diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index c60cd6b..8468871 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -1,5 +1,11 @@
-FILE(GLOB headers "polarssl/*.h")
+option(INSTALL_POLARSSL_HEADERS "Install PolarSSL headers." ON)
 
-INSTALL(FILES ${headers}
+if(INSTALL_POLARSSL_HEADERS)
+
+file(GLOB headers "polarssl/*.h")
+
+install(FILES ${headers}
         DESTINATION include/polarssl
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
+
+endif(INSTALL_POLARSSL_HEADERS)
diff --git a/include/polarssl/asn1.h b/include/polarssl/asn1.h
index fc86fc8..82145c3 100644
--- a/include/polarssl/asn1.h
+++ b/include/polarssl/asn1.h
@@ -52,6 +52,7 @@
 #define POLARSSL_ERR_ASN1_INVALID_LENGTH                   -0x0018  /**< Error when trying to determine the length or invalid length. */
 #define POLARSSL_ERR_ASN1_LENGTH_MISMATCH                  -0x001A  /**< Actual length differs from expected length. */
 #define POLARSSL_ERR_ASN1_INVALID_DATA                     -0x001C  /**< Data is invalid. (not used) */
+#define POLARSSL_ERR_ASN1_MALLOC_FAILED                    -0x001E  /**< Memory allocation failed */
 /* \} name */
 
 /**
diff --git a/include/polarssl/base64.h b/include/polarssl/base64.h
index 9071155..883215d 100644
--- a/include/polarssl/base64.h
+++ b/include/polarssl/base64.h
@@ -29,8 +29,8 @@
 
 #include <string.h>
 
-#define POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL               -0x0010  /**< Output buffer too small. */
-#define POLARSSL_ERR_BASE64_INVALID_CHARACTER              -0x0012  /**< Invalid character in input. */
+#define POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL               -0x002A  /**< Output buffer too small. */
+#define POLARSSL_ERR_BASE64_INVALID_CHARACTER              -0x002C  /**< Invalid character in input. */
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/include/polarssl/bignum.h b/include/polarssl/bignum.h
index b4496b8..f830c08 100644
--- a/include/polarssl/bignum.h
+++ b/include/polarssl/bignum.h
@@ -33,10 +33,11 @@
 #define POLARSSL_ERR_MPI_FILE_IO_ERROR                     -0x0002  /**< An error occurred while reading from or writing to a file. */
 #define POLARSSL_ERR_MPI_BAD_INPUT_DATA                    -0x0004  /**< Bad input parameters to function. */
 #define POLARSSL_ERR_MPI_INVALID_CHARACTER                 -0x0006  /**< There is an invalid character in the digit string. */
-#define POLARSSL_ERR_MPI_BUFFER_TOO_SMALL                  -0x0008  /**< The buffer is too small to write too. */
+#define POLARSSL_ERR_MPI_BUFFER_TOO_SMALL                  -0x0008  /**< The buffer is too small to write to. */
 #define POLARSSL_ERR_MPI_NEGATIVE_VALUE                    -0x000A  /**< The input arguments are negative or result in illegal output. */
 #define POLARSSL_ERR_MPI_DIVISION_BY_ZERO                  -0x000C  /**< The input argument for division is zero, which is not allowed. */
 #define POLARSSL_ERR_MPI_NOT_ACCEPTABLE                    -0x000E  /**< The input arguments are not acceptable. */
+#define POLARSSL_ERR_MPI_MALLOC_FAILED                     -0x0010  /**< Memory allocation failed. */
 
 #define MPI_CHK(f) if( ( ret = f ) != 0 ) goto cleanup
 
@@ -145,7 +146,7 @@
  * \param nblimbs  The target number of limbs
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_grow( mpi *X, size_t nblimbs );
 
@@ -156,7 +157,7 @@
  * \param Y        Source MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_copy( mpi *X, const mpi *Y );
 
@@ -175,7 +176,7 @@
  * \param z        Value to use
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_lset( mpi *X, t_sint z );
 
@@ -200,7 +201,7 @@
  * \param val      The value to set the bit to (0 or 1)
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_BAD_INPUT_DATA if val is not 0 or 1
  */
 int mpi_set_bit( mpi *X, size_t pos, unsigned char val );
@@ -289,7 +290,7 @@
  * \param buflen   Input buffer size
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_read_binary( mpi *X, const unsigned char *buf, size_t buflen );
 
@@ -312,7 +313,7 @@
  * \param count    Amount to shift
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_shift_l( mpi *X, size_t count );
 
@@ -323,7 +324,7 @@
  * \param count    Amount to shift
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_shift_r( mpi *X, size_t count );
 
@@ -371,7 +372,7 @@
  * \param B        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_add_abs( mpi *X, const mpi *A, const mpi *B );
 
@@ -395,7 +396,7 @@
  * \param B        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_add_mpi( mpi *X, const mpi *A, const mpi *B );
 
@@ -407,7 +408,7 @@
  * \param B        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_sub_mpi( mpi *X, const mpi *A, const mpi *B );
 
@@ -419,7 +420,7 @@
  * \param b        The integer value to add
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_add_int( mpi *X, const mpi *A, t_sint b );
 
@@ -431,7 +432,7 @@
  * \param b        The integer value to subtract
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_sub_int( mpi *X, const mpi *A, t_sint b );
 
@@ -443,7 +444,7 @@
  * \param B        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_mul_mpi( mpi *X, const mpi *A, const mpi *B );
 
@@ -457,7 +458,7 @@
  * \param b        The integer value to multiply with
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_mul_int( mpi *X, const mpi *A, t_sint b );
 
@@ -470,7 +471,7 @@
  * \param B        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_DIVISION_BY_ZERO if B == 0
  *
  * \note           Either Q or R can be NULL.
@@ -486,7 +487,7 @@
  * \param b        Integer to divide by
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_DIVISION_BY_ZERO if b == 0
  *
  * \note           Either Q or R can be NULL.
@@ -501,7 +502,7 @@
  * \param B        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_DIVISION_BY_ZERO if B == 0,
  *                 POLARSSL_ERR_MPI_NEGATIVE_VALUE if B < 0
  */
@@ -515,7 +516,7 @@
  * \param b        Integer to divide by
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_DIVISION_BY_ZERO if b == 0,
  *                 POLARSSL_ERR_MPI_NEGATIVE_VALUE if b < 0
  */
@@ -531,7 +532,7 @@
  * \param _RR      Speed-up MPI used for recalculations
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_BAD_INPUT_DATA if N is negative or even
  *
  * \note           _RR is used to avoid re-computing R*R mod N across
@@ -549,7 +550,7 @@
  * \param p_rng    RNG parameter
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_fill_random( mpi *X, size_t size,
                      int (*f_rng)(void *, unsigned char *, size_t),
@@ -563,7 +564,7 @@
  * \param B        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
  */
 int mpi_gcd( mpi *G, const mpi *A, const mpi *B );
 
@@ -575,7 +576,7 @@
  * \param N        Right-hand MPI
  *
  * \return         0 if successful,
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_BAD_INPUT_DATA if N is negative or nil
                    POLARSSL_ERR_MPI_NOT_ACCEPTABLE if A has no inverse mod N
  */
@@ -589,7 +590,7 @@
  * \param p_rng    RNG parameter
  *
  * \return         0 if successful (probably prime),
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_NOT_ACCEPTABLE if X is not prime
  */
 int mpi_is_prime( mpi *X,
@@ -606,7 +607,7 @@
  * \param p_rng    RNG parameter
  *
  * \return         0 if successful (probably prime),
- *                 1 if memory allocation failed,
+ *                 POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
  *                 POLARSSL_ERR_MPI_BAD_INPUT_DATA if nbits is < 3
  */
 int mpi_gen_prime( mpi *X, size_t nbits, int dh_flag,
diff --git a/include/polarssl/ctr_drbg.h b/include/polarssl/ctr_drbg.h
index b2014c2..83861a9 100644
--- a/include/polarssl/ctr_drbg.h
+++ b/include/polarssl/ctr_drbg.h
@@ -34,13 +34,14 @@
 #define POLARSSL_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED        -0x0034  /**< The entropy source failed. */
 #define POLARSSL_ERR_CTR_DRBG_REQUEST_TOO_BIG              -0x0036  /**< Too many random requested in single call. */
 #define POLARSSL_ERR_CTR_DRBG_INPUT_TOO_BIG                -0x0038  /**< Input too large (Entropy + additional). */
+#define POLARSSL_ERR_CTR_DRBG_FILE_IO_ERROR                -0x003A  /**< Read/write error in file. */
 
 #define CTR_DRBG_BLOCKSIZE          16      /**< Block size used by the cipher                  */
 #define CTR_DRBG_KEYSIZE            32      /**< Key size used by the cipher                    */
 #define CTR_DRBG_KEYBITS            ( CTR_DRBG_KEYSIZE * 8 )
 #define CTR_DRBG_SEEDLEN            ( CTR_DRBG_KEYSIZE + CTR_DRBG_BLOCKSIZE )
                                             /**< The seed length (counter + AES key)            */
-#define CTR_DRBG_ENTROPY_LEN        32      /**< Amount of entropy used per seed by default     */
+#define CTR_DRBG_ENTROPY_LEN        48      /**< Amount of entropy used per seed by default     */
 #define CTR_DRBG_RESEED_INTERVAL    10000   /**< Interval before reseed is performed by default */
 #define CTR_DRBG_MAX_INPUT          256     /**< Maximum number of additional input bytes       */
 #define CTR_DRBG_MAX_REQUEST        1024    /**< Maximum number of requested bytes per call     */
diff --git a/include/polarssl/entropy.h b/include/polarssl/entropy.h
index 46df929..aeec8b2 100644
--- a/include/polarssl/entropy.h
+++ b/include/polarssl/entropy.h
@@ -31,10 +31,9 @@
 
 #include "sha4.h"
 
-#define POLARSSL_ERR_ENTROPY_SOURCE_FAILED                 -0x003A  /**< Critical entropy source failure. */
-#define POLARSSL_ERR_ENTROPY_MAX_SOURCES                   -0x003C  /**< No more sources can be added. */
+#define POLARSSL_ERR_ENTROPY_SOURCE_FAILED                 -0x003C  /**< Critical entropy source failure. */
+#define POLARSSL_ERR_ENTROPY_MAX_SOURCES                   -0x003E  /**< No more sources can be added. */
 
-#define ENTROPY_MIN_POOL        128     /**< Minimum amount of pool entropy needed for release */
 #define ENTROPY_MAX_SOURCES     20      /**< Maximum number of sources supported */
 #define ENTROPY_MAX_GATHER      128     /**< Maximum amount requested from entropy sources */
 #define ENTROPY_BLOCK_SIZE      64      /**< Block size of entropy accumulator (SHA-512) */
@@ -59,15 +58,25 @@
 typedef int (*f_source_ptr)(void *, unsigned char *, size_t, size_t *);
 
 /**
+ * \brief           Entropy source state
+ */
+typedef struct
+{
+    f_source_ptr    f_source;   /**< The entropy source callback */
+    void *          p_source;   /**< The callback data pointer */
+    size_t          size;       /**< Amount received */
+    size_t          threshold;  /**< Minimum level required before release */
+}
+source_state;
+
+/**
  * \brief           Entropy context structure
  */
 typedef struct 
 {
     sha4_context    accumulator;
-    size_t          size;
     int             source_count;
-    f_source_ptr    f_source[ENTROPY_MAX_SOURCES];
-    void *          p_source[ENTROPY_MAX_SOURCES];
+    source_state    source[ENTROPY_MAX_SOURCES];
 }
 entropy_context;
 
@@ -84,11 +93,14 @@
  * \param ctx       Entropy context
  * \param f_source  Entropy function
  * \param p_source  Function data
+ * \param threshold Minimum required from source before entropy is released
+ *                  ( with entropy_func() )
  *
  * \return          0 is successful or POLARSSL_ERR_ENTROPY_MAX_SOURCES
  */
 int entropy_add_source( entropy_context *ctx,
-                        f_source_ptr f_source, void *p_source );
+                        f_source_ptr f_source, void *p_source,
+                        size_t threshold );
 
 /**
  * \brief           Trigger an extra gather poll for the accumulator
diff --git a/include/polarssl/entropy_poll.h b/include/polarssl/entropy_poll.h
index d9acbe5..0116598 100644
--- a/include/polarssl/entropy_poll.h
+++ b/include/polarssl/entropy_poll.h
@@ -35,6 +35,13 @@
 extern "C" {
 #endif
 
+/*
+ * Default thresholds for built-in sources
+ */
+#define ENTROPY_MIN_PLATFORM    128     /**< Minimum for platform source    */
+#define ENTROPY_MIN_HAVEGE      128     /**< Minimum for HAVEGE             */
+#define ENTROPY_MIN_HARDCLOCK    32     /**< Minimum for hardclock()        */
+
 #if !defined(POLARSSL_NO_PLATFORM_ENTROPY)
 /**
  * \brief           Platform-specific entropy poll callback
diff --git a/include/polarssl/error.h b/include/polarssl/error.h
index 69e7b04..f167a7b 100644
--- a/include/polarssl/error.h
+++ b/include/polarssl/error.h
@@ -48,27 +48,33 @@
  * Low-level module errors (0x007E-0x0002)
  *
  * Module   Nr  Codes assigned 
- * MPI       7  0x0002-0x000E
- * BASE64    2  0x0010-0x0012
- * ASN1      5  0x0014-0x001C
+ * MPI       7  0x0002-0x0010
+ * ASN1      6  0x0014-0x001E
  * AES       2  0x0020-0x0022
  * CAMELLIA  2  0x0024-0x0026
  * XTEA      1  0x0028-0x0028
+ * BASE64    2  0x002A-0x002C
  * PADLOCK   1  0x0030-0x0030
  * DES       1  0x0032-0x0032
  * NET      11  0x0040-0x0054
- * CTR_DBRG  3  0x0034-0x0038
- * ENTROPY   2  0x003A-0x003C
+ * CTR_DBRG  3  0x0034-0x003A
+ * ENTROPY   2  0x003C-0x003E
+ * MD2       1  0x0070-0x0070
+ * MD4       1  0x0072-0x0072
+ * MD5       1  0x0074-0x0074
+ * SHA1      1  0x0076-0x0076
+ * SHA2      1  0x0078-0x0078
+ * SHA4      1  0x007A-0x007A
  *
  * High-level module nr (3 bits - 0x1...-0x8...)
  * Name     ID  Nr of Errors
  * PEM      1   8
- * X509     2   20
+ * X509     2   21
  * DHM      3   6
  * RSA      4   9
  * MD       5   1
  * CIPER    6   1
- * SSL      7   27
+ * SSL      7   30
  *
  * Module dependent error code (5 bits 0x.08.-0x.F8.)
  */
diff --git a/include/polarssl/md2.h b/include/polarssl/md2.h
index 2726ca3..1f60470 100644
--- a/include/polarssl/md2.h
+++ b/include/polarssl/md2.h
@@ -29,6 +29,8 @@
 
 #include <string.h>
 
+#define POLARSSL_ERR_MD2_FILE_IO_ERROR                 -0x0070  /**< Read/write error in file. */
+
 /**
  * \brief          MD2 context structure
  */
@@ -87,8 +89,7 @@
  * \param path     input file name
  * \param output   MD2 checksum result
  *
- * \return         0 if successful, 1 if fopen failed,
- *                 or 2 if fread failed
+ * \return         0 if successful, or POLARSSL_ERR_MD2_FILE_IO_ERROR
  */
 int md2_file( const char *path, unsigned char output[16] );
 
diff --git a/include/polarssl/md4.h b/include/polarssl/md4.h
index 5a796ae..2bd35ea 100644
--- a/include/polarssl/md4.h
+++ b/include/polarssl/md4.h
@@ -29,6 +29,8 @@
 
 #include <string.h>
 
+#define POLARSSL_ERR_MD4_FILE_IO_ERROR                 -0x0072  /**< Read/write error in file. */
+
 /**
  * \brief          MD4 context structure
  */
@@ -86,8 +88,7 @@
  * \param path     input file name
  * \param output   MD4 checksum result
  *
- * \return         0 if successful, 1 if fopen failed,
- *                 or 2 if fread failed
+ * \return         0 if successful, or POLARSSL_ERR_MD4_FILE_IO_ERROR
  */
 int md4_file( const char *path, unsigned char output[16] );
 
diff --git a/include/polarssl/md5.h b/include/polarssl/md5.h
index cf0459d..936e9c9 100644
--- a/include/polarssl/md5.h
+++ b/include/polarssl/md5.h
@@ -29,6 +29,8 @@
 
 #include <string.h>
 
+#define POLARSSL_ERR_MD5_FILE_IO_ERROR                 -0x0074  /**< Read/write error in file. */
+
 /**
  * \brief          MD5 context structure
  */
@@ -86,8 +88,7 @@
  * \param path     input file name
  * \param output   MD5 checksum result
  *
- * \return         0 if successful, 1 if fopen failed,
- *                 or 2 if fread failed
+ * \return         0 if successful, or POLARSSL_ERR_MD5_FILE_IO_ERROR
  */
 int md5_file( const char *path, unsigned char output[16] );
 
diff --git a/include/polarssl/sha1.h b/include/polarssl/sha1.h
index 76b369a..0d5e67e 100644
--- a/include/polarssl/sha1.h
+++ b/include/polarssl/sha1.h
@@ -29,6 +29,8 @@
 
 #include <string.h>
 
+#define POLARSSL_ERR_SHA1_FILE_IO_ERROR                -0x0076  /**< Read/write error in file. */
+
 /**
  * \brief          SHA-1 context structure
  */
@@ -86,8 +88,7 @@
  * \param path     input file name
  * \param output   SHA-1 checksum result
  *
- * \return         0 if successful, 1 if fopen failed,
- *                 or 2 if fread failed
+ * \return         0 if successful, or POLARSSL_ERR_SHA1_FILE_IO_ERROR
  */
 int sha1_file( const char *path, unsigned char output[20] );
 
diff --git a/include/polarssl/sha2.h b/include/polarssl/sha2.h
index c963ca1..811b0fd 100644
--- a/include/polarssl/sha2.h
+++ b/include/polarssl/sha2.h
@@ -29,6 +29,8 @@
 
 #include <string.h>
 
+#define POLARSSL_ERR_SHA2_FILE_IO_ERROR                -0x0078  /**< Read/write error in file. */
+
 /**
  * \brief          SHA-256 context structure
  */
@@ -91,8 +93,7 @@
  * \param output   SHA-224/256 checksum result
  * \param is224    0 = use SHA256, 1 = use SHA224
  *
- * \return         0 if successful, 1 if fopen failed,
- *                 or 2 if fread failed
+ * \return         0 if successful, or POLARSSL_ERR_SHA2_FILE_IO_ERROR
  */
 int sha2_file( const char *path, unsigned char output[32], int is224 );
 
diff --git a/include/polarssl/sha4.h b/include/polarssl/sha4.h
index 06a85f1..dafebec 100644
--- a/include/polarssl/sha4.h
+++ b/include/polarssl/sha4.h
@@ -29,6 +29,8 @@
 
 #include <string.h>
 
+#define POLARSSL_ERR_SHA4_FILE_IO_ERROR                -0x007A  /**< Read/write error in file. */
+
 #if defined(_MSC_VER) || defined(__WATCOMC__)
   #define UL64(x) x##ui64
   #define long64 __int64
@@ -99,8 +101,7 @@
  * \param output   SHA-384/512 checksum result
  * \param is384    0 = use SHA512, 1 = use SHA384
  *
- * \return         0 if successful, 1 if fopen failed,
- *                 or 2 if fread failed
+ * \return         0 if successful, or POLARSSL_ERR_SHA4_FILE_IO_ERROR
  */
 int sha4_file( const char *path, unsigned char output[64], int is384 );
 
diff --git a/include/polarssl/ssl.h b/include/polarssl/ssl.h
index 02d75c7..c897a1e 100644
--- a/include/polarssl/ssl.h
+++ b/include/polarssl/ssl.h
@@ -81,6 +81,7 @@
 #define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY         -0x7D80  /**< Processing of the CertificateVerify handshake message failed. */
 #define POLARSSL_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC         -0x7E00  /**< Processing of the ChangeCipherSpec handshake message failed. */
 #define POLARSSL_ERR_SSL_BAD_HS_FINISHED                   -0x7E80  /**< Processing of the Finished handshake message failed. */
+#define POLARSSL_ERR_SSL_MALLOC_FAILED                     -0x7F00  /**< Memory allocation failed */
 
 /*
  * Various constants
@@ -373,7 +374,8 @@
  *
  * \param ssl      SSL context
  *
- * \return         0 if successful, or 1 if memory allocation failed
+ * \return         0 if successful, or POLARSSL_ERR_SSL_MALLOC_FAILED if
+ *                 memory allocation failed
  */
 int ssl_init( ssl_context *ssl );
 
diff --git a/include/polarssl/x509.h b/include/polarssl/x509.h
index 11f1a31..cd0dc84 100644
--- a/include/polarssl/x509.h
+++ b/include/polarssl/x509.h
@@ -59,7 +59,9 @@
 #define POLARSSL_ERR_X509_KEY_INVALID_VERSION              -0x2880  /**< Unsupported RSA key version */
 #define POLARSSL_ERR_X509_KEY_INVALID_FORMAT               -0x2900  /**< Invalid RSA key tag or value. */
 #define POLARSSL_ERR_X509_CERT_UNKNOWN_FORMAT              -0x2980  /**< Format not recognized as DER or PEM. */
-#define POLARSSL_ERR_X509_VALUE_TO_LENGTH                  -0x2A00  /**< Not used. */
+#define POLARSSL_ERR_X509_INVALID_INPUT                    -0x2A00  /**< Input invalid. */
+#define POLARSSL_ERR_X509_MALLOC_FAILED                    -0x2A80  /**< Allocation of memory failed. */
+#define POLARSSL_ERR_X509_FILE_IO_ERROR                    -0x2B00  /**< Read/write of file failed. */
 /* \} name */
 
 
@@ -227,10 +229,6 @@
 #define X509_FORMAT_DER                 1
 #define X509_FORMAT_PEM                 2
 
-#define X509_NON_PERMISSIVE             0
-#define X509_PERMISSIVE                 1
-
-
 /** 
  * \addtogroup x509_module
  * \{ */
@@ -420,34 +418,35 @@
 /** \ingroup x509_module */
 /**
  * \brief          Parse one or more certificates and add them
- *                 to the chained list. With permissive parsing enabled
- *                 all certificates that cannot be parsed are ignored.
- *                 If none complete correctly, the first error is returned.
+ *                 to the chained list. Parses permissively. If some
+ *                 certificates can be parsed, the result is the number
+ *                 of failed certificates it encountered. If none complete
+ *                 correctly, the first error is returned.
  *
  * \param chain    points to the start of the chain
  * \param buf      buffer holding the certificate data
  * \param buflen   size of the buffer
- * \param permissive    X509_PERMISSIVE or X509_NON_PERMISSIVE
  *
- * \return         0 if successful, or a specific X509 or PEM error code
+ * \return         0 if all certificates parsed successfully, a positive number
+ *                 if partly successful or a specific X509 or PEM error code
  */
-int x509parse_crt( x509_cert *chain, const unsigned char *buf, size_t buflen,
-                   int permissive );
+int x509parse_crt( x509_cert *chain, const unsigned char *buf, size_t buflen );
 
 /** \ingroup x509_module */
 /**
  * \brief          Load one or more certificates and add them
- *                 to the chained list. With permissive parsing enabled
- *                 all certificates that cannot be parsed are ignored.
- *                 If none complete correctly, the first error is returned.
+ *                 to the chained list. Parses permissively. If some
+ *                 certificates can be parsed, the result is the number
+ *                 of failed certificates it encountered. If none complete
+ *                 correctly, the first error is returned.
  *
  * \param chain    points to the start of the chain
  * \param path     filename to read the certificates from
- * \param permissive    X509_PERMISSIVE or X509_NON_PERMISSIVE
  *
- * \return         0 if successful, or a specific X509 or PEM error code
+ * \return         0 if all certificates parsed successfully, a positive number
+ *                 if partly successful or a specific X509 or PEM error code
  */
-int x509parse_crtfile( x509_cert *chain, const char *path, int permissive );
+int x509parse_crtfile( x509_cert *chain, const char *path );
 
 /** \ingroup x509_module */
 /**
@@ -552,8 +551,6 @@
 
 /** \} name Functions to read in DHM parameters, a certificate, CRL or private RSA key */
 
-
-
 /**
  * \brief          Store the certificate DN in printable form into buf;
  *                 no more than size characters will be written.