diff --git a/ChangeLog b/ChangeLog
index 8616934..28093ae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,6 +13,8 @@
      Migration helpers scripts/rename.pl and include/mbedlts/compat-1.3.h are
      provided.
    * Headers are now found in the 'mbedtls' directory (previously 'polarssl').
+   * Error codes NET_WANT_READ and NET_WANT_WRITE have been moved to the SSL
+     module and renamed accordingly (handled by rename.pl and compat-1.3.h)
    * The following _init() functions that could return errors have
      been split into an _init() that returns void and another function:
      mbedtls_ssl_init() -> mbedtls_ssl_setup()
diff --git a/include/mbedtls/compat-1.3.h b/include/mbedtls/compat-1.3.h
index 21c507e..8b85656 100644
--- a/include/mbedtls/compat-1.3.h
+++ b/include/mbedtls/compat-1.3.h
@@ -1161,10 +1161,10 @@
 #define POLARSSL_ERR_NET_RECV_FAILED MBEDTLS_ERR_NET_RECV_FAILED
 #define POLARSSL_ERR_NET_SEND_FAILED MBEDTLS_ERR_NET_SEND_FAILED
 #define POLARSSL_ERR_NET_SOCKET_FAILED MBEDTLS_ERR_NET_SOCKET_FAILED
-#define POLARSSL_ERR_NET_TIMEOUT MBEDTLS_ERR_NET_TIMEOUT
+#define POLARSSL_ERR_NET_TIMEOUT MBEDTLS_ERR_SSL_TIMEOUT
 #define POLARSSL_ERR_NET_UNKNOWN_HOST MBEDTLS_ERR_NET_UNKNOWN_HOST
-#define POLARSSL_ERR_NET_WANT_READ MBEDTLS_ERR_NET_WANT_READ
-#define POLARSSL_ERR_NET_WANT_WRITE MBEDTLS_ERR_NET_WANT_WRITE
+#define POLARSSL_ERR_NET_WANT_READ MBEDTLS_ERR_SSL_WANT_READ
+#define POLARSSL_ERR_NET_WANT_WRITE MBEDTLS_ERR_SSL_WANT_WRITE
 #define POLARSSL_ERR_OID_BUF_TOO_SMALL MBEDTLS_ERR_OID_BUF_TOO_SMALL
 #define POLARSSL_ERR_OID_NOT_FOUND MBEDTLS_ERR_OID_NOT_FOUND
 #define POLARSSL_ERR_PADLOCK_DATA_MISALIGNED MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED
diff --git a/include/mbedtls/error.h b/include/mbedtls/error.h
index 099fa42..c3b0b15 100644
--- a/include/mbedtls/error.h
+++ b/include/mbedtls/error.h
@@ -62,7 +62,7 @@
  * DES       1  0x0032-0x0032
  * CTR_DBRG  4  0x0034-0x003A
  * ENTROPY   3  0x003C-0x0040
- * NET      12  0x0042-0x0056   0x0011-0x0011
+ * NET       9  0x0042-0x0052
  * ENTROPY   1  0x0058-0x0058
  * ASN1      7  0x0060-0x006C
  * MD2       1  0x0070-0x0070
@@ -88,7 +88,7 @@
  * ECP       4   8 (Started from top)
  * MD        5   4
  * CIPHER    6   6
- * SSL       6   13 (Started from top)
+ * SSL       6   16 (Started from top)
  * SSL       7   31
  *
  * Module dependent error code (5 bits 0x.00.-0x.F8.)
diff --git a/include/mbedtls/net.h b/include/mbedtls/net.h
index 85fa3e7..077fa3d 100644
--- a/include/mbedtls/net.h
+++ b/include/mbedtls/net.h
@@ -30,6 +30,8 @@
 #include MBEDTLS_CONFIG_FILE
 #endif
 
+#include "ssl.h"
+
 #include <stddef.h>
 #include <stdint.h>
 
@@ -41,10 +43,7 @@
 #define MBEDTLS_ERR_NET_RECV_FAILED                       -0x004C  /**< Reading information from the socket failed. */
 #define MBEDTLS_ERR_NET_SEND_FAILED                       -0x004E  /**< Sending information through the socket failed. */
 #define MBEDTLS_ERR_NET_CONN_RESET                        -0x0050  /**< Connection was reset by peer. */
-#define MBEDTLS_ERR_NET_WANT_READ                         -0x0052  /**< Connection requires a read call. */
-#define MBEDTLS_ERR_NET_WANT_WRITE                        -0x0054  /**< Connection requires a write call. */
-#define MBEDTLS_ERR_NET_UNKNOWN_HOST                      -0x0056  /**< Failed to get an IP address for the given hostname. */
-#define MBEDTLS_ERR_NET_TIMEOUT                           -0x0011  /**< The operation timed out. */
+#define MBEDTLS_ERR_NET_UNKNOWN_HOST                      -0x0052  /**< Failed to get an IP address for the given hostname. */
 
 #define MBEDTLS_NET_LISTEN_BACKLOG         10 /**< The backlog that listen() should use. */
 
@@ -100,7 +99,7 @@
  *                  Must be at least 4 bytes, or 16 if IPv6 is supported
  *
  * \return          0 if successful, MBEDTLS_ERR_NET_ACCEPT_FAILED, or
- *                  MBEDTLS_ERR_NET_WANT_READ is bind_fd was set to
+ *                  MBEDTLS_ERR_SSL_WANT_READ is bind_fd was set to
  *                  non-blocking and accept() is blocking.
  *
  * \note            With UDP, connects the bind_fd to the client and just copy
@@ -148,8 +147,9 @@
  * \param len      Maximum length of the buffer
  *
  * \return         This function returns the number of bytes received,
- *                 or a non-zero error code; MBEDTLS_ERR_NET_WANT_READ
- *                 indicates read() is blocking.
+ *                 or a non-zero error code; with a non-blocking socket,
+ *                 MBEDTLS_ERR_SSL_WANT_READ indicates read() would be
+ *                 blocking.
  */
 int mbedtls_net_recv( void *ctx, unsigned char *buf, size_t len );
 
@@ -162,8 +162,9 @@
  * \param len      The length of the buffer
  *
  * \return         This function returns the number of bytes sent,
- *                 or a non-zero error code; MBEDTLS_ERR_NET_WANT_WRITE
- *                 indicates write() is blocking.
+ *                 or a non-zero error code; with a non-blocking socket,
+ *                 MBEDTLS_ERR_SSL_WANT_WRITE indicates write() would be
+ *                 blocking.
  */
 int mbedtls_net_send( void *ctx, const unsigned char *buf, size_t len );
 
@@ -180,8 +181,8 @@
  *
  * \return         This function returns the number of bytes received,
  *                 or a non-zero error code:
- *                 MBEDTLS_ERR_NET_TIMEOUT if the operation timed out,
- *                 MBEDTLS_ERR_NET_WANT_READ if interrupted by a signal.
+ *                 MBEDTLS_ERR_SSL_TIMEOUT if the operation timed out,
+ *                 MBEDTLS_ERR_SSL_WANT_READ if interrupted by a signal.
  *
  * \note           This function will block (until data becomes available or
  *                 timeout is reached) even if the socket is set to
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 0a517de..92420b5 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -30,7 +30,6 @@
 #include MBEDTLS_CONFIG_FILE
 #endif
 
-#include "net.h"
 #include "bignum.h"
 #include "ecp.h"
 
@@ -151,6 +150,9 @@
 #define MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED             -0x6A80  /**< DTLS client must retry for hello verification */
 #define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL                  -0x6A00  /**< A buffer is too small to receive or write a message */
 #define MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE             -0x6980  /**< None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages). */
+#define MBEDTLS_ERR_SSL_WANT_READ                         -0x6900  /**< Connection requires a read call. */
+#define MBEDTLS_ERR_SSL_WANT_WRITE                        -0x6880  /**< Connection requires a write call. */
+#define MBEDTLS_ERR_SSL_TIMEOUT                           -0x6800  /**< The operation timed out. */
 
 /*
  * Various constants
@@ -1269,7 +1271,7 @@
  * \param p_bio    parameter (context) shared by BIO callbacks
  * \param f_send   write callback
  * \param f_recv   read callback
- * \param f_recv_timeout read callback with timeout.
+ * \param f_recv_timeout blocking read callback with timeout.
  *                 The last argument of the callback is the timeout in seconds
  *
  * \note           f_recv_timeout is required for DTLS, unless f_recv performs
@@ -2119,8 +2121,8 @@
  *
  * \param ssl      SSL context
  *
- * \return         0 if successful, MBEDTLS_ERR_NET_WANT_READ,
- *                 MBEDTLS_ERR_NET_WANT_WRITE, or a specific SSL error code.
+ * \return         0 if successful, MBEDTLS_ERR_SSL_WANT_READ,
+ *                 MBEDTLS_ERR_SSL_WANT_WRITE, or a specific SSL error code.
  */
 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl );
 
@@ -2133,8 +2135,8 @@
  *
  * \param ssl      SSL context
  *
- * \return         0 if successful, MBEDTLS_ERR_NET_WANT_READ,
- *                 MBEDTLS_ERR_NET_WANT_WRITE, or a specific SSL error code.
+ * \return         0 if successful, MBEDTLS_ERR_SSL_WANT_READ,
+ *                 MBEDTLS_ERR_SSL_WANT_WRITE, or a specific SSL error code.
  */
 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl );
 
@@ -2174,7 +2176,7 @@
  * \return         This function returns the number of bytes written,
  *                 or a negative error code.
  *
- * \note           When this function returns MBEDTLS_ERR_NET_WANT_WRITE,
+ * \note           When this function returns MBEDTLS_ERR_SSL_WANT_WRITE,
  *                 it must be called later with the *same* arguments,
  *                 until it returns a positive value.
  *
diff --git a/library/error.c b/library/error.c
index 4281e89..1a82cc9 100644
--- a/library/error.c
+++ b/library/error.c
@@ -457,6 +457,12 @@
             mbedtls_snprintf( buf, buflen, "SSL - A buffer is too small to receive or write a message" );
         if( use_ret == -(MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE) )
             mbedtls_snprintf( buf, buflen, "SSL - None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages)" );
+        if( use_ret == -(MBEDTLS_ERR_SSL_WANT_READ) )
+            mbedtls_snprintf( buf, buflen, "SSL - Connection requires a read call" );
+        if( use_ret == -(MBEDTLS_ERR_SSL_WANT_WRITE) )
+            mbedtls_snprintf( buf, buflen, "SSL - Connection requires a write call" );
+        if( use_ret == -(MBEDTLS_ERR_SSL_TIMEOUT) )
+            mbedtls_snprintf( buf, buflen, "SSL - The operation timed out" );
 #endif /* MBEDTLS_SSL_TLS_C */
 
 #if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)
@@ -675,14 +681,8 @@
         mbedtls_snprintf( buf, buflen, "NET - Sending information through the socket failed" );
     if( use_ret == -(MBEDTLS_ERR_NET_CONN_RESET) )
         mbedtls_snprintf( buf, buflen, "NET - Connection was reset by peer" );
-    if( use_ret == -(MBEDTLS_ERR_NET_WANT_READ) )
-        mbedtls_snprintf( buf, buflen, "NET - Connection requires a read call" );
-    if( use_ret == -(MBEDTLS_ERR_NET_WANT_WRITE) )
-        mbedtls_snprintf( buf, buflen, "NET - Connection requires a write call" );
     if( use_ret == -(MBEDTLS_ERR_NET_UNKNOWN_HOST) )
         mbedtls_snprintf( buf, buflen, "NET - Failed to get an IP address for the given hostname" );
-    if( use_ret == -(MBEDTLS_ERR_NET_TIMEOUT) )
-        mbedtls_snprintf( buf, buflen, "NET - The operation timed out" );
 #endif /* MBEDTLS_NET_C */
 
 #if defined(MBEDTLS_OID_C)
diff --git a/library/net.c b/library/net.c
index 0db8834..a372134 100644
--- a/library/net.c
+++ b/library/net.c
@@ -338,7 +338,7 @@
     if( ret < 0 )
     {
         if( net_would_block( bind_fd ) != 0 )
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
 
         return( MBEDTLS_ERR_NET_ACCEPT_FAILED );
     }
@@ -425,7 +425,7 @@
     if( ret < 0 )
     {
         if( net_would_block( fd ) != 0 )
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
 
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
@@ -436,7 +436,7 @@
             return( MBEDTLS_ERR_NET_CONN_RESET );
 
         if( errno == EINTR )
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
 #endif
 
         return( MBEDTLS_ERR_NET_RECV_FAILED );
@@ -467,17 +467,17 @@
 
     /* Zero fds ready means we timed out */
     if( ret == 0 )
-        return( MBEDTLS_ERR_NET_TIMEOUT );
+        return( MBEDTLS_ERR_SSL_TIMEOUT );
 
     if( ret < 0 )
     {
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
         if( WSAGetLastError() == WSAEINTR )
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
 #else
         if( errno == EINTR )
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
 #endif
 
         return( MBEDTLS_ERR_NET_RECV_FAILED );
@@ -499,7 +499,7 @@
     if( ret < 0 )
     {
         if( net_would_block( fd ) != 0 )
-            return( MBEDTLS_ERR_NET_WANT_WRITE );
+            return( MBEDTLS_ERR_SSL_WANT_WRITE );
 
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
@@ -510,7 +510,7 @@
             return( MBEDTLS_ERR_NET_CONN_RESET );
 
         if( errno == EINTR )
-            return( MBEDTLS_ERR_NET_WANT_WRITE );
+            return( MBEDTLS_ERR_SSL_WANT_WRITE );
 #endif
 
         return( MBEDTLS_ERR_NET_SEND_FAILED );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 1e176b4..229536d 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2264,7 +2264,7 @@
          * that will end up being dropped.
          */
         if( ssl_check_timer( ssl ) != 0 )
-            ret = MBEDTLS_ERR_NET_TIMEOUT;
+            ret = MBEDTLS_ERR_SSL_TIMEOUT;
         else
         {
             len = MBEDTLS_SSL_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf );
@@ -2288,7 +2288,7 @@
                 return( MBEDTLS_ERR_SSL_CONN_EOF );
         }
 
-        if( ret == MBEDTLS_ERR_NET_TIMEOUT )
+        if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
             ssl_set_timer( ssl, 0 );
@@ -2298,7 +2298,7 @@
                 if( ssl_double_retransmit_timeout( ssl ) != 0 )
                 {
                     MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
-                    return( MBEDTLS_ERR_NET_TIMEOUT );
+                    return( MBEDTLS_ERR_SSL_TIMEOUT );
                 }
 
                 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
@@ -2307,7 +2307,7 @@
                     return( ret );
                 }
 
-                return( MBEDTLS_ERR_NET_WANT_READ );
+                return( MBEDTLS_ERR_SSL_WANT_READ );
             }
 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
             else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
@@ -2319,7 +2319,7 @@
                     return( ret );
                 }
 
-                return( MBEDTLS_ERR_NET_WANT_READ );
+                return( MBEDTLS_ERR_SSL_WANT_READ );
             }
 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
         }
@@ -2964,7 +2964,7 @@
     if( ssl_bitmask_check( bitmask, msg_len ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "message is not complete yet" ) );
-        return( MBEDTLS_ERR_NET_WANT_READ );
+        return( MBEDTLS_ERR_SSL_WANT_READ );
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake message completed" ) );
@@ -3070,7 +3070,7 @@
                                     ssl->handshake->in_msg_seq ) );
             }
 
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
         }
         /* Wait until message completion to increment in_msg_seq */
 
@@ -3584,7 +3584,7 @@
                 return( ret );
             }
 
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
         }
         else
         {
@@ -6063,7 +6063,7 @@
                 /* With DTLS, drop the packet (probably from last handshake) */
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
                 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-                    return( MBEDTLS_ERR_NET_WANT_READ );
+                    return( MBEDTLS_ERR_SSL_WANT_READ );
 #endif
                 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
             }
@@ -6076,7 +6076,7 @@
                 /* With DTLS, drop the packet (probably from last handshake) */
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
                 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-                    return( MBEDTLS_ERR_NET_WANT_READ );
+                    return( MBEDTLS_ERR_SSL_WANT_READ );
 #endif
                 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
             }
@@ -6144,7 +6144,7 @@
             /* If a non-handshake record was read during renego, fallthrough,
              * else tell the user they should call mbedtls_ssl_read() again */
             if( ! record_read )
-                return( MBEDTLS_ERR_NET_WANT_READ );
+                return( MBEDTLS_ERR_SSL_WANT_READ );
         }
         else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
         {
@@ -6165,7 +6165,7 @@
         if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
-            return( MBEDTLS_ERR_NET_WANT_READ );
+            return( MBEDTLS_ERR_SSL_WANT_READ );
         }
 
         if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
diff --git a/programs/ssl/dtls_client.c b/programs/ssl/dtls_client.c
index 35b7468..58068bc 100644
--- a/programs/ssl/dtls_client.c
+++ b/programs/ssl/dtls_client.c
@@ -202,8 +202,8 @@
     fflush( stdout );
 
     do ret = mbedtls_ssl_handshake( &ssl );
-    while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-           ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+           ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
     if( ret != 0 )
     {
@@ -252,8 +252,8 @@
     len = sizeof( MESSAGE ) - 1;
 
     do ret = mbedtls_ssl_write( &ssl, (unsigned char *) MESSAGE, len );
-    while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-           ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+           ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
     if( ret < 0 )
     {
@@ -274,14 +274,14 @@
     memset( buf, 0, sizeof( buf ) );
 
     do ret = mbedtls_ssl_read( &ssl, buf, len );
-    while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-           ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+           ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
     if( ret <= 0 )
     {
         switch( ret )
         {
-            case MBEDTLS_ERR_NET_TIMEOUT:
+            case MBEDTLS_ERR_SSL_TIMEOUT:
                 mbedtls_printf( " timeout\n\n" );
                 if( retry_left-- > 0 )
                     goto send_request;
@@ -309,7 +309,7 @@
 
     /* No error checking, the connection might be closed already */
     do ret = mbedtls_ssl_close_notify( &ssl );
-    while( ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_WRITE );
     ret = 0;
 
     mbedtls_printf( " done\n" );
diff --git a/programs/ssl/dtls_server.c b/programs/ssl/dtls_server.c
index f412335..ef899e4 100644
--- a/programs/ssl/dtls_server.c
+++ b/programs/ssl/dtls_server.c
@@ -291,8 +291,8 @@
     fflush( stdout );
 
     do ret = mbedtls_ssl_handshake( &ssl );
-    while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-           ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+           ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
     if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
     {
@@ -318,14 +318,14 @@
     memset( buf, 0, sizeof( buf ) );
 
     do ret = mbedtls_ssl_read( &ssl, buf, len );
-    while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-           ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+           ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
     if( ret <= 0 )
     {
         switch( ret )
         {
-            case MBEDTLS_ERR_NET_TIMEOUT:
+            case MBEDTLS_ERR_SSL_TIMEOUT:
                 printf( " timeout\n\n" );
                 goto reset;
 
@@ -350,8 +350,8 @@
     fflush( stdout );
 
     do ret = mbedtls_ssl_write( &ssl, buf, len );
-    while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-           ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+           ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
     if( ret < 0 )
     {
@@ -370,7 +370,7 @@
 
     /* No error checking, the connection might be closed already */
     do ret = mbedtls_ssl_close_notify( &ssl );
-    while( ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_WRITE );
     ret = 0;
 
     printf( " done\n" );
diff --git a/programs/ssl/ssl_client1.c b/programs/ssl/ssl_client1.c
index 7881272..cac0a1b 100644
--- a/programs/ssl/ssl_client1.c
+++ b/programs/ssl/ssl_client1.c
@@ -188,7 +188,7 @@
 
     while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret );
             goto exit;
@@ -226,7 +226,7 @@
 
     while( ( ret = mbedtls_ssl_write( &ssl, buf, len ) ) <= 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
             goto exit;
@@ -248,7 +248,7 @@
         memset( buf, 0, sizeof( buf ) );
         ret = mbedtls_ssl_read( &ssl, buf, len );
 
-        if( ret == MBEDTLS_ERR_NET_WANT_READ || ret == MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
             continue;
 
         if( ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY )
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index 6503d8b..27d87cb 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -334,11 +334,11 @@
     if( first_try )
     {
         first_try = 0;
-        return( MBEDTLS_ERR_NET_WANT_READ );
+        return( MBEDTLS_ERR_SSL_WANT_READ );
     }
 
     ret = mbedtls_net_recv( ctx, buf, len );
-    if( ret != MBEDTLS_ERR_NET_WANT_READ )
+    if( ret != MBEDTLS_ERR_SSL_WANT_READ )
         first_try = 1; /* Next call will be a new operation */
     return( ret );
 }
@@ -351,11 +351,11 @@
     if( first_try )
     {
         first_try = 0;
-        return( MBEDTLS_ERR_NET_WANT_WRITE );
+        return( MBEDTLS_ERR_SSL_WANT_WRITE );
     }
 
     ret = mbedtls_net_send( ctx, buf, len );
-    if( ret != MBEDTLS_ERR_NET_WANT_WRITE )
+    if( ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         first_try = 1; /* Next call will be a new operation */
     return( ret );
 }
@@ -1217,7 +1217,7 @@
 
     while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned -0x%x\n", -ret );
             if( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED )
@@ -1303,8 +1303,8 @@
         fflush( stdout );
         while( ( ret = mbedtls_ssl_renegotiate( &ssl ) ) != 0 )
         {
-            if( ret != MBEDTLS_ERR_NET_WANT_READ &&
-                ret != MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                ret != MBEDTLS_ERR_SSL_WANT_WRITE )
             {
                 mbedtls_printf( " failed\n  ! mbedtls_ssl_renegotiate returned %d\n\n", ret );
                 goto exit;
@@ -1355,8 +1355,8 @@
             while( ( ret = mbedtls_ssl_write( &ssl, buf + written, len - written ) )
                            <= 0 )
             {
-                if( ret != MBEDTLS_ERR_NET_WANT_READ &&
-                    ret != MBEDTLS_ERR_NET_WANT_WRITE )
+                if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                    ret != MBEDTLS_ERR_SSL_WANT_WRITE )
                 {
                     mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned -0x%x\n\n", -ret );
                     goto exit;
@@ -1367,8 +1367,8 @@
     else /* Not stream, so datagram */
     {
         do ret = mbedtls_ssl_write( &ssl, buf, len );
-        while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-               ret == MBEDTLS_ERR_NET_WANT_WRITE );
+        while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+               ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
         if( ret < 0 )
         {
@@ -1400,8 +1400,8 @@
             memset( buf, 0, sizeof( buf ) );
             ret = mbedtls_ssl_read( &ssl, buf, len );
 
-            if( ret == MBEDTLS_ERR_NET_WANT_READ ||
-                ret == MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+                ret == MBEDTLS_ERR_SSL_WANT_WRITE )
                 continue;
 
             if( ret <= 0 )
@@ -1445,14 +1445,14 @@
         memset( buf, 0, sizeof( buf ) );
 
         do ret = mbedtls_ssl_read( &ssl, buf, len );
-        while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-               ret == MBEDTLS_ERR_NET_WANT_WRITE );
+        while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+               ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
         if( ret <= 0 )
         {
             switch( ret )
             {
-                case MBEDTLS_ERR_NET_TIMEOUT:
+                case MBEDTLS_ERR_SSL_TIMEOUT:
                     mbedtls_printf( " timeout\n" );
                     if( retry_left-- > 0 )
                         goto send_request;
@@ -1489,7 +1489,7 @@
 
     /* No error checking, the connection might be closed already */
     do ret = mbedtls_ssl_close_notify( &ssl );
-    while( ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_WRITE );
     ret = 0;
 
     mbedtls_printf( " done\n" );
@@ -1545,8 +1545,8 @@
 
         while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
         {
-            if( ret != MBEDTLS_ERR_NET_WANT_READ &&
-                ret != MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                ret != MBEDTLS_ERR_SSL_WANT_WRITE )
             {
                 mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret );
                 goto exit;
diff --git a/programs/ssl/ssl_fork_server.c b/programs/ssl/ssl_fork_server.c
index e743e3e..61a59c6 100644
--- a/programs/ssl/ssl_fork_server.c
+++ b/programs/ssl/ssl_fork_server.c
@@ -284,7 +284,7 @@
 
         while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
         {
-            if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
             {
                 mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned %d\n\n", ret );
                 goto exit;
@@ -305,7 +305,7 @@
             memset( buf, 0, sizeof( buf ) );
             ret = mbedtls_ssl_read( &ssl, buf, len );
 
-            if( ret == MBEDTLS_ERR_NET_WANT_READ || ret == MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
                 continue;
 
             if( ret <= 0 )
@@ -355,7 +355,7 @@
                     goto exit;
                 }
 
-                if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+                if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
                 {
                     mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
                     goto exit;
diff --git a/programs/ssl/ssl_mail_client.c b/programs/ssl/ssl_mail_client.c
index db51399..139c1ad 100644
--- a/programs/ssl/ssl_mail_client.c
+++ b/programs/ssl/ssl_mail_client.c
@@ -177,7 +177,7 @@
 
     while( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
 #if defined(MBEDTLS_ERROR_C)
             mbedtls_strerror( ret, (char *) buf, 1024 );
@@ -224,7 +224,7 @@
     mbedtls_printf("\n%s", buf);
     while( len && ( ret = mbedtls_ssl_write( ssl, buf, len ) ) <= 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
             return -1;
@@ -244,7 +244,7 @@
     mbedtls_printf("\n%s", buf);
     while( len && ( ret = mbedtls_ssl_write( ssl, buf, len ) ) <= 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
             return -1;
@@ -257,7 +257,7 @@
         memset( data, 0, sizeof( data ) );
         ret = mbedtls_ssl_read( ssl, data, len );
 
-        if( ret == MBEDTLS_ERR_NET_WANT_READ || ret == MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
             continue;
 
         if( ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY )
diff --git a/programs/ssl/ssl_pthread_server.c b/programs/ssl/ssl_pthread_server.c
index cbe6b4d..162d5ca 100644
--- a/programs/ssl/ssl_pthread_server.c
+++ b/programs/ssl/ssl_pthread_server.c
@@ -208,7 +208,7 @@
 
     while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( "  [ #%d ]  failed: mbedtls_ssl_handshake returned -0x%04x\n",
                     thread_id, -ret );
@@ -229,7 +229,7 @@
         memset( buf, 0, sizeof( buf ) );
         ret = mbedtls_ssl_read( &ssl, buf, len );
 
-        if( ret == MBEDTLS_ERR_NET_WANT_READ || ret == MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
             continue;
 
         if( ret <= 0 )
@@ -279,7 +279,7 @@
             goto thread_exit;
         }
 
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( "  [ #%d ]  failed: mbedtls_ssl_write returned -0x%04x\n",
                     thread_id, ret );
@@ -295,8 +295,8 @@
 
     while( ( ret = mbedtls_ssl_close_notify( &ssl ) ) < 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ &&
-            ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
+            ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( "  [ #%d ]  failed: mbedtls_ssl_close_notify returned -0x%04x\n",
                     thread_id, ret );
diff --git a/programs/ssl/ssl_server.c b/programs/ssl/ssl_server.c
index 583cfdd..c11fbd5 100644
--- a/programs/ssl/ssl_server.c
+++ b/programs/ssl/ssl_server.c
@@ -264,7 +264,7 @@
 
     while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned %d\n\n", ret );
             goto reset;
@@ -285,7 +285,7 @@
         memset( buf, 0, sizeof( buf ) );
         ret = mbedtls_ssl_read( &ssl, buf, len );
 
-        if( ret == MBEDTLS_ERR_NET_WANT_READ || ret == MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
             continue;
 
         if( ret <= 0 )
@@ -333,7 +333,7 @@
             goto reset;
         }
 
-        if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
             goto exit;
@@ -347,8 +347,8 @@
 
     while( ( ret = mbedtls_ssl_close_notify( &ssl ) ) < 0 )
     {
-        if( ret != MBEDTLS_ERR_NET_WANT_READ &&
-            ret != MBEDTLS_ERR_NET_WANT_WRITE )
+        if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
+            ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         {
             mbedtls_printf( " failed\n  ! mbedtls_ssl_close_notify returned %d\n\n", ret );
             goto reset;
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 7b85ce8..6f6836d 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -409,11 +409,11 @@
     if( first_try )
     {
         first_try = 0;
-        return( MBEDTLS_ERR_NET_WANT_READ );
+        return( MBEDTLS_ERR_SSL_WANT_READ );
     }
 
     ret = mbedtls_net_recv( ctx, buf, len );
-    if( ret != MBEDTLS_ERR_NET_WANT_READ )
+    if( ret != MBEDTLS_ERR_SSL_WANT_READ )
         first_try = 1; /* Next call will be a new operation */
     return( ret );
 }
@@ -426,11 +426,11 @@
     if( first_try )
     {
         first_try = 0;
-        return( MBEDTLS_ERR_NET_WANT_WRITE );
+        return( MBEDTLS_ERR_SSL_WANT_WRITE );
     }
 
     ret = mbedtls_net_send( ctx, buf, len );
-    if( ret != MBEDTLS_ERR_NET_WANT_WRITE )
+    if( ret != MBEDTLS_ERR_SSL_WANT_WRITE )
         first_try = 1; /* Next call will be a new operation */
     return( ret );
 }
@@ -1874,8 +1874,8 @@
     fflush( stdout );
 
     do ret = mbedtls_ssl_handshake( &ssl );
-    while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-           ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+           ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
     if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
     {
@@ -1959,8 +1959,8 @@
             memset( buf, 0, sizeof( buf ) );
             ret = mbedtls_ssl_read( &ssl, buf, len );
 
-            if( ret == MBEDTLS_ERR_NET_WANT_READ ||
-                ret == MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+                ret == MBEDTLS_ERR_SSL_WANT_WRITE )
                 continue;
 
             if( ret <= 0 )
@@ -2050,8 +2050,8 @@
         memset( buf, 0, sizeof( buf ) );
 
         do ret = mbedtls_ssl_read( &ssl, buf, len );
-        while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-               ret == MBEDTLS_ERR_NET_WANT_WRITE );
+        while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+               ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
         if( ret <= 0 )
         {
@@ -2086,8 +2086,8 @@
 
         while( ( ret = mbedtls_ssl_renegotiate( &ssl ) ) != 0 )
         {
-            if( ret != MBEDTLS_ERR_NET_WANT_READ &&
-                ret != MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                ret != MBEDTLS_ERR_SSL_WANT_WRITE )
             {
                 mbedtls_printf( " failed\n  ! mbedtls_ssl_renegotiate returned %d\n\n", ret );
                 goto reset;
@@ -2120,8 +2120,8 @@
                     goto reset;
                 }
 
-                if( ret != MBEDTLS_ERR_NET_WANT_READ &&
-                    ret != MBEDTLS_ERR_NET_WANT_WRITE )
+                if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
+                    ret != MBEDTLS_ERR_SSL_WANT_WRITE )
                 {
                     mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
                     goto reset;
@@ -2132,8 +2132,8 @@
     else /* Not stream, so datagram */
     {
         do ret = mbedtls_ssl_write( &ssl, buf, len );
-        while( ret == MBEDTLS_ERR_NET_WANT_READ ||
-               ret == MBEDTLS_ERR_NET_WANT_WRITE );
+        while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
+               ret == MBEDTLS_ERR_SSL_WANT_WRITE );
 
         if( ret < 0 )
         {
@@ -2163,7 +2163,7 @@
 
     /* No error checking, the connection might be closed already */
     do ret = mbedtls_ssl_close_notify( &ssl );
-    while( ret == MBEDTLS_ERR_NET_WANT_WRITE );
+    while( ret == MBEDTLS_ERR_SSL_WANT_WRITE );
     ret = 0;
 
     mbedtls_printf( " done\n" );
diff --git a/programs/x509/cert_app.c b/programs/x509/cert_app.c
index 6c0659a..d0aea99 100644
--- a/programs/x509/cert_app.c
+++ b/programs/x509/cert_app.c
@@ -440,7 +440,7 @@
          */
         while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
         {
-            if( ret != MBEDTLS_ERR_NET_WANT_READ && ret != MBEDTLS_ERR_NET_WANT_WRITE )
+            if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
             {
                 mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned %d\n\n", ret );
                 goto ssl_exit;
diff --git a/scripts/data_files/rename-1.3-2.0.txt b/scripts/data_files/rename-1.3-2.0.txt
index 06b56fe..9ae06ae 100644
--- a/scripts/data_files/rename-1.3-2.0.txt
+++ b/scripts/data_files/rename-1.3-2.0.txt
@@ -546,10 +546,10 @@
 POLARSSL_ERR_NET_RECV_FAILED MBEDTLS_ERR_NET_RECV_FAILED
 POLARSSL_ERR_NET_SEND_FAILED MBEDTLS_ERR_NET_SEND_FAILED
 POLARSSL_ERR_NET_SOCKET_FAILED MBEDTLS_ERR_NET_SOCKET_FAILED
-POLARSSL_ERR_NET_TIMEOUT MBEDTLS_ERR_NET_TIMEOUT
+POLARSSL_ERR_NET_TIMEOUT MBEDTLS_ERR_SSL_TIMEOUT
 POLARSSL_ERR_NET_UNKNOWN_HOST MBEDTLS_ERR_NET_UNKNOWN_HOST
-POLARSSL_ERR_NET_WANT_READ MBEDTLS_ERR_NET_WANT_READ
-POLARSSL_ERR_NET_WANT_WRITE MBEDTLS_ERR_NET_WANT_WRITE
+POLARSSL_ERR_NET_WANT_READ MBEDTLS_ERR_SSL_WANT_READ
+POLARSSL_ERR_NET_WANT_WRITE MBEDTLS_ERR_SSL_WANT_WRITE
 POLARSSL_ERR_OID_BUF_TOO_SMALL MBEDTLS_ERR_OID_BUF_TOO_SMALL
 POLARSSL_ERR_OID_NOT_FOUND MBEDTLS_ERR_OID_NOT_FOUND
 POLARSSL_ERR_PADLOCK_DATA_MISALIGNED MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED