material -> nx_secure_tls_server_random,
-                                           32,
-                                           NX_NULL,
-                                           NX_NULL,
-                                           0,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                           NX_NULL,
-                                           NX_NULL);
+        	status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
+											   handler,
+											   (NX_CRYPTO_METHOD*)hash_method,
+											   NX_NULL,
+											   0,
+											   tls_key_material -> nx_secure_tls_server_random,
+											   32,
+											   NX_NULL,
+											   NX_NULL,
+											   0,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+											   NX_NULL,
+											   NX_NULL);
 
-        if(status != NX_CRYPTO_SUCCESS)
-        {
-            return(status);
-        }
+        	if(status != NX_CRYPTO_SUCCESS)
+        	{
+        		return(status);
+        	}
 
-        status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
-                                           handler,
-                                           (NX_CRYPTO_METHOD*)hash_method,
-                                           NX_NULL,
-                                           0,
-                                           packet_buffer,
-                                           (ULONG)(4 + key_length),
-                                           NX_NULL,
-                                           NX_NULL,
-                                           0,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                           NX_NULL,
-                                           NX_NULL);
+        	status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
+											   handler,
+											   (NX_CRYPTO_METHOD*)hash_method,
+											   NX_NULL,
+											   0,
+											   packet_buffer,
+											   (ULONG)(4 + key_length),
+											   NX_NULL,
+											   NX_NULL,
+											   0,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+											   NX_NULL,
+											   NX_NULL);
 
-        if(status != NX_CRYPTO_SUCCESS)
-        {
-            return(status);
-        }
+        	if(status != NX_CRYPTO_SUCCESS)
+        	{
+        		return(status);
+        	}
 
-        status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_CALCULATE,
-                                           handler,
-                                           (NX_CRYPTO_METHOD*)hash_method,
-                                           NX_NULL,
-                                           0,
-                                           NX_NULL,
-                                           0,
-                                           NX_NULL,
-                                           hash,
-                                           hash_method -> nx_crypto_ICV_size_in_bits >> 3,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                           tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                           NX_NULL,
-                                           NX_NULL);
-        if(status != NX_CRYPTO_SUCCESS)
-        {
-            return(status);
-        }
+        	status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_CALCULATE,
+											   handler,
+											   (NX_CRYPTO_METHOD*)hash_method,
+											   NX_NULL,
+											   0,
+											   NX_NULL,
+											   0,
+											   NX_NULL,
+											   hash,
+											   hash_method -> nx_crypto_ICV_size_in_bits >> 3,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+											   tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+											   NX_NULL,
+											   NX_NULL);
+        	if(status != NX_CRYPTO_SUCCESS)
+        	{
+        		return(status);
+        	}
 
-        if (hash_method -> nx_crypto_cleanup)
-        {
-            status = hash_method -> nx_crypto_cleanup(tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch);
+        	if (hash_method -> nx_crypto_cleanup)
+        	{
+        		status = hash_method -> nx_crypto_cleanup(tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch);
 
-            if(status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
-        }
-        handler = NX_NULL;
+        		if(status != NX_CRYPTO_SUCCESS)
+        		{
+        			return(status);
+        		}
+        	}
+        	handler = NX_NULL;
 
 #if (NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED)
 #ifdef NX_SECURE_ENABLE_DTLS
-        if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
-           (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-            protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
-            protocol_version == NX_SECURE_DTLS_VERSION_1_0))
+        	if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
+        	   (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        		protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
+				protocol_version == NX_SECURE_DTLS_VERSION_1_0))
 #else
-        if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
-           (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-            protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1))
+        		if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
+        		   (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        			protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1))
 #endif /* NX_SECURE_ENABLE_DTLS */
-        {
-            hash_method = tls_crypto_table -> nx_secure_tls_handshake_hash_sha1_method;;
+        		{
+        			hash_method = tls_crypto_table -> nx_secure_tls_handshake_hash_sha1_method;;
 
-            /* Calculate the hash: SHA(ClientHello.random + ServerHello.random +
+        			/* Calculate the hash: SHA(ClientHello.random + ServerHello.random +
                                        ServerKeyExchange.params); */
-            if (hash_method -> nx_crypto_init)
-            {
-                status = hash_method -> nx_crypto_init((NX_CRYPTO_METHOD*)hash_method,
-                                                NX_NULL,
-                                                0,
-                                                &handler,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size);
+        			if (hash_method -> nx_crypto_init)
+        			{
+        				status = hash_method -> nx_crypto_init((NX_CRYPTO_METHOD*)hash_method,
+														NX_NULL,
+														0,
+														&handler,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size);
 
-                if(status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
+        				if(status != NX_CRYPTO_SUCCESS)
+        				{
+        					return(status);
+        				}
+        			}
 
-            if (hash_method -> nx_crypto_operation != NX_NULL)
-            {
-                status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_INITIALIZE,
-                                                    handler,
-                                                    (NX_CRYPTO_METHOD*)hash_method,
-                                                    NX_NULL,
-                                                    0,
-                                                    NX_NULL,
-                                                    0,
-                                                    NX_NULL,
-                                                    NX_NULL,
-                                                    0,
-                                                    tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                                    tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                                    NX_NULL,
-                                                    NX_NULL);
+        			if (hash_method -> nx_crypto_operation != NX_NULL)
+        			{
+        				status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_INITIALIZE,
+															handler,
+															(NX_CRYPTO_METHOD*)hash_method,
+															NX_NULL,
+															0,
+															NX_NULL,
+															0,
+															NX_NULL,
+															NX_NULL,
+															0,
+															tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+															tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+															NX_NULL,
+															NX_NULL);
 
-                if(status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
-            else
-            {
-                return(NX_SECURE_TLS_MISSING_CRYPTO_ROUTINE);
-            }
+        				if(status != NX_CRYPTO_SUCCESS)
+        				{
+        					return(status);
+        				}
+        			}
+        			else
+        			{
+        				return(NX_SECURE_TLS_MISSING_CRYPTO_ROUTINE);
+        			}
 
-            status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
-                                                handler,
-                                                (NX_CRYPTO_METHOD*)hash_method,
-                                                NX_NULL,
-                                                0,
-                                                tls_key_material -> nx_secure_tls_client_random,
-                                                32,
-                                                NX_NULL,
-                                                NX_NULL,
-                                                0,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                                NX_NULL,
-                                                NX_NULL);
+        			status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
+														handler,
+														(NX_CRYPTO_METHOD*)hash_method,
+														NX_NULL,
+														0,
+														tls_key_material -> nx_secure_tls_client_random,
+														32,
+														NX_NULL,
+														NX_NULL,
+														0,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+														NX_NULL,
+														NX_NULL);
 
-            if(status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
+        			if(status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
 
-            status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
-                                                handler,
-                                                (NX_CRYPTO_METHOD*)hash_method,
-                                                NX_NULL,
-                                                0,
-                                                tls_key_material -> nx_secure_tls_server_random,
-                                                32,
-                                                NX_NULL,
-                                                NX_NULL,
-                                                0,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                                NX_NULL,
-                                                NX_NULL);
+        			status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
+														handler,
+														(NX_CRYPTO_METHOD*)hash_method,
+														NX_NULL,
+														0,
+														tls_key_material -> nx_secure_tls_server_random,
+														32,
+														NX_NULL,
+														NX_NULL,
+														0,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+														NX_NULL,
+														NX_NULL);
 
-            if (status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
+        			if (status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
 
-            status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
-                                                handler,
-                                                (NX_CRYPTO_METHOD*)hash_method,
-                                                NX_NULL,
-                                                0,
-                                                packet_buffer,
-                                                (ULONG)(4 + key_length),
-                                                NX_NULL,
-                                                NX_NULL,
-                                                0,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                                NX_NULL,
-                                                NX_NULL);
+        			status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_UPDATE,
+														handler,
+														(NX_CRYPTO_METHOD*)hash_method,
+														NX_NULL,
+														0,
+														packet_buffer,
+														(ULONG)(4 + key_length),
+														NX_NULL,
+														NX_NULL,
+														0,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+														NX_NULL,
+														NX_NULL);
 
-            if(status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
+        			if(status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
 
-            status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_CALCULATE,
-                                                handler,
-                                                (NX_CRYPTO_METHOD*)hash_method,
-                                                NX_NULL,
-                                                0,
-                                                NX_NULL,
-                                                0,
-                                                NX_NULL,
-                                                &hash[16],
-                                                hash_method -> nx_crypto_ICV_size_in_bits >> 3,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
-                                                tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
-                                                NX_NULL,
-                                                NX_NULL);
+        			status = hash_method -> nx_crypto_operation(NX_CRYPTO_HASH_CALCULATE,
+														handler,
+														(NX_CRYPTO_METHOD*)hash_method,
+														NX_NULL,
+														0,
+														NX_NULL,
+														0,
+														NX_NULL,
+														&hash[16],
+														hash_method -> nx_crypto_ICV_size_in_bits >> 3,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch,
+														tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch_size,
+														NX_NULL,
+														NX_NULL);
 
-            if (status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
+        			if (status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
 
-            if (hash_method -> nx_crypto_cleanup)
-            {
-                status = hash_method -> nx_crypto_cleanup(tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch);
+        			if (hash_method -> nx_crypto_cleanup)
+        			{
+        				status = hash_method -> nx_crypto_cleanup(tls_handshake_hash -> nx_secure_tls_handshake_hash_scratch);
 
-                if(status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
-            handler = NX_NULL;
-        }
+        				if(status != NX_CRYPTO_SUCCESS)
+        				{
+        					return(status);
+        				}
+        			}
+        			handler = NX_NULL;
+        		}
 #endif /* NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED */
 
-        signature_length = (USHORT)((current_buffer[0] << 8) + current_buffer[1]);
-        current_buffer += 2;
+        	signature_length = (USHORT)((current_buffer[0] << 8) + current_buffer[1]);
+        	current_buffer += 2;
 
 #if (NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED)
 #ifdef NX_SECURE_ENABLE_DTLS
-        if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-            protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
-            protocol_version == NX_SECURE_DTLS_VERSION_1_0)
+        	if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        		protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
+				protocol_version == NX_SECURE_DTLS_VERSION_1_0)
 #else
-        if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-            protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1)
+        		if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        			protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1)
 #endif /* NX_SECURE_ENABLE_DTLS */
-        {
-            if ((UINT)signature_length + key_length + 6 > message_length)
-            {
-                return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
-            }
-        }
-        else
+        		{
+        			if ((UINT)signature_length + key_length + 6 > message_length)
+        			{
+        				return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
+        			}
+        		}
+        		else
 #endif
-        {
-            if ((UINT)signature_length + key_length + 8 > message_length)
-            {
-                return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
-            }
-        }
+        		{
+        			if ((UINT)signature_length + key_length + 8 > message_length)
+        			{
+        				return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
+        			}
+        		}
 
-        /* Verify the signature. */
-        auth_method = ciphersuite -> nx_secure_tls_public_auth;
+        	/* Verify the signature. */
+        	auth_method = ciphersuite -> nx_secure_tls_public_auth;
 
-        if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
-            (auth_method -> nx_crypto_algorithm == NX_CRYPTO_DIGITAL_SIGNATURE_RSA ||
-            auth_method -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_RSA))
-        {
-            /* Verify the RSA signature. */
+        	if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_RSA &&
+        		(auth_method -> nx_crypto_algorithm == NX_CRYPTO_DIGITAL_SIGNATURE_RSA ||
+        		auth_method -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_RSA))
+        	{
+        		/* Verify the RSA signature. */
 
-            if (auth_method -> nx_crypto_init != NX_NULL)
-            {
-                /* Initialize the crypto method with public key. */
-                status = auth_method -> nx_crypto_init((NX_CRYPTO_METHOD*)auth_method,
-                                                       (UCHAR *)certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_modulus,
-                                                       (NX_CRYPTO_KEY_SIZE)(certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_modulus_length << 3),
-                                                       &handler,
-                                                       public_auth_metadata,
-                                                       public_auth_metadata_size);
-                if(status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
+        		if (auth_method -> nx_crypto_init != NX_NULL)
+        		{
+        			/* Initialize the crypto method with public key. */
+        			status = auth_method -> nx_crypto_init((NX_CRYPTO_METHOD*)auth_method,
+														   (UCHAR *)certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_modulus,
+														   (NX_CRYPTO_KEY_SIZE)(certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_modulus_length << 3),
+														   &handler,
+														   public_auth_metadata,
+														   public_auth_metadata_size);
+        			if(status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
+        		}
 
-            if (auth_method -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_RSA)
-            {
-                status = auth_method -> nx_crypto_operation(NX_CRYPTO_DECRYPT,
-                                                            handler,
-                                                            (NX_CRYPTO_METHOD*)auth_method,
-                                                            (UCHAR *)certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_exponent,
-                                                            (NX_CRYPTO_KEY_SIZE)(certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_exponent_length << 3),
-                                                            current_buffer,
-                                                            signature_length,
-                                                            NX_NULL,
-                                                            decrypted_signature,
-                                                            sizeof(decrypted_signature),
-                                                            public_auth_metadata,
-                                                            public_auth_metadata_size,
-                                                            NX_NULL, NX_NULL);
-                if(status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
+        		if (auth_method -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_RSA)
+        		{
+        			status = auth_method -> nx_crypto_operation(NX_CRYPTO_DECRYPT,
+																handler,
+																(NX_CRYPTO_METHOD*)auth_method,
+																(UCHAR *)certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_exponent,
+																(NX_CRYPTO_KEY_SIZE)(certificate -> nx_secure_x509_public_key.rsa_public_key.nx_secure_rsa_public_exponent_length << 3),
+																current_buffer,
+																signature_length,
+																NX_NULL,
+																decrypted_signature,
+																sizeof(decrypted_signature),
+																public_auth_metadata,
+																public_auth_metadata_size,
+																NX_NULL, NX_NULL);
+        			if(status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
+        		}
 
-            if (auth_method -> nx_crypto_cleanup)
-            {
-                status = auth_method -> nx_crypto_cleanup(public_auth_metadata);
-                if(status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
-            handler = NX_NULL;
+        		if (auth_method -> nx_crypto_cleanup)
+        		{
+        			status = auth_method -> nx_crypto_cleanup(public_auth_metadata);
+        			if(status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
+        		}
+        		handler = NX_NULL;
 
 #if (NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED)
 #ifdef NX_SECURE_ENABLE_DTLS
-            if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-                protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
-                protocol_version == NX_SECURE_DTLS_VERSION_1_0)
+        		if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        			protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1 ||
+					protocol_version == NX_SECURE_DTLS_VERSION_1_0)
 #else
-            if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
-                protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1)
+        			if (protocol_version == NX_SECURE_TLS_VERSION_TLS_1_0 ||
+        				protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1)
 #endif /* NX_SECURE_ENABLE_DTLS */
-            {
-                if (signature_length < 39)
-                {
-                    return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
-                }
+        			{
+        				if (signature_length < 39)
+        				{
+        					return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
+        				}
 
-                /* Block type is 0x00, 0x01 for signatures */
-                if (decrypted_signature[0] != 0x0 && decrypted_signature[1] != 0x1)
-                {
-                    /* Unknown block type. */
-                    return(NX_SECURE_TLS_PADDING_CHECK_FAILED);
-                }
+        				/* Block type is 0x00, 0x01 for signatures */
+        				if (decrypted_signature[0] != 0x0 && decrypted_signature[1] != 0x1)
+        				{
+        					/* Unknown block type. */
+        					return(NX_SECURE_TLS_PADDING_CHECK_FAILED);
+        				}
 
-                /* Check padding. */
-                for (i = 2; i < (UINT)(signature_length - 37); ++i)
-                {
-                    if (decrypted_signature[i] != (UCHAR)0xFF)
-                    {
-                        /* Bad padding value. */
-                        return(NX_SECURE_TLS_PADDING_CHECK_FAILED);
-                    }
-                }
+        				/* Check padding. */
+        				for (i = 2; i < (UINT)(signature_length - 37); ++i)
+        				{
+        					if (decrypted_signature[i] != (UCHAR)0xFF)
+        					{
+        						/* Bad padding value. */
+        						return(NX_SECURE_TLS_PADDING_CHECK_FAILED);
+        					}
+        				}
 
-                /* Make sure we actually saw a NULL byte. */
-                if (decrypted_signature[i] != 0x00)
-                {
-                    return(NX_SECURE_TLS_PADDING_CHECK_FAILED);
-                }
+        				/* Make sure we actually saw a NULL byte. */
+        				if (decrypted_signature[i] != 0x00)
+        				{
+        					return(NX_SECURE_TLS_PADDING_CHECK_FAILED);
+        				}
 
-                decrypted_hash = &decrypted_signature[i + 1];
-                decrypted_hash_length = 36;
-            }
-            else
+        				decrypted_hash = &decrypted_signature[i + 1];
+        				decrypted_hash_length = 36;
+        			}
+        			else
 #endif /* NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED */
-            {
-                /* Decode the decrypted signature. */
-                status = _nx_secure_x509_pkcs7_decode(decrypted_signature, signature_length, &sig_oid, &sig_oid_length,
-                                                      &decrypted_hash, &decrypted_hash_length);
-                if (status != NX_SUCCESS)
-                {
-                    return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
-                }
+        			{
+        				/* Decode the decrypted signature. */
+        				status = _nx_secure_x509_pkcs7_decode(decrypted_signature, signature_length, &sig_oid, &sig_oid_length,
+        													  &decrypted_hash, &decrypted_hash_length);
+        				if (status != NX_SUCCESS)
+        				{
+        					return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
+        				}
 
-                if (decrypted_hash_length != (hash_method -> nx_crypto_ICV_size_in_bits >> 3))
-                {
-                    return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
-                }
-            }
+        				if (decrypted_hash_length != (hash_method -> nx_crypto_ICV_size_in_bits >> 3))
+        				{
+        					return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
+        				}
+        			}
 
-            /* Compare generated hash with decrypted hash. */
-            compare_result = (UINT)NX_SECURE_MEMCMP(hash, decrypted_hash, decrypted_hash_length);
+        		/* Compare generated hash with decrypted hash. */
+        		compare_result = (UINT)NX_SECURE_MEMCMP(hash, decrypted_hash, decrypted_hash_length);
 
 #ifdef NX_SECURE_KEY_CLEAR
-            NX_SECURE_MEMSET(hash, 0, sizeof(hash));
-            NX_SECURE_MEMSET(decrypted_signature, 0, sizeof(decrypted_signature));
+        		NX_SECURE_MEMSET(hash, 0, sizeof(hash));
+        		NX_SECURE_MEMSET(decrypted_signature, 0, sizeof(decrypted_signature));
 #endif /* NX_SECURE_KEY_CLEAR  */
 
-            if (compare_result != 0)
-            {
-                return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
-            }
-        }
-        else if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_ECDSA &&
-                 auth_method -> nx_crypto_algorithm == NX_CRYPTO_DIGITAL_SIGNATURE_ECDSA)
-        {
-            /* Verify the ECDSA signature. */
+        		if (compare_result != 0)
+        		{
+        			return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
+        		}
+        	}
+        	else if (signature_algorithm == NX_SECURE_TLS_SIGNATURE_ALGORITHM_ECDSA &&
+        			 auth_method -> nx_crypto_algorithm == NX_CRYPTO_DIGITAL_SIGNATURE_ECDSA)
+        	{
+        		/* Verify the ECDSA signature. */
 
-            ec_pubkey = &certificate -> nx_secure_x509_public_key.ec_public_key;
+        		ec_pubkey = &certificate -> nx_secure_x509_public_key.ec_public_key;
 
-            /* Find out which named curve the remote certificate is using. */
-            status = _nx_secure_tls_find_curve_method((NX_SECURE_TLS_ECC *)tls_ecc_curves, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert, NX_NULL);
+        		/* Find out which named curve the remote certificate is using. */
+        		status = _nx_secure_tls_find_curve_method((NX_SECURE_TLS_ECC *)tls_ecc_curves, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert, NX_NULL);
 
-            if(status != NX_SUCCESS)
-            {
+        		if(status != NX_SUCCESS)
+        		{
 
-                /* The remote certificate is using an unsupported curve. */
-                return(NX_SECURE_TLS_UNSUPPORTED_ECC_CURVE);
-            }
+        			/* The remote certificate is using an unsupported curve. */
+        			return(NX_SECURE_TLS_UNSUPPORTED_ECC_CURVE);
+        		}
 
-            if (auth_method -> nx_crypto_init != NX_NULL)
-            {
-                status = auth_method -> nx_crypto_init((NX_CRYPTO_METHOD*)auth_method,
-                                                       (UCHAR *)ec_pubkey -> nx_secure_ec_public_key,
-                                                       (NX_CRYPTO_KEY_SIZE)(ec_pubkey -> nx_secure_ec_public_key_length << 3),
-                                                       &handler,
-                                                       public_auth_metadata,
-                                                       public_auth_metadata_size);
-                if (status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
-            if (auth_method -> nx_crypto_operation == NX_NULL)
-            {
-                return(NX_SECURE_TLS_MISSING_CRYPTO_ROUTINE);
-            }
+        		if (auth_method -> nx_crypto_init != NX_NULL)
+        		{
+        			status = auth_method -> nx_crypto_init((NX_CRYPTO_METHOD*)auth_method,
+														   (UCHAR *)ec_pubkey -> nx_secure_ec_public_key,
+														   (NX_CRYPTO_KEY_SIZE)(ec_pubkey -> nx_secure_ec_public_key_length << 3),
+														   &handler,
+														   public_auth_metadata,
+														   public_auth_metadata_size);
+        			if (status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
+        		}
+        		if (auth_method -> nx_crypto_operation == NX_NULL)
+        		{
+        			return(NX_SECURE_TLS_MISSING_CRYPTO_ROUTINE);
+        		}
 
-            status = auth_method -> nx_crypto_operation(NX_CRYPTO_EC_CURVE_SET, handler,
-                                                        (NX_CRYPTO_METHOD*)auth_method, NX_NULL, 0,
-                                                        (UCHAR *)curve_method_cert, sizeof(NX_CRYPTO_METHOD *), NX_NULL,
-                                                        NX_NULL, 0,
-                                                        public_auth_metadata,
-                                                        public_auth_metadata_size,
-                                                        NX_NULL, NX_NULL);
-            if (status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
+        		status = auth_method -> nx_crypto_operation(NX_CRYPTO_EC_CURVE_SET, handler,
+															(NX_CRYPTO_METHOD*)auth_method, NX_NULL, 0,
+															(UCHAR *)curve_method_cert, sizeof(NX_CRYPTO_METHOD *), NX_NULL,
+															NX_NULL, 0,
+															public_auth_metadata,
+															public_auth_metadata_size,
+															NX_NULL, NX_NULL);
+        		if (status != NX_CRYPTO_SUCCESS)
+        		{
+        			return(status);
+        		}
 
-            status = auth_method -> nx_crypto_operation(NX_CRYPTO_VERIFY, handler,
-                                                        (NX_CRYPTO_METHOD*)auth_method,
-                                                        (UCHAR *)ec_pubkey -> nx_secure_ec_public_key,
-                                                        (NX_CRYPTO_KEY_SIZE)(ec_pubkey -> nx_secure_ec_public_key_length << 3),
-                                                        hash,
-                                                        hash_method -> nx_crypto_ICV_size_in_bits >> 3,
-                                                        NX_NULL,
-                                                        current_buffer,
-                                                        signature_length,
-                                                        public_auth_metadata,
-                                                        public_auth_metadata_size,
-                                                        NX_NULL, NX_NULL);
+        		status = auth_method -> nx_crypto_operation(NX_CRYPTO_VERIFY, handler,
+															(NX_CRYPTO_METHOD*)auth_method,
+															(UCHAR *)ec_pubkey -> nx_secure_ec_public_key,
+															(NX_CRYPTO_KEY_SIZE)(ec_pubkey -> nx_secure_ec_public_key_length << 3),
+															hash,
+															hash_method -> nx_crypto_ICV_size_in_bits >> 3,
+															NX_NULL,
+															current_buffer,
+															signature_length,
+															public_auth_metadata,
+															public_auth_metadata_size,
+															NX_NULL, NX_NULL);
 
-            if (status == NX_CRYPTO_AUTHENTICATION_FAILED)
-            {
-                return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
-            }
+        		if (status == NX_CRYPTO_AUTHENTICATION_FAILED)
+        		{
+        			return(NX_SECURE_TLS_SIGNATURE_VERIFICATION_ERROR);
+        		}
 
-            if (status != NX_CRYPTO_SUCCESS)
-            {
-                return(status);
-            }
+        		if (status != NX_CRYPTO_SUCCESS)
+        		{
+        			return(status);
+        		}
 
-            if (auth_method -> nx_crypto_cleanup)
-            {
-                status = auth_method -> nx_crypto_cleanup(public_auth_metadata);
-                if(status != NX_CRYPTO_SUCCESS)
-                {
-                    return(status);
-                }
-            }
-        }
-        else
-        {
-            /* The signature hash algorithm used by the server is not supported. */
-            return(NX_SECURE_TLS_UNSUPPORTED_SIGNATURE_ALGORITHM);
+        		if (auth_method -> nx_crypto_cleanup)
+        		{
+        			status = auth_method -> nx_crypto_cleanup(public_auth_metadata);
+        			if(status != NX_CRYPTO_SUCCESS)
+        			{
+        				return(status);
+        			}
+        		}
+        	}
+        	else
+        	{
+        		/* The signature hash algorithm used by the server is not supported. */
+        		return(NX_SECURE_TLS_UNSUPPORTED_SIGNATURE_ALGORITHM);
+        	}
         }
 
         ecdh_method = ciphersuite -> nx_secure_tls_public_cipher;
diff --git a/nx_secure/src/nx_secure_tls_process_server_key_exchange.c b/nx_secure/src/nx_secure_tls_process_server_key_exchange.c
index eb3d7037..770faf20 100644
--- a/nx_secure/src/nx_secure_tls_process_server_key_exchange.c
+++ b/nx_secure/src/nx_secure_tls_process_server_key_exchange.c
@@ -96,6 +96,8 @@ UINT                                  status;
 #if defined(NX_SECURE_ENABLE_PSK_CIPHERSUITES) || defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) || \
    (defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE))
 const NX_SECURE_TLS_CIPHERSUITE_INFO *ciphersuite;
+UINT								  auth_algorithm;
+NX_SECURE_TLS_CLIENT_STATE			  client_state;
 #endif /* defined(NX_SECURE_ENABLE_PSK_CIPHERSUITES) || defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) */
 
 #if defined(NX_SECURE_ENABLE_PSK_CIPHERSUITES) || defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) || \
@@ -115,7 +117,11 @@ const NX_SECURE_TLS_CIPHERSUITE_INFO *ciphersuite;
 
     if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)
     {
-        if (tls_session -> nx_secure_tls_client_state != NX_SECURE_TLS_CLIENT_STATE_SERVER_CERTIFICATE)
+    	auth_algorithm = ciphersuite->nx_secure_tls_public_auth->nx_crypto_algorithm;
+    	client_state = tls_session->nx_secure_tls_client_state;
+
+        if (auth_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK &&
+        	 client_state != NX_SECURE_TLS_CLIENT_STATE_SERVER_CERTIFICATE)
         {
             return(NX_SECURE_TLS_UNEXPECTED_MESSAGE);
         }