diff --git a/tmp/analyze-names.sh b/tmp/analyze-names.sh
new file mode 100755
index 0000000..042f3eb
--- /dev/null
+++ b/tmp/analyze-names.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -eu
+
+tmp/list-macros.sh
+tmp/list-enum-consts.pl
+tmp/list-identifiers.sh
+tmp/list-symbols.sh
+
+UNDECLARED=$( diff exported-symbols identifiers | sed -n -e 's/^< //p' )
+if [ "x$UNDECLARED" == "x" ]; then
+    echo "All exported symbols are declared in headers: good"
+else
+    echo "The following symbols are probably missing a 'static': $UNDECLARED"
+fi
+
+for THING in macros identifiers enum-consts; do
+    echo ''
+    echo "=== $THING ==="
+
+    NO_=$( grep -v _ $THING | tr '\n' ' ' )
+    echo "Without underscore: $NO_"
+
+    cut -f1 -d_ $THING | uniq -c | sort -nr > prefix-$THING
+    echo "By prefix: (10 most frequent, see prefix-$THING for full list)"
+    head -n 10 < prefix-$THING
+done
+
+echo ''; echo "=== all public names ==="
+sort -u macros identifiers enum-consts > public-names
+wc -l public-names
+
+
+NL='
+'
+sed -n 's/POLARSSL_[A-Z0-9_]*/\'"$NL"'&\'"$NL"/gp \
+    include/mbedtls/*.h tests/scripts/* scripts/* library/*.c \
+    | grep POLARSSL | sort -u > _POLARSSL_XXX
+diff public-names _POLARSSL_XXX | sed -n 's/^> //p' > extra-names
+rm _POLARSSL_XXX
+
+echo 'polarssl_zeroize' >> extra-names
+
+wc -l extra-names
+
+for THING in public-names extra-names; do
+    if grep '[^A-Za-z0-9_]' $THING; then
+        echo "invalid character in $THING" >&2
+        exit 1;
+    fi
+done
diff --git a/tmp/invoke-rename.sh b/tmp/invoke-rename.sh
new file mode 100755
index 0000000..c0615f2
--- /dev/null
+++ b/tmp/invoke-rename.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# test result with:
+# make all check
+# ggrep -i --exclude-dir=mpg --exclude=.travis.yml --exclude=ChangeLog --exclude=extra-names --exclude=public-names polarssl . --exclude-dir=tmp G -v 'include|OU?=PolarSSL|PolarSSLTes' | cut -d':' -f1 | sort -u
+
+set -eu
+
+FILES='include/mbedtls/*.h library/*.c programs/*.c programs/*/*.c tests/suites/* configs/*.h scripts/data_files/*.fmt scripts/* tests/scripts/*'
+
+tmp/rename.pl old2new $FILES
+# re-invoke on programs including strings
diff --git a/tmp/list-enum-consts.pl b/tmp/list-enum-consts.pl
new file mode 100755
index 0000000..4e0baec
--- /dev/null
+++ b/tmp/list-enum-consts.pl
@@ -0,0 +1,33 @@
+#!/usr/bin/perl
+
+use warnings;
+use strict;
+
+use utf8;
+use open qw(:std utf8);
+
+@ARGV = <include/mbedtls/*.h>;
+
+my @consts;
+my $state = 'out';
+while (<>)
+{
+    if( $state eq 'out' and /^(typedef )?enum {/ ) {
+        $state = 'in';
+    } elsif( $state eq 'out' and /^(typedef )?enum/ ) {
+        $state = 'start';
+    } elsif( $state eq 'start' and /{/ ) {
+        $state = 'in';
+    } elsif( $state eq 'in' and /}/ ) {
+        $state = 'out';
+    } elsif( $state eq 'in' ) {
+        s/=.*//; s!/\*.*!!; s/,.*//; s/\s+//g; chomp;
+        push @consts, $_ if $_;
+    }
+}
+
+open my $fh, '>', 'enum-consts' or die;
+print $fh "$_\n" for sort @consts;
+close $fh or die;
+
+printf "%8d enum-consts\n", scalar @consts;
diff --git a/tmp/list-identifiers.sh b/tmp/list-identifiers.sh
new file mode 100755
index 0000000..549f213
--- /dev/null
+++ b/tmp/list-identifiers.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+set -eu
+
+HEADERS=$( ls include/mbedtls/*.h | egrep -v 'compat-1.2|openssl|bn_mul' )
+
+rm -f identifiers
+
+grep '^[^ /#{]' $HEADERS | \
+    sed -e 's/^[^:]*://' | \
+    egrep -v '^(extern "C"|(typedef )?(struct|enum)( {)?$|};?$)' \
+    > _decls
+
+if true; then
+sed -n -e 's/.* \**\([a-zA-Z_][a-zA-Z0-9_]*\)(.*/\1/p' \
+       -e 's/.*(\*\(.*\))(.*/\1/p' _decls
+grep -v '(' _decls | sed -e 's/\([a-zA-Z0-9_]*\)[;[].*/\1/' -e 's/.* \**//'
+fi > _identifiers
+
+if [ $( wc -l < _identifiers ) -eq $( wc -l < _decls ) ]; then
+    rm _decls
+    egrep -v '^(u?int(16|32|64)_t)$' _identifiers | sort > identifiers
+    rm _identifiers
+else
+    echo "Mismatch" 2>&1
+    exit 1
+fi
+
+wc -l identifiers
diff --git a/tmp/list-macros.sh b/tmp/list-macros.sh
new file mode 100755
index 0000000..b194831
--- /dev/null
+++ b/tmp/list-macros.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set =eu
+
+HEADERS=$( ls include/mbedtls/*.h )
+
+sed -n -e 's/.*#define \([a-zA-Z0-9_]*\).*/\1/p' $HEADERS \
+    | egrep -v '^(asm|inline|EMIT|_CRT_SECURE_NO_DEPRECATE)$|^MULADDC_' \
+    | sort -u > macros
+
+wc -l macros
diff --git a/tmp/list-symbols.sh b/tmp/list-symbols.sh
new file mode 100755
index 0000000..9f10c62
--- /dev/null
+++ b/tmp/list-symbols.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -eu
+
+if grep -i cmake Makefile >/dev/null; then
+    echo "not compatible with cmake" >&2
+    exit 1
+fi
+
+cp include/mbedtls/config.h{,.bak}
+scripts/config.pl full
+CFLAGS=-fno-asynchronous-unwind-tables make clean lib >/dev/null 2>&1
+mv include/mbedtls/config.h{.bak,}
+nm -gUj library/libmbedtls.a 2>/dev/null | sed -n -e 's/^_//p' | sort > exported-symbols
+make clean
+
+wc -l exported-symbols
diff --git a/tmp/makelist.pl b/tmp/makelist.pl
new file mode 100755
index 0000000..fd447ee
--- /dev/null
+++ b/tmp/makelist.pl
@@ -0,0 +1,65 @@
+#!/usr/bin/perl
+
+use warnings;
+use strict;
+
+use utf8;
+use open qw(:std utf8);
+
+# build substitution table from a list of names on stdin or input files
+
+my %special_cases = (
+    'supported_ciphers' => 'mbedtls_cipher_supported',
+    'f'                 => 'mbedtls_entropy_f',
+    'source'            => 'mbedtls_entropy_source',
+    'COLLECT'           => 'MBEDTLS_HAVEGE_COLLECT',
+    'LN'                => 'MBEDTLS_MPI_LN',
+    'key'               => 'mbedtls_ssl_key',
+    'safer'             => 'mbedtls_ssl_safer',
+    'alarmed'           => 'mbedtls_timing_alarmed',
+    'get'               => 'mbedtls_timing_get',
+    'hardclock'         => 'mbedtls_timing_hardclock',
+    'hr'                => 'mbedtls_timing_hr',
+    'm'                 => 'mbedtls_timing_m',
+    'set'               => 'mbedtls_timing_set',
+    'BADCERT'           => 'MBEDTLS_X509_BADCERT',
+    'BADCRL'            => 'MBEDTLS_X509_BADCRL',
+    'EXT'               => 'MBEDTLS_X509_EXT',
+    'KU'                => 'MBEDTLS_X509_KU',
+    'NS'                => 'MBEDTLS_X509_NS',
+    't'                 => 'mbedtls_mpi',
+);
+
+my %subst;
+while( my $name = <> ) {
+    my $new;
+
+    chomp $name;
+
+    while( my ($prefix, $newpref) = each %special_cases ) {
+        if( $name =~ /^$prefix($|_)/ ) {
+            ($new = $name) =~ s/^$prefix/$newpref/;
+            last;
+        }
+    }
+
+    unless( $new ) {
+        if( $name =~ /^POLARSSL_/ ) {
+            ($new = $name) =~ s/POLARSSL/MBEDTLS/;
+        } elsif( $name =~ /^polarssl_/ ) {
+            ($new = $name) =~ s/polarssl/mbedtls/;
+        } elsif( $name =~ /^_[a-z]/ ) {
+            $new = "mbedtls$name";
+        } elsif( $name =~ /^[A-Z]/ ) {
+            $new = "MBEDTLS_$name";
+        } elsif( $name =~ /^[a-z]/ ) {
+            $new = "mbedtls_$name";
+        } else {
+            die "I don't know how to rename '$name'";
+        }
+    }
+
+    $subst{$name} = $new;
+}
+
+printf "%s %s\n", $_, $subst{$_} for sort keys %subst;
diff --git a/tmp/rename.pl b/tmp/rename.pl
new file mode 100755
index 0000000..56f2ce2
--- /dev/null
+++ b/tmp/rename.pl
@@ -0,0 +1,67 @@
+#!/usr/bin/perl
+
+use warnings;
+use strict;
+
+use utf8;
+use open qw(:std utf8);
+
+# apply substitutions from the table in the first arg to files
+#   expected usage: via invoke-rename.pl
+
+die "Usage: $0 names-file [filenames...]\n" if( @ARGV < 1 or ! -r $ARGV[0] );
+
+open my $nfh, '<', shift or die;
+my @names = <$nfh>;
+close $nfh or die;
+
+my %subst;
+for my $name (@names) {
+    chomp $name;
+    my ($old, $new) = split / /, $name;
+    $subst{$old} = $new;
+}
+
+my $string = qr/".*?(?<!\\)"/;
+my $space = qr/\s+/;
+my $idnum = qr/[a-zA-Z0-9_]+/;
+my $symbols = qr/[!#%&'()*+,-.:;<=>?@^_`{|}~\$\/\[\\\]]+|"/;
+
+my %warnings;
+
+while( my $filename = shift )
+{
+    print STDERR "$filename... ";
+    if( -d $filename ) { print STDERR "skip (directory)"; next }
+
+    open my $rfh, '<', $filename or die;
+    my @lines = <$rfh>;
+    close $rfh or die;
+
+    my @out;
+    for my $line (@lines) {
+        my @words = ($line =~ /$string|$space|$idnum|$symbols/g);
+        my $checkline = join '', @words;
+        if( $checkline eq $line ) {
+            my @new = map { exists $subst{$_} ? $subst{$_} : $_ } @words;
+            push( @out, join '', @new );
+        } else {
+            $warnings{$filename} = [] unless $warnings{$filename};
+            push @{ $warnings{$filename} }, $line;
+            push( @out, $line );
+        }
+    }
+
+    open my $wfh, '>', $filename or die;
+    print $wfh $_ for @out;
+    close $wfh or die;
+    print STDERR "done\n";
+}
+
+if( %warnings ) {
+    print "\nWarning: lines skipped due to unexpected charaacters:\n";
+    for my $filename (sort keys %warnings) {
+        print "in $filename:\n";
+        print for @{ $warnings{$filename} };
+    }
+}