diff --git a/library/aes.c b/library/aes.c
index a15a809..d18278e 100644
--- a/library/aes.c
+++ b/library/aes.c
@@ -562,7 +562,7 @@
         case 128: ctx->nr = 10; break;
         case 192: ctx->nr = 12; break;
         case 256: ctx->nr = 14; break;
-        default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
+        default : return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH ;
     }
 
 #if !defined(MBEDTLS_AES_ROM_TABLES)
@@ -585,7 +585,7 @@
 
 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
-        return( mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) );
+        return mbedtls_aesni_setkey_enc( (unsigned char *) ctx->rk, key, keybits ) ;
 #endif
 
     for( i = 0; i < ( keybits >> 5 ); i++ )
@@ -656,7 +656,7 @@
             break;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* !MBEDTLS_AES_SETKEY_ENC_ALT */
 
@@ -728,7 +728,7 @@
 exit:
     mbedtls_aes_free( &cty );
 
-    return( ret );
+    return ret ;
 }
 #endif /* !MBEDTLS_AES_SETKEY_DEC_ALT */
 
@@ -747,7 +747,7 @@
     {
         case 256: break;
         case 512: break;
-        default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
+        default : return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH ;
     }
 
     *key1bits = half_keybits;
@@ -772,12 +772,12 @@
     ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
                                        &key2, &key2bits );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /* Set the tweak key. Always set tweak key for the encryption mode. */
     ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /* Set crypt key for encryption. */
     return mbedtls_aes_setkey_enc( &ctx->crypt, key1, key1bits );
@@ -797,12 +797,12 @@
     ret = mbedtls_aes_xts_decode_keys( key, keybits, &key1, &key1bits,
                                        &key2, &key2bits );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /* Set the tweak key. Always set tweak key for encryption. */
     ret = mbedtls_aes_setkey_enc( &ctx->tweak, key2, key2bits );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /* Set crypt key for decryption. */
     return mbedtls_aes_setkey_dec( &ctx->crypt, key1, key1bits );
@@ -917,7 +917,7 @@
 
     mbedtls_platform_zeroize( &t, sizeof( t ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* !MBEDTLS_AES_ENCRYPT_ALT */
 
@@ -981,7 +981,7 @@
 
     mbedtls_platform_zeroize( &t, sizeof( t ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* !MBEDTLS_AES_DECRYPT_ALT */
 
@@ -1001,14 +1001,14 @@
 
 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_AES ) )
-        return( mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) );
+        return mbedtls_aesni_crypt_ecb( ctx, mode, input, output ) ;
 #endif
 
 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
     if( aes_padlock_ace > 0)
     {
         if( mbedtls_padlock_xcryptecb( ctx, mode, input, output ) == 0 )
-            return( 0 );
+            return 0 ;
 
         // If padlock data misaligned, we just fall back to
         // unaccelerated mode
@@ -1017,9 +1017,9 @@
 #endif
 
     if( mode == MBEDTLS_AES_ENCRYPT )
-        return( mbedtls_internal_aes_encrypt( ctx, input, output ) );
+        return mbedtls_internal_aes_encrypt( ctx, input, output ) ;
     else
-        return( mbedtls_internal_aes_decrypt( ctx, input, output ) );
+        return mbedtls_internal_aes_decrypt( ctx, input, output ) ;
 }
 
 #if defined(MBEDTLS_CIPHER_MODE_CBC)
@@ -1044,13 +1044,13 @@
     AES_VALIDATE_RET( output != NULL );
 
     if( length % 16 )
-        return( MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH );
+        return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH ;
 
 #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
     if( aes_padlock_ace > 0 )
     {
         if( mbedtls_padlock_xcryptcbc( ctx, mode, length, iv, input, output ) == 0 )
-            return( 0 );
+            return 0 ;
 
         // If padlock data misaligned, we just fall back to
         // unaccelerated mode
@@ -1091,7 +1091,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CBC */
 
@@ -1187,7 +1187,7 @@
     ret = mbedtls_aes_crypt_ecb( &ctx->tweak, MBEDTLS_AES_ENCRYPT,
                                  data_unit, tweak );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     while( blocks-- )
     {
@@ -1209,7 +1209,7 @@
 
         ret = mbedtls_aes_crypt_ecb( &ctx->crypt, mode, tmp, tmp );
         if( ret != 0 )
-            return( ret );
+            return ret ;
 
         for( i = 0; i < 16; i++ )
             output[i] = tmp[i] ^ tweak[i];
@@ -1257,7 +1257,7 @@
             prev_output[i] = tmp[i] ^ t[i];
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_XTS */
 
@@ -1287,7 +1287,7 @@
     n = *iv_off;
 
     if( n > 15 )
-        return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_AES_BAD_INPUT_DATA ;
 
     if( mode == MBEDTLS_AES_DECRYPT )
     {
@@ -1318,7 +1318,7 @@
 
     *iv_off = n;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1356,7 +1356,7 @@
         memcpy( iv, ov + 1, 16 );
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CFB */
 
@@ -1383,7 +1383,7 @@
     n = *iv_off;
 
     if( n > 15 )
-        return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_AES_BAD_INPUT_DATA ;
 
     while( length-- )
     {
@@ -1401,7 +1401,7 @@
     *iv_off = n;
 
 exit:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_OFB */
 
@@ -1430,7 +1430,7 @@
     n = *nc_off;
 
     if ( n > 0x0F )
-        return( MBEDTLS_ERR_AES_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_AES_BAD_INPUT_DATA ;
 
     while( length-- )
     {
@@ -1449,7 +1449,7 @@
 
     *nc_off = n;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CTR */
 
@@ -2187,7 +2187,7 @@
 
     mbedtls_aes_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/aesni.c b/library/aesni.c
index be226c9..09a9e9a 100644
--- a/library/aesni.c
+++ b/library/aesni.c
@@ -60,7 +60,7 @@
         done = 1;
     }
 
-    return( ( c & what ) != 0 );
+    return ( c & what ) != 0 ;
 }
 
 /*
@@ -131,7 +131,7 @@
          : "memory", "cc", "xmm0", "xmm1" );
 
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -453,10 +453,10 @@
         case 128: aesni_setkey_enc_128( rk, key ); break;
         case 192: aesni_setkey_enc_192( rk, key ); break;
         case 256: aesni_setkey_enc_256( rk, key ); break;
-        default : return( MBEDTLS_ERR_AES_INVALID_KEY_LENGTH );
+        default : return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_HAVE_X86_64 */
diff --git a/library/aria.c b/library/aria.c
index a5786b3..0a47373 100644
--- a/library/aria.c
+++ b/library/aria.c
@@ -96,7 +96,7 @@
 {
     uint32_t r;
     __asm( "rev16 %0, %1" : "=l" (r) : "l" (x) );
-    return( r );
+    return r ;
 }
 #define ARIA_P1 aria_p1
 #elif defined(__ARMCC_VERSION) && __ARMCC_VERSION < 6000000 && \
@@ -105,7 +105,7 @@
 {
     uint32_t r;
     __asm( "rev16 r, x" );
-    return( r );
+    return r ;
 }
 #define ARIA_P1 aria_p1
 #endif
@@ -147,7 +147,7 @@
 {
     uint32_t r;
     __asm( "rev %0, %1" : "=l" (r) : "l" (x) );
-    return( r );
+    return r ;
 }
 #define ARIA_P3 aria_p3
 #elif defined(__ARMCC_VERSION) && __ARMCC_VERSION < 6000000 && \
@@ -156,7 +156,7 @@
 {
     uint32_t r;
     __asm( "rev r, x" );
-    return( r );
+    return r ;
 }
 #define ARIA_P3 aria_p3
 #endif
@@ -166,7 +166,7 @@
 static inline uint32_t aria_p3( uint32_t x )
 {
     __asm( "bswap %0" : "=r" (x) : "0" (x) );
-    return( x );
+    return x ;
 }
 #define ARIA_P3 aria_p3
 #endif /* x86 gnuc */
@@ -453,7 +453,7 @@
     ARIA_VALIDATE_RET( key != NULL );
 
     if( keybits != 128 && keybits != 192 && keybits != 256 )
-        return( MBEDTLS_ERR_ARIA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ARIA_BAD_INPUT_DATA ;
 
     /* Copy key to W0 (and potential remainder to W1) */
     GET_UINT32_LE( w[0][0], key,  0 );
@@ -495,7 +495,7 @@
     /* w holds enough info to reconstruct the round keys */
     mbedtls_platform_zeroize( w, sizeof( w ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -510,7 +510,7 @@
 
     ret = mbedtls_aria_setkey_enc( ctx, key, keybits );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /* flip the order of round keys */
     for( i = 0, j = ctx->nr; i < j; i++, j-- )
@@ -530,7 +530,7 @@
                 &ctx->rk[i][2], &ctx->rk[i][3] );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -587,7 +587,7 @@
     PUT_UINT32_LE( c, output,  8 );
     PUT_UINT32_LE( d, output, 12 );
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Initialize context */
@@ -628,7 +628,7 @@
     ARIA_VALIDATE_RET( iv != NULL );
 
     if( length % MBEDTLS_ARIA_BLOCKSIZE )
-        return( MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH );
+        return MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH ;
 
     if( mode == MBEDTLS_ARIA_DECRYPT )
     {
@@ -663,7 +663,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CBC */
 
@@ -696,7 +696,7 @@
      * buffer overflow. Therefore, guard against this
      * outside of parameter validation. */
     if( n >= MBEDTLS_ARIA_BLOCKSIZE )
-        return( MBEDTLS_ERR_ARIA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ARIA_BAD_INPUT_DATA ;
 
     if( mode == MBEDTLS_ARIA_DECRYPT )
     {
@@ -727,7 +727,7 @@
 
     *iv_off = n;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CFB */
 
@@ -758,7 +758,7 @@
      * buffer overflow. Therefore, guard against this
      * outside of parameter validation. */
     if( n >= MBEDTLS_ARIA_BLOCKSIZE )
-        return( MBEDTLS_ERR_ARIA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ARIA_BAD_INPUT_DATA ;
 
     while( length-- )
     {
@@ -778,7 +778,7 @@
 
     *nc_off = n;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CTR */
 #endif /* !MBEDTLS_ARIA_ALT */
@@ -1072,7 +1072,7 @@
 
 exit:
     mbedtls_aria_free( &ctx );
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/asn1parse.c b/library/asn1parse.c
index 83c7c58..67c162a 100644
--- a/library/asn1parse.c
+++ b/library/asn1parse.c
@@ -47,7 +47,7 @@
                   size_t *len )
 {
     if( ( end - *p ) < 1 )
-        return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+        return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
     if( ( **p & 0x80 ) == 0 )
         *len = *(*p)++;
@@ -57,7 +57,7 @@
         {
         case 1:
             if( ( end - *p ) < 2 )
-                return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+                return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
             *len = (*p)[1];
             (*p) += 2;
@@ -65,7 +65,7 @@
 
         case 2:
             if( ( end - *p ) < 3 )
-                return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+                return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
             *len = ( (size_t)(*p)[1] << 8 ) | (*p)[2];
             (*p) += 3;
@@ -73,7 +73,7 @@
 
         case 3:
             if( ( end - *p ) < 4 )
-                return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+                return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
             *len = ( (size_t)(*p)[1] << 16 ) |
                    ( (size_t)(*p)[2] << 8  ) | (*p)[3];
@@ -82,7 +82,7 @@
 
         case 4:
             if( ( end - *p ) < 5 )
-                return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+                return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
             *len = ( (size_t)(*p)[1] << 24 ) | ( (size_t)(*p)[2] << 16 ) |
                    ( (size_t)(*p)[3] << 8  ) |           (*p)[4];
@@ -90,14 +90,14 @@
             break;
 
         default:
-            return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+            return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
         }
     }
 
     if( *len > (size_t) ( end - *p ) )
-        return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+        return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_asn1_get_tag( unsigned char **p,
@@ -105,14 +105,14 @@
                   size_t *len, int tag )
 {
     if( ( end - *p ) < 1 )
-        return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+        return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
     if( **p != tag )
-        return( MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
+        return MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ;
 
     (*p)++;
 
-    return( mbedtls_asn1_get_len( p, end, len ) );
+    return mbedtls_asn1_get_len( p, end, len ) ;
 }
 
 int mbedtls_asn1_get_bool( unsigned char **p,
@@ -123,15 +123,15 @@
     size_t len;
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_BOOLEAN ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( len != 1 )
-        return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+        return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
 
     *val = ( **p != 0 ) ? 1 : 0;
     (*p)++;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int asn1_get_tagged_int( unsigned char **p,
@@ -142,17 +142,17 @@
     size_t len;
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len, tag ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /*
      * len==0 is malformed (0 must be represented as 020100 for INTEGER,
      * or 0A0100 for ENUMERATED tags
      */
     if( len == 0 )
-        return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+        return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
     /* This is a cryptography library. Reject negative integers. */
     if( ( **p & 0x80 ) != 0 )
-        return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+        return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
 
     /* Skip leading zeros. */
     while( len > 0 && **p == 0 )
@@ -164,9 +164,9 @@
     /* Reject integers that don't fit in an int. This code assumes that
      * the int type has no padding bit. */
     if( len > sizeof( int ) )
-        return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+        return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
     if( len == sizeof( int ) && ( **p & 0x80 ) != 0 )
-        return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+        return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
 
     *val = 0;
     while( len-- > 0 )
@@ -175,21 +175,21 @@
         (*p)++;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_asn1_get_int( unsigned char **p,
                           const unsigned char *end,
                           int *val )
 {
-    return( asn1_get_tagged_int( p, end, MBEDTLS_ASN1_INTEGER, val) );
+    return asn1_get_tagged_int( p, end, MBEDTLS_ASN1_INTEGER, val) ;
 }
 
 int mbedtls_asn1_get_enum( unsigned char **p,
                            const unsigned char *end,
                            int *val )
 {
-    return( asn1_get_tagged_int( p, end, MBEDTLS_ASN1_ENUMERATED, val) );
+    return asn1_get_tagged_int( p, end, MBEDTLS_ASN1_ENUMERATED, val) ;
 }
 
 #if defined(MBEDTLS_BIGNUM_C)
@@ -201,13 +201,13 @@
     size_t len;
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_mpi_read_binary( X, *p, len );
 
     *p += len;
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_BIGNUM_C */
 
@@ -218,17 +218,17 @@
 
     /* Certificate type is a single byte bitstring */
     if( ( ret = mbedtls_asn1_get_tag( p, end, &bs->len, MBEDTLS_ASN1_BIT_STRING ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* Check length, subtract one for actual bit string length */
     if( bs->len < 1 )
-        return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+        return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
     bs->len -= 1;
 
     /* Get number of unused bits, ensure unused bits <= 7 */
     bs->unused_bits = **p;
     if( bs->unused_bits > 7 )
-        return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+        return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
     (*p)++;
 
     /* Get actual bitstring */
@@ -236,9 +236,9 @@
     *p += bs->len;
 
     if( *p != end )
-        return( MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
+        return MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -261,21 +261,21 @@
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( *p + len != end )
-        return( MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
+        return MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ;
 
     while( *p < end )
     {
         unsigned char const tag = *(*p)++;
 
         if( ( tag & tag_must_mask ) != tag_must_val )
-            return( MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
+            return MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ;
 
         if( ( ret = mbedtls_asn1_get_len( p, end, &len ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( ( tag & tag_may_mask ) == tag_may_val )
         {
@@ -283,14 +283,14 @@
             {
                 ret = cb( ctx, tag, *p, len );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
             }
         }
 
         *p += len;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -302,17 +302,17 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, len, MBEDTLS_ASN1_BIT_STRING ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( *len == 0 )
-        return( MBEDTLS_ERR_ASN1_INVALID_DATA );
+        return MBEDTLS_ERR_ASN1_INVALID_DATA ;
     --( *len );
 
     if( **p != 0 )
-        return( MBEDTLS_ERR_ASN1_INVALID_DATA );
+        return MBEDTLS_ERR_ASN1_INVALID_DATA ;
     ++( *p );
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_asn1_sequence_free( mbedtls_asn1_sequence *seq )
@@ -348,7 +348,7 @@
             mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
         if( cur->next == NULL )
-            return( MBEDTLS_ERR_ASN1_ALLOC_FAILED );
+            return MBEDTLS_ERR_ASN1_ALLOC_FAILED ;
 
         cur = cur->next;
     }
@@ -358,7 +358,7 @@
     cur->buf.tag = tag;
 
     cb_ctx->cur = cur;
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -385,16 +385,16 @@
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( end - *p ) < 1 )
-        return( MBEDTLS_ERR_ASN1_OUT_OF_DATA );
+        return MBEDTLS_ERR_ASN1_OUT_OF_DATA ;
 
     alg->tag = **p;
     end = *p + len;
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &alg->len, MBEDTLS_ASN1_OID ) ) != 0 )
-        return( ret );
+        return ret ;
 
     alg->p = *p;
     *p += alg->len;
@@ -402,22 +402,22 @@
     if( *p == end )
     {
         mbedtls_platform_zeroize( params, sizeof(mbedtls_asn1_buf) );
-        return( 0 );
+        return 0 ;
     }
 
     params->tag = **p;
     (*p)++;
 
     if( ( ret = mbedtls_asn1_get_len( p, end, &params->len ) ) != 0 )
-        return( ret );
+        return ret ;
 
     params->p = *p;
     *p += params->len;
 
     if( *p != end )
-        return( MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
+        return MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_asn1_get_alg_null( unsigned char **p,
@@ -430,12 +430,12 @@
     memset( &params, 0, sizeof(mbedtls_asn1_buf) );
 
     if( ( ret = mbedtls_asn1_get_alg( p, end, alg, &params ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( params.tag != MBEDTLS_ASN1_NULL && params.tag != 0 ) || params.len != 0 )
-        return( MBEDTLS_ERR_ASN1_INVALID_DATA );
+        return MBEDTLS_ERR_ASN1_INVALID_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_asn1_free_named_data( mbedtls_asn1_named_data *cur )
@@ -475,7 +475,7 @@
         list = list->next;
     }
 
-    return( list );
+    return list ;
 }
 
 #endif /* MBEDTLS_ASN1_PARSE_C */
diff --git a/library/asn1write.c b/library/asn1write.c
index 0289e89..8391e80 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -39,43 +39,43 @@
     if( len < 0x80 )
     {
         if( *p - start < 1 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
         *--(*p) = (unsigned char) len;
-        return( 1 );
+        return 1 ;
     }
 
     if( len <= 0xFF )
     {
         if( *p - start < 2 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
         *--(*p) = (unsigned char) len;
         *--(*p) = 0x81;
-        return( 2 );
+        return 2 ;
     }
 
     if( len <= 0xFFFF )
     {
         if( *p - start < 3 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
         *--(*p) = ( len       ) & 0xFF;
         *--(*p) = ( len >>  8 ) & 0xFF;
         *--(*p) = 0x82;
-        return( 3 );
+        return 3 ;
     }
 
     if( len <= 0xFFFFFF )
     {
         if( *p - start < 4 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
         *--(*p) = ( len       ) & 0xFF;
         *--(*p) = ( len >>  8 ) & 0xFF;
         *--(*p) = ( len >> 16 ) & 0xFF;
         *--(*p) = 0x83;
-        return( 4 );
+        return 4 ;
     }
 
 #if SIZE_MAX > 0xFFFFFFFF
@@ -83,29 +83,29 @@
 #endif
     {
         if( *p - start < 5 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
         *--(*p) = ( len       ) & 0xFF;
         *--(*p) = ( len >>  8 ) & 0xFF;
         *--(*p) = ( len >> 16 ) & 0xFF;
         *--(*p) = ( len >> 24 ) & 0xFF;
         *--(*p) = 0x84;
-        return( 5 );
+        return 5 ;
     }
 
 #if SIZE_MAX > 0xFFFFFFFF
-    return( MBEDTLS_ERR_ASN1_INVALID_LENGTH );
+    return MBEDTLS_ERR_ASN1_INVALID_LENGTH ;
 #endif
 }
 
 int mbedtls_asn1_write_tag( unsigned char **p, const unsigned char *start, unsigned char tag )
 {
     if( *p - start < 1 )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     *--(*p) = tag;
 
-    return( 1 );
+    return 1 ;
 }
 
 int mbedtls_asn1_write_raw_buffer( unsigned char **p, const unsigned char *start,
@@ -114,13 +114,13 @@
     size_t len = 0;
 
     if( *p < start || (size_t)( *p - start ) < size )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     len = size;
     (*p) -= len;
     memcpy( *p, buf, len );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 #if defined(MBEDTLS_BIGNUM_C)
@@ -134,7 +134,7 @@
     len = mbedtls_mpi_size( X );
 
     if( *p < start || (size_t)( *p - start ) < len )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     (*p) -= len;
     MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( X, *p, len ) );
@@ -145,7 +145,7 @@
     if( X->s ==1 && **p & 0x80 )
     {
         if( *p - start < 1 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
         *--(*p) = 0x00;
         len += 1;
@@ -157,7 +157,7 @@
     ret = (int) len;
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_BIGNUM_C */
 
@@ -171,7 +171,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, 0) );
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_NULL ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_asn1_write_oid( unsigned char **p, const unsigned char *start,
@@ -185,7 +185,7 @@
     MBEDTLS_ASN1_CHK_ADD( len , mbedtls_asn1_write_len( p, start, len ) );
     MBEDTLS_ASN1_CHK_ADD( len , mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_OID ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_asn1_write_algorithm_identifier( unsigned char **p, const unsigned char *start,
@@ -206,7 +206,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
                                        MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_asn1_write_bool( unsigned char **p, const unsigned char *start, int boolean )
@@ -215,7 +215,7 @@
     size_t len = 0;
 
     if( *p - start < 1 )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     *--(*p) = (boolean) ? 255 : 0;
     len++;
@@ -223,7 +223,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_BOOLEAN ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 static int asn1_write_tagged_int( unsigned char **p, const unsigned char *start, int val, int tag )
@@ -234,7 +234,7 @@
     do
     {
         if( *p - start < 1 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
         len += 1;
         *--(*p) = val & 0xff;
         val >>= 8;
@@ -244,7 +244,7 @@
     if( **p & 0x80 )
     {
         if( *p - start < 1 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
         *--(*p) = 0x00;
         len += 1;
     }
@@ -252,17 +252,17 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, tag ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_asn1_write_int( unsigned char **p, const unsigned char *start, int val )
 {
-    return( asn1_write_tagged_int( p, start, val, MBEDTLS_ASN1_INTEGER ) );
+    return asn1_write_tagged_int( p, start, val, MBEDTLS_ASN1_INTEGER ) ;
 }
 
 int mbedtls_asn1_write_enum( unsigned char **p, const unsigned char *start, int val )
 {
-    return( asn1_write_tagged_int( p, start, val, MBEDTLS_ASN1_ENUMERATED ) );
+    return asn1_write_tagged_int( p, start, val, MBEDTLS_ASN1_ENUMERATED ) ;
 }
 
 int mbedtls_asn1_write_tagged_string( unsigned char **p, const unsigned char *start, int tag,
@@ -277,25 +277,25 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, tag ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_asn1_write_utf8_string( unsigned char **p, const unsigned char *start,
     const char *text, size_t text_len )
 {
-    return( mbedtls_asn1_write_tagged_string(p, start, MBEDTLS_ASN1_UTF8_STRING, text, text_len) );
+    return mbedtls_asn1_write_tagged_string(p, start, MBEDTLS_ASN1_UTF8_STRING, text, text_len) ;
 }
 
 int mbedtls_asn1_write_printable_string( unsigned char **p, const unsigned char *start,
                                  const char *text, size_t text_len )
 {
-    return( mbedtls_asn1_write_tagged_string(p, start, MBEDTLS_ASN1_PRINTABLE_STRING, text, text_len) );
+    return mbedtls_asn1_write_tagged_string(p, start, MBEDTLS_ASN1_PRINTABLE_STRING, text, text_len) ;
 }
 
 int mbedtls_asn1_write_ia5_string( unsigned char **p, const unsigned char *start,
                            const char *text, size_t text_len )
 {
-    return( mbedtls_asn1_write_tagged_string(p, start, MBEDTLS_ASN1_IA5_STRING, text, text_len) );
+    return mbedtls_asn1_write_tagged_string(p, start, MBEDTLS_ASN1_IA5_STRING, text, text_len) ;
 }
 
 int mbedtls_asn1_write_named_bitstring( unsigned char **p,
@@ -338,7 +338,7 @@
         }
     }
 
-    return( mbedtls_asn1_write_bitstring( p, start, buf, bits ) );
+    return mbedtls_asn1_write_bitstring( p, start, buf, bits ) ;
 }
 
 int mbedtls_asn1_write_bitstring( unsigned char **p, const unsigned char *start,
@@ -352,7 +352,7 @@
     unused_bits = ( byte_len * 8 ) - bits;
 
     if( *p < start || (size_t)( *p - start ) < byte_len + 1 )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     len = byte_len + 1;
 
@@ -371,7 +371,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_BIT_STRING ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_asn1_write_octet_string( unsigned char **p, const unsigned char *start,
@@ -385,7 +385,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_OCTET_STRING ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 
@@ -406,7 +406,7 @@
         list = list->next;
     }
 
-    return( list );
+    return list ;
 }
 
 mbedtls_asn1_named_data *mbedtls_asn1_store_named_data(
@@ -424,14 +424,14 @@
         cur = (mbedtls_asn1_named_data*)mbedtls_calloc( 1,
                                             sizeof(mbedtls_asn1_named_data) );
         if( cur == NULL )
-            return( NULL );
+            return NULL ;
 
         cur->oid.len = oid_len;
         cur->oid.p = mbedtls_calloc( 1, oid_len );
         if( cur->oid.p == NULL )
         {
             mbedtls_free( cur );
-            return( NULL );
+            return NULL ;
         }
 
         memcpy( cur->oid.p, oid, oid_len );
@@ -444,7 +444,7 @@
             {
                 mbedtls_free( cur->oid.p );
                 mbedtls_free( cur );
-                return( NULL );
+                return NULL ;
             }
         }
 
@@ -465,7 +465,7 @@
          */
         void *p = mbedtls_calloc( 1, val_len );
         if( p == NULL )
-            return( NULL );
+            return NULL ;
 
         mbedtls_free( cur->val.p );
         cur->val.p = p;
@@ -475,6 +475,6 @@
     if( val != NULL )
         memcpy( cur->val.p, val, val_len );
 
-    return( cur );
+    return cur ;
 }
 #endif /* MBEDTLS_ASN1_WRITE_C */
diff --git a/library/base64.c b/library/base64.c
index 1a05226..f78a29b 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -171,7 +171,7 @@
     if( slen == 0 )
     {
         *olen = 0;
-        return( 0 );
+        return 0 ;
     }
 
     n = slen / 3 + ( slen % 3 != 0 );
@@ -179,7 +179,7 @@
     if( n > ( BASE64_SIZE_T_MAX - 1 ) / 4 )
     {
         *olen = BASE64_SIZE_T_MAX;
-        return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL ;
     }
 
     n *= 4;
@@ -187,7 +187,7 @@
     if( ( dlen < n + 1 ) || ( NULL == dst ) )
     {
         *olen = n + 1;
-        return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL ;
     }
 
     n = ( slen / 3 ) * 3;
@@ -233,7 +233,7 @@
     *olen = p - dst;
     *p = 0;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -271,18 +271,18 @@
 
         /* Space inside a line is an error */
         if( x != 0 )
-            return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER );
+            return MBEDTLS_ERR_BASE64_INVALID_CHARACTER ;
 
         if( src[i] == '=' && ++j > 2 )
-            return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER );
+            return MBEDTLS_ERR_BASE64_INVALID_CHARACTER ;
 
         dec_map_lookup = mbedtls_base64_table_lookup( base64_dec_map, sizeof( base64_dec_map ), src[i] );
 
         if( src[i] > 127 || dec_map_lookup == 127 )
-            return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER );
+            return MBEDTLS_ERR_BASE64_INVALID_CHARACTER ;
 
         if( dec_map_lookup < 64 && j != 0 )
-            return( MBEDTLS_ERR_BASE64_INVALID_CHARACTER );
+            return MBEDTLS_ERR_BASE64_INVALID_CHARACTER ;
 
         n++;
     }
@@ -290,7 +290,7 @@
     if( n == 0 )
     {
         *olen = 0;
-        return( 0 );
+        return 0 ;
     }
 
     /* The following expression is to calculate the following formula without
@@ -303,7 +303,7 @@
     if( dst == NULL || dlen < n )
     {
         *olen = n;
-        return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL ;
     }
 
    for( j = 3, n = x = 0, p = dst; i > 0; i--, src++ )
@@ -327,7 +327,7 @@
 
     *olen = p - dst;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -368,7 +368,7 @@
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
-        return( 1 );
+        return 1 ;
     }
 
     if( verbose != 0 )
@@ -382,13 +382,13 @@
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
-        return( 1 );
+        return 1 ;
     }
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n\n" );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/bignum.c b/library/bignum.c
index 42ec7ac..46bd6d0 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -118,12 +118,12 @@
     MPI_VALIDATE_RET( X != NULL );
 
     if( nblimbs > MBEDTLS_MPI_MAX_LIMBS )
-        return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+        return MBEDTLS_ERR_MPI_ALLOC_FAILED ;
 
     if( X->n < nblimbs )
     {
         if( ( p = (mbedtls_mpi_uint*)mbedtls_calloc( nblimbs, ciL ) ) == NULL )
-            return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+            return MBEDTLS_ERR_MPI_ALLOC_FAILED ;
 
         if( X->p != NULL )
         {
@@ -136,7 +136,7 @@
         X->p = p;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -150,11 +150,11 @@
     MPI_VALIDATE_RET( X != NULL );
 
     if( nblimbs > MBEDTLS_MPI_MAX_LIMBS )
-        return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+        return MBEDTLS_ERR_MPI_ALLOC_FAILED ;
 
     /* Actually resize up if there are currently fewer than nblimbs limbs. */
     if( X->n <= nblimbs )
-        return( mbedtls_mpi_grow( X, nblimbs ) );
+        return mbedtls_mpi_grow( X, nblimbs ) ;
     /* After this point, then X->n > nblimbs and in particular X->n > 0. */
 
     for( i = X->n - 1; i > 0; i-- )
@@ -166,7 +166,7 @@
         i = nblimbs;
 
     if( ( p = (mbedtls_mpi_uint*)mbedtls_calloc( i, ciL ) ) == NULL )
-        return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+        return MBEDTLS_ERR_MPI_ALLOC_FAILED ;
 
     if( X->p != NULL )
     {
@@ -178,7 +178,7 @@
     X->n = i;
     X->p = p;
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Resize X to have exactly n limbs and set it to 0. */
@@ -187,18 +187,18 @@
     if( limbs == 0 )
     {
         mbedtls_mpi_free( X );
-        return( 0 );
+        return 0 ;
     }
     else if( X->n == limbs )
     {
         memset( X->p, 0, limbs * ciL );
         X->s = 1;
-        return( 0 );
+        return 0 ;
     }
     else
     {
         mbedtls_mpi_free( X );
-        return( mbedtls_mpi_grow( X, limbs ) );
+        return mbedtls_mpi_grow( X, limbs ) ;
     }
 }
 
@@ -219,7 +219,7 @@
     MPI_VALIDATE_RET( Y != NULL );
 
     if( X == Y )
-        return( 0 );
+        return 0 ;
 
     if( Y->n == 0 )
     {
@@ -228,7 +228,7 @@
             X->s = 1;
             memset( X->p, 0, X->n * ciL );
         }
-        return( 0 );
+        return 0 ;
     }
 
     for( i = Y->n - 1; i > 0; i-- )
@@ -251,7 +251,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -295,7 +295,7 @@
     unsigned ur = ( ua & ~mask ) | ( ub & mask );
 
     /* ur is now 0 or 2, convert back to -1 or +1 */
-    return( (int) ur - 1 );
+    return (int) ur - 1 ;
 }
 
 /*
@@ -368,7 +368,7 @@
         X->p[i] &= ~limb_mask;
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -387,7 +387,7 @@
     MPI_VALIDATE_RET( Y != NULL );
 
     if( X == Y )
-        return( 0 );
+        return 0 ;
 
     /* MSVC has a warning about unary minus on unsigned integer types,
      * but this is well-defined and precisely what we want to do here. */
@@ -421,7 +421,7 @@
     }
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -440,7 +440,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -451,9 +451,9 @@
     MPI_VALIDATE_RET( X != NULL );
 
     if( X->n * biL <= pos )
-        return( 0 );
+        return 0 ;
 
-    return( ( X->p[pos / biL] >> ( pos % biL ) ) & 0x01 );
+    return ( X->p[pos / biL] >> ( pos % biL ) ) & 0x01 ;
 }
 
 /* Get a specific byte, without range checks. */
@@ -471,12 +471,12 @@
     MPI_VALIDATE_RET( X != NULL );
 
     if( val != 0 && val != 1 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     if( X->n * biL <= pos )
     {
         if( val == 0 )
-            return( 0 );
+            return 0 ;
 
         MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, off + 1 ) );
     }
@@ -486,7 +486,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -500,9 +500,9 @@
     for( i = 0; i < X->n; i++ )
         for( j = 0; j < biL; j++, count++ )
             if( ( ( X->p[i] >> j ) & 1 ) != 0 )
-                return( count );
+                return count ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -531,7 +531,7 @@
     size_t i, j;
 
     if( X->n == 0 )
-        return( 0 );
+        return 0 ;
 
     for( i = X->n - 1; i > 0; i-- )
         if( X->p[i] != 0 )
@@ -539,7 +539,7 @@
 
     j = biL - mbedtls_clz( X->p[i] );
 
-    return( ( i * biL ) + j );
+    return ( i * biL ) + j ;
 }
 
 /*
@@ -547,7 +547,7 @@
  */
 size_t mbedtls_mpi_size( const mbedtls_mpi *X )
 {
-    return( ( mbedtls_mpi_bitlen( X ) + 7 ) >> 3 );
+    return ( mbedtls_mpi_bitlen( X ) + 7 ) >> 3 ;
 }
 
 /*
@@ -562,9 +562,9 @@
     if( c >= 0x61 && c <= 0x66 ) *d = c - 0x57;
 
     if( *d >= (mbedtls_mpi_uint) radix )
-        return( MBEDTLS_ERR_MPI_INVALID_CHARACTER );
+        return MBEDTLS_ERR_MPI_INVALID_CHARACTER ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -581,14 +581,14 @@
     MPI_VALIDATE_RET( s != NULL );
 
     if( radix < 2 || radix > 16 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     mbedtls_mpi_init( &T );
 
     if( s[0] == 0 )
     {
         mbedtls_mpi_free( X );
-        return( 0 );
+        return 0 ;
     }
 
     if( s[0] == '-' )
@@ -602,7 +602,7 @@
     if( radix == 16 )
     {
         if( slen > MPI_SIZE_T_MAX >> 2 )
-            return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
         n = BITS_TO_LIMBS( slen << 2 );
 
@@ -634,7 +634,7 @@
 
     mbedtls_mpi_free( &T );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -652,7 +652,7 @@
     {
         if( length >= buflen )
         {
-            return( MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL ;
         }
 
         MBEDTLS_MPI_CHK( mbedtls_mpi_mod_int( &r, X, radix ) );
@@ -673,7 +673,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -691,7 +691,7 @@
     MPI_VALIDATE_RET( buflen == 0 || buf != NULL );
 
     if( radix < 2 || radix > 16 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     n = mbedtls_mpi_bitlen( X ); /* Number of bits necessary to present `n`. */
     if( radix >=  4 ) n >>= 1;   /* Number of 4-adic digits necessary to present
@@ -711,7 +711,7 @@
     if( buflen < n )
     {
         *olen = n;
-        return( MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL ;
     }
 
     p = buf;
@@ -760,7 +760,7 @@
 
     mbedtls_mpi_free( &T );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_FS_IO)
@@ -782,15 +782,15 @@
     MPI_VALIDATE_RET( fin != NULL );
 
     if( radix < 2 || radix > 16 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     memset( s, 0, sizeof( s ) );
     if( fgets( s, sizeof( s ) - 1, fin ) == NULL )
-        return( MBEDTLS_ERR_MPI_FILE_IO_ERROR );
+        return MBEDTLS_ERR_MPI_FILE_IO_ERROR ;
 
     slen = strlen( s );
     if( slen == sizeof( s ) - 2 )
-        return( MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL ;
 
     if( slen > 0 && s[slen - 1] == '\n' ) { slen--; s[slen] = '\0'; }
     if( slen > 0 && s[slen - 1] == '\r' ) { slen--; s[slen] = '\0'; }
@@ -800,7 +800,7 @@
         if( mpi_get_digit( &d, radix, *p ) != 0 )
             break;
 
-    return( mbedtls_mpi_read_string( X, radix, p + 1 ) );
+    return mbedtls_mpi_read_string( X, radix, p + 1 ) ;
 }
 
 /*
@@ -818,7 +818,7 @@
     MPI_VALIDATE_RET( X != NULL );
 
     if( radix < 2 || radix > 16 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     memset( s, 0, sizeof( s ) );
 
@@ -835,14 +835,14 @@
     {
         if( fwrite( p, 1, plen, fout ) != plen ||
             fwrite( s, 1, slen, fout ) != slen )
-            return( MBEDTLS_ERR_MPI_FILE_IO_ERROR );
+            return MBEDTLS_ERR_MPI_FILE_IO_ERROR ;
     }
     else
         mbedtls_printf( "%s%s", p, s );
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -862,7 +862,7 @@
         tmp |= (mbedtls_mpi_uint) *x_ptr;
     }
 
-    return( tmp );
+    return tmp ;
 }
 
 static mbedtls_mpi_uint mpi_uint_bigendian_to_host( mbedtls_mpi_uint x )
@@ -871,7 +871,7 @@
 
 /* Nothing to do on bigendian systems. */
 #if ( __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ )
-    return( x );
+    return x ;
 #endif /* __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ */
 
 #if ( __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ )
@@ -895,9 +895,9 @@
     switch( sizeof(mbedtls_mpi_uint) )
     {
         case 4:
-            return( __builtin_bswap32(x) );
+            return __builtin_bswap32(x) ;
         case 8:
-            return( __builtin_bswap64(x) );
+            return __builtin_bswap64(x) ;
     }
 #endif
 #endif /* __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ */
@@ -905,7 +905,7 @@
 
     /* Fall back to C-based reordering if we don't know the byte order
      * or we couldn't use a compiler-specific builtin. */
-    return( mpi_uint_bigendian_to_host_c( x ) );
+    return mpi_uint_bigendian_to_host_c( x ) ;
 }
 
 static void mpi_bigendian_to_host( mbedtls_mpi_uint * const p, size_t limbs )
@@ -960,7 +960,7 @@
      * upon failure is not necessary because failure only can happen before any
      * input is copied.
      */
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -996,7 +996,7 @@
      * upon failure is not necessary because failure only can happen before any
      * input is copied.
      */
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1022,7 +1022,7 @@
         for( i = bytes_to_copy; i < stored_bytes; i++ )
         {
             if( GET_BYTE( X, i ) != 0 )
-                return( MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL ;
         }
     }
 
@@ -1035,7 +1035,7 @@
         memset( buf + stored_bytes, 0, buflen - stored_bytes );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1074,14 +1074,14 @@
         for( i = bytes_to_copy; i < stored_bytes; i++ )
         {
             if( GET_BYTE( X, i ) != 0 )
-                return( MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL ;
         }
     }
 
     for( i = 0; i < bytes_to_copy; i++ )
         p[bytes_to_copy - i - 1] = GET_BYTE( X, i );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1132,7 +1132,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1176,7 +1176,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1197,18 +1197,18 @@
             break;
 
     if( i == 0 && j == 0 )
-        return( 0 );
+        return 0 ;
 
-    if( i > j ) return(  1 );
-    if( j > i ) return( -1 );
+    if( i > j ) return 1 ;
+    if( j > i ) return -1 ;
 
     for( ; i > 0; i-- )
     {
-        if( X->p[i - 1] > Y->p[i - 1] ) return(  1 );
-        if( X->p[i - 1] < Y->p[i - 1] ) return( -1 );
+        if( X->p[i - 1] > Y->p[i - 1] ) return 1 ;
+        if( X->p[i - 1] < Y->p[i - 1] ) return -1 ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1229,21 +1229,21 @@
             break;
 
     if( i == 0 && j == 0 )
-        return( 0 );
+        return 0 ;
 
-    if( i > j ) return(  X->s );
-    if( j > i ) return( -Y->s );
+    if( i > j ) return X->s ;
+    if( j > i ) return -Y->s ;
 
-    if( X->s > 0 && Y->s < 0 ) return(  1 );
-    if( Y->s > 0 && X->s < 0 ) return( -1 );
+    if( X->s > 0 && Y->s < 0 ) return 1 ;
+    if( Y->s > 0 && X->s < 0 ) return -1 ;
 
     for( ; i > 0; i-- )
     {
-        if( X->p[i - 1] > Y->p[i - 1] ) return(  X->s );
-        if( X->p[i - 1] < Y->p[i - 1] ) return( -X->s );
+        if( X->p[i - 1] > Y->p[i - 1] ) return X->s ;
+        if( X->p[i - 1] < Y->p[i - 1] ) return -X->s ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /** Decide if an integer is less than the other, without branches.
@@ -1344,7 +1344,7 @@
         done |= cond;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1361,7 +1361,7 @@
     Y.n = 1;
     Y.p = p;
 
-    return( mbedtls_mpi_cmp_mpi( X, &Y ) );
+    return mbedtls_mpi_cmp_mpi( X, &Y ) ;
 }
 
 /*
@@ -1420,7 +1420,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /**
@@ -1454,7 +1454,7 @@
         c = ( t < r[i] ) + z; d[i] = t - r[i];
     }
 
-    return( c );
+    return c ;
 }
 
 /*
@@ -1509,7 +1509,7 @@
     X->s = 1;
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1544,7 +1544,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1579,7 +1579,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1597,7 +1597,7 @@
     B.n = 1;
     B.p = p;
 
-    return( mbedtls_mpi_add_mpi( X, A, &B ) );
+    return mbedtls_mpi_add_mpi( X, A, &B ) ;
 }
 
 /*
@@ -1615,7 +1615,7 @@
     B.n = 1;
     B.p = p;
 
-    return( mbedtls_mpi_sub_mpi( X, A, &B ) );
+    return mbedtls_mpi_sub_mpi( X, A, &B ) ;
 }
 
 /** Helper for mbedtls_mpi multiplication.
@@ -1755,7 +1755,7 @@
 
     mbedtls_mpi_free( &TB ); mbedtls_mpi_free( &TA );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1775,7 +1775,7 @@
      * calculating the result is trivial in those cases. */
     if( b == 0 || n == 0 )
     {
-        return( mbedtls_mpi_lset( X, 0 ) );
+        return mbedtls_mpi_lset( X, 0 ) ;
     }
 
     /* Calculate A*b as A + A*(b-1) to take advantage of mpi_mul_hlp */
@@ -1793,7 +1793,7 @@
     mpi_mul_hlp( n, A->p, X->p, b - 1 );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1820,7 +1820,7 @@
     {
         if (r != NULL) *r = ~0;
 
-        return ( ~0 );
+        return ~0 ;
     }
 
 #if defined(MBEDTLS_HAVE_UDBL)
@@ -1906,7 +1906,7 @@
     MPI_VALIDATE_RET( B != NULL );
 
     if( mbedtls_mpi_cmp_int( B, 0 ) == 0 )
-        return( MBEDTLS_ERR_MPI_DIVISION_BY_ZERO );
+        return MBEDTLS_ERR_MPI_DIVISION_BY_ZERO ;
 
     mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
     mbedtls_mpi_init( &T1 );
@@ -1925,7 +1925,7 @@
     {
         if( Q != NULL ) MBEDTLS_MPI_CHK( mbedtls_mpi_lset( Q, 0 ) );
         if( R != NULL ) MBEDTLS_MPI_CHK( mbedtls_mpi_copy( R, A ) );
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &X, A ) );
@@ -2017,7 +2017,7 @@
     mbedtls_mpi_free( &T1 );
     mbedtls_platform_zeroize( TP2, sizeof( TP2 ) );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2036,7 +2036,7 @@
     B.n = 1;
     B.p = p;
 
-    return( mbedtls_mpi_div_mpi( Q, R, A, &B ) );
+    return mbedtls_mpi_div_mpi( Q, R, A, &B ) ;
 }
 
 /*
@@ -2050,7 +2050,7 @@
     MPI_VALIDATE_RET( B != NULL );
 
     if( mbedtls_mpi_cmp_int( B, 0 ) < 0 )
-        return( MBEDTLS_ERR_MPI_NEGATIVE_VALUE );
+        return MBEDTLS_ERR_MPI_NEGATIVE_VALUE ;
 
     MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( NULL, R, A, B ) );
 
@@ -2062,7 +2062,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2076,10 +2076,10 @@
     MPI_VALIDATE_RET( A != NULL );
 
     if( b == 0 )
-        return( MBEDTLS_ERR_MPI_DIVISION_BY_ZERO );
+        return MBEDTLS_ERR_MPI_DIVISION_BY_ZERO ;
 
     if( b < 0 )
-        return( MBEDTLS_ERR_MPI_NEGATIVE_VALUE );
+        return MBEDTLS_ERR_MPI_NEGATIVE_VALUE ;
 
     /*
      * handle trivial cases
@@ -2087,13 +2087,13 @@
     if( b == 1 )
     {
         *r = 0;
-        return( 0 );
+        return 0 ;
     }
 
     if( b == 2 )
     {
         *r = A->p[0] & 1;
-        return( 0 );
+        return 0 ;
     }
 
     /*
@@ -2121,7 +2121,7 @@
 
     *r = y;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2260,7 +2260,7 @@
     /* diff1 = (x != y) ? 1 : 0 */
     const size_t diff1 = diff_msb >> ( sizeof( diff_msb ) * 8 - 1 );
 
-    return( 1 ^ diff1 );
+    return 1 ^ diff1 ;
 }
 
 /**
@@ -2289,7 +2289,7 @@
     }
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2313,14 +2313,14 @@
     MPI_VALIDATE_RET( N != NULL );
 
     if( mbedtls_mpi_cmp_int( N, 0 ) <= 0 || ( N->p[0] & 1 ) == 0 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     if( mbedtls_mpi_cmp_int( E, 0 ) < 0 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     if( mbedtls_mpi_bitlen( E ) > MBEDTLS_MPI_MAX_BITS ||
         mbedtls_mpi_bitlen( N ) > MBEDTLS_MPI_MAX_BITS )
-        return ( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     /*
      * Init temps and window size
@@ -2526,7 +2526,7 @@
     if( prec_RR == NULL || prec_RR->p == NULL )
         mbedtls_mpi_free( &RR );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2640,7 +2640,7 @@
 
     mbedtls_mpi_free( &TA ); mbedtls_mpi_free( &TB );
 
-    return( ret );
+    return ret ;
 }
 
 /* Fill X with n_bytes random bytes.
@@ -2659,7 +2659,7 @@
     const size_t overhead = ( limbs * ciL ) - n_bytes;
 
     if( X->n < limbs )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     memset( X->p, 0, overhead );
     memset( (unsigned char *) X->p + limbs * ciL, 0, ( X->n - limbs ) * ciL );
@@ -2667,7 +2667,7 @@
     mpi_bigendian_to_host( X->p, limbs );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2690,12 +2690,12 @@
     /* Ensure that target MPI has exactly the necessary number of limbs */
     MBEDTLS_MPI_CHK( mbedtls_mpi_resize_clear( X, limbs ) );
     if( size == 0 )
-        return( 0 );
+        return 0 ;
 
     ret = mpi_fill_random_internal( X, size, f_rng, p_rng );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_mpi_random( mbedtls_mpi *X,
@@ -2712,9 +2712,9 @@
     mbedtls_mpi lower_bound;
 
     if( min < 0 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
     if( mbedtls_mpi_cmp_int( N, min ) <= 0 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     /*
      * When min == 0, each try has at worst a probability 1/2 of failing
@@ -2770,7 +2770,7 @@
 
 cleanup:
     mbedtls_mpi_free( &lower_bound );
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2785,7 +2785,7 @@
     MPI_VALIDATE_RET( N != NULL );
 
     if( mbedtls_mpi_cmp_int( N, 1 ) <= 0 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     mbedtls_mpi_init( &TA ); mbedtls_mpi_init( &TU ); mbedtls_mpi_init( &U1 ); mbedtls_mpi_init( &U2 );
     mbedtls_mpi_init( &G ); mbedtls_mpi_init( &TB ); mbedtls_mpi_init( &TV );
@@ -2868,7 +2868,7 @@
     mbedtls_mpi_free( &G ); mbedtls_mpi_free( &TB ); mbedtls_mpi_free( &TV );
     mbedtls_mpi_free( &V1 ); mbedtls_mpi_free( &V2 );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_GENPRIME)
@@ -2914,21 +2914,21 @@
     mbedtls_mpi_uint r;
 
     if( ( X->p[0] & 1 ) == 0 )
-        return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
+        return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE ;
 
     for( i = 0; small_prime[i] > 0; i++ )
     {
         if( mbedtls_mpi_cmp_int( X, small_prime[i] ) <= 0 )
-            return( 1 );
+            return 1 ;
 
         MBEDTLS_MPI_CHK( mbedtls_mpi_mod_int( &r, X, small_prime[i] ) );
 
         if( r == 0 )
-            return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
+            return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE ;
     }
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -3021,7 +3021,7 @@
     mbedtls_mpi_free( &T ); mbedtls_mpi_free( &A );
     mbedtls_mpi_free( &RR );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -3042,20 +3042,20 @@
 
     if( mbedtls_mpi_cmp_int( &XX, 0 ) == 0 ||
         mbedtls_mpi_cmp_int( &XX, 1 ) == 0 )
-        return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
+        return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE ;
 
     if( mbedtls_mpi_cmp_int( &XX, 2 ) == 0 )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mpi_check_small_factors( &XX ) ) != 0 )
     {
         if( ret == 1 )
-            return( 0 );
+            return 0 ;
 
-        return( ret );
+        return ret ;
     }
 
-    return( mpi_miller_rabin( &XX, rounds, f_rng, p_rng ) );
+    return mpi_miller_rabin( &XX, rounds, f_rng, p_rng ) ;
 }
 
 /*
@@ -3086,7 +3086,7 @@
     MPI_VALIDATE_RET( f_rng != NULL );
 
     if( nbits < 3 || nbits > MBEDTLS_MPI_MAX_BITS )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     mbedtls_mpi_init( &Y );
 
@@ -3182,7 +3182,7 @@
 
     mbedtls_mpi_free( &Y );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_GENPRIME */
@@ -3356,7 +3356,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/camellia.c b/library/camellia.c
index f7e0136..34c8a10 100644
--- a/library/camellia.c
+++ b/library/camellia.c
@@ -361,7 +361,7 @@
         case 128: ctx->nr = 3; idx = 0; break;
         case 192:
         case 256: ctx->nr = 4; idx = 1; break;
-        default : return( MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA );
+        default : return MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA ;
     }
 
     for( i = 0; i < keybits / 8; ++i )
@@ -439,7 +439,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -490,7 +490,7 @@
 exit:
     mbedtls_camellia_free( &cty );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -557,7 +557,7 @@
     PUT_UINT32_BE( X[0], output,  8 );
     PUT_UINT32_BE( X[1], output, 12 );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_CIPHER_MODE_CBC)
@@ -581,7 +581,7 @@
     CAMELLIA_VALIDATE_RET( length == 0 || output != NULL );
 
     if( length % 16 )
-        return( MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH );
+        return MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH ;
 
     if( mode == MBEDTLS_CAMELLIA_DECRYPT )
     {
@@ -616,7 +616,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CBC */
 
@@ -644,7 +644,7 @@
 
     n = *iv_off;
     if( n >= 16 )
-        return( MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA ;
 
     if( mode == MBEDTLS_CAMELLIA_DECRYPT )
     {
@@ -675,7 +675,7 @@
 
     *iv_off = n;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CFB */
 
@@ -702,7 +702,7 @@
 
     n = *nc_off;
     if( n >= 16 )
-        return( MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA ;
 
     while( length-- )
     {
@@ -722,7 +722,7 @@
 
     *nc_off = n;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CTR */
 #endif /* !MBEDTLS_CAMELLIA_ALT */
@@ -1102,7 +1102,7 @@
 
 exit:
     mbedtls_camellia_free( &ctx );
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/ccm.c b/library/ccm.c
index 424ee77..f4a40cf 100644
--- a/library/ccm.c
+++ b/library/ccm.c
@@ -78,23 +78,23 @@
     cipher_info = mbedtls_cipher_info_from_values( cipher, keybits,
                                                    MBEDTLS_MODE_ECB );
     if( cipher_info == NULL )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
     if( cipher_info->block_size != 16 )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
     mbedtls_cipher_free( &ctx->cipher_ctx );
 
     if( ( ret = mbedtls_cipher_setup( &ctx->cipher_ctx, cipher_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_cipher_setkey( &ctx->cipher_ctx, key, keybits,
                                MBEDTLS_ENCRYPT ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -122,7 +122,7 @@
         y[i] ^= b[i];                                                       \
                                                                             \
     if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, y, 16, y, &olen ) ) != 0 ) \
-        return( ret );
+        return ret ;
 
 /*
  * Encrypt or decrypt a partial block with CTR
@@ -135,7 +135,7 @@
         if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, ctr,       \
                                            16, b, &olen ) ) != 0 )      \
         {                                                               \
-            return( ret );                                              \
+            return ret ;                                              \
         }                                                               \
                                                                         \
         for( i = 0; i < (len); i++ )                                    \
@@ -169,14 +169,14 @@
      * Also, loosen the requirements to enable support for CCM* (IEEE 802.15.4).
      */
     if( tag_len == 2 || tag_len > 16 || tag_len % 2 != 0 )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
     /* Also implies q is within bounds */
     if( iv_len < 7 || iv_len > 13 )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
     if( add_len >= 0xFF00 )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
     q = 16 - 1 - (unsigned char) iv_len;
 
@@ -203,7 +203,7 @@
         b[15-i] = (unsigned char)( len_left & 0xFF );
 
     if( len_left > 0 )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
 
     /* Start CBC-MAC with first block */
@@ -311,7 +311,7 @@
     CTR_CRYPT( y, y, 16 );
     memcpy( tag, y, tag_len );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -346,7 +346,7 @@
     CCM_VALIDATE_RET( length == 0 || output != NULL );
     CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
     if( tag_len == 0 )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
     return( mbedtls_ccm_star_encrypt_and_tag( ctx, length, iv, iv_len, add,
                 add_len, input, output, tag, tag_len ) );
@@ -377,7 +377,7 @@
                                 iv, iv_len, add, add_len,
                                 input, output, check_tag, tag_len ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* Check tag in "constant-time" */
@@ -387,10 +387,10 @@
     if( diff != 0 )
     {
         mbedtls_platform_zeroize( output, length );
-        return( MBEDTLS_ERR_CCM_AUTH_FAILED );
+        return MBEDTLS_ERR_CCM_AUTH_FAILED ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ccm_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
@@ -407,7 +407,7 @@
     CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
 
     if( tag_len == 0 )
-        return( MBEDTLS_ERR_CCM_BAD_INPUT );
+        return MBEDTLS_ERR_CCM_BAD_INPUT ;
 
     return( mbedtls_ccm_star_auth_decrypt( ctx, length, iv, iv_len, add,
                 add_len, input, output, tag, tag_len ) );
@@ -479,12 +479,12 @@
     mbedtls_ccm_init( &ctx );
 
     if( mbedtls_ccm_setkey( &ctx, MBEDTLS_CIPHER_ID_AES, key_test_data,
-                            8 * sizeof key_test_data ) != 0 )
+                            8 * sizeof(key_test_data) ) != 0 )
     {
         if( verbose != 0 )
             mbedtls_printf( "  CCM: setup failed" );
 
-        return( 1 );
+        return 1 ;
     }
 
     for( i = 0; i < NB_TESTS; i++ )
@@ -510,7 +510,7 @@
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
-            return( 1 );
+            return 1 ;
         }
         memset( plaintext, 0, CCM_SELFTEST_PT_MAX_LEN );
 
@@ -527,7 +527,7 @@
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
-            return( 1 );
+            return 1 ;
         }
 
         if( verbose != 0 )
@@ -539,7 +539,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
diff --git a/library/chacha20.c b/library/chacha20.c
index 78467d3..87553bb 100644
--- a/library/chacha20.c
+++ b/library/chacha20.c
@@ -221,7 +221,7 @@
     ctx->state[10] = BYTES_TO_U32_LE( key, 24 );
     ctx->state[11] = BYTES_TO_U32_LE( key, 28 );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_chacha20_starts( mbedtls_chacha20_context* ctx,
@@ -244,7 +244,7 @@
     /* Initially, there's no keystream bytes available */
     ctx->keystream_bytes_used = CHACHA20_BLOCK_SIZE_BYTES;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_chacha20_update( mbedtls_chacha20_context *ctx,
@@ -309,7 +309,7 @@
 
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_chacha20_crypt( const unsigned char key[32],
@@ -341,7 +341,7 @@
 
 cleanup:
     mbedtls_chacha20_free( &ctx );
-    return( ret );
+    return ret ;
 }
 
 #endif /* !MBEDTLS_CHACHA20_ALT */
@@ -525,7 +525,7 @@
             if( verbose != 0 )          \
                 mbedtls_printf args;    \
                                         \
-            return( -1 );               \
+            return -1 ;               \
         }                               \
     }                                   \
     while( 0 )
@@ -560,7 +560,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/chachapoly.c b/library/chachapoly.c
index 77d5477..ffa074b 100644
--- a/library/chachapoly.c
+++ b/library/chachapoly.c
@@ -61,7 +61,7 @@
     unsigned char zeroes[15];
 
     if( partial_block_len == 0U )
-        return( 0 );
+        return 0 ;
 
     memset( zeroes, 0, sizeof( zeroes ) );
 
@@ -81,7 +81,7 @@
     unsigned char zeroes[15];
 
     if( partial_block_len == 0U )
-        return( 0 );
+        return 0 ;
 
     memset( zeroes, 0, sizeof( zeroes ) );
     return( mbedtls_poly1305_update( &ctx->poly1305_ctx,
@@ -123,7 +123,7 @@
 
     ret = mbedtls_chacha20_setkey( &ctx->chacha20_ctx, key );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_chachapoly_starts( mbedtls_chachapoly_context *ctx,
@@ -163,7 +163,7 @@
 
 cleanup:
     mbedtls_platform_zeroize( poly1305_key, 64U );
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_chachapoly_update_aad( mbedtls_chachapoly_context *ctx,
@@ -174,11 +174,11 @@
     CHACHAPOLY_VALIDATE_RET( aad_len == 0 || aad != NULL );
 
     if( ctx->state != CHACHAPOLY_STATE_AAD )
-        return( MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
+        return MBEDTLS_ERR_CHACHAPOLY_BAD_STATE ;
 
     ctx->aad_len += aad_len;
 
-    return( mbedtls_poly1305_update( &ctx->poly1305_ctx, aad, aad_len ) );
+    return mbedtls_poly1305_update( &ctx->poly1305_ctx, aad, aad_len ) ;
 }
 
 int mbedtls_chachapoly_update( mbedtls_chachapoly_context *ctx,
@@ -194,7 +194,7 @@
     if( ( ctx->state != CHACHAPOLY_STATE_AAD ) &&
         ( ctx->state != CHACHAPOLY_STATE_CIPHERTEXT ) )
     {
-        return( MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
+        return MBEDTLS_ERR_CHACHAPOLY_BAD_STATE ;
     }
 
     if( ctx->state == CHACHAPOLY_STATE_AAD )
@@ -203,7 +203,7 @@
 
         ret = chachapoly_pad_aad( ctx );
         if( ret != 0 )
-            return( ret );
+            return ret ;
     }
 
     ctx->ciphertext_len += len;
@@ -212,24 +212,24 @@
     {
         ret = mbedtls_chacha20_update( &ctx->chacha20_ctx, len, input, output );
         if( ret != 0 )
-            return( ret );
+            return ret ;
 
         ret = mbedtls_poly1305_update( &ctx->poly1305_ctx, output, len );
         if( ret != 0 )
-            return( ret );
+            return ret ;
     }
     else /* DECRYPT */
     {
         ret = mbedtls_poly1305_update( &ctx->poly1305_ctx, input, len );
         if( ret != 0 )
-            return( ret );
+            return ret ;
 
         ret = mbedtls_chacha20_update( &ctx->chacha20_ctx, len, input, output );
         if( ret != 0 )
-            return( ret );
+            return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_chachapoly_finish( mbedtls_chachapoly_context *ctx,
@@ -242,20 +242,20 @@
 
     if( ctx->state == CHACHAPOLY_STATE_INIT )
     {
-        return( MBEDTLS_ERR_CHACHAPOLY_BAD_STATE );
+        return MBEDTLS_ERR_CHACHAPOLY_BAD_STATE ;
     }
 
     if( ctx->state == CHACHAPOLY_STATE_AAD )
     {
         ret = chachapoly_pad_aad( ctx );
         if( ret != 0 )
-            return( ret );
+            return ret ;
     }
     else if( ctx->state == CHACHAPOLY_STATE_CIPHERTEXT )
     {
         ret = chachapoly_pad_ciphertext( ctx );
         if( ret != 0 )
-            return( ret );
+            return ret ;
     }
 
     ctx->state = CHACHAPOLY_STATE_FINISHED;
@@ -282,11 +282,11 @@
 
     ret = mbedtls_poly1305_update( &ctx->poly1305_ctx, len_block, 16U );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_poly1305_finish( &ctx->poly1305_ctx, mac );
 
-    return( ret );
+    return ret ;
 }
 
 static int chachapoly_crypt_and_tag( mbedtls_chachapoly_context *ctx,
@@ -316,7 +316,7 @@
     ret = mbedtls_chachapoly_finish( ctx, tag );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_chachapoly_encrypt_and_tag( mbedtls_chachapoly_context *ctx,
@@ -364,7 +364,7 @@
                         MBEDTLS_CHACHAPOLY_DECRYPT, length, nonce,
                         aad, aad_len, input, output, check_tag ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* Check tag in "constant-time" */
@@ -374,10 +374,10 @@
     if( diff != 0 )
     {
         mbedtls_platform_zeroize( output, length );
-        return( MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED );
+        return MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_CHACHAPOLY_ALT */
@@ -481,7 +481,7 @@
             if( verbose != 0 )          \
                 mbedtls_printf args;    \
                                         \
-            return( -1 );               \
+            return -1 ;               \
         }                               \
     }                                   \
     while( 0 )
@@ -530,7 +530,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/cipher.c b/library/cipher.c
index 546cace..203a587 100644
--- a/library/cipher.c
+++ b/library/cipher.c
@@ -91,7 +91,7 @@
     for( diff = 0, i = 0; i < len; i++ )
         diff |= p1[i] ^ p2[i];
 
-    return( (int)diff );
+    return (int)diff ;
 }
 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
 
@@ -115,7 +115,7 @@
         supported_init = 1;
     }
 
-    return( mbedtls_cipher_supported );
+    return mbedtls_cipher_supported ;
 }
 
 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type(
@@ -125,9 +125,9 @@
 
     for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
         if( def->type == cipher_type )
-            return( def->info );
+            return def->info ;
 
-    return( NULL );
+    return NULL ;
 }
 
 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string(
@@ -136,13 +136,13 @@
     const mbedtls_cipher_definition_t *def;
 
     if( NULL == cipher_name )
-        return( NULL );
+        return NULL ;
 
     for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
         if( !  strcmp( def->info->name, cipher_name ) )
-            return( def->info );
+            return def->info ;
 
-    return( NULL );
+    return NULL ;
 }
 
 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values(
@@ -156,9 +156,9 @@
         if( def->info->base->cipher == cipher_id &&
             def->info->key_bitlen == (unsigned) key_bitlen &&
             def->info->mode == mode )
-            return( def->info );
+            return def->info ;
 
-    return( NULL );
+    return NULL ;
 }
 
 void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx )
@@ -215,12 +215,12 @@
 {
     CIPHER_VALIDATE_RET( ctx != NULL );
     if( cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
 
     if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) )
-        return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
+        return MBEDTLS_ERR_CIPHER_ALLOC_FAILED ;
 
     ctx->cipher_info = cipher_info;
 
@@ -235,7 +235,7 @@
 #endif
 #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -247,26 +247,26 @@
     mbedtls_cipher_context_psa *cipher_psa;
 
     if( NULL == cipher_info || NULL == ctx )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     /* Check that the underlying cipher mode and cipher type are
      * supported by the underlying PSA Crypto implementation. */
     alg = mbedtls_psa_translate_cipher_mode( cipher_info->mode, taglen );
     if( alg == 0 )
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     if( mbedtls_psa_translate_cipher_type( cipher_info->type ) == 0 )
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 
     memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
 
     cipher_psa = mbedtls_calloc( 1, sizeof(mbedtls_cipher_context_psa ) );
     if( cipher_psa == NULL )
-        return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
+        return MBEDTLS_ERR_CIPHER_ALLOC_FAILED ;
     cipher_psa->alg  = alg;
     ctx->cipher_ctx  = cipher_psa;
     ctx->cipher_info = cipher_info;
     ctx->psa_enabled = 1;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -280,7 +280,7 @@
     CIPHER_VALIDATE_RET( operation == MBEDTLS_ENCRYPT ||
                          operation == MBEDTLS_DECRYPT );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ctx->psa_enabled == 1 )
@@ -296,16 +296,16 @@
 
         /* PSA Crypto API only accepts byte-aligned keys. */
         if( key_bitlen % 8 != 0 )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         /* Don't allow keys to be set multiple times. */
         if( cipher_psa->slot_state != MBEDTLS_CIPHER_PSA_KEY_UNSET )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         key_type = mbedtls_psa_translate_cipher_type(
             ctx->cipher_info->type );
         if( key_type == 0 )
-            return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
         psa_set_key_type( &attributes, key_type );
 
         /* Mbed TLS' cipher layer doesn't enforce the mode of operation
@@ -324,11 +324,11 @@
             case PSA_SUCCESS:
                 break;
             case PSA_ERROR_INSUFFICIENT_MEMORY:
-                return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
+                return MBEDTLS_ERR_CIPHER_ALLOC_FAILED ;
             case PSA_ERROR_NOT_SUPPORTED:
-                return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+                return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
             default:
-                return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+                return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
         }
         /* Indicate that we own the key slot and need to
          * destroy it in mbedtls_cipher_free(). */
@@ -336,14 +336,14 @@
 
         ctx->key_bitlen = key_bitlen;
         ctx->operation = operation;
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN ) == 0 &&
         (int) ctx->cipher_info->key_bitlen != key_bitlen )
     {
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
     ctx->key_bitlen = key_bitlen;
@@ -365,7 +365,7 @@
         return( ctx->cipher_info->base->setkey_dec_func( ctx->cipher_ctx, key,
                                                          ctx->key_bitlen ) );
 
-    return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+    return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 }
 
 int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
@@ -377,20 +377,20 @@
     CIPHER_VALIDATE_RET( ctx != NULL );
     CIPHER_VALIDATE_RET( iv_len == 0 || iv != NULL );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ctx->psa_enabled == 1 )
     {
         /* While PSA Crypto has an API for multipart
          * operations, we currently don't make it
          * accessible through the cipher layer. */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     /* avoid buffer overflow in ctx->iv */
     if( iv_len > MBEDTLS_MAX_IV_LENGTH )
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 
     if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN ) != 0 )
         actual_iv_size = iv_len;
@@ -400,7 +400,7 @@
 
         /* avoid reading past the end of input buffer */
         if( actual_iv_size > iv_len )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_CHACHA20_C)
@@ -410,7 +410,7 @@
                                            iv,
                                            0U ) ) /* Initial counter value */
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
     }
 #endif
@@ -430,27 +430,27 @@
         ctx->iv_size = actual_iv_size;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx )
 {
     CIPHER_VALIDATE_RET( ctx != NULL );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ctx->psa_enabled == 1 )
     {
         /* We don't support resetting PSA-based
          * cipher contexts, yet. */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     ctx->unprocessed_len = 0;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
@@ -460,7 +460,7 @@
     CIPHER_VALIDATE_RET( ctx != NULL );
     CIPHER_VALIDATE_RET( ad_len == 0 || ad != NULL );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ctx->psa_enabled == 1 )
@@ -468,7 +468,7 @@
         /* While PSA Crypto has an API for multipart
          * operations, we currently don't make it
          * accessible through the cipher layer. */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -494,14 +494,14 @@
                                                         ctx->iv,
                                                         mode );
         if ( result != 0 )
-            return( result );
+            return result ;
 
         return( mbedtls_chachapoly_update_aad( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
                                                ad, ad_len ) );
     }
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
 
@@ -516,7 +516,7 @@
     CIPHER_VALIDATE_RET( output != NULL );
     CIPHER_VALIDATE_RET( olen != NULL );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ctx->psa_enabled == 1 )
@@ -524,7 +524,7 @@
         /* While PSA Crypto has an API for multipart
          * operations, we currently don't make it
          * accessible through the cipher layer. */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -532,23 +532,23 @@
     block_size = mbedtls_cipher_get_block_size( ctx );
     if ( 0 == block_size )
     {
-        return( MBEDTLS_ERR_CIPHER_INVALID_CONTEXT );
+        return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT ;
     }
 
     if( ctx->cipher_info->mode == MBEDTLS_MODE_ECB )
     {
         if( ilen != block_size )
-            return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
+            return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ;
 
         *olen = ilen;
 
         if( 0 != ( ret = ctx->cipher_info->base->ecb_func( ctx->cipher_ctx,
                     ctx->operation, input, output ) ) )
         {
-            return( ret );
+            return ret ;
         }
 
-        return( 0 );
+        return 0 ;
     }
 
 #if defined(MBEDTLS_GCM_C)
@@ -572,7 +572,7 @@
     if( input == output &&
        ( ctx->unprocessed_len != 0 || ilen % block_size ) )
     {
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_CIPHER_MODE_CBC)
@@ -594,7 +594,7 @@
                     ilen );
 
             ctx->unprocessed_len += ilen;
-            return( 0 );
+            return 0 ;
         }
 
         /*
@@ -611,7 +611,7 @@
                     ctx->operation, block_size, ctx->iv,
                     ctx->unprocessed_data, output ) ) )
             {
-                return( ret );
+                return ret ;
             }
 
             *olen += block_size;
@@ -654,13 +654,13 @@
             if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
                     ctx->operation, ilen, ctx->iv, input, output ) ) )
             {
-                return( ret );
+                return ret ;
             }
 
             *olen += ilen;
         }
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_CIPHER_MODE_CBC */
 
@@ -671,12 +671,12 @@
                 ctx->operation, ilen, &ctx->unprocessed_len, ctx->iv,
                 input, output ) ) )
         {
-            return( ret );
+            return ret ;
         }
 
         *olen = ilen;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_CIPHER_MODE_CFB */
 
@@ -686,12 +686,12 @@
         if( 0 != ( ret = ctx->cipher_info->base->ofb_func( ctx->cipher_ctx,
                 ilen, &ctx->unprocessed_len, ctx->iv, input, output ) ) )
         {
-            return( ret );
+            return ret ;
         }
 
         *olen = ilen;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_CIPHER_MODE_OFB */
 
@@ -702,12 +702,12 @@
                 ilen, &ctx->unprocessed_len, ctx->iv,
                 ctx->unprocessed_data, input, output ) ) )
         {
-            return( ret );
+            return ret ;
         }
 
         *olen = ilen;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_CIPHER_MODE_CTR */
 
@@ -716,19 +716,19 @@
     {
         if( ctx->unprocessed_len > 0 ) {
             /* We can only process an entire data unit at a time. */
-            return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
         }
 
         ret = ctx->cipher_info->base->xts_func( ctx->cipher_ctx,
                 ctx->operation, ilen, ctx->iv, input, output );
         if( ret != 0 )
         {
-            return( ret );
+            return ret ;
         }
 
         *olen = ilen;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_CIPHER_MODE_XTS */
 
@@ -738,16 +738,16 @@
         if( 0 != ( ret = ctx->cipher_info->base->stream_func( ctx->cipher_ctx,
                                                     ilen, input, output ) ) )
         {
-            return( ret );
+            return ret ;
         }
 
         *olen = ilen;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_CIPHER_MODE_STREAM */
 
-    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 }
 
 #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
@@ -772,7 +772,7 @@
     unsigned char padding_len, bad = 0;
 
     if( NULL == input || NULL == data_len )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     padding_len = input[input_len - 1];
     *data_len = input_len - padding_len;
@@ -787,7 +787,7 @@
     for( i = 0; i < input_len; i++ )
         bad |= ( input[i] ^ padding_len ) * ( i >= pad_idx );
 
-    return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
+    return MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) ;
 }
 #endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */
 
@@ -813,7 +813,7 @@
     unsigned char done = 0, prev_done, bad;
 
     if( NULL == input || NULL == data_len )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     bad = 0x80;
     *data_len = 0;
@@ -825,7 +825,7 @@
         bad ^= input[i - 1] * ( done != prev_done );
     }
 
-    return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
+    return MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) ;
 
 }
 #endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */
@@ -852,7 +852,7 @@
     unsigned char padding_len, bad = 0;
 
     if( NULL == input || NULL == data_len )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     padding_len = input[input_len - 1];
     *data_len = input_len - padding_len;
@@ -866,7 +866,7 @@
     for( i = 0; i < input_len - 1; i++ )
         bad |= input[i] * ( i >= pad_idx );
 
-    return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
+    return MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) ;
 }
 #endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */
 
@@ -890,7 +890,7 @@
     unsigned char done = 0, prev_done;
 
     if( NULL == input || NULL == data_len )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     *data_len = 0;
     for( i = input_len; i > 0; i-- )
@@ -900,7 +900,7 @@
         *data_len |= i * ( done != prev_done );
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_PADDING_ZEROS */
 
@@ -914,11 +914,11 @@
                               size_t *data_len )
 {
     if( NULL == input || NULL == data_len )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     *data_len = input_len;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
 
@@ -929,7 +929,7 @@
     CIPHER_VALIDATE_RET( output != NULL );
     CIPHER_VALIDATE_RET( olen != NULL );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ctx->psa_enabled == 1 )
@@ -937,7 +937,7 @@
         /* While PSA Crypto has an API for multipart
          * operations, we currently don't make it
          * accessible through the cipher layer. */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -950,21 +950,21 @@
         MBEDTLS_MODE_XTS == ctx->cipher_info->mode ||
         MBEDTLS_MODE_STREAM == ctx->cipher_info->mode )
     {
-        return( 0 );
+        return 0 ;
     }
 
     if ( ( MBEDTLS_CIPHER_CHACHA20          == ctx->cipher_info->type ) ||
          ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) )
     {
-        return( 0 );
+        return 0 ;
     }
 
     if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode )
     {
         if( ctx->unprocessed_len != 0 )
-            return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
+            return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ;
 
-        return( 0 );
+        return 0 ;
     }
 
 #if defined(MBEDTLS_CIPHER_MODE_CBC)
@@ -978,9 +978,9 @@
             if( NULL == ctx->add_padding )
             {
                 if( 0 != ctx->unprocessed_len )
-                    return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
+                    return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ;
 
-                return( 0 );
+                return 0 ;
             }
 
             ctx->add_padding( ctx->unprocessed_data, mbedtls_cipher_get_iv_size( ctx ),
@@ -993,9 +993,9 @@
              * or an empty block if no padding
              */
             if( NULL == ctx->add_padding && 0 == ctx->unprocessed_len )
-                return( 0 );
+                return 0 ;
 
-            return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
+            return MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED ;
         }
 
         /* cipher block */
@@ -1003,7 +1003,7 @@
                 ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv,
                 ctx->unprocessed_data, output ) ) )
         {
-            return( ret );
+            return ret ;
         }
 
         /* Set output size for decryption */
@@ -1013,13 +1013,13 @@
 
         /* Set output size for encryption */
         *olen = mbedtls_cipher_get_block_size( ctx );
-        return( 0 );
+        return 0 ;
     }
 #else
     ((void) output);
 #endif /* MBEDTLS_CIPHER_MODE_CBC */
 
-    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 }
 
 #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
@@ -1030,7 +1030,7 @@
 
     if( NULL == ctx->cipher_info || MBEDTLS_MODE_CBC != ctx->cipher_info->mode )
     {
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -1040,9 +1040,9 @@
          * schemes, we currently don't make them
          * accessible through the cipher layer. */
         if( mode != MBEDTLS_PADDING_NONE )
-            return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -1078,10 +1078,10 @@
         break;
 
     default:
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
 
@@ -1092,10 +1092,10 @@
     CIPHER_VALIDATE_RET( ctx != NULL );
     CIPHER_VALIDATE_RET( tag_len == 0 || tag != NULL );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     if( MBEDTLS_ENCRYPT != ctx->operation )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ctx->psa_enabled == 1 )
@@ -1103,7 +1103,7 @@
         /* While PSA Crypto has an API for multipart
          * operations, we currently don't make it
          * accessible through the cipher layer. */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -1124,14 +1124,14 @@
     {
         /* Don't allow truncated MAC for Poly1305 */
         if ( tag_len != 16U )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         return( mbedtls_chachapoly_finish(
                     (mbedtls_chachapoly_context*) ctx->cipher_ctx, tag ) );
     }
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
@@ -1143,11 +1143,11 @@
     CIPHER_VALIDATE_RET( ctx != NULL );
     CIPHER_VALIDATE_RET( tag_len == 0 || tag != NULL );
     if( ctx->cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     if( MBEDTLS_DECRYPT != ctx->operation )
     {
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -1156,7 +1156,7 @@
         /* While PSA Crypto has an API for multipart
          * operations, we currently don't make it
          * accessible through the cipher layer. */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -1168,21 +1168,21 @@
          * that can delay up to a block of output. */
 
         if( tag_len > sizeof( check_tag ) )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         if( 0 != ( ret = mbedtls_gcm_finish(
                        (mbedtls_gcm_context *) ctx->cipher_ctx,
                        NULL, 0, &output_length,
                        check_tag, tag_len ) ) )
         {
-            return( ret );
+            return ret ;
         }
 
         /* Check the tag in "constant-time" */
         if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
-            return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
+            return MBEDTLS_ERR_CIPHER_AUTH_FAILED ;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_GCM_C */
 
@@ -1191,24 +1191,24 @@
     {
         /* Don't allow truncated MAC for Poly1305 */
         if ( tag_len != sizeof( check_tag ) )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         ret = mbedtls_chachapoly_finish(
             (mbedtls_chachapoly_context*) ctx->cipher_ctx, check_tag );
         if ( ret != 0 )
         {
-            return( ret );
+            return ret ;
         }
 
         /* Check the tag in "constant-time" */
         if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
-            return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
+            return MBEDTLS_ERR_CIPHER_AUTH_FAILED ;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_CHACHAPOLY_C */
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
 
@@ -1257,53 +1257,53 @@
                                                cipher_psa->alg );
         }
         else
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         /* In the following, we can immediately return on an error,
          * because the PSA Crypto API guarantees that cipher operations
          * are terminated by unsuccessful calls to psa_cipher_update(),
          * and by any call to psa_cipher_finish(). */
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
         status = psa_cipher_set_iv( &cipher_op, iv, iv_len );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
         status = psa_cipher_update( &cipher_op,
                                     input, ilen,
                                     output, ilen, olen );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
         status = psa_cipher_finish( &cipher_op,
                                     output + *olen, ilen - *olen,
                                     &part_len );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
         *olen += part_len;
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     if( ( ret = mbedtls_cipher_set_iv( ctx, iv, iv_len ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_cipher_reset( ctx ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_cipher_update( ctx, input, ilen,
                                        output, olen ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_cipher_finish( ctx, output + *olen,
                                        &finish_olen ) ) != 0 )
-        return( ret );
+        return ret ;
 
     *olen += finish_olen;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_CIPHER_MODE_AEAD)
@@ -1334,7 +1334,7 @@
         /* PSA Crypto API always writes the authentication tag
          * at the end of the encrypted message. */
         if( output == NULL || tag != output + ilen )
-            return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 
         status = psa_aead_encrypt( cipher_psa->slot,
                                    cipher_psa->alg,
@@ -1343,10 +1343,10 @@
                                    input, ilen,
                                    output, ilen + tag_len, olen );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
         *olen -= tag_len;
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -1375,7 +1375,7 @@
         if ( ( iv_len != ctx->cipher_info->iv_size ) ||
              ( tag_len != 16U ) )
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         *olen = ilen;
@@ -1384,7 +1384,7 @@
     }
 #endif /* MBEDTLS_CHACHAPOLY_C */
 
-    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 }
 
 /*
@@ -1414,7 +1414,7 @@
         /* PSA Crypto API always writes the authentication tag
          * at the end of the encrypted message. */
         if( input == NULL || tag != input + ilen )
-            return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 
         status = psa_aead_decrypt( cipher_psa->slot,
                                    cipher_psa->alg,
@@ -1423,11 +1423,11 @@
                                    input, ilen + tag_len,
                                    output, ilen, olen );
         if( status == PSA_ERROR_INVALID_SIGNATURE )
-            return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
+            return MBEDTLS_ERR_CIPHER_AUTH_FAILED ;
         else if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -1444,7 +1444,7 @@
         if( ret == MBEDTLS_ERR_GCM_AUTH_FAILED )
             ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
 
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_GCM_C */
 #if defined(MBEDTLS_CCM_C)
@@ -1460,7 +1460,7 @@
         if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED )
             ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
 
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_CCM_C */
 #if defined(MBEDTLS_CHACHAPOLY_C)
@@ -1472,7 +1472,7 @@
         if ( ( iv_len != ctx->cipher_info->iv_size ) ||
              ( tag_len != 16U ) )
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         *olen = ilen;
@@ -1482,11 +1482,11 @@
         if( ret == MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED )
             ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
 
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_CHACHAPOLY_C */
 
-    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_AEAD */
 
@@ -1522,7 +1522,7 @@
         /* There is no iv, tag or ad associated with KW and KWP,
          * so these length should be 0 as documented. */
         if( iv_len != 0 || tag_len != 0 || ad_len != 0 )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         (void) iv;
         (void) ad;
@@ -1535,15 +1535,15 @@
 #if defined(MBEDTLS_CIPHER_MODE_AEAD)
     /* AEAD case: check length before passing on to shared function */
     if( output_len < ilen + tag_len )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     int ret = mbedtls_cipher_aead_encrypt( ctx, iv, iv_len, ad, ad_len,
                                        input, ilen, output, olen,
                                        output + ilen, tag_len );
     *olen += tag_len;
-    return( ret );
+    return ret ;
 #else
-    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_CIPHER_MODE_AEAD */
 }
 
@@ -1578,7 +1578,7 @@
         /* There is no iv, tag or ad associated with KW and KWP,
          * so these length should be 0 as documented. */
         if( iv_len != 0 || tag_len != 0 || ad_len != 0 )
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
         (void) iv;
         (void) ad;
@@ -1591,13 +1591,13 @@
 #if defined(MBEDTLS_CIPHER_MODE_AEAD)
     /* AEAD case: check length before passing on to shared function */
     if( ilen < tag_len || output_len < ilen - tag_len )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     return( mbedtls_cipher_aead_decrypt( ctx, iv, iv_len, ad, ad_len,
                                          input, ilen - tag_len, output, olen,
                                          input + ilen - tag_len, tag_len ) );
 #else
-    return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_CIPHER_MODE_AEAD */
 }
 #endif /* MBEDTLS_CIPHER_MODE_AEAD || MBEDTLS_NIST_KW_C */
diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
index 5776d5e..3c55045 100644
--- a/library/cipher_wrap.c
+++ b/library/cipher_wrap.c
@@ -85,7 +85,7 @@
     if( ctx != NULL )
         mbedtls_gcm_init( (mbedtls_gcm_context *) ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void gcm_ctx_free( void *ctx )
@@ -104,7 +104,7 @@
     if( ctx != NULL )
         mbedtls_ccm_init( (mbedtls_ccm_context *) ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void ccm_ctx_free( void *ctx )
@@ -204,11 +204,11 @@
     mbedtls_aes_context *aes = mbedtls_calloc( 1, sizeof( mbedtls_aes_context ) );
 
     if( aes == NULL )
-        return( NULL );
+        return NULL ;
 
     mbedtls_aes_init( aes );
 
-    return( aes );
+    return aes ;
 }
 
 static void aes_ctx_free( void *ctx )
@@ -422,14 +422,14 @@
                                     unsigned int key_bitlen )
 {
     mbedtls_aes_xts_context *xts_ctx = ctx;
-    return( mbedtls_aes_xts_setkey_enc( xts_ctx, key, key_bitlen ) );
+    return mbedtls_aes_xts_setkey_enc( xts_ctx, key, key_bitlen ) ;
 }
 
 static int xts_aes_setkey_dec_wrap( void *ctx, const unsigned char *key,
                                     unsigned int key_bitlen )
 {
     mbedtls_aes_xts_context *xts_ctx = ctx;
-    return( mbedtls_aes_xts_setkey_dec( xts_ctx, key, key_bitlen ) );
+    return mbedtls_aes_xts_setkey_dec( xts_ctx, key, key_bitlen ) ;
 }
 
 static void *xts_aes_ctx_alloc( void )
@@ -439,7 +439,7 @@
     if( xts_ctx != NULL )
         mbedtls_aes_xts_init( xts_ctx );
 
-    return( xts_ctx );
+    return xts_ctx ;
 }
 
 static void xts_aes_ctx_free( void *ctx )
@@ -700,11 +700,11 @@
     ctx = mbedtls_calloc( 1, sizeof( mbedtls_camellia_context ) );
 
     if( ctx == NULL )
-        return( NULL );
+        return NULL ;
 
     mbedtls_camellia_init( ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void camellia_ctx_free( void *ctx )
@@ -1076,11 +1076,11 @@
     ctx = mbedtls_calloc( 1, sizeof( mbedtls_aria_context ) );
 
     if( ctx == NULL )
-        return( NULL );
+        return NULL ;
 
     mbedtls_aria_init( ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void aria_ctx_free( void *ctx )
@@ -1481,11 +1481,11 @@
     mbedtls_des_context *des = mbedtls_calloc( 1, sizeof( mbedtls_des_context ) );
 
     if( des == NULL )
-        return( NULL );
+        return NULL ;
 
     mbedtls_des_init( des );
 
-    return( des );
+    return des ;
 }
 
 static void des_ctx_free( void *ctx )
@@ -1500,11 +1500,11 @@
     des3 = mbedtls_calloc( 1, sizeof( mbedtls_des3_context ) );
 
     if( des3 == NULL )
-        return( NULL );
+        return NULL ;
 
     mbedtls_des3_init( des3 );
 
-    return( des3 );
+    return des3 ;
 }
 
 static void des3_ctx_free( void *ctx )
@@ -1672,12 +1672,12 @@
                                  unsigned int key_bitlen )
 {
     if( key_bitlen != 256U )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     if ( 0 != mbedtls_chacha20_setkey( (mbedtls_chacha20_context*)ctx, key ) )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int chacha20_stream_wrap( void *ctx,  size_t length,
@@ -1688,9 +1688,9 @@
 
     ret = mbedtls_chacha20_update( ctx, length, input, output );
     if( ret == MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
-    return( ret );
+    return ret ;
 }
 
 static void * chacha20_ctx_alloc( void )
@@ -1699,11 +1699,11 @@
     ctx = mbedtls_calloc( 1, sizeof( mbedtls_chacha20_context ) );
 
     if( ctx == NULL )
-        return( NULL );
+        return NULL ;
 
     mbedtls_chacha20_init( ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void chacha20_ctx_free( void *ctx )
@@ -1757,12 +1757,12 @@
                                    unsigned int key_bitlen )
 {
     if( key_bitlen != 256U )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     if ( 0 != mbedtls_chachapoly_setkey( (mbedtls_chachapoly_context*)ctx, key ) )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static void * chachapoly_ctx_alloc( void )
@@ -1771,11 +1771,11 @@
     ctx = mbedtls_calloc( 1, sizeof( mbedtls_chachapoly_context ) );
 
     if( ctx == NULL )
-        return( NULL );
+        return NULL ;
 
     mbedtls_chachapoly_init( ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void chachapoly_ctx_free( void *ctx )
@@ -1829,7 +1829,7 @@
 {
     ((void) ctx);
     memmove( output, input, length );
-    return( 0 );
+    return 0 ;
 }
 
 static int null_setkey( void *ctx, const unsigned char *key,
@@ -1839,12 +1839,12 @@
     ((void) key);
     ((void) key_bitlen);
 
-    return( 0 );
+    return 0 ;
 }
 
 static void * null_ctx_alloc( void )
 {
-    return( (void *) 1 );
+    return (void *) 1 ;
 }
 
 static void null_ctx_free( void *ctx )
@@ -1899,7 +1899,7 @@
     if( ctx != NULL )
         mbedtls_nist_kw_init( (mbedtls_nist_kw_context *) ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void kw_ctx_free( void *ctx )
diff --git a/library/cmac.c b/library/cmac.c
index 3cc49d1..1070b03 100644
--- a/library/cmac.c
+++ b/library/cmac.c
@@ -83,7 +83,7 @@
     }
     else
     {
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
     for( i = (int)blocksize - 1; i >= 0; i-- )
@@ -108,7 +108,7 @@
 
     output[ blocksize - 1 ] ^= R_n & mask;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -143,7 +143,7 @@
 exit:
     mbedtls_platform_zeroize( L, sizeof( L ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* !defined(MBEDTLS_CMAC_ALT) || defined(MBEDTLS_SELF_TEST) */
 
@@ -190,11 +190,11 @@
     int retval;
 
     if( ctx == NULL || ctx->cipher_info == NULL || key == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     if( ( retval = mbedtls_cipher_setkey( ctx, key, (int)keybits,
                                           MBEDTLS_ENCRYPT ) ) != 0 )
-        return( retval );
+        return retval ;
 
     type = ctx->cipher_info->type;
 
@@ -206,14 +206,14 @@
         case MBEDTLS_CIPHER_DES_EDE3_ECB:
             break;
         default:
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
     /* Allocated and initialise in the cipher context memory for the CMAC
      * context */
     cmac_ctx = mbedtls_calloc( 1, sizeof( mbedtls_cmac_context_t ) );
     if( cmac_ctx == NULL )
-        return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
+        return MBEDTLS_ERR_CIPHER_ALLOC_FAILED ;
 
     ctx->cmac_ctx = cmac_ctx;
 
@@ -232,7 +232,7 @@
 
     if( ctx == NULL || ctx->cipher_info == NULL || input == NULL ||
         ctx->cmac_ctx == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     cmac_ctx = ctx->cmac_ctx;
     block_size = ctx->cipher_info->block_size;
@@ -287,7 +287,7 @@
     }
 
 exit:
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx,
@@ -303,7 +303,7 @@
 
     if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL ||
         output == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     cmac_ctx = ctx->cmac_ctx;
     block_size = ctx->cipher_info->block_size;
@@ -348,7 +348,7 @@
                               sizeof( cmac_ctx->unprocessed_block ) );
 
     mbedtls_platform_zeroize( state, MBEDTLS_CIPHER_BLKSIZE_MAX );
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx )
@@ -356,7 +356,7 @@
     mbedtls_cmac_context_t* cmac_ctx;
 
     if( ctx == NULL || ctx->cipher_info == NULL || ctx->cmac_ctx == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     cmac_ctx = ctx->cmac_ctx;
 
@@ -367,7 +367,7 @@
     mbedtls_platform_zeroize( cmac_ctx->state,
                               sizeof( cmac_ctx->state ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info,
@@ -379,7 +379,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( cipher_info == NULL || key == NULL || input == NULL || output == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     mbedtls_cipher_init( &ctx );
 
@@ -399,7 +399,7 @@
 exit:
     mbedtls_cipher_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_AES_C)
@@ -416,7 +416,7 @@
     unsigned char int_key[MBEDTLS_AES_BLOCK_SIZE];
 
     if( key == NULL || input == NULL || output == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     cipher_info = mbedtls_cipher_info_from_type( MBEDTLS_CIPHER_AES_128_ECB );
     if( cipher_info == NULL )
@@ -447,7 +447,7 @@
 exit:
     mbedtls_platform_zeroize( int_key, sizeof( int_key ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_AES_C */
 
@@ -760,7 +760,7 @@
     if( cipher_info == NULL )
     {
         /* Failing at this point must be due to a build issue */
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
     }
 
     for( i = 0; i < num_tests; i++ )
@@ -831,7 +831,7 @@
     mbedtls_cipher_free( &ctx );
 
 exit:
-    return( ret );
+    return ret ;
 }
 
 static int cmac_test_wth_cipher( int verbose,
@@ -896,7 +896,7 @@
     ret = 0;
 
 exit:
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_AES_C)
@@ -917,14 +917,14 @@
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
-            return( ret );
+            return ret ;
         }
         else if( verbose != 0 )
         {
             mbedtls_printf( "passed\n" );
         }
     }
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_AES_C */
 
@@ -943,7 +943,7 @@
                                    MBEDTLS_AES_BLOCK_SIZE,
                                    NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = cmac_test_wth_cipher( verbose,
@@ -957,7 +957,7 @@
                                       MBEDTLS_AES_BLOCK_SIZE,
                                       NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* AES-192 */
@@ -970,7 +970,7 @@
                                    MBEDTLS_AES_BLOCK_SIZE,
                                    NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = cmac_test_wth_cipher( verbose,
@@ -984,7 +984,7 @@
                                       MBEDTLS_AES_BLOCK_SIZE,
                                       NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* AES-256 */
@@ -997,7 +997,7 @@
                                    MBEDTLS_AES_BLOCK_SIZE,
                                    NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = cmac_test_wth_cipher ( verbose,
@@ -1011,7 +1011,7 @@
                                        MBEDTLS_AES_BLOCK_SIZE,
                                        NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_AES_C */
 
@@ -1026,7 +1026,7 @@
                                    MBEDTLS_DES3_BLOCK_SIZE,
                                    NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = cmac_test_wth_cipher( verbose,
@@ -1040,7 +1040,7 @@
                                       MBEDTLS_DES3_BLOCK_SIZE,
                                       NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* 3DES 3 key */
@@ -1053,7 +1053,7 @@
                                    MBEDTLS_DES3_BLOCK_SIZE,
                                    NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = cmac_test_wth_cipher( verbose,
@@ -1067,19 +1067,19 @@
                                       MBEDTLS_DES3_BLOCK_SIZE,
                                       NB_CMAC_TESTS_PER_KEY ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_DES_C */
 
 #if defined(MBEDTLS_AES_C)
     if( ( ret = test_aes128_cmac_prf( verbose ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_AES_C */
 
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/ctr_drbg.c b/library/ctr_drbg.c
index b664fb0..5927514 100644
--- a/library/ctr_drbg.c
+++ b/library/ctr_drbg.c
@@ -96,16 +96,16 @@
     /* If mbedtls_ctr_drbg_seed() has already been called, it's
      * too late. Return the error code that's closest to making sense. */
     if( ctx->f_entropy != NULL )
-        return( MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED ;
 
     if( len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT )
-        return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG ;
 #if SIZE_MAX > INT_MAX
     /* This shouldn't be an issue because
      * MBEDTLS_CTR_DRBG_MAX_SEED_INPUT < INT_MAX in any sensible
      * configuration, but make sure anyway. */
     if( len > INT_MAX )
-        return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG ;
 #endif
 
     /* For backward compatibility with Mbed TLS <= 2.19, store the
@@ -113,7 +113,7 @@
      * used until after the initial seeding. */
     /* Due to the capping of len above, the value fits in an int. */
     ctx->reseed_counter = (int) len;
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_ctr_drbg_set_reseed_interval( mbedtls_ctr_drbg_context *ctx,
@@ -138,7 +138,7 @@
     size_t buf_len, use_len;
 
     if( data_len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT )
-        return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG ;
 
     memset( buf, 0, MBEDTLS_CTR_DRBG_MAX_SEED_INPUT +
             MBEDTLS_CTR_DRBG_BLOCKSIZE + 16 );
@@ -242,7 +242,7 @@
         mbedtls_platform_zeroize( output, MBEDTLS_CTR_DRBG_SEEDLEN );
     }
 
-    return( ret );
+    return ret ;
 }
 
 /* CTR_DRBG_Update (SP 800-90A &sect;10.2.1.2)
@@ -300,7 +300,7 @@
 
 exit:
     mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
-    return( ret );
+    return ret ;
 }
 
 /* CTR_DRBG_Instantiate with derivation function (SP 800-90A &sect;10.2.1.3.2)
@@ -323,7 +323,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( add_len == 0 )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = block_cipher_df( add_input, additional, add_len ) ) != 0 )
         goto exit;
@@ -332,7 +332,7 @@
 
 exit:
     mbedtls_platform_zeroize( add_input, sizeof( add_input ) );
-    return( ret );
+    return ret ;
 }
 
 /* CTR_DRBG_Reseed with derivation function (SP 800-90A &sect;10.2.1.4.2)
@@ -358,18 +358,18 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ctx->entropy_len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT )
-        return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG ;
     if( nonce_len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - ctx->entropy_len )
-        return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG ;
     if( len > MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - ctx->entropy_len - nonce_len )
-        return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG ;
 
     memset( seed, 0, MBEDTLS_CTR_DRBG_MAX_SEED_INPUT );
 
     /* Gather entropy_len bytes of entropy to seed state. */
     if( 0 != ctx->f_entropy( ctx->p_entropy, seed, ctx->entropy_len ) )
     {
-        return( MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED ;
     }
     seedlen += ctx->entropy_len;
 
@@ -378,7 +378,7 @@
     {
         if( 0 != ctx->f_entropy( ctx->p_entropy, seed + seedlen, nonce_len ) )
         {
-            return( MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED );
+            return MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED ;
         }
         seedlen += nonce_len;
     }
@@ -401,13 +401,13 @@
 
 exit:
     mbedtls_platform_zeroize( seed, sizeof( seed ) );
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ctr_drbg_reseed( mbedtls_ctr_drbg_context *ctx,
                              const unsigned char *additional, size_t len )
 {
-    return( mbedtls_ctr_drbg_reseed_internal( ctx, additional, len, 0 ) );
+    return mbedtls_ctr_drbg_reseed_internal( ctx, additional, len, 0 ) ;
 }
 
 /* Return a "good" nonce length for CTR_DRBG. The chosen nonce length
@@ -418,9 +418,9 @@
 static size_t good_nonce_len( size_t entropy_len )
 {
     if( entropy_len >= MBEDTLS_CTR_DRBG_KEYSIZE * 3 / 2 )
-        return( 0 );
+        return 0 ;
     else
-        return( ( entropy_len + 1 ) / 2 );
+        return ( entropy_len + 1 ) / 2 ;
 }
 
 /* CTR_DRBG_Instantiate with derivation function (SP 800-90A &sect;10.2.1.3.2)
@@ -470,16 +470,16 @@
     if( ( ret = mbedtls_aes_setkey_enc( &ctx->aes_ctx, key,
                                         MBEDTLS_CTR_DRBG_KEYBITS ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* Do the initial seeding. */
     if( ( ret = mbedtls_ctr_drbg_reseed_internal( ctx, custom, len,
                                                   nonce_len ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
-    return( 0 );
+    return 0 ;
 }
 
 /* CTR_DRBG_Generate with derivation function (SP 800-90A &sect;10.2.1.5.2)
@@ -514,10 +514,10 @@
     size_t use_len;
 
     if( output_len > MBEDTLS_CTR_DRBG_MAX_REQUEST )
-        return( MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG ;
 
     if( add_len > MBEDTLS_CTR_DRBG_MAX_INPUT )
-        return( MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG ;
 
     memset( add_input, 0, MBEDTLS_CTR_DRBG_SEEDLEN );
 
@@ -526,7 +526,7 @@
     {
         if( ( ret = mbedtls_ctr_drbg_reseed( ctx, additional, add_len ) ) != 0 )
         {
-            return( ret );
+            return ret ;
         }
         add_len = 0;
     }
@@ -575,7 +575,7 @@
 exit:
     mbedtls_platform_zeroize( add_input, sizeof( add_input ) );
     mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ctr_drbg_random( void *p_rng, unsigned char *output,
@@ -586,17 +586,17 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     ret = mbedtls_ctr_drbg_random_with_add( ctx, output, output_len, NULL, 0 );
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_FS_IO)
@@ -608,7 +608,7 @@
     unsigned char buf[ MBEDTLS_CTR_DRBG_MAX_INPUT ];
 
     if( ( f = fopen( path, "wb" ) ) == NULL )
-        return( MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR );
+        return MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR ;
 
     if( ( ret = mbedtls_ctr_drbg_random( ctx, buf,
                                          MBEDTLS_CTR_DRBG_MAX_INPUT ) ) != 0 )
@@ -628,7 +628,7 @@
     mbedtls_platform_zeroize( buf, sizeof( buf ) );
 
     fclose( f );
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ctr_drbg_update_seed_file( mbedtls_ctr_drbg_context *ctx,
@@ -641,7 +641,7 @@
     unsigned char c;
 
     if( ( f = fopen( path, "rb" ) ) == NULL )
-        return( MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR );
+        return MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR ;
 
     n = fread( buf, 1, sizeof( buf ), f );
     if( fread( &c, 1, 1, f ) != 0 )
@@ -664,8 +664,8 @@
     if( f != NULL )
         fclose( f );
     if( ret != 0 )
-        return( ret );
-    return( mbedtls_ctr_drbg_write_seed_file( ctx, path ) );
+        return ret ;
+    return mbedtls_ctr_drbg_write_seed_file( ctx, path ) ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -808,14 +808,14 @@
     const unsigned char *p = data;
     memcpy( buf, p + test_offset, len );
     test_offset += len;
-    return( 0 );
+    return 0 ;
 }
 
 #define CHK( c )    if( (c) != 0 )                          \
                     {                                       \
                         if( verbose != 0 )                  \
                             mbedtls_printf( "failed\n" );  \
-                        return( 1 );                        \
+                        return 1 ;                        \
                     }
 
 #define SELF_TEST_OUPUT_DISCARD_LENGTH 64
@@ -881,7 +881,7 @@
     if( verbose != 0 )
             mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SELF_TEST */
 
diff --git a/library/des.c b/library/des.c
index eddf55e..9908582 100644
--- a/library/des.c
+++ b/library/des.c
@@ -357,9 +357,9 @@
 
     for( i = 0; i < MBEDTLS_DES_KEY_SIZE; i++ )
         if( key[i] != odd_parity_table[key[i] / 2] )
-            return( 1 );
+            return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -412,9 +412,9 @@
 
     for( i = 0; i < WEAK_KEY_COUNT; i++ )
         if( memcmp( weak_key_table[i], key, MBEDTLS_DES_KEY_SIZE) == 0 )
-            return( 1 );
+            return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_DES_SETKEY_ALT)
@@ -495,7 +495,7 @@
 {
     mbedtls_des_setkey( ctx->sk, key );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -513,7 +513,7 @@
         SWAP( ctx->sk[i + 1], ctx->sk[31 - i] );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static void des3_set2key( uint32_t esk[96],
@@ -552,7 +552,7 @@
     des3_set2key( ctx->sk, sk, key );
     mbedtls_platform_zeroize( sk,  sizeof( sk ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -566,7 +566,7 @@
     des3_set2key( sk, ctx->sk, key );
     mbedtls_platform_zeroize( sk,  sizeof( sk ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 static void des3_set3key( uint32_t esk[96],
@@ -603,7 +603,7 @@
     des3_set3key( ctx->sk, sk, key );
     mbedtls_platform_zeroize( sk,  sizeof( sk ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -617,7 +617,7 @@
     des3_set3key( sk, ctx->sk, key );
     mbedtls_platform_zeroize( sk,  sizeof( sk ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -649,7 +649,7 @@
     PUT_UINT32_BE( Y, output, 0 );
     PUT_UINT32_BE( X, output, 4 );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* !MBEDTLS_DES_CRYPT_ECB_ALT */
 
@@ -668,7 +668,7 @@
     unsigned char temp[8];
 
     if( length % 8 )
-        return( MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH );
+        return MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH ;
 
     if( mode == MBEDTLS_DES_ENCRYPT )
     {
@@ -703,7 +703,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CBC */
 
@@ -748,7 +748,7 @@
     PUT_UINT32_BE( Y, output, 0 );
     PUT_UINT32_BE( X, output, 4 );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* !MBEDTLS_DES3_CRYPT_ECB_ALT */
 
@@ -767,7 +767,7 @@
     unsigned char temp[8];
 
     if( length % 8 )
-        return( MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH );
+        return MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH ;
 
     if( mode == MBEDTLS_DES_ENCRYPT )
     {
@@ -802,7 +802,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_CIPHER_MODE_CBC */
 
@@ -919,7 +919,7 @@
             break;
 
         default:
-            return( 1 );
+            return 1 ;
         }
 
         for( j = 0; j < 100; j++ )
@@ -994,7 +994,7 @@
             break;
 
         default:
-            return( 1 );
+            return 1 ;
         }
 
         if( v == MBEDTLS_DES_DECRYPT )
@@ -1050,7 +1050,7 @@
     mbedtls_des_free( &ctx );
     mbedtls_des3_free( &ctx3 );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/dhm.c b/library/dhm.c
index 29ce755..3221195 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -70,20 +70,20 @@
     int ret, n;
 
     if( end - *p < 2 )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
 
     n = ( (*p)[0] << 8 ) | (*p)[1];
     (*p) += 2;
 
     if( (int)( end - *p ) < n )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
 
     if( ( ret = mbedtls_mpi_read_binary( X, *p, n ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_READ_PARAMS_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_READ_PARAMS_FAILED, ret ) ;
 
     (*p) += n;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -115,7 +115,7 @@
 
 cleanup:
     mbedtls_mpi_free( &U );
-    return( ret );
+    return ret ;
 }
 
 void mbedtls_dhm_init( mbedtls_dhm_context *ctx )
@@ -126,12 +126,12 @@
 
 size_t mbedtls_dhm_get_bitlen( const mbedtls_dhm_context *ctx )
 {
-    return( mbedtls_mpi_bitlen( &ctx->P ) );
+    return mbedtls_mpi_bitlen( &ctx->P ) ;
 }
 
 size_t mbedtls_dhm_get_len( const mbedtls_dhm_context *ctx )
 {
-    return( mbedtls_mpi_size( &ctx->P ) );
+    return mbedtls_mpi_size( &ctx->P ) ;
 }
 
 int mbedtls_dhm_get_value( const mbedtls_dhm_context *ctx,
@@ -160,9 +160,9 @@
             src = &ctx->K;
             break;
         default:
-            return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
     }
-    return( mbedtls_mpi_copy( dest, src ) );
+    return mbedtls_mpi_copy( dest, src ) ;
 }
 
 /*
@@ -180,12 +180,12 @@
     if( ( ret = dhm_read_bignum( &ctx->P,  p, end ) ) != 0 ||
         ( ret = dhm_read_bignum( &ctx->G,  p, end ) ) != 0 ||
         ( ret = dhm_read_bignum( &ctx->GY, p, end ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -200,7 +200,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( R, R, 1 ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 static int dhm_make_common( mbedtls_dhm_context *ctx, int x_size,
@@ -210,9 +210,9 @@
     int ret = 0;
 
     if( mbedtls_mpi_cmp_int( &ctx->P, 0 ) == 0 )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
     if( x_size < 0 )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
 
     if( (unsigned) x_size < mbedtls_mpi_size( &ctx->P ) )
     {
@@ -223,9 +223,9 @@
         /* Generate X as large as possible ( <= P - 2 ) */
         ret = dhm_random_below( &ctx->X, &ctx->P, f_rng, p_rng );
         if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
-            return( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED );
+            return MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED ;
         if( ret != 0 )
-            return( ret );
+            return ret ;
     }
 
     /*
@@ -235,10 +235,10 @@
                           &ctx->P , &ctx->RP ) );
 
     if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
-        return( ret );
+        return ret ;
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -289,7 +289,7 @@
 cleanup:
     if( ret != 0 && ret > -128 )
         ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED, ret );
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -307,10 +307,10 @@
     if( ( ret = mbedtls_mpi_copy( &ctx->P, P ) ) != 0 ||
         ( ret = mbedtls_mpi_copy( &ctx->G, G ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_SET_GROUP_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_SET_GROUP_FAILED, ret ) ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -324,12 +324,12 @@
     DHM_VALIDATE_RET( input != NULL );
 
     if( ilen < 1 || ilen > mbedtls_dhm_get_len( ctx ) )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
 
     if( ( ret = mbedtls_mpi_read_binary( &ctx->GY, input, ilen ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED, ret ) ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -346,11 +346,11 @@
     DHM_VALIDATE_RET( f_rng != NULL );
 
     if( olen < 1 || olen > mbedtls_dhm_get_len( ctx ) )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
 
     ret = dhm_make_common( ctx, x_size, f_rng, p_rng );
     if( ret == MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED )
-        return( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED );
+        return MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED ;
     if( ret != 0 )
         goto cleanup;
 
@@ -359,7 +359,7 @@
 cleanup:
     if( ret != 0 && ret > -128 )
         ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED, ret );
-    return( ret );
+    return ret ;
 }
 
 
@@ -387,7 +387,7 @@
         MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vi, 1 ) );
         MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->Vf, 1 ) );
 
-        return( 0 );
+        return 0 ;
     }
 
     /*
@@ -402,7 +402,7 @@
         MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
         MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->P ) );
 
-        return( 0 );
+        return 0 ;
     }
 
     /*
@@ -427,7 +427,7 @@
 cleanup:
     mbedtls_mpi_free( &R );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -445,13 +445,13 @@
     DHM_VALIDATE_RET( olen != NULL );
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
 
     if( output_size < mbedtls_dhm_get_len( ctx ) )
-        return( MBEDTLS_ERR_DHM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_DHM_BAD_INPUT_DATA ;
 
     if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
-        return( ret );
+        return ret ;
 
     mbedtls_mpi_init( &GYb );
 
@@ -477,9 +477,9 @@
     mbedtls_mpi_free( &GYb );
 
     if( ret != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_CALC_SECRET_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_DHM_CALC_SECRET_FAILED, ret ) ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -602,7 +602,7 @@
     if( ret != 0 )
         mbedtls_dhm_free( dhm );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_FS_IO)
@@ -619,13 +619,13 @@
     long size;
 
     if( ( f = fopen( path, "rb" ) ) == NULL )
-        return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
+        return MBEDTLS_ERR_DHM_FILE_IO_ERROR ;
 
     fseek( f, 0, SEEK_END );
     if( ( size = ftell( f ) ) == -1 )
     {
         fclose( f );
-        return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
+        return MBEDTLS_ERR_DHM_FILE_IO_ERROR ;
     }
     fseek( f, 0, SEEK_SET );
 
@@ -635,7 +635,7 @@
         ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
-        return( MBEDTLS_ERR_DHM_ALLOC_FAILED );
+        return MBEDTLS_ERR_DHM_ALLOC_FAILED ;
     }
 
     if( fread( *buf, 1, *n, f ) != *n )
@@ -645,7 +645,7 @@
         mbedtls_platform_zeroize( *buf, *n + 1 );
         mbedtls_free( *buf );
 
-        return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
+        return MBEDTLS_ERR_DHM_FILE_IO_ERROR ;
     }
 
     fclose( f );
@@ -655,7 +655,7 @@
     if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL )
         ++*n;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -670,14 +670,14 @@
     DHM_VALIDATE_RET( path != NULL );
 
     if( ( ret = load_file( path, &buf, &n ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_dhm_parse_dhm( dhm, buf, n );
 
     mbedtls_platform_zeroize( buf, n );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_FS_IO */
 #endif /* MBEDTLS_ASN1_PARSE_C */
@@ -740,7 +740,7 @@
 exit:
     mbedtls_dhm_free( &dhm );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/ecdh.c b/library/ecdh.c
index 9dfa868..b578db5 100644
--- a/library/ecdh.c
+++ b/library/ecdh.c
@@ -48,9 +48,9 @@
     const mbedtls_ecdh_context *ctx )
 {
 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
-    return( ctx->grp.id );
+    return ctx->grp.id ;
 #else
-    return( ctx->grp_id );
+    return ctx->grp_id ;
 #endif
 }
 
@@ -58,7 +58,7 @@
 {
     /* At this time, all groups support ECDH. */
     (void) gid;
-    return( 1 );
+    return 1 ;
 }
 
 #if !defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT)
@@ -87,7 +87,7 @@
                                                   f_rng, p_rng, rs_ctx ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -101,7 +101,7 @@
     ECDH_VALIDATE_RET( d != NULL );
     ECDH_VALIDATE_RET( Q != NULL );
     ECDH_VALIDATE_RET( f_rng != NULL );
-    return( ecdh_gen_public_restartable( grp, d, Q, f_rng, p_rng, NULL ) );
+    return ecdh_gen_public_restartable( grp, d, Q, f_rng, p_rng, NULL ) ;
 }
 #endif /* !MBEDTLS_ECDH_GEN_PUBLIC_ALT */
 
@@ -135,7 +135,7 @@
 cleanup:
     mbedtls_ecp_point_free( &P );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -199,10 +199,10 @@
     ret = mbedtls_ecp_group_load( &ctx->grp, grp_id );
     if( ret != 0 )
     {
-        return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -213,7 +213,7 @@
     ECDH_VALIDATE_RET( ctx != NULL );
 
 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
-    return( ecdh_setup_internal( ctx, grp_id ) );
+    return ecdh_setup_internal( ctx, grp_id ) ;
 #else
     switch( grp_id )
     {
@@ -222,14 +222,14 @@
             ctx->point_format = MBEDTLS_ECP_PF_COMPRESSED;
             ctx->var = MBEDTLS_ECDH_VARIANT_EVEREST;
             ctx->grp_id = grp_id;
-            return( mbedtls_everest_setup( &ctx->ctx.everest_ecdh, grp_id ) );
+            return mbedtls_everest_setup( &ctx->ctx.everest_ecdh, grp_id ) ;
 #endif
         default:
             ctx->point_format = MBEDTLS_ECP_PF_UNCOMPRESSED;
             ctx->var = MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0;
             ctx->grp_id = grp_id;
             ecdh_init_internal( &ctx->ctx.mbed_ecdh );
-            return( ecdh_setup_internal( &ctx->ctx.mbed_ecdh, grp_id ) );
+            return ecdh_setup_internal( &ctx->ctx.mbed_ecdh, grp_id ) ;
     }
 #endif
 }
@@ -309,7 +309,7 @@
 #endif
 
     if( ctx->grp.pbits == 0 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_ECP_RESTARTABLE)
     if( restart_enabled )
@@ -322,26 +322,26 @@
 #if defined(MBEDTLS_ECP_RESTARTABLE)
     if( ( ret = ecdh_gen_public_restartable( &ctx->grp, &ctx->d, &ctx->Q,
                                              f_rng, p_rng, rs_ctx ) ) != 0 )
-        return( ret );
+        return ret ;
 #else
     if( ( ret = mbedtls_ecdh_gen_public( &ctx->grp, &ctx->d, &ctx->Q,
                                          f_rng, p_rng ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_ECP_RESTARTABLE */
 
     if( ( ret = mbedtls_ecp_tls_write_group( &ctx->grp, &grp_len, buf,
                                              blen ) ) != 0 )
-        return( ret );
+        return ret ;
 
     buf += grp_len;
     blen -= grp_len;
 
     if( ( ret = mbedtls_ecp_tls_write_point( &ctx->grp, &ctx->Q, point_format,
                                              &pt_len, buf, blen ) ) != 0 )
-        return( ret );
+        return ret ;
 
     *olen = grp_len + pt_len;
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -418,13 +418,13 @@
 
     if( ( ret = mbedtls_ecp_tls_read_group_id( &grp_id, buf, end - *buf ) )
             != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_ecdh_setup( ctx, grp_id ) ) != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
-    return( ecdh_read_params_internal( ctx, buf, end ) );
+    return ecdh_read_params_internal( ctx, buf, end ) ;
 #else
     switch( ctx->var )
     {
@@ -450,17 +450,17 @@
 
     /* If it's not our key, just import the public part as Qp */
     if( side == MBEDTLS_ECDH_THEIRS )
-        return( mbedtls_ecp_copy( &ctx->Qp, &key->Q ) );
+        return mbedtls_ecp_copy( &ctx->Qp, &key->Q ) ;
 
     /* Our key: import public (as Q) and private parts */
     if( side != MBEDTLS_ECDH_OURS )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     if( ( ret = mbedtls_ecp_copy( &ctx->Q, &key->Q ) ) != 0 ||
         ( ret = mbedtls_mpi_copy( &ctx->d, &key->d ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -481,7 +481,7 @@
         /* This is the first call to get_params(). Set up the context
          * for use with the group. */
         if( ( ret = mbedtls_ecdh_setup( ctx, key->grp.id ) ) != 0 )
-            return( ret );
+            return ret ;
     }
     else
     {
@@ -489,11 +489,11 @@
          * current key's group is the same as the context's, which was set
          * from the first key's group. */
         if( mbedtls_ecdh_grp_id( ctx ) != key->grp.id )
-            return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
-    return( ecdh_get_params_internal( ctx, key, side ) );
+    return ecdh_get_params_internal( ctx, key, side ) ;
 #else
     switch( ctx->var )
     {
@@ -531,7 +531,7 @@
 #endif
 
     if( ctx->grp.pbits == 0 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_ECP_RESTARTABLE)
     if( restart_enabled )
@@ -543,11 +543,11 @@
 #if defined(MBEDTLS_ECP_RESTARTABLE)
     if( ( ret = ecdh_gen_public_restartable( &ctx->grp, &ctx->d, &ctx->Q,
                                              f_rng, p_rng, rs_ctx ) ) != 0 )
-        return( ret );
+        return ret ;
 #else
     if( ( ret = mbedtls_ecdh_gen_public( &ctx->grp, &ctx->d, &ctx->Q,
                                          f_rng, p_rng ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_ECP_RESTARTABLE */
 
     return mbedtls_ecp_tls_write_point( &ctx->grp, &ctx->Q, point_format, olen,
@@ -602,12 +602,12 @@
 
     if( ( ret = mbedtls_ecp_tls_read_point( &ctx->grp, &ctx->Qp, &p,
                                             blen ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( (size_t)( p - buf ) != blen )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -620,7 +620,7 @@
     ECDH_VALIDATE_RET( buf != NULL );
 
 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
-    return( ecdh_read_public_internal( ctx, buf, blen ) );
+    return ecdh_read_public_internal( ctx, buf, blen ) ;
 #else
     switch( ctx->var )
     {
@@ -653,7 +653,7 @@
 #endif
 
     if( ctx == NULL || ctx->grp.pbits == 0 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_ECP_RESTARTABLE)
     if( restart_enabled )
@@ -667,18 +667,18 @@
                                                  &ctx->d, f_rng, p_rng,
                                                  rs_ctx ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 #else
     if( ( ret = mbedtls_ecdh_compute_shared( &ctx->grp, &ctx->z, &ctx->Qp,
                                              &ctx->d, f_rng, p_rng ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_ECP_RESTARTABLE */
 
     if( mbedtls_mpi_size( &ctx->z ) > blen )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     *olen = ctx->grp.pbits / 8 + ( ( ctx->grp.pbits % 8 ) != 0 );
 
@@ -721,7 +721,7 @@
                                                blen, f_rng, p_rng,
                                                restart_enabled ) );
         default:
-            return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     }
 #endif
 }
diff --git a/library/ecdsa.c b/library/ecdsa.c
index 0b612ce..1364c9e 100644
--- a/library/ecdsa.c
+++ b/library/ecdsa.c
@@ -185,7 +185,7 @@
     {                                                                \
         rs_ctx->SUB = mbedtls_calloc( 1, sizeof( *rs_ctx->SUB ) );   \
         if( rs_ctx->SUB == NULL )                                    \
-            return( MBEDTLS_ERR_ECP_ALLOC_FAILED );                  \
+            return MBEDTLS_ERR_ECP_ALLOC_FAILED ;                  \
                                                                      \
         ecdsa_restart_## SUB ##_init( rs_ctx->SUB );                 \
     }                                                                \
@@ -240,7 +240,7 @@
         MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( x, x, &grp->N ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* ECDSA_DETERMINISTIC || !ECDSA_SIGN_ALT || !ECDSA_VERIFY_ALT */
 
@@ -265,11 +265,11 @@
 
     /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
     if( ! mbedtls_ecdsa_can_do( grp->id ) || grp->N.p == NULL )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /* Make sure d is in range 1..n-1 */
     if( mbedtls_mpi_cmp_int( d, 1 ) < 0 || mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
-        return( MBEDTLS_ERR_ECP_INVALID_KEY );
+        return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
     mbedtls_ecp_point_init( &R );
     mbedtls_mpi_init( &k ); mbedtls_mpi_init( &e ); mbedtls_mpi_init( &t );
@@ -380,7 +380,7 @@
 
     ECDSA_RS_LEAVE( sig );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ecdsa_can_do( mbedtls_ecp_group_id gid )
@@ -441,7 +441,7 @@
     mbedtls_mpi h;
 
     if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     mbedtls_mpi_init( &h );
     mbedtls_hmac_drbg_init( &rng_ctx );
@@ -489,7 +489,7 @@
 
     ECDSA_RS_LEAVE( det );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -537,7 +537,7 @@
 
     /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
     if( ! mbedtls_ecdsa_can_do( grp->id ) || grp->N.p == NULL )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     ECDSA_RS_ENTER( ver );
 
@@ -622,7 +622,7 @@
 
     ECDSA_RS_LEAVE( ver );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -640,7 +640,7 @@
     ECDSA_VALIDATE_RET( s   != NULL );
     ECDSA_VALIDATE_RET( buf != NULL || blen == 0 );
 
-    return( ecdsa_verify_restartable( grp, buf, blen, Q, r, s, NULL ) );
+    return ecdsa_verify_restartable( grp, buf, blen, Q, r, s, NULL ) ;
 }
 #endif /* !MBEDTLS_ECDSA_VERIFY_ALT */
 
@@ -664,12 +664,12 @@
                                        MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
 
     if( len > sig_size )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     memcpy( sig, p, len );
     *slen = len;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -691,7 +691,7 @@
     ECDSA_VALIDATE_RET( slen  != NULL );
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     mbedtls_mpi_init( &r );
     mbedtls_mpi_init( &s );
@@ -722,7 +722,7 @@
     mbedtls_mpi_free( &r );
     mbedtls_mpi_free( &s );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -820,7 +820,7 @@
     mbedtls_mpi_free( &r );
     mbedtls_mpi_free( &s );
 
-    return( ret );
+    return ret ;
 }
 
 #if !defined(MBEDTLS_ECDSA_GENKEY_ALT)
@@ -836,7 +836,7 @@
 
     ret = mbedtls_ecp_group_load( &ctx->grp, gid );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
    return( mbedtls_ecp_gen_keypair( &ctx->grp, &ctx->d,
                                     &ctx->Q, f_rng, p_rng ) );
@@ -859,7 +859,7 @@
         mbedtls_ecdsa_free( ctx );
     }
 
-    return( ret );
+    return ret ;
 }
 
 /*
diff --git a/library/ecjpake.c b/library/ecjpake.c
index d229311..cda3c9f 100644
--- a/library/ecjpake.c
+++ b/library/ecjpake.c
@@ -115,7 +115,7 @@
     ctx->role = role;
 
     if( ( ctx->md_info = mbedtls_md_info_from_type( hash ) ) == NULL )
-        return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE ;
 
     MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &ctx->grp, curve ) );
 
@@ -125,7 +125,7 @@
     if( ret != 0 )
         mbedtls_ecjpake_free( ctx );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ecjpake_set_point_format( mbedtls_ecjpake_context *ctx,
@@ -136,9 +136,9 @@
         case MBEDTLS_ECP_PF_UNCOMPRESSED:
         case MBEDTLS_ECP_PF_COMPRESSED:
             ctx->point_format = point_format;
-            return( 0 );
+            return 0 ;
         default:
-            return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     }
 }
 
@@ -153,10 +153,10 @@
         ctx->grp.id == MBEDTLS_ECP_DP_NONE ||
         ctx->s.p == NULL )
     {
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -173,12 +173,12 @@
 
     /* Need at least 4 for length plus 1 for point */
     if( end < *p || end - *p < 5 )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     ret = mbedtls_ecp_point_write_binary( grp, P, pf,
                                           &len, *p + 4, end - ( *p + 4 ) );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     (*p)[0] = (unsigned char)( ( len >> 24 ) & 0xFF );
     (*p)[1] = (unsigned char)( ( len >> 16 ) & 0xFF );
@@ -187,7 +187,7 @@
 
     *p += 4 + len;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -221,7 +221,7 @@
     MBEDTLS_MPI_CHK( ecjpake_write_len_point( &p, end, grp, pf, X ) );
 
     if( end - p < 4 )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     *p++ = (unsigned char)( ( id_len >> 24 ) & 0xFF );
     *p++ = (unsigned char)( ( id_len >> 16 ) & 0xFF );
@@ -229,7 +229,7 @@
     *p++ = (unsigned char)( ( id_len       ) & 0xFF );
 
     if( end < p || (size_t)( end - p ) < id_len )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     memcpy( p, id, id_len );
     p += id_len;
@@ -243,7 +243,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( h, h, &grp->N ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -275,7 +275,7 @@
      * } ECSchnorrZKP;
      */
     if( end < *p )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     MBEDTLS_MPI_CHK( mbedtls_ecp_tls_read_point( grp, &V, p, end - *p ) );
 
@@ -315,7 +315,7 @@
     mbedtls_mpi_free( &r );
     mbedtls_mpi_free( &h );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -340,7 +340,7 @@
     size_t len;
 
     if( end < *p )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     mbedtls_ecp_point_init( &V );
     mbedtls_mpi_init( &v );
@@ -375,7 +375,7 @@
     mbedtls_mpi_free( &v );
     mbedtls_mpi_free( &h );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -394,7 +394,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( end < *p )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /*
      * struct {
@@ -412,7 +412,7 @@
     MBEDTLS_MPI_CHK( ecjpake_zkp_read( md_info, grp, pf, G, X, id, p, end ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -435,7 +435,7 @@
     size_t len;
 
     if( end < *p )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     /* Generate key (7.4.2.3.1) and write it out */
     MBEDTLS_MPI_CHK( mbedtls_ecp_gen_keypair_base( (mbedtls_ecp_group *) grp, G, x, X,
@@ -449,7 +449,7 @@
                                         p, end, f_rng, p_rng ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -482,7 +482,7 @@
         ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -516,7 +516,7 @@
     *olen = p - buf;
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -574,7 +574,7 @@
 cleanup:
     mbedtls_mpi_free( &one );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -635,7 +635,7 @@
     mbedtls_ecp_group_free( &grp );
     mbedtls_ecp_point_free( &G );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -666,7 +666,7 @@
 cleanup:
     mbedtls_mpi_free( &b );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -748,7 +748,7 @@
     mbedtls_ecp_point_free( &Xm );
     mbedtls_mpi_free( &xm );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -772,7 +772,7 @@
 
     *olen = mbedtls_md_get_size( ctx->md_info );
     if( len < *olen )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     mbedtls_ecp_point_init( &K );
     mbedtls_mpi_init( &m_xm2_s );
@@ -803,7 +803,7 @@
     mbedtls_mpi_free( &m_xm2_s );
     mbedtls_mpi_free( &one );
 
-    return( ret );
+    return ret ;
 }
 
 #undef ID_MINE
@@ -825,7 +825,7 @@
 int mbedtls_ecjpake_self_test( int verbose )
 {
     (void) verbose;
-    return( 0 );
+    return 0 ;
 }
 #else
 
@@ -981,7 +981,7 @@
         out[i] = (unsigned char) state;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Load my private keys and generate the corresponding public keys */
@@ -999,7 +999,7 @@
                                       &ctx->grp.G, self_test_rng, NULL ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 #endif /* ! MBEDTLS_ECJPAKE_ALT */
@@ -1020,7 +1020,7 @@
         len -= use_len;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #define TEST_ASSERT( x )    \
@@ -1170,7 +1170,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( ret );
+    return ret ;
 }
 
 #undef TEST_ASSERT
diff --git a/library/ecp.c b/library/ecp.c
index b608ff1..de213ec 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -141,7 +141,7 @@
  */
 int mbedtls_ecp_restart_is_enabled( void )
 {
-    return( ecp_max_ops != 0 );
+    return ecp_max_ops != 0 ;
 }
 
 /*
@@ -292,14 +292,14 @@
             ( rs_ctx->ops_done > ecp_max_ops ||
               ops > ecp_max_ops - rs_ctx->ops_done ) )
         {
-            return( MBEDTLS_ERR_ECP_IN_PROGRESS );
+            return MBEDTLS_ERR_ECP_IN_PROGRESS ;
         }
 
         /* update running count */
         rs_ctx->ops_done += ops;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Call this when entering a function that needs its own sub-context */
@@ -314,7 +314,7 @@
     {                                                                   \
         rs_ctx->SUB = mbedtls_calloc( 1, sizeof( *rs_ctx->SUB ) );      \
         if( rs_ctx->SUB == NULL )                                       \
-            return( MBEDTLS_ERR_ECP_ALLOC_FAILED );                     \
+            return MBEDTLS_ERR_ECP_ALLOC_FAILED ;                     \
                                                                         \
         ecp_restart_## SUB ##_init( rs_ctx->SUB );                      \
     }                                                                   \
@@ -408,7 +408,7 @@
  */
 const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void )
 {
-    return( ecp_supported_curves );
+    return ecp_supported_curves ;
 }
 
 /*
@@ -434,7 +434,7 @@
         init_done = 1;
     }
 
-    return( ecp_supported_grp_id );
+    return ecp_supported_grp_id ;
 }
 
 /*
@@ -449,10 +449,10 @@
          curve_info++ )
     {
         if( curve_info->grp_id == grp_id )
-            return( curve_info );
+            return curve_info ;
     }
 
-    return( NULL );
+    return NULL ;
 }
 
 /*
@@ -467,10 +467,10 @@
          curve_info++ )
     {
         if( curve_info->tls_id == tls_id )
-            return( curve_info );
+            return curve_info ;
     }
 
-    return( NULL );
+    return NULL ;
 }
 
 /*
@@ -481,17 +481,17 @@
     const mbedtls_ecp_curve_info *curve_info;
 
     if( name == NULL )
-        return( NULL );
+        return NULL ;
 
     for( curve_info = mbedtls_ecp_curve_list();
          curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
          curve_info++ )
     {
         if( strcmp( curve_info->name, name ) == 0 )
-            return( curve_info );
+            return curve_info ;
     }
 
-    return( NULL );
+    return NULL ;
 }
 
 /*
@@ -500,12 +500,12 @@
 mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp )
 {
     if( grp->G.X.p == NULL )
-        return( MBEDTLS_ECP_TYPE_NONE );
+        return MBEDTLS_ECP_TYPE_NONE ;
 
     if( grp->G.Y.p == NULL )
-        return( MBEDTLS_ECP_TYPE_MONTGOMERY );
+        return MBEDTLS_ECP_TYPE_MONTGOMERY ;
     else
-        return( MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS );
+        return MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ;
 }
 
 /*
@@ -637,7 +637,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Z, &Q->Z ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -648,7 +648,7 @@
     ECP_VALIDATE_RET( dst != NULL );
     ECP_VALIDATE_RET( src != NULL );
 
-    return( mbedtls_ecp_group_load( dst, src->id ) );
+    return mbedtls_ecp_group_load( dst, src->id ) ;
 }
 
 /*
@@ -664,7 +664,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z , 0 ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -674,7 +674,7 @@
 {
     ECP_VALIDATE_RET( pt != NULL );
 
-    return( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 );
+    return mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 ;
 }
 
 /*
@@ -690,10 +690,10 @@
         mbedtls_mpi_cmp_mpi( &P->Y, &Q->Y ) == 0 &&
         mbedtls_mpi_cmp_mpi( &P->Z, &Q->Z ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
-    return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+    return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 }
 
 /*
@@ -712,7 +712,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -740,7 +740,7 @@
     {
         *olen = plen;
         if( buflen < *olen )
-            return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
         MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &P->X, buf, plen ) );
     }
@@ -754,12 +754,12 @@
         if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
         {
             if( buflen < 1 )
-                return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
             buf[0] = 0x00;
             *olen = 1;
 
-            return( 0 );
+            return 0 ;
         }
 
         if( format == MBEDTLS_ECP_PF_UNCOMPRESSED )
@@ -767,7 +767,7 @@
             *olen = 2 * plen + 1;
 
             if( buflen < *olen )
-                return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
             buf[0] = 0x04;
             MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
@@ -778,7 +778,7 @@
             *olen = plen + 1;
 
             if( buflen < *olen )
-                return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
             buf[0] = 0x02 + mbedtls_mpi_get_bit( &P->Y, 0 );
             MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
@@ -787,7 +787,7 @@
 #endif
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -804,7 +804,7 @@
     ECP_VALIDATE_RET( buf != NULL );
 
     if( ilen < 1 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     plen = mbedtls_mpi_size( &grp->P );
 
@@ -812,7 +812,7 @@
     if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
     {
         if( plen != ilen )
-            return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
         MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &pt->X, buf, plen ) );
         mbedtls_mpi_free( &pt->Y );
@@ -830,16 +830,16 @@
         if( buf[0] == 0x00 )
         {
             if( ilen == 1 )
-                return( mbedtls_ecp_set_zero( pt ) );
+                return mbedtls_ecp_set_zero( pt ) ;
             else
-                return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+                return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
         }
 
         if( buf[0] != 0x04 )
-            return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 
         if( ilen != 2 * plen + 1 )
-            return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
         MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->X, buf + 1, plen ) );
         MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->Y,
@@ -849,7 +849,7 @@
 #endif
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -873,11 +873,11 @@
      * We must have at least two bytes (1 for length, at least one for data)
      */
     if( buf_len < 2 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     data_len = *(*buf)++;
     if( data_len < 1 || data_len > buf_len - 1 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /*
      * Save buffer start for read_binary and update buf
@@ -885,7 +885,7 @@
     buf_start = *buf;
     *buf += data_len;
 
-    return( mbedtls_ecp_point_read_binary( grp, pt, buf_start, data_len ) );
+    return mbedtls_ecp_point_read_binary( grp, pt, buf_start, data_len ) ;
 }
 
 /*
@@ -910,11 +910,11 @@
      * buffer length must be at least one, for our length byte
      */
     if( blen < 1 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     if( ( ret = mbedtls_ecp_point_write_binary( grp, pt, format,
                     olen, buf + 1, blen - 1) ) != 0 )
-        return( ret );
+        return ret ;
 
     /*
      * write length to the first byte and update total length
@@ -922,7 +922,7 @@
     buf[0] = (unsigned char) *olen;
     ++*olen;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -938,9 +938,9 @@
     ECP_VALIDATE_RET( *buf != NULL );
 
     if( ( ret = mbedtls_ecp_tls_read_group_id( &grp_id, buf, len ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( mbedtls_ecp_group_load( grp, grp_id ) );
+    return mbedtls_ecp_group_load( grp, grp_id ) ;
 }
 
 /*
@@ -960,13 +960,13 @@
      * We expect at least three bytes (see below)
      */
     if( len < 3 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /*
      * First byte is curve_type; only named_curve is handled
      */
     if( *(*buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /*
      * Next two bytes are the namedcurve value
@@ -976,11 +976,11 @@
     tls_id |= *(*buf)++;
 
     if( ( curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_id ) ) == NULL )
-        return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 
     *grp = curve_info->grp_id;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -995,14 +995,14 @@
     ECP_VALIDATE_RET( olen != NULL );
 
     if( ( curve_info = mbedtls_ecp_curve_info_from_grp_id( grp->id ) ) == NULL )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /*
      * We are going to write 3 bytes (see below)
      */
     *olen = 3;
     if( blen < *olen )
-        return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
     /*
      * First byte is curve_type, always named_curve
@@ -1015,7 +1015,7 @@
     buf[0] = curve_info->tls_id >> 8;
     buf[1] = curve_info->tls_id & 0xFF;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1029,13 +1029,13 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( grp->modp == NULL )
-        return( mbedtls_mpi_mod_mpi( N, N, &grp->P ) );
+        return mbedtls_mpi_mod_mpi( N, N, &grp->P ) ;
 
     /* N->s < 0 is a much faster test, which fails only if N is 0 */
     if( ( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 ) ||
         mbedtls_mpi_bitlen( N ) > 2 * grp->pbits )
     {
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     }
 
     MBEDTLS_MPI_CHK( grp->modp( N ) );
@@ -1049,7 +1049,7 @@
         MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, N, &grp->P ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1087,7 +1087,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( X, A, B ) );
     MOD_MUL( *X );
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1114,7 +1114,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( X, A, B ) );
     MOD_SUB( *X );
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* All functions referencing mbedtls_mpi_sub_mod() are alt-implemented without fallback */
 
@@ -1136,7 +1136,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( X, A, B ) );
     MOD_ADD( *X );
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) && \
@@ -1151,7 +1151,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( X, count ) );
     MOD_ADD( *X );
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* All functions referencing mbedtls_mpi_shift_l_mod() are alt-implemented without fallback */
 
@@ -1171,15 +1171,15 @@
 static int ecp_normalize_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt )
 {
     if( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 )
-        return( 0 );
+        return 0 ;
 
 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_normalize_jac( grp, pt ) );
+        return mbedtls_internal_ecp_normalize_jac( grp, pt ) ;
 #endif /* MBEDTLS_ECP_NORMALIZE_JAC_ALT */
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_mpi Zi, ZZi;
@@ -1207,7 +1207,7 @@
 
     mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi );
 
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) */
 }
 
@@ -1226,22 +1226,22 @@
                                    mbedtls_ecp_point *T[], size_t T_size )
 {
     if( T_size < 2 )
-        return( ecp_normalize_jac( grp, *T ) );
+        return ecp_normalize_jac( grp, *T ) ;
 
 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_normalize_jac_many( grp, T, T_size ) );
+        return mbedtls_internal_ecp_normalize_jac_many( grp, T, T_size ) ;
 #endif
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     size_t i;
     mbedtls_mpi *c, u, Zi, ZZi;
 
     if( ( c = mbedtls_calloc( T_size, sizeof( mbedtls_mpi ) ) ) == NULL )
-        return( MBEDTLS_ERR_ECP_ALLOC_FAILED );
+        return MBEDTLS_ERR_ECP_ALLOC_FAILED ;
 
     for( i = 0; i < T_size; i++ )
         mbedtls_mpi_init( &c[i] );
@@ -1306,7 +1306,7 @@
         mbedtls_mpi_free( &c[i] );
     mbedtls_free( c );
 
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) */
 }
 
@@ -1332,7 +1332,7 @@
 cleanup:
     mbedtls_mpi_free( &mQY );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1358,11 +1358,11 @@
 
 #if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_double_jac( grp, R, P ) );
+        return mbedtls_internal_ecp_double_jac( grp, R, P ) ;
 #endif /* MBEDTLS_ECP_DOUBLE_JAC_ALT */
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_mpi M, S, T, U;
@@ -1427,7 +1427,7 @@
 cleanup:
     mbedtls_mpi_free( &M ); mbedtls_mpi_free( &S ); mbedtls_mpi_free( &T ); mbedtls_mpi_free( &U );
 
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) */
 }
 
@@ -1458,11 +1458,11 @@
 
 #if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_add_mixed( grp, R, P, Q ) );
+        return mbedtls_internal_ecp_add_mixed( grp, R, P, Q ) ;
 #endif /* MBEDTLS_ECP_ADD_MIXED_ALT */
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_ADD_MIXED_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_mpi T1, T2, T3, T4, X, Y, Z;
@@ -1471,16 +1471,16 @@
      * Trivial cases: P == 0 or Q == 0 (case 1)
      */
     if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
-        return( mbedtls_ecp_copy( R, Q ) );
+        return mbedtls_ecp_copy( R, Q ) ;
 
     if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 0 ) == 0 )
-        return( mbedtls_ecp_copy( R, P ) );
+        return mbedtls_ecp_copy( R, P ) ;
 
     /*
      * Make sure Q coordinates are normalized
      */
     if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 1 ) != 0 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 ); mbedtls_mpi_init( &T3 ); mbedtls_mpi_init( &T4 );
     mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
@@ -1530,7 +1530,7 @@
     mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 ); mbedtls_mpi_free( &T3 ); mbedtls_mpi_free( &T4 );
     mbedtls_mpi_free( &X ); mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &Z );
 
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_ADD_MIXED_ALT) */
 }
 
@@ -1546,11 +1546,11 @@
 {
 #if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_randomize_jac( grp, pt, f_rng, p_rng ) );
+        return mbedtls_internal_ecp_randomize_jac( grp, pt, f_rng, p_rng ) ;
 #endif /* MBEDTLS_ECP_RANDOMIZE_JAC_ALT */
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_mpi l, ll;
@@ -1576,7 +1576,7 @@
 
     if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
         ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) */
 }
 
@@ -1833,7 +1833,7 @@
     }
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1862,7 +1862,7 @@
     MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, i >> 7 ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1936,7 +1936,7 @@
     }
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1966,7 +1966,7 @@
 
     /* N is always odd (see above), just make extra sure */
     if( mbedtls_mpi_get_bit( &grp->N, 0 ) != 1 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /* do we need the parity trick? */
     *parity_trick = ( mbedtls_mpi_get_bit( m, 0 ) == 0 );
@@ -1983,7 +1983,7 @@
     mbedtls_mpi_free( &mm );
     mbedtls_mpi_free( &M );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2054,7 +2054,7 @@
 #endif
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2096,7 +2096,7 @@
     if( w >= grp->nbits )
         w = 2;
 
-    return( w );
+    return w ;
 }
 
 /*
@@ -2230,7 +2230,7 @@
 
     ECP_RS_LEAVE( rsm );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
@@ -2252,11 +2252,11 @@
 {
 #if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_normalize_mxz( grp, P ) );
+        return mbedtls_internal_ecp_normalize_mxz( grp, P ) ;
 #endif /* MBEDTLS_ECP_NORMALIZE_MXZ_ALT */
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &P->Z, &P->Z, &grp->P ) );
@@ -2264,7 +2264,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) */
 }
 
@@ -2281,11 +2281,11 @@
 {
 #if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng ) );
+        return mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng ) ;
 #endif /* MBEDTLS_ECP_RANDOMIZE_MXZ_ALT */
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_mpi l;
@@ -2302,7 +2302,7 @@
 
     if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
         ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) */
 }
 
@@ -2328,11 +2328,11 @@
 {
 #if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
     if( mbedtls_internal_ecp_grp_capable( grp ) )
-        return( mbedtls_internal_ecp_double_add_mxz( grp, R, S, P, Q, d ) );
+        return mbedtls_internal_ecp_double_add_mxz( grp, R, S, P, Q, d ) ;
 #endif /* MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT */
 
 #if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
-    return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 #else
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
     mbedtls_mpi A, AA, B, BB, E, C, D, DA, CB;
@@ -2365,7 +2365,7 @@
     mbedtls_mpi_free( &BB ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &C );
     mbedtls_mpi_free( &D ); mbedtls_mpi_free( &DA ); mbedtls_mpi_free( &CB );
 
-    return( ret );
+    return ret ;
 #endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) */
 }
 
@@ -2386,7 +2386,7 @@
     mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
     /* Save PX and read from P before writing to R, in case P == R */
     MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
@@ -2439,7 +2439,7 @@
 cleanup:
     mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
@@ -2508,7 +2508,7 @@
         rs_ctx->depth--;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2525,9 +2525,9 @@
     ECP_VALIDATE_RET( P   != NULL );
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 
-    return( ecp_mul_restartable_internal( grp, R, m, P, f_rng, p_rng, rs_ctx ) );
+    return ecp_mul_restartable_internal( grp, R, m, P, f_rng, p_rng, rs_ctx ) ;
 }
 
 /*
@@ -2541,7 +2541,7 @@
     ECP_VALIDATE_RET( R   != NULL );
     ECP_VALIDATE_RET( m   != NULL );
     ECP_VALIDATE_RET( P   != NULL );
-    return( mbedtls_ecp_mul_restartable( grp, R, m, P, f_rng, p_rng, NULL ) );
+    return mbedtls_ecp_mul_restartable( grp, R, m, P, f_rng, p_rng, NULL ) ;
 }
 
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
@@ -2559,7 +2559,7 @@
         mbedtls_mpi_cmp_int( &pt->Y, 0 ) < 0 ||
         mbedtls_mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 ||
         mbedtls_mpi_cmp_mpi( &pt->Y, &grp->P ) >= 0 )
-        return( MBEDTLS_ERR_ECP_INVALID_KEY );
+        return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
     mbedtls_mpi_init( &YY ); mbedtls_mpi_init( &RHS );
 
@@ -2590,7 +2590,7 @@
 
     mbedtls_mpi_free( &YY ); mbedtls_mpi_free( &RHS );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
 
@@ -2628,7 +2628,7 @@
     }
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2656,7 +2656,7 @@
     ECP_VALIDATE_RET( Q   != NULL );
 
     if( mbedtls_ecp_get_type( grp ) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
-        return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
 
     mbedtls_ecp_point_init( &mP );
 
@@ -2725,7 +2725,7 @@
 
     ECP_RS_LEAVE( ma );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2742,7 +2742,7 @@
     ECP_VALIDATE_RET( P   != NULL );
     ECP_VALIDATE_RET( n   != NULL );
     ECP_VALIDATE_RET( Q   != NULL );
-    return( mbedtls_ecp_muladd_restartable( grp, R, m, P, n, Q, NULL ) );
+    return mbedtls_ecp_muladd_restartable( grp, R, m, P, n, Q, NULL ) ;
 }
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
 
@@ -2835,7 +2835,7 @@
 cleanup:
     mbedtls_mpi_free( &XmP );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2847,15 +2847,15 @@
     /* Allow any public value, if it's too big then we'll just reduce it mod p
      * (RFC 7748 sec. 5 para. 3). */
     if( mbedtls_mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 )
-        return( MBEDTLS_ERR_ECP_INVALID_KEY );
+        return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
     /* Implicit in all standards (as they don't consider negative numbers):
      * X must be non-negative. This is normally ensured by the way it's
      * encoded for transmission, but let's be extra sure. */
     if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 )
-        return( MBEDTLS_ERR_ECP_INVALID_KEY );
+        return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
-    return( ecp_check_bad_points_mx( &pt->X, &grp->P, grp->id ) );
+    return ecp_check_bad_points_mx( &pt->X, &grp->P, grp->id ) ;
 }
 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
 
@@ -2870,17 +2870,17 @@
 
     /* Must use affine coordinates */
     if( mbedtls_mpi_cmp_int( &pt->Z, 1 ) != 0 )
-        return( MBEDTLS_ERR_ECP_INVALID_KEY );
+        return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
 #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
     if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
-        return( ecp_check_pubkey_mx( grp, pt ) );
+        return ecp_check_pubkey_mx( grp, pt ) ;
 #endif
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
     if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
-        return( ecp_check_pubkey_sw( grp, pt ) );
+        return ecp_check_pubkey_sw( grp, pt ) ;
 #endif
-    return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+    return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 }
 
 /*
@@ -2899,13 +2899,13 @@
         if( mbedtls_mpi_get_bit( d, 0 ) != 0 ||
             mbedtls_mpi_get_bit( d, 1 ) != 0 ||
             mbedtls_mpi_bitlen( d ) - 1 != grp->nbits ) /* mbedtls_mpi_bitlen is one-based! */
-            return( MBEDTLS_ERR_ECP_INVALID_KEY );
+            return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
         /* see [Curve25519] page 5 */
         if( grp->nbits == 254 && mbedtls_mpi_get_bit( d, 2 ) != 0 )
-            return( MBEDTLS_ERR_ECP_INVALID_KEY );
+            return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
@@ -2914,13 +2914,13 @@
         /* see SEC1 3.2 */
         if( mbedtls_mpi_cmp_int( d, 1 ) < 0 ||
             mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
-            return( MBEDTLS_ERR_ECP_INVALID_KEY );
+            return MBEDTLS_ERR_ECP_INVALID_KEY ;
         else
-            return( 0 );
+            return 0 ;
     }
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
 
-    return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+    return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 }
 
 #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
@@ -2953,7 +2953,7 @@
     }
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
 
@@ -2966,9 +2966,9 @@
     switch( ret )
     {
         case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
-            return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
+            return MBEDTLS_ERR_ECP_RANDOM_FAILED ;
         default:
-            return( ret );
+            return ret ;
     }
 }
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
@@ -2987,15 +2987,15 @@
 
 #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
     if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
-        return( mbedtls_ecp_gen_privkey_mx( grp->nbits, d, f_rng, p_rng ) );
+        return mbedtls_ecp_gen_privkey_mx( grp->nbits, d, f_rng, p_rng ) ;
 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
 
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
     if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
-        return( mbedtls_ecp_gen_privkey_sw( &grp->N, d, f_rng, p_rng ) );
+        return mbedtls_ecp_gen_privkey_sw( &grp->N, d, f_rng, p_rng ) ;
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
 
-    return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+    return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
 }
 
 /*
@@ -3018,7 +3018,7 @@
     MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, Q, d, G, f_rng, p_rng ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -3034,7 +3034,7 @@
     ECP_VALIDATE_RET( Q     != NULL );
     ECP_VALIDATE_RET( f_rng != NULL );
 
-    return( mbedtls_ecp_gen_keypair_base( grp, &grp->G, d, Q, f_rng, p_rng ) );
+    return mbedtls_ecp_gen_keypair_base( grp, &grp->G, d, Q, f_rng, p_rng ) ;
 }
 
 /*
@@ -3048,9 +3048,9 @@
     ECP_VALIDATE_RET( f_rng != NULL );
 
     if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( mbedtls_ecp_gen_keypair( &key->grp, &key->d, &key->Q, f_rng, p_rng ) );
+    return mbedtls_ecp_gen_keypair( &key->grp, &key->d, &key->Q, f_rng, p_rng ) ;
 }
 
 #define ECP_CURVE25519_KEY_SIZE 32
@@ -3067,7 +3067,7 @@
     ECP_VALIDATE_RET( buf  != NULL );
 
     if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
 
@@ -3080,7 +3080,7 @@
         if( grp_id == MBEDTLS_ECP_DP_CURVE25519 )
         {
             if( buflen != ECP_CURVE25519_KEY_SIZE )
-                return( MBEDTLS_ERR_ECP_INVALID_KEY );
+                return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
             MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &key->d, buf, buflen ) );
 
@@ -3104,7 +3104,7 @@
         else if( grp_id == MBEDTLS_ECP_DP_CURVE448 )
         {
             if( buflen != ECP_CURVE448_KEY_SIZE )
-                return( MBEDTLS_ERR_ECP_INVALID_KEY );
+                return MBEDTLS_ERR_ECP_INVALID_KEY ;
 
             MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &key->d, buf, buflen ) );
 
@@ -3135,7 +3135,7 @@
     if( ret != 0 )
         mbedtls_mpi_free( &key->d );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -3155,13 +3155,13 @@
         if( key->grp.id == MBEDTLS_ECP_DP_CURVE25519 )
         {
             if( buflen < ECP_CURVE25519_KEY_SIZE )
-                return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
 
         }
         else if( key->grp.id == MBEDTLS_ECP_DP_CURVE448 )
         {
             if( buflen < ECP_CURVE448_KEY_SIZE )
-                return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ;
         }
         MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &key->d, buf, buflen ) );
     }
@@ -3175,7 +3175,7 @@
 #endif
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 
@@ -3198,7 +3198,7 @@
         mbedtls_mpi_cmp_mpi( &pub->Q.Y, &prv->Q.Y ) ||
         mbedtls_mpi_cmp_mpi( &pub->Q.Z, &prv->Q.Z ) )
     {
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     }
 
     mbedtls_ecp_point_init( &Q );
@@ -3222,7 +3222,7 @@
     mbedtls_ecp_point_free( &Q );
     mbedtls_ecp_group_free( &grp );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -3246,7 +3246,7 @@
         out[i] = (unsigned char) state;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Adjust the exponent to be a valid private point for the specified curve.
@@ -3282,7 +3282,7 @@
             goto cleanup;
     }
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 /* Calculate R = m.P for each m in exponents. Check that the number of
@@ -3336,7 +3336,7 @@
         else
             mbedtls_printf( "passed\n" );
     }
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -3448,7 +3448,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/ecp_curves.c b/library/ecp_curves.c
index 421a067..280e4c8 100644
--- a/library/ecp_curves.c
+++ b/library/ecp_curves.c
@@ -4509,7 +4509,7 @@
 #if defined(ECP_LOAD_GROUP)
 /*
  * Create an MPI from embedded constants
- * (assumes len is an exact multiple of sizeof mbedtls_mpi_uint)
+ * (assumes len is an exact multiple of sizeof(mbedtls_mpi_uint))
  */
 static inline void ecp_mpi_load( mbedtls_mpi *X, const mbedtls_mpi_uint *p, size_t len )
 {
@@ -4561,7 +4561,7 @@
      */
     grp->T_size = 0;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* ECP_LOAD_GROUP */
 
@@ -4669,7 +4669,7 @@
     if( ret != 0 )
         mbedtls_ecp_group_free( grp );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
 
@@ -4724,7 +4724,7 @@
     if( ret != 0 )
         mbedtls_ecp_group_free( grp );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
 
@@ -4743,81 +4743,81 @@
 #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
         case MBEDTLS_ECP_DP_SECP192R1:
             NIST_MODP( p192 );
-            return( LOAD_GROUP( secp192r1 ) );
+            return LOAD_GROUP( secp192r1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
         case MBEDTLS_ECP_DP_SECP224R1:
             NIST_MODP( p224 );
-            return( LOAD_GROUP( secp224r1 ) );
+            return LOAD_GROUP( secp224r1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
         case MBEDTLS_ECP_DP_SECP256R1:
             NIST_MODP( p256 );
-            return( LOAD_GROUP( secp256r1 ) );
+            return LOAD_GROUP( secp256r1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
         case MBEDTLS_ECP_DP_SECP384R1:
             NIST_MODP( p384 );
-            return( LOAD_GROUP( secp384r1 ) );
+            return LOAD_GROUP( secp384r1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
         case MBEDTLS_ECP_DP_SECP521R1:
             NIST_MODP( p521 );
-            return( LOAD_GROUP( secp521r1 ) );
+            return LOAD_GROUP( secp521r1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
         case MBEDTLS_ECP_DP_SECP192K1:
             grp->modp = ecp_mod_p192k1;
-            return( LOAD_GROUP_A( secp192k1 ) );
+            return LOAD_GROUP_A( secp192k1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
         case MBEDTLS_ECP_DP_SECP224K1:
             grp->modp = ecp_mod_p224k1;
-            return( LOAD_GROUP_A( secp224k1 ) );
+            return LOAD_GROUP_A( secp224k1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
         case MBEDTLS_ECP_DP_SECP256K1:
             grp->modp = ecp_mod_p256k1;
-            return( LOAD_GROUP_A( secp256k1 ) );
+            return LOAD_GROUP_A( secp256k1 ) ;
 #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
         case MBEDTLS_ECP_DP_BP256R1:
-            return( LOAD_GROUP_A( brainpoolP256r1 ) );
+            return LOAD_GROUP_A( brainpoolP256r1 ) ;
 #endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
         case MBEDTLS_ECP_DP_BP384R1:
-            return( LOAD_GROUP_A( brainpoolP384r1 ) );
+            return LOAD_GROUP_A( brainpoolP384r1 ) ;
 #endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
         case MBEDTLS_ECP_DP_BP512R1:
-            return( LOAD_GROUP_A( brainpoolP512r1 ) );
+            return LOAD_GROUP_A( brainpoolP512r1 ) ;
 #endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
         case MBEDTLS_ECP_DP_CURVE25519:
             grp->modp = ecp_mod_p255;
-            return( ecp_use_curve25519( grp ) );
+            return ecp_use_curve25519( grp ) ;
 #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
 
 #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
         case MBEDTLS_ECP_DP_CURVE448:
             grp->modp = ecp_mod_p448;
-            return( ecp_use_curve448( grp ) );
+            return ecp_use_curve448( grp ) ;
 #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
 
         default:
             grp->id = MBEDTLS_ECP_DP_NONE;
-            return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ;
     }
 }
 
@@ -4895,7 +4895,7 @@
     ADD( 4 ); ADD( 5 );             LAST; // A2 += A4 + A5
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 #undef WIDTH
@@ -5048,7 +5048,7 @@
     SUB( 13 ); ADD( 10 );               LAST; // A6 += -A13 + A10
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
 
@@ -5085,7 +5085,7 @@
     SUB( 10 ); SUB( 11 ); SUB( 12 ); SUB( 13 );             LAST; // A7
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
 
@@ -5134,7 +5134,7 @@
     SUB( 22 );                                              LAST; // A11
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
 
@@ -5177,7 +5177,7 @@
      * P521_WIDTH + 1. Otherwise P521_WIDTH is enough. */
 
     if( N->n < P521_WIDTH )
-        return( 0 );
+        return 0 ;
 
     /* M = A1 */
     M.s = 1;
@@ -5197,7 +5197,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 #undef P521_WIDTH
@@ -5223,15 +5223,15 @@
     mbedtls_mpi_uint Mp[P255_WIDTH + 2];
 
     if( N->n < P255_WIDTH )
-        return( 0 );
+        return 0 ;
 
     /* M = A1 */
     M.s = 1;
     M.n = N->n - ( P255_WIDTH - 1 );
     if( M.n > P255_WIDTH + 1 )
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     M.p = Mp;
-    memset( Mp, 0, sizeof Mp );
+    memset( Mp, 0, sizeof(Mp) );
     memcpy( Mp, N->p + P255_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
     MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 255 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
     M.n++; /* Make room for multiplication by 19 */
@@ -5246,7 +5246,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
 
@@ -5280,14 +5280,14 @@
     mbedtls_mpi_uint Mp[P448_WIDTH + 1], Qp[P448_WIDTH];
 
     if( N->n <= P448_WIDTH )
-        return( 0 );
+        return 0 ;
 
     /* M = A1 */
     M.s = 1;
     M.n = N->n - ( P448_WIDTH );
     if( M.n > P448_WIDTH )
         /* Shouldn't be called with N larger than 2^896! */
-        return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA ;
     M.p = Mp;
     memset( Mp, 0, sizeof( Mp ) );
     memcpy( Mp, N->p + P448_WIDTH, M.n * sizeof( mbedtls_mpi_uint ) );
@@ -5317,7 +5317,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &M ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
 
@@ -5342,7 +5342,7 @@
     mbedtls_mpi_uint Mp[P_KOBLITZ_MAX + P_KOBLITZ_R + 1];
 
     if( N->n < p_limbs )
-        return( 0 );
+        return 0 ;
 
     /* Init R */
     R.s = 1;
@@ -5357,7 +5357,7 @@
     M.n = N->n - ( p_limbs - adjust );
     if( M.n > p_limbs + adjust )
         M.n = p_limbs + adjust;
-    memset( Mp, 0, sizeof Mp );
+    memset( Mp, 0, sizeof(Mp) );
     memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
     if( shift != 0 )
         MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
@@ -5379,7 +5379,7 @@
     M.n = N->n - ( p_limbs - adjust );
     if( M.n > p_limbs + adjust )
         M.n = p_limbs + adjust;
-    memset( Mp, 0, sizeof Mp );
+    memset( Mp, 0, sizeof(Mp) );
     memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
     if( shift != 0 )
         MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
@@ -5396,7 +5396,7 @@
     MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED) ||
           MBEDTLS_ECP_DP_SECP224K1_ENABLED) ||
@@ -5430,7 +5430,7 @@
                                    0x00 ) };
 
 #if defined(MBEDTLS_HAVE_INT64)
-    return( ecp_mod_koblitz( N, Rp, 4, 1, 32, 0xFFFFFFFF ) );
+    return ecp_mod_koblitz( N, Rp, 4, 1, 32, 0xFFFFFFFF ) ;
 #else
     return( ecp_mod_koblitz( N, Rp, 224 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0,
                              0 ) );
diff --git a/library/entropy.c b/library/entropy.c
index 9e31f84..4b39231 100644
--- a/library/entropy.c
+++ b/library/entropy.c
@@ -118,7 +118,7 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     idx = ctx->source_count;
@@ -138,10 +138,10 @@
 exit:
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -200,7 +200,7 @@
 cleanup:
     mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx,
@@ -210,17 +210,17 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     ret = entropy_update( ctx, MBEDTLS_ENTROPY_SOURCE_MANUAL, data, len );
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -235,7 +235,7 @@
     size_t olen;
 
     if( ctx->source_count == 0 )
-        return( MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED );
+        return MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED ;
 
     /*
      * Run through our entropy sources
@@ -259,7 +259,7 @@
         {
             if( ( ret = entropy_update( ctx, (unsigned char) i,
                                         buf, olen ) ) != 0 )
-                return( ret );
+                return ret ;
             ctx->source[i].size += olen;
         }
     }
@@ -270,7 +270,7 @@
 cleanup:
     mbedtls_platform_zeroize( buf, sizeof( buf ) );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -282,17 +282,17 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     ret = entropy_gather_internal( ctx );
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_entropy_func( void *data, unsigned char *output, size_t len )
@@ -303,7 +303,7 @@
     unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE];
 
     if( len > MBEDTLS_ENTROPY_BLOCK_SIZE )
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
 
 #if defined(MBEDTLS_ENTROPY_NV_SEED)
     /* Update the NV entropy seed before generating any entropy for outside
@@ -313,13 +313,13 @@
     {
         ctx->initial_entropy_run = 1;
         if( ( ret = mbedtls_entropy_update_nv_seed( ctx ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 #endif
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     /*
@@ -411,10 +411,10 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_ENTROPY_NV_SEED)
@@ -425,16 +425,16 @@
 
     /* Read new seed  and write it to NV */
     if( ( ret = mbedtls_entropy_func( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( mbedtls_nv_seed_write( buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) < 0 )
-        return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
+        return MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR ;
 
     /* Manually update the remaining stream with a separator value to diverge */
     memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
     ret = mbedtls_entropy_update_manual( ctx, buf, MBEDTLS_ENTROPY_BLOCK_SIZE );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ENTROPY_NV_SEED */
 
@@ -471,7 +471,7 @@
     if( f != NULL )
         fclose( f );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_entropy_update_seed_file( mbedtls_entropy_context *ctx, const char *path )
@@ -482,7 +482,7 @@
     unsigned char buf[ MBEDTLS_ENTROPY_MAX_SEED_SIZE ];
 
     if( ( f = fopen( path, "rb" ) ) == NULL )
-        return( MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR );
+        return MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR ;
 
     fseek( f, 0, SEEK_END );
     n = (size_t) ftell( f );
@@ -501,9 +501,9 @@
     mbedtls_platform_zeroize( buf, sizeof( buf ) );
 
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( mbedtls_entropy_write_seed_file( ctx, path ) );
+    return mbedtls_entropy_write_seed_file( ctx, path ) ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -519,7 +519,7 @@
     memset( output, 0x2a, len );
     *olen = len;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
@@ -535,7 +535,7 @@
     {
         if( ( ret = mbedtls_hardware_poll( NULL, buf + entropy_len,
             buf_len - entropy_len, &olen ) ) != 0 )
-            return( ret );
+            return ret ;
 
         entropy_len += olen;
         attempts--;
@@ -546,7 +546,7 @@
         ret = 1;
     }
 
-    return( ret );
+    return ret ;
 }
 
 
@@ -563,7 +563,7 @@
         unset |= buf[i];
     }
 
-    return( set == 0xFF || unset == 0x00 );
+    return set == 0xFF || unset == 0x00 ;
 }
 
 /*
@@ -615,7 +615,7 @@
         mbedtls_printf( "\n" );
     }
 
-    return( ret != 0 );
+    return ret != 0 ;
 }
 
 #endif /* MBEDTLS_ENTROPY_HARDWARE_ALT */
@@ -647,7 +647,7 @@
     if( ret != 0 )
         goto cleanup;
 
-    if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 )
+    if( ( ret = mbedtls_entropy_update_manual( &ctx, buf, sizeof(buf) ) ) != 0 )
         goto cleanup;
 
     /*
@@ -694,7 +694,7 @@
         mbedtls_printf( "\n" );
     }
 
-    return( ret != 0 );
+    return ret != 0 ;
 }
 #endif /* MBEDTLS_SELF_TEST */
 
diff --git a/library/entropy_poll.c b/library/entropy_poll.c
index 058c307..7153e66 100644
--- a/library/entropy_poll.c
+++ b/library/entropy_poll.c
@@ -65,19 +65,19 @@
     if( CryptAcquireContext( &provider, NULL, NULL,
                               PROV_RSA_FULL, CRYPT_VERIFYCONTEXT ) == FALSE )
     {
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
     }
 
     if( CryptGenRandom( provider, (DWORD) len, output ) == FALSE )
     {
         CryptReleaseContext( provider, 0 );
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
     }
 
     CryptReleaseContext( provider, 0 );
     *olen = len;
 
-    return( 0 );
+    return 0 ;
 }
 #else /* _WIN32 && !EFIX64 && !EFI32 */
 
@@ -101,7 +101,7 @@
     memset( buf, 0, buflen );
 #endif
 #endif
-    return( syscall( SYS_getrandom, buf, buflen, flags ) );
+    return syscall( SYS_getrandom, buf, buflen, flags ) ;
 }
 #endif /* SYS_getrandom */
 #endif /* __linux__ || __midipix__ */
@@ -147,11 +147,11 @@
     {
         len = buflen > 256 ? 256 : buflen;
         if( sysctl(name, 2, buf, &len, NULL, 0) == -1 )
-            return( -1 );
+            return -1 ;
         buflen -= len;
         buf += len;
     }
-    return( 0 );
+    return 0 ;
 }
 #endif /* KERN_ARND */
 #endif /* __FreeBSD__ || __NetBSD__ */
@@ -171,10 +171,10 @@
     if( ret >= 0 )
     {
         *olen = ret;
-        return( 0 );
+        return 0 ;
     }
     else if( errno != ENOSYS )
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
     /* Fall through if the system call isn't known. */
 #else
     ((void) ret);
@@ -184,28 +184,28 @@
     ((void) file);
     ((void) read_len);
     if( sysctl_arnd_wrapper( output, len ) == -1 )
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
     *olen = len;
-    return( 0 );
+    return 0 ;
 #else
 
     *olen = 0;
 
     file = fopen( "/dev/urandom", "rb" );
     if( file == NULL )
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
 
     read_len = fread( output, 1, len, file );
     if( read_len != len )
     {
         fclose( file );
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
     }
 
     fclose( file );
     *olen = len;
 
-    return( 0 );
+    return 0 ;
 #endif /* HAVE_SYSCTL_ARND */
 }
 #endif /* _WIN32 && !EFIX64 && !EFI32 */
@@ -222,7 +222,7 @@
     memset( buf, 0, MBEDTLS_ENTROPY_BLOCK_SIZE );
 
     if( mbedtls_nv_seed_read( buf, MBEDTLS_ENTROPY_BLOCK_SIZE ) < 0 )
-      return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+      return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
 
     if( len < use_len )
       use_len = len;
@@ -230,7 +230,7 @@
     memcpy( output, buf, use_len );
     *olen = use_len;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_ENTROPY_NV_SEED */
 
diff --git a/library/gcm.c b/library/gcm.c
index 835b1b2..123777d 100644
--- a/library/gcm.c
+++ b/library/gcm.c
@@ -108,7 +108,7 @@
 
     memset( h, 0, 16 );
     if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, h, 16, h, &olen ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* pack h as two 64-bits ints, big-endian */
     GET_UINT32_BE( hi, h,  0  );
@@ -126,7 +126,7 @@
 #if defined(MBEDTLS_AESNI_C) && defined(MBEDTLS_HAVE_X86_64)
     /* With CLMUL support, we need only h, not the rest of the table */
     if( mbedtls_aesni_has_support( MBEDTLS_AESNI_CLMUL ) )
-        return( 0 );
+        return 0 ;
 #endif
 
     /* 0 corresponds to 0 in GF(2^128) */
@@ -155,7 +155,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx,
@@ -173,26 +173,26 @@
     cipher_info = mbedtls_cipher_info_from_values( cipher, keybits,
                                                    MBEDTLS_MODE_ECB );
     if( cipher_info == NULL )
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
 
     if( cipher_info->block_size != 16 )
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
 
     mbedtls_cipher_free( &ctx->cipher_ctx );
 
     if( ( ret = mbedtls_cipher_setup( &ctx->cipher_ctx, cipher_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_cipher_setkey( &ctx->cipher_ctx, key, keybits,
                                MBEDTLS_ENCRYPT ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = gcm_gen_table( ctx ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -284,7 +284,7 @@
     /* IV is limited to 2^64 bits, so 2^61 bytes */
     /* IV is not allowed to be zero length */
     if( iv_len == 0 || (uint64_t) iv_len >> 61 != 0 )
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
 
     memset( ctx->y, 0x00, sizeof(ctx->y) );
     memset( ctx->buf, 0x00, sizeof(ctx->buf) );
@@ -326,10 +326,10 @@
     if( ( ret = mbedtls_cipher_update( &ctx->cipher_ctx, ctx->y, 16,
                                        ctx->base_ectr, &olen ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /**
@@ -359,7 +359,7 @@
 
     /* IV is limited to 2^64 bits, so 2^61 bytes */
     if( (uint64_t) add_len >> 61 != 0 )
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
 
     offset = ctx->add_len % 16;
     p = add;
@@ -400,7 +400,7 @@
             ctx->buf[i] ^= p[i];
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Increment the counter. */
@@ -428,7 +428,7 @@
                                        &olen ) ) != 0 )
     {
         mbedtls_platform_zeroize( ectr, 16 );
-        return( ret );
+        return ret ;
     }
 
     for( i = 0; i < use_len; i++ )
@@ -439,7 +439,7 @@
         if( ctx->mode == MBEDTLS_GCM_ENCRYPT )
             ctx->buf[offset + i] ^= output[i];
     }
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_gcm_update( mbedtls_gcm_context *ctx,
@@ -454,7 +454,7 @@
     unsigned char ectr[16];
 
     if( output_size < input_length )
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
     GCM_VALIDATE_RET( output_length != NULL );
     *output_length = input_length;
 
@@ -463,21 +463,21 @@
      * Returning early also means that the last partial block of AD remains
      * untouched for mbedtls_gcm_finish */
     if( input_length == 0 )
-        return( 0 );
+        return 0 ;
 
     GCM_VALIDATE_RET( ctx != NULL );
     GCM_VALIDATE_RET( input != NULL );
     GCM_VALIDATE_RET( output != NULL );
 
     if( output > input && (size_t) ( output - input ) < input_length )
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
 
     /* Total length is restricted to 2^39 - 256 bits, ie 2^36 - 2^5 bytes
      * Also check for possible overflow */
     if( ctx->len + input_length < ctx->len ||
         (uint64_t) ctx->len + input_length > 0xFFFFFFFE0ull )
     {
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
     }
 
     if( ctx->len == 0 && ctx->add_len % 16 != 0 )
@@ -493,7 +493,7 @@
             use_len = input_length;
 
         if( ( ret = gcm_mask( ctx, ectr, offset, use_len, p, out_p ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( offset + use_len == 16 )
             gcm_mult( ctx, ctx->buf, ctx->buf );
@@ -510,7 +510,7 @@
     {
         gcm_incr( ctx->y );
         if( ( ret = gcm_mask( ctx, ectr, 0, 16, p, out_p ) ) != 0 )
-            return( ret );
+            return ret ;
 
         gcm_mult( ctx, ctx->buf, ctx->buf );
 
@@ -523,11 +523,11 @@
     {
         gcm_incr( ctx->y );
         if( ( ret = gcm_mask( ctx, ectr, 0, input_length, p, out_p ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 
     mbedtls_platform_zeroize( ectr, sizeof( ectr ) );
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_gcm_finish( mbedtls_gcm_context *ctx,
@@ -558,7 +558,7 @@
     }
 
     if( tag_len > 16 || tag_len < 4 )
-        return( MBEDTLS_ERR_GCM_BAD_INPUT );
+        return MBEDTLS_ERR_GCM_BAD_INPUT ;
 
     if( ctx->len % 16 != 0 )
         gcm_mult( ctx, ctx->buf, ctx->buf );
@@ -583,7 +583,7 @@
             tag[i] ^= ctx->buf[i];
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_gcm_crypt_and_tag( mbedtls_gcm_context *ctx,
@@ -609,19 +609,19 @@
     GCM_VALIDATE_RET( tag != NULL );
 
     if( ( ret = mbedtls_gcm_starts( ctx, mode, iv, iv_len ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_gcm_update_ad( ctx, add, add_len ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_gcm_update( ctx, input, length,
                                     output, length, &olen ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_gcm_finish( ctx, NULL, 0, &olen, tag, tag_len ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_gcm_auth_decrypt( mbedtls_gcm_context *ctx,
@@ -651,7 +651,7 @@
                                    iv, iv_len, add, add_len,
                                    input, output, tag_len, check_tag ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* Check tag in "constant-time" */
@@ -661,10 +661,10 @@
     if( diff != 0 )
     {
         mbedtls_platform_zeroize( output, length );
-        return( MBEDTLS_ERR_GCM_AUTH_FAILED );
+        return MBEDTLS_ERR_GCM_AUTH_FAILED ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_gcm_free( mbedtls_gcm_context *ctx )
@@ -1174,7 +1174,7 @@
         mbedtls_gcm_free( &ctx );
     }
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
diff --git a/library/hkdf.c b/library/hkdf.c
index 5013729..6c7082b 100644
--- a/library/hkdf.c
+++ b/library/hkdf.c
@@ -43,7 +43,7 @@
 
     mbedtls_platform_zeroize( prk, sizeof( prk ) );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_hkdf_extract( const mbedtls_md_info_t *md,
@@ -73,7 +73,7 @@
         salt_len = hash_len;
     }
 
-    return( mbedtls_md_hmac( md, salt, salt_len, ikm, ikm_len, prk ) );
+    return mbedtls_md_hmac( md, salt, salt_len, ikm, ikm_len, prk ) ;
 }
 
 int mbedtls_hkdf_expand( const mbedtls_md_info_t *md, const unsigned char *prk,
@@ -91,14 +91,14 @@
 
     if( okm == NULL )
     {
-        return( MBEDTLS_ERR_HKDF_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_HKDF_BAD_INPUT_DATA ;
     }
 
     hash_len = mbedtls_md_get_size( md );
 
     if( prk_len < hash_len || hash_len == 0 )
     {
-        return( MBEDTLS_ERR_HKDF_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_HKDF_BAD_INPUT_DATA ;
     }
 
     if( info == NULL )
@@ -120,7 +120,7 @@
      */
     if( n > 255 )
     {
-        return( MBEDTLS_ERR_HKDF_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_HKDF_BAD_INPUT_DATA ;
     }
 
     mbedtls_md_init( &ctx );
@@ -183,7 +183,7 @@
     mbedtls_md_free( &ctx );
     mbedtls_platform_zeroize( t, sizeof( t ) );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_HKDF_C */
diff --git a/library/hmac_drbg.c b/library/hmac_drbg.c
index ab353bf..954d088 100644
--- a/library/hmac_drbg.c
+++ b/library/hmac_drbg.c
@@ -101,7 +101,7 @@
 
 exit:
     mbedtls_platform_zeroize( K, sizeof( K ) );
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -114,7 +114,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ( ret = mbedtls_md_setup( &ctx->md_ctx, md_info, 1 ) ) != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_THREADING_C)
     mbedtls_mutex_init( &ctx->mutex );
@@ -127,13 +127,13 @@
      */
     if( ( ret = mbedtls_md_hmac_starts( &ctx->md_ctx, ctx->V,
                                         mbedtls_md_get_size( md_info ) ) ) != 0 )
-        return( ret );
+        return ret ;
     memset( ctx->V, 0x01, mbedtls_md_get_size( md_info ) );
 
     if( ( ret = mbedtls_hmac_drbg_update( ctx, data, data_len ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -161,7 +161,7 @@
         if( len > MBEDTLS_HMAC_DRBG_MAX_INPUT ||
             total_entropy_len + len > MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT )
         {
-            return( MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG );
+            return MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG ;
         }
     }
 
@@ -171,7 +171,7 @@
     if( ( ret = ctx->f_entropy( ctx->p_entropy,
                                 seed, ctx->entropy_len ) ) != 0 )
     {
-        return( MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED ;
     }
     seedlen += ctx->entropy_len;
 
@@ -190,7 +190,7 @@
                                     seed + seedlen,
                                     ctx->entropy_len / 2 ) ) != 0 )
         {
-            return( MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED );
+            return MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED ;
         }
 
         seedlen += ctx->entropy_len / 2;
@@ -214,7 +214,7 @@
 exit:
     /* 4. Done */
     mbedtls_platform_zeroize( seed, seedlen );
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -223,7 +223,7 @@
 int mbedtls_hmac_drbg_reseed( mbedtls_hmac_drbg_context *ctx,
                       const unsigned char *additional, size_t len )
 {
-    return( hmac_drbg_reseed_core( ctx, additional, len, 0 ) );
+    return hmac_drbg_reseed_core( ctx, additional, len, 0 ) ;
 }
 
 /*
@@ -243,7 +243,7 @@
     size_t md_size;
 
     if( ( ret = mbedtls_md_setup( &ctx->md_ctx, md_info, 1 ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* The mutex is initialized iff the md context is set up. */
 #if defined(MBEDTLS_THREADING_C)
@@ -258,7 +258,7 @@
      * MD context with an all-zero key. Then set V to its initial value.
      */
     if( ( ret = mbedtls_md_hmac_starts( &ctx->md_ctx, ctx->V, md_size ) ) != 0 )
-        return( ret );
+        return ret ;
     memset( ctx->V, 0x01, md_size );
 
     ctx->f_entropy = f_entropy;
@@ -281,10 +281,10 @@
     if( ( ret = hmac_drbg_reseed_core( ctx, custom, len,
                                        1 /* add nonce */ ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -328,11 +328,11 @@
 
     /* II. Check request length */
     if( out_len > MBEDTLS_HMAC_DRBG_MAX_REQUEST )
-        return( MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG );
+        return MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG ;
 
     /* III. Check input length */
     if( add_len > MBEDTLS_HMAC_DRBG_MAX_INPUT )
-        return( MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG );
+        return MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG ;
 
     /* 1. (aka VII and IX) Check reseed counter and PR */
     if( ctx->f_entropy != NULL && /* For no-reseeding instances */
@@ -340,7 +340,7 @@
           ctx->reseed_counter > ctx->reseed_interval ) )
     {
         if( ( ret = mbedtls_hmac_drbg_reseed( ctx, additional, add_len ) ) != 0 )
-            return( ret );
+            return ret ;
 
         add_len = 0; /* VII.4 */
     }
@@ -381,7 +381,7 @@
 
 exit:
     /* 8. Done */
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -394,17 +394,17 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     ret = mbedtls_hmac_drbg_random_with_add( ctx, output, out_len, NULL, 0 );
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -434,7 +434,7 @@
     unsigned char buf[ MBEDTLS_HMAC_DRBG_MAX_INPUT ];
 
     if( ( f = fopen( path, "wb" ) ) == NULL )
-        return( MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR );
+        return MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR ;
 
     if( ( ret = mbedtls_hmac_drbg_random( ctx, buf, sizeof( buf ) ) ) != 0 )
         goto exit;
@@ -451,7 +451,7 @@
     fclose( f );
     mbedtls_platform_zeroize( buf, sizeof( buf ) );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_hmac_drbg_update_seed_file( mbedtls_hmac_drbg_context *ctx, const char *path )
@@ -463,7 +463,7 @@
     unsigned char c;
 
     if( ( f = fopen( path, "rb" ) ) == NULL )
-        return( MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR );
+        return MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR ;
 
     n = fread( buf, 1, sizeof( buf ), f );
     if( fread( &c, 1, 1, f ) != 0 )
@@ -486,8 +486,8 @@
     if( f != NULL )
         fclose( f );
     if( ret != 0 )
-        return( ret );
-    return( mbedtls_hmac_drbg_write_seed_file( ctx, path ) );
+        return ret ;
+    return mbedtls_hmac_drbg_write_seed_file( ctx, path ) ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -499,7 +499,7 @@
 int mbedtls_hmac_drbg_self_test( int verbose )
 {
     (void) verbose;
-    return( 0 );
+    return 0 ;
 }
 #else
 
@@ -544,14 +544,14 @@
     const unsigned char *p = data;
     memcpy( buf, p + test_offset, len );
     test_offset += len;
-    return( 0 );
+    return 0 ;
 }
 
 #define CHK( c )    if( (c) != 0 )                          \
                     {                                       \
                         if( verbose != 0 )                  \
                             mbedtls_printf( "failed\n" );  \
-                        return( 1 );                        \
+                        return 1 ;                        \
                     }
 
 /*
@@ -612,7 +612,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SHA1_C */
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/md.c b/library/md.c
index a228789..6d27e08 100644
--- a/library/md.c
+++ b/library/md.c
@@ -150,13 +150,13 @@
 
 const int *mbedtls_md_list( void )
 {
-    return( supported_digests );
+    return supported_digests ;
 }
 
 const mbedtls_md_info_t *mbedtls_md_info_from_string( const char *md_name )
 {
     if( NULL == md_name )
-        return( NULL );
+        return NULL ;
 
     /* Get the appropriate digest information */
 #if defined(MBEDTLS_MD5_C)
@@ -187,7 +187,7 @@
     if( !strcmp( "SHA512", md_name ) )
         return mbedtls_md_info_from_type( MBEDTLS_MD_SHA512 );
 #endif
-    return( NULL );
+    return NULL ;
 }
 
 const mbedtls_md_info_t *mbedtls_md_info_from_type( mbedtls_md_type_t md_type )
@@ -196,34 +196,34 @@
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
-            return( &mbedtls_md5_info );
+            return &mbedtls_md5_info ;
 #endif
 #if defined(MBEDTLS_RIPEMD160_C)
         case MBEDTLS_MD_RIPEMD160:
-            return( &mbedtls_ripemd160_info );
+            return &mbedtls_ripemd160_info ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_MD_SHA1:
-            return( &mbedtls_sha1_info );
+            return &mbedtls_sha1_info ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_MD_SHA224:
-            return( &mbedtls_sha224_info );
+            return &mbedtls_sha224_info ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_MD_SHA256:
-            return( &mbedtls_sha256_info );
+            return &mbedtls_sha256_info ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_MD_SHA384:
-            return( &mbedtls_sha384_info );
+            return &mbedtls_sha384_info ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_MD_SHA512:
-            return( &mbedtls_sha512_info );
+            return &mbedtls_sha512_info ;
 #endif
         default:
-            return( NULL );
+            return NULL ;
     }
 }
 
@@ -300,7 +300,7 @@
         src == NULL || src->md_info == NULL ||
         dst->md_info != src->md_info )
     {
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 
     switch( src->md_info->type )
@@ -341,17 +341,17 @@
             break;
 #endif
         default:
-            return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #define ALLOC( type )                                                   \
     do {                                                                \
         ctx->md_ctx = mbedtls_calloc( 1, sizeof( mbedtls_##type##_context ) ); \
         if( ctx->md_ctx == NULL )                                       \
-            return( MBEDTLS_ERR_MD_ALLOC_FAILED );                      \
+            return MBEDTLS_ERR_MD_ALLOC_FAILED ;                      \
         mbedtls_##type##_init( ctx->md_ctx );                           \
     }                                                                   \
     while( 0 )
@@ -359,7 +359,7 @@
 int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_info, int hmac )
 {
     if( md_info == NULL || ctx == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     ctx->md_info = md_info;
     ctx->md_ctx = NULL;
@@ -403,7 +403,7 @@
             break;
 #endif
         default:
-            return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 
     if( hmac != 0 )
@@ -412,131 +412,131 @@
         if( ctx->hmac_ctx == NULL )
         {
             mbedtls_md_free( ctx );
-            return( MBEDTLS_ERR_MD_ALLOC_FAILED );
+            return MBEDTLS_ERR_MD_ALLOC_FAILED ;
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 #undef ALLOC
 
 int mbedtls_md_starts( mbedtls_md_context_t *ctx )
 {
     if( ctx == NULL || ctx->md_info == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     switch( ctx->md_info->type )
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
-            return( mbedtls_md5_starts( ctx->md_ctx ) );
+            return mbedtls_md5_starts( ctx->md_ctx ) ;
 #endif
 #if defined(MBEDTLS_RIPEMD160_C)
         case MBEDTLS_MD_RIPEMD160:
-            return( mbedtls_ripemd160_starts( ctx->md_ctx ) );
+            return mbedtls_ripemd160_starts( ctx->md_ctx ) ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_MD_SHA1:
-            return( mbedtls_sha1_starts( ctx->md_ctx ) );
+            return mbedtls_sha1_starts( ctx->md_ctx ) ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_MD_SHA224:
-            return( mbedtls_sha256_starts( ctx->md_ctx, 1 ) );
+            return mbedtls_sha256_starts( ctx->md_ctx, 1 ) ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_MD_SHA256:
-            return( mbedtls_sha256_starts( ctx->md_ctx, 0 ) );
+            return mbedtls_sha256_starts( ctx->md_ctx, 0 ) ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_MD_SHA384:
-            return( mbedtls_sha512_starts( ctx->md_ctx, 1 ) );
+            return mbedtls_sha512_starts( ctx->md_ctx, 1 ) ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_MD_SHA512:
-            return( mbedtls_sha512_starts( ctx->md_ctx, 0 ) );
+            return mbedtls_sha512_starts( ctx->md_ctx, 0 ) ;
 #endif
         default:
-            return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 }
 
 int mbedtls_md_update( mbedtls_md_context_t *ctx, const unsigned char *input, size_t ilen )
 {
     if( ctx == NULL || ctx->md_info == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     switch( ctx->md_info->type )
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
-            return( mbedtls_md5_update( ctx->md_ctx, input, ilen ) );
+            return mbedtls_md5_update( ctx->md_ctx, input, ilen ) ;
 #endif
 #if defined(MBEDTLS_RIPEMD160_C)
         case MBEDTLS_MD_RIPEMD160:
-            return( mbedtls_ripemd160_update( ctx->md_ctx, input, ilen ) );
+            return mbedtls_ripemd160_update( ctx->md_ctx, input, ilen ) ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_MD_SHA1:
-            return( mbedtls_sha1_update( ctx->md_ctx, input, ilen ) );
+            return mbedtls_sha1_update( ctx->md_ctx, input, ilen ) ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_MD_SHA224:
-            return( mbedtls_sha256_update( ctx->md_ctx, input, ilen ) );
+            return mbedtls_sha256_update( ctx->md_ctx, input, ilen ) ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_MD_SHA256:
-            return( mbedtls_sha256_update( ctx->md_ctx, input, ilen ) );
+            return mbedtls_sha256_update( ctx->md_ctx, input, ilen ) ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_MD_SHA384:
-            return( mbedtls_sha512_update( ctx->md_ctx, input, ilen ) );
+            return mbedtls_sha512_update( ctx->md_ctx, input, ilen ) ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_MD_SHA512:
-            return( mbedtls_sha512_update( ctx->md_ctx, input, ilen ) );
+            return mbedtls_sha512_update( ctx->md_ctx, input, ilen ) ;
 #endif
         default:
-            return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 }
 
 int mbedtls_md_finish( mbedtls_md_context_t *ctx, unsigned char *output )
 {
     if( ctx == NULL || ctx->md_info == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     switch( ctx->md_info->type )
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
-            return( mbedtls_md5_finish( ctx->md_ctx, output ) );
+            return mbedtls_md5_finish( ctx->md_ctx, output ) ;
 #endif
 #if defined(MBEDTLS_RIPEMD160_C)
         case MBEDTLS_MD_RIPEMD160:
-            return( mbedtls_ripemd160_finish( ctx->md_ctx, output ) );
+            return mbedtls_ripemd160_finish( ctx->md_ctx, output ) ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_MD_SHA1:
-            return( mbedtls_sha1_finish( ctx->md_ctx, output ) );
+            return mbedtls_sha1_finish( ctx->md_ctx, output ) ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_MD_SHA224:
-            return( mbedtls_sha256_finish( ctx->md_ctx, output ) );
+            return mbedtls_sha256_finish( ctx->md_ctx, output ) ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_MD_SHA256:
-            return( mbedtls_sha256_finish( ctx->md_ctx, output ) );
+            return mbedtls_sha256_finish( ctx->md_ctx, output ) ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_MD_SHA384:
-            return( mbedtls_sha512_finish( ctx->md_ctx, output ) );
+            return mbedtls_sha512_finish( ctx->md_ctx, output ) ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_MD_SHA512:
-            return( mbedtls_sha512_finish( ctx->md_ctx, output ) );
+            return mbedtls_sha512_finish( ctx->md_ctx, output ) ;
 #endif
         default:
-            return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 }
 
@@ -544,40 +544,40 @@
             unsigned char *output )
 {
     if( md_info == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     switch( md_info->type )
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
-            return( mbedtls_md5( input, ilen, output ) );
+            return mbedtls_md5( input, ilen, output ) ;
 #endif
 #if defined(MBEDTLS_RIPEMD160_C)
         case MBEDTLS_MD_RIPEMD160:
-            return( mbedtls_ripemd160( input, ilen, output ) );
+            return mbedtls_ripemd160( input, ilen, output ) ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_MD_SHA1:
-            return( mbedtls_sha1( input, ilen, output ) );
+            return mbedtls_sha1( input, ilen, output ) ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_MD_SHA224:
-            return( mbedtls_sha256( input, ilen, output, 1 ) );
+            return mbedtls_sha256( input, ilen, output, 1 ) ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_MD_SHA256:
-            return( mbedtls_sha256( input, ilen, output, 0 ) );
+            return mbedtls_sha256( input, ilen, output, 0 ) ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_MD_SHA384:
-            return( mbedtls_sha512( input, ilen, output, 1 ) );
+            return mbedtls_sha512( input, ilen, output, 1 ) ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_MD_SHA512:
-            return( mbedtls_sha512( input, ilen, output, 0 ) );
+            return mbedtls_sha512( input, ilen, output, 0 ) ;
 #endif
         default:
-            return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 }
 
@@ -591,10 +591,10 @@
     unsigned char buf[1024];
 
     if( md_info == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     if( ( f = fopen( path, "rb" ) ) == NULL )
-        return( MBEDTLS_ERR_MD_FILE_IO_ERROR );
+        return MBEDTLS_ERR_MD_FILE_IO_ERROR ;
 
     mbedtls_md_init( &ctx );
 
@@ -618,7 +618,7 @@
     fclose( f );
     mbedtls_md_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -630,7 +630,7 @@
     size_t i;
 
     if( ctx == NULL || ctx->md_info == NULL || ctx->hmac_ctx == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     if( keylen > (size_t) ctx->md_info->block_size )
     {
@@ -666,15 +666,15 @@
 cleanup:
     mbedtls_platform_zeroize( sum, sizeof( sum ) );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_md_hmac_update( mbedtls_md_context_t *ctx, const unsigned char *input, size_t ilen )
 {
     if( ctx == NULL || ctx->md_info == NULL || ctx->hmac_ctx == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
-    return( mbedtls_md_update( ctx, input, ilen ) );
+    return mbedtls_md_update( ctx, input, ilen ) ;
 }
 
 int mbedtls_md_hmac_finish( mbedtls_md_context_t *ctx, unsigned char *output )
@@ -684,21 +684,21 @@
     unsigned char *opad;
 
     if( ctx == NULL || ctx->md_info == NULL || ctx->hmac_ctx == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     opad = (unsigned char *) ctx->hmac_ctx + ctx->md_info->block_size;
 
     if( ( ret = mbedtls_md_finish( ctx, tmp ) ) != 0 )
-        return( ret );
+        return ret ;
     if( ( ret = mbedtls_md_starts( ctx ) ) != 0 )
-        return( ret );
+        return ret ;
     if( ( ret = mbedtls_md_update( ctx, opad,
                                    ctx->md_info->block_size ) ) != 0 )
-        return( ret );
+        return ret ;
     if( ( ret = mbedtls_md_update( ctx, tmp,
                                    ctx->md_info->size ) ) != 0 )
-        return( ret );
-    return( mbedtls_md_finish( ctx, output ) );
+        return ret ;
+    return mbedtls_md_finish( ctx, output ) ;
 }
 
 int mbedtls_md_hmac_reset( mbedtls_md_context_t *ctx )
@@ -707,13 +707,13 @@
     unsigned char *ipad;
 
     if( ctx == NULL || ctx->md_info == NULL || ctx->hmac_ctx == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     ipad = (unsigned char *) ctx->hmac_ctx;
 
     if( ( ret = mbedtls_md_starts( ctx ) ) != 0 )
-        return( ret );
-    return( mbedtls_md_update( ctx, ipad, ctx->md_info->block_size ) );
+        return ret ;
+    return mbedtls_md_update( ctx, ipad, ctx->md_info->block_size ) ;
 }
 
 int mbedtls_md_hmac( const mbedtls_md_info_t *md_info,
@@ -725,7 +725,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( md_info == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     mbedtls_md_init( &ctx );
 
@@ -742,53 +742,53 @@
 cleanup:
     mbedtls_md_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_md_process( mbedtls_md_context_t *ctx, const unsigned char *data )
 {
     if( ctx == NULL || ctx->md_info == NULL )
-        return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
 
     switch( ctx->md_info->type )
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
-            return( mbedtls_internal_md5_process( ctx->md_ctx, data ) );
+            return mbedtls_internal_md5_process( ctx->md_ctx, data ) ;
 #endif
 #if defined(MBEDTLS_RIPEMD160_C)
         case MBEDTLS_MD_RIPEMD160:
-            return( mbedtls_internal_ripemd160_process( ctx->md_ctx, data ) );
+            return mbedtls_internal_ripemd160_process( ctx->md_ctx, data ) ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_MD_SHA1:
-            return( mbedtls_internal_sha1_process( ctx->md_ctx, data ) );
+            return mbedtls_internal_sha1_process( ctx->md_ctx, data ) ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_MD_SHA224:
-            return( mbedtls_internal_sha256_process( ctx->md_ctx, data ) );
+            return mbedtls_internal_sha256_process( ctx->md_ctx, data ) ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_MD_SHA256:
-            return( mbedtls_internal_sha256_process( ctx->md_ctx, data ) );
+            return mbedtls_internal_sha256_process( ctx->md_ctx, data ) ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_MD_SHA384:
-            return( mbedtls_internal_sha512_process( ctx->md_ctx, data ) );
+            return mbedtls_internal_sha512_process( ctx->md_ctx, data ) ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_MD_SHA512:
-            return( mbedtls_internal_sha512_process( ctx->md_ctx, data ) );
+            return mbedtls_internal_sha512_process( ctx->md_ctx, data ) ;
 #endif
         default:
-            return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
     }
 }
 
 unsigned char mbedtls_md_get_size( const mbedtls_md_info_t *md_info )
 {
     if( md_info == NULL )
-        return( 0 );
+        return 0 ;
 
     return md_info->size;
 }
@@ -796,7 +796,7 @@
 mbedtls_md_type_t mbedtls_md_get_type( const mbedtls_md_info_t *md_info )
 {
     if( md_info == NULL )
-        return( MBEDTLS_MD_NONE );
+        return MBEDTLS_MD_NONE ;
 
     return md_info->type;
 }
@@ -804,7 +804,7 @@
 const char *mbedtls_md_get_name( const mbedtls_md_info_t *md_info )
 {
     if( md_info == NULL )
-        return( NULL );
+        return NULL ;
 
     return md_info->name;
 }
diff --git a/library/md5.c b/library/md5.c
index d7f8cee..9761316 100644
--- a/library/md5.c
+++ b/library/md5.c
@@ -98,7 +98,7 @@
     ctx->state[2] = 0x98BADCFE;
     ctx->state[3] = 0x10325476;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_MD5_PROCESS_ALT)
@@ -234,7 +234,7 @@
     /* Zeroise variables to clear sensitive data from memory. */
     mbedtls_platform_zeroize( &local, sizeof( local ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_MD5_PROCESS_ALT */
@@ -251,7 +251,7 @@
     uint32_t left;
 
     if( ilen == 0 )
-        return( 0 );
+        return 0 ;
 
     left = ctx->total[0] & 0x3F;
     fill = 64 - left;
@@ -266,7 +266,7 @@
     {
         memcpy( (void *) (ctx->buffer + left), input, fill );
         if( ( ret = mbedtls_internal_md5_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += fill;
         ilen  -= fill;
@@ -276,7 +276,7 @@
     while( ilen >= 64 )
     {
         if( ( ret = mbedtls_internal_md5_process( ctx, input ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += 64;
         ilen  -= 64;
@@ -287,7 +287,7 @@
         memcpy( (void *) (ctx->buffer + left), input, ilen );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -318,7 +318,7 @@
         memset( ctx->buffer + used, 0, 64 - used );
 
         if( ( ret = mbedtls_internal_md5_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         memset( ctx->buffer, 0, 56 );
     }
@@ -334,7 +334,7 @@
     PUT_UINT32_LE( high, ctx->buffer, 60 );
 
     if( ( ret = mbedtls_internal_md5_process( ctx, ctx->buffer ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /*
      * Output final state
@@ -344,7 +344,7 @@
     PUT_UINT32_LE( ctx->state[2], output,  8 );
     PUT_UINT32_LE( ctx->state[3], output, 12 );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_MD5_ALT */
@@ -373,7 +373,7 @@
 exit:
     mbedtls_md5_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -444,13 +444,13 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 
 fail:
     if( verbose != 0 )
         mbedtls_printf( "failed\n" );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/memory_buffer_alloc.c b/library/memory_buffer_alloc.c
index 0d5d27d..54377b5 100644
--- a/library/memory_buffer_alloc.c
+++ b/library/memory_buffer_alloc.c
@@ -132,7 +132,7 @@
 #if defined(MBEDTLS_MEMORY_DEBUG)
         mbedtls_fprintf( stderr, "FATAL: MAGIC1 mismatch\n" );
 #endif
-        return( 1 );
+        return 1 ;
     }
 
     if( hdr->magic2 != MAGIC2 )
@@ -140,7 +140,7 @@
 #if defined(MBEDTLS_MEMORY_DEBUG)
         mbedtls_fprintf( stderr, "FATAL: MAGIC2 mismatch\n" );
 #endif
-        return( 1 );
+        return 1 ;
     }
 
     if( hdr->alloc > 1 )
@@ -148,7 +148,7 @@
 #if defined(MBEDTLS_MEMORY_DEBUG)
         mbedtls_fprintf( stderr, "FATAL: alloc has illegal value\n" );
 #endif
-        return( 1 );
+        return 1 ;
     }
 
     if( hdr->prev != NULL && hdr->prev == hdr->next )
@@ -156,7 +156,7 @@
 #if defined(MBEDTLS_MEMORY_DEBUG)
         mbedtls_fprintf( stderr, "FATAL: prev == next\n" );
 #endif
-        return( 1 );
+        return 1 ;
     }
 
     if( hdr->prev_free != NULL && hdr->prev_free == hdr->next_free )
@@ -164,10 +164,10 @@
 #if defined(MBEDTLS_MEMORY_DEBUG)
         mbedtls_fprintf( stderr, "FATAL: prev_free == next_free\n" );
 #endif
-        return( 1 );
+        return 1 ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static int verify_chain( void )
@@ -180,7 +180,7 @@
         mbedtls_fprintf( stderr, "FATAL: verification of first header "
                                   "failed\n" );
 #endif
-        return( 1 );
+        return 1 ;
     }
 
     if( heap.first->prev != NULL )
@@ -189,7 +189,7 @@
         mbedtls_fprintf( stderr, "FATAL: verification failed: "
                                   "first->prev != NULL\n" );
 #endif
-        return( 1 );
+        return 1 ;
     }
 
     cur = heap.first->next;
@@ -202,7 +202,7 @@
             mbedtls_fprintf( stderr, "FATAL: verification of header "
                                       "failed\n" );
 #endif
-            return( 1 );
+            return 1 ;
         }
 
         if( cur->prev != prv )
@@ -211,14 +211,14 @@
             mbedtls_fprintf( stderr, "FATAL: verification failed: "
                                       "cur->prev != prv\n" );
 #endif
-            return( 1 );
+            return 1 ;
         }
 
         prv = cur;
         cur = cur->next;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static void *buffer_alloc_calloc( size_t n, size_t size )
@@ -233,14 +233,14 @@
 #endif
 
     if( heap.buf == NULL || heap.first == NULL )
-        return( NULL );
+        return NULL ;
 
     original_len = len = n * size;
 
     if( n == 0 || size == 0 || len / n != size )
-        return( NULL );
+        return NULL ;
     else if( len > (size_t)-MBEDTLS_MEMORY_ALIGN_MULTIPLE )
-        return( NULL );
+        return NULL ;
 
     if( len % MBEDTLS_MEMORY_ALIGN_MULTIPLE )
     {
@@ -259,7 +259,7 @@
     }
 
     if( cur == NULL )
-        return( NULL );
+        return NULL ;
 
     if( cur->alloc != 0 )
     {
@@ -311,7 +311,7 @@
         ret = (unsigned char *) cur + sizeof( memory_header );
         memset( ret, 0, original_len );
 
-        return( ret );
+        return ret ;
     }
 
     p = ( (unsigned char *) cur ) + sizeof(memory_header) + len;
@@ -369,7 +369,7 @@
     ret = (unsigned char *) cur + sizeof( memory_header );
     memset( ret, 0, original_len );
 
-    return( ret );
+    return ret ;
 }
 
 static void buffer_alloc_free( void *ptr )
@@ -546,11 +546,11 @@
 {
     void *buf;
     if( mbedtls_mutex_lock( &heap.mutex ) != 0 )
-        return( NULL );
+        return NULL ;
     buf = buffer_alloc_calloc( n, size );
     if( mbedtls_mutex_unlock( &heap.mutex ) )
-        return( NULL );
-    return( buf );
+        return NULL ;
+    return buf ;
 }
 
 static void buffer_alloc_free_mutexed( void *ptr )
@@ -611,12 +611,12 @@
 static int check_pointer( void *p )
 {
     if( p == NULL )
-        return( -1 );
+        return -1 ;
 
     if( (size_t) p % MBEDTLS_MEMORY_ALIGN_MULTIPLE != 0 )
-        return( -1 );
+        return -1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int check_all_free( void )
@@ -628,10 +628,10 @@
         heap.first != heap.first_free ||
         (void *) heap.first != (void *) heap.buf )
     {
-        return( -1 );
+        return -1 ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #define TEST_ASSERT( condition )            \
@@ -737,7 +737,7 @@
 cleanup:
     mbedtls_memory_buffer_alloc_free( );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SELF_TEST */
 
diff --git a/library/mps_reader.c b/library/mps_reader.c
index 9af5073..c8129c4 100644
--- a/library/mps_reader.c
+++ b/library/mps_reader.c
@@ -76,23 +76,23 @@
 {
     mbedtls_mps_size_t acc_remaining;
     if( rd->acc == NULL )
-        return( 0 );
+        return 0 ;
 
     acc_remaining = rd->acc_share.acc_remaining;
-    return( acc_remaining > 0 );
+    return acc_remaining > 0 ;
 }
 
 static inline int mps_reader_is_producing(
     mbedtls_mps_reader const *rd )
 {
     unsigned char *frag = rd->frag;
-    return( frag == NULL );
+    return frag == NULL ;
 }
 
 static inline int mps_reader_is_consuming(
     mbedtls_mps_reader const *rd )
 {
-    return( !mps_reader_is_producing( rd ) );
+    return !mps_reader_is_producing( rd ) ;
 }
 
 static inline mbedtls_mps_size_t mps_reader_get_fragment_offset(
@@ -102,10 +102,10 @@
     mbedtls_mps_size_t frag_offset;
 
     if( acc == NULL )
-        return( 0 );
+        return 0 ;
 
     frag_offset = rd->acc_share.frag_offset;
-    return( frag_offset );
+    return frag_offset ;
 }
 
 static inline mbedtls_mps_size_t mps_reader_serving_from_accumulator(
@@ -116,7 +116,7 @@
     frag_offset = mps_reader_get_fragment_offset( rd );
     end = rd->end;
 
-    return( end < frag_offset );
+    return end < frag_offset ;
 }
 
 static inline void mps_reader_zero( mbedtls_mps_reader *rd )
diff --git a/library/mps_trace.h b/library/mps_trace.h
index 7c23601..f6786d4 100644
--- a/library/mps_trace.h
+++ b/library/mps_trace.h
@@ -159,7 +159,7 @@
         /* Breaks tail recursion. */            \
         int ret__ = val;                        \
         MBEDTLS_MPS_TRACE_END( ret__ );         \
-        return( ret__ );                        \
+        return ret__ ;                        \
     } while( 0 )
 
 #else /* MBEDTLS_MPS_TRACE */
@@ -168,7 +168,7 @@
 #define MBEDTLS_MPS_TRACE_INIT( ... )  do { } while( 0 )
 #define MBEDTLS_MPS_TRACE_END          do { } while( 0 )
 
-#define MBEDTLS_MPS_TRACE_RETURN( val ) return( val );
+#define MBEDTLS_MPS_TRACE_RETURN( val ) return val ;
 
 #endif /* MBEDTLS_MPS_TRACE */
 
diff --git a/library/net_sockets.c b/library/net_sockets.c
index 17a9e4a..fc4024e 100644
--- a/library/net_sockets.c
+++ b/library/net_sockets.c
@@ -123,7 +123,7 @@
     if( wsa_init_done == 0 )
     {
         if( WSAStartup( MAKEWORD(2,0), &wsaData ) != 0 )
-            return( MBEDTLS_ERR_NET_SOCKET_FAILED );
+            return MBEDTLS_ERR_NET_SOCKET_FAILED ;
 
         wsa_init_done = 1;
     }
@@ -132,7 +132,7 @@
     signal( SIGPIPE, SIG_IGN );
 #endif
 #endif
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -143,7 +143,7 @@
 static int check_fd( int fd, int for_select )
 {
     if( fd < 0 )
-        return( MBEDTLS_ERR_NET_INVALID_CONTEXT );
+        return MBEDTLS_ERR_NET_INVALID_CONTEXT ;
 
 #if (defined(_WIN32) || defined(_WIN32_WCE)) && !defined(EFIX64) && \
     !defined(EFI32)
@@ -154,10 +154,10 @@
      * fd_set type. Error out early, because attempting to call FD_SET on a
      * large file descriptor is a buffer overflow on typical platforms. */
     if( for_select && fd >= FD_SETSIZE )
-        return( MBEDTLS_ERR_NET_POLL_FAILED );
+        return MBEDTLS_ERR_NET_POLL_FAILED ;
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -178,7 +178,7 @@
     struct addrinfo hints, *addr_list, *cur;
 
     if( ( ret = net_prepare() ) != 0 )
-        return( ret );
+        return ret ;
 
     /* Do name resolution with both IPv6 and IPv4 */
     memset( &hints, 0, sizeof( hints ) );
@@ -187,7 +187,7 @@
     hints.ai_protocol = proto == MBEDTLS_NET_PROTO_UDP ? IPPROTO_UDP : IPPROTO_TCP;
 
     if( getaddrinfo( host, port, &hints, &addr_list ) != 0 )
-        return( MBEDTLS_ERR_NET_UNKNOWN_HOST );
+        return MBEDTLS_ERR_NET_UNKNOWN_HOST ;
 
     /* Try the sockaddrs until a connection succeeds */
     ret = MBEDTLS_ERR_NET_UNKNOWN_HOST;
@@ -213,7 +213,7 @@
 
     freeaddrinfo( addr_list );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -225,7 +225,7 @@
     struct addrinfo hints, *addr_list, *cur;
 
     if( ( ret = net_prepare() ) != 0 )
-        return( ret );
+        return ret ;
 
     /* Bind to IPv6 and/or IPv4, but only in the desired protocol */
     memset( &hints, 0, sizeof( hints ) );
@@ -236,7 +236,7 @@
         hints.ai_flags = AI_PASSIVE;
 
     if( getaddrinfo( bind_ip, port, &hints, &addr_list ) != 0 )
-        return( MBEDTLS_ERR_NET_UNKNOWN_HOST );
+        return MBEDTLS_ERR_NET_UNKNOWN_HOST ;
 
     /* Try the sockaddrs until a binding succeeds */
     ret = MBEDTLS_ERR_NET_UNKNOWN_HOST;
@@ -284,7 +284,7 @@
 
     freeaddrinfo( addr_list );
 
-    return( ret );
+    return ret ;
 
 }
 
@@ -297,7 +297,7 @@
 static int net_would_block( const mbedtls_net_context *ctx )
 {
     ((void) ctx);
-    return( WSAGetLastError() == WSAEWOULDBLOCK );
+    return WSAGetLastError() == WSAEWOULDBLOCK ;
 }
 #else
 /*
@@ -316,7 +316,7 @@
     if( ( fcntl( ctx->fd, F_GETFL ) & O_NONBLOCK ) != O_NONBLOCK )
     {
         errno = err;
-        return( 0 );
+        return 0 ;
     }
 
     switch( errno = err )
@@ -327,9 +327,9 @@
 #if defined EWOULDBLOCK && EWOULDBLOCK != EAGAIN
         case EWOULDBLOCK:
 #endif
-            return( 1 );
+            return 1 ;
     }
-    return( 0 );
+    return 0 ;
 }
 #endif /* ( _WIN32 || _WIN32_WCE ) && !EFIX64 && !EFI32 */
 
@@ -360,7 +360,7 @@
                     (void *) &type, &type_len ) != 0 ||
         ( type != SOCK_STREAM && type != SOCK_DGRAM ) )
     {
-        return( MBEDTLS_ERR_NET_ACCEPT_FAILED );
+        return MBEDTLS_ERR_NET_ACCEPT_FAILED ;
     }
 
     if( type == SOCK_STREAM )
@@ -390,9 +390,9 @@
     if( ret < 0 )
     {
         if( net_would_block( bind_ctx ) != 0 )
-            return( MBEDTLS_ERR_SSL_WANT_READ );
+            return MBEDTLS_ERR_SSL_WANT_READ ;
 
-        return( MBEDTLS_ERR_NET_ACCEPT_FAILED );
+        return MBEDTLS_ERR_NET_ACCEPT_FAILED ;
     }
 
     /* UDP: hijack the listening socket to communicate with the client,
@@ -403,7 +403,7 @@
         int one = 1;
 
         if( connect( bind_ctx->fd, (struct sockaddr *) &client_addr, n ) != 0 )
-            return( MBEDTLS_ERR_NET_ACCEPT_FAILED );
+            return MBEDTLS_ERR_NET_ACCEPT_FAILED ;
 
         client_ctx->fd = bind_ctx->fd;
         bind_ctx->fd   = -1; /* In case we exit early */
@@ -416,12 +416,12 @@
             setsockopt( bind_ctx->fd, SOL_SOCKET, SO_REUSEADDR,
                         (const char *) &one, sizeof( one ) ) != 0 )
         {
-            return( MBEDTLS_ERR_NET_SOCKET_FAILED );
+            return MBEDTLS_ERR_NET_SOCKET_FAILED ;
         }
 
         if( bind( bind_ctx->fd, (struct sockaddr *) &local_addr, n ) != 0 )
         {
-            return( MBEDTLS_ERR_NET_BIND_FAILED );
+            return MBEDTLS_ERR_NET_BIND_FAILED ;
         }
     }
 
@@ -433,7 +433,7 @@
             *ip_len = sizeof( addr4->sin_addr.s_addr );
 
             if( buf_size < *ip_len )
-                return( MBEDTLS_ERR_NET_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_NET_BUFFER_TOO_SMALL ;
 
             memcpy( client_ip, &addr4->sin_addr.s_addr, *ip_len );
         }
@@ -443,13 +443,13 @@
             *ip_len = sizeof( addr6->sin6_addr.s6_addr );
 
             if( buf_size < *ip_len )
-                return( MBEDTLS_ERR_NET_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_NET_BUFFER_TOO_SMALL ;
 
             memcpy( client_ip, &addr6->sin6_addr.s6_addr, *ip_len);
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -460,9 +460,9 @@
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
     u_long n = 0;
-    return( ioctlsocket( ctx->fd, FIONBIO, &n ) );
+    return ioctlsocket( ctx->fd, FIONBIO, &n ) ;
 #else
-    return( fcntl( ctx->fd, F_SETFL, fcntl( ctx->fd, F_GETFL ) & ~O_NONBLOCK ) );
+    return fcntl( ctx->fd, F_SETFL, fcntl( ctx->fd, F_GETFL ) & ~O_NONBLOCK ) ;
 #endif
 }
 
@@ -471,9 +471,9 @@
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
     u_long n = 1;
-    return( ioctlsocket( ctx->fd, FIONBIO, &n ) );
+    return ioctlsocket( ctx->fd, FIONBIO, &n ) ;
 #else
-    return( fcntl( ctx->fd, F_SETFL, fcntl( ctx->fd, F_GETFL ) | O_NONBLOCK ) );
+    return fcntl( ctx->fd, F_SETFL, fcntl( ctx->fd, F_GETFL ) | O_NONBLOCK ) ;
 #endif
 }
 
@@ -493,7 +493,7 @@
 
     ret = check_fd( fd, 1 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(__has_feature)
 #if __has_feature(memory_sanitizer)
@@ -520,7 +520,7 @@
     }
 
     if( rw != 0 )
-        return( MBEDTLS_ERR_NET_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_NET_BAD_INPUT_DATA ;
 
     tv.tv_sec  = timeout / 1000;
     tv.tv_usec = ( timeout % 1000 ) * 1000;
@@ -533,7 +533,7 @@
     while( IS_EINTR( ret ) );
 
     if( ret < 0 )
-        return( MBEDTLS_ERR_NET_POLL_FAILED );
+        return MBEDTLS_ERR_NET_POLL_FAILED ;
 
     ret = 0;
     if( FD_ISSET( fd, &read_fds ) )
@@ -541,7 +541,7 @@
     if( FD_ISSET( fd, &write_fds ) )
         ret |= MBEDTLS_NET_POLL_WRITE;
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -574,31 +574,31 @@
 
     ret = check_fd( fd, 0 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = (int) read( fd, buf, len );
 
     if( ret < 0 )
     {
         if( net_would_block( ctx ) != 0 )
-            return( MBEDTLS_ERR_SSL_WANT_READ );
+            return MBEDTLS_ERR_SSL_WANT_READ ;
 
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
         if( WSAGetLastError() == WSAECONNRESET )
-            return( MBEDTLS_ERR_NET_CONN_RESET );
+            return MBEDTLS_ERR_NET_CONN_RESET ;
 #else
         if( errno == EPIPE || errno == ECONNRESET )
-            return( MBEDTLS_ERR_NET_CONN_RESET );
+            return MBEDTLS_ERR_NET_CONN_RESET ;
 
         if( errno == EINTR )
-            return( MBEDTLS_ERR_SSL_WANT_READ );
+            return MBEDTLS_ERR_SSL_WANT_READ ;
 #endif
 
-        return( MBEDTLS_ERR_NET_RECV_FAILED );
+        return MBEDTLS_ERR_NET_RECV_FAILED ;
     }
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -614,7 +614,7 @@
 
     ret = check_fd( fd, 1 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     FD_ZERO( &read_fds );
     FD_SET( fd, &read_fds );
@@ -626,24 +626,24 @@
 
     /* Zero fds ready means we timed out */
     if( ret == 0 )
-        return( MBEDTLS_ERR_SSL_TIMEOUT );
+        return MBEDTLS_ERR_SSL_TIMEOUT ;
 
     if( ret < 0 )
     {
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
         if( WSAGetLastError() == WSAEINTR )
-            return( MBEDTLS_ERR_SSL_WANT_READ );
+            return MBEDTLS_ERR_SSL_WANT_READ ;
 #else
         if( errno == EINTR )
-            return( MBEDTLS_ERR_SSL_WANT_READ );
+            return MBEDTLS_ERR_SSL_WANT_READ ;
 #endif
 
-        return( MBEDTLS_ERR_NET_RECV_FAILED );
+        return MBEDTLS_ERR_NET_RECV_FAILED ;
     }
 
     /* This call will not block */
-    return( mbedtls_net_recv( ctx, buf, len ) );
+    return mbedtls_net_recv( ctx, buf, len ) ;
 }
 
 /*
@@ -656,31 +656,31 @@
 
     ret = check_fd( fd, 0 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = (int) write( fd, buf, len );
 
     if( ret < 0 )
     {
         if( net_would_block( ctx ) != 0 )
-            return( MBEDTLS_ERR_SSL_WANT_WRITE );
+            return MBEDTLS_ERR_SSL_WANT_WRITE ;
 
 #if ( defined(_WIN32) || defined(_WIN32_WCE) ) && !defined(EFIX64) && \
     !defined(EFI32)
         if( WSAGetLastError() == WSAECONNRESET )
-            return( MBEDTLS_ERR_NET_CONN_RESET );
+            return MBEDTLS_ERR_NET_CONN_RESET ;
 #else
         if( errno == EPIPE || errno == ECONNRESET )
-            return( MBEDTLS_ERR_NET_CONN_RESET );
+            return MBEDTLS_ERR_NET_CONN_RESET ;
 
         if( errno == EINTR )
-            return( MBEDTLS_ERR_SSL_WANT_WRITE );
+            return MBEDTLS_ERR_SSL_WANT_WRITE ;
 #endif
 
-        return( MBEDTLS_ERR_NET_SEND_FAILED );
+        return MBEDTLS_ERR_NET_SEND_FAILED ;
     }
 
-    return( ret );
+    return ret ;
 }
 
 /*
diff --git a/library/nist_kw.c b/library/nist_kw.c
index 5054ca2..33b98d0 100644
--- a/library/nist_kw.c
+++ b/library/nist_kw.c
@@ -69,7 +69,7 @@
         diff |= x ^ y;
     }
 
-    return( diff );
+    return diff ;
 }
 
 /*! The 64-bit default integrity check value (ICV) for KW mode. */
@@ -118,10 +118,10 @@
                                                    keybits,
                                                    MBEDTLS_MODE_ECB );
     if( cipher_info == NULL )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     if( cipher_info->block_size != 16 )
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
 
     /*
      * SP 800-38F currently defines AES cipher as the only block cipher allowed:
@@ -133,22 +133,22 @@
      *  such as Camellia and Aria.
      */
     if( cipher != MBEDTLS_CIPHER_ID_AES )
-        return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ;
 
     mbedtls_cipher_free( &ctx->cipher_ctx );
 
     if( ( ret = mbedtls_cipher_setup( &ctx->cipher_ctx, cipher_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_cipher_setkey( &ctx->cipher_ctx, key, keybits,
                                        is_wrap ? MBEDTLS_ENCRYPT :
                                                  MBEDTLS_DECRYPT )
                                                                    ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -198,7 +198,7 @@
     {
         if( out_size < in_len + KW_SEMIBLOCK_LENGTH )
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         /*
@@ -211,7 +211,7 @@
 #endif
             in_len % KW_SEMIBLOCK_LENGTH != 0 )
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         memcpy( output, NIST_KW_ICV1, KW_SEMIBLOCK_LENGTH );
@@ -226,7 +226,7 @@
 
         if( out_size < in_len + KW_SEMIBLOCK_LENGTH + padlen )
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         /*
@@ -239,7 +239,7 @@
 #endif
           )
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         memcpy( output, NIST_KW_ICV2, KW_SEMIBLOCK_LENGTH / 2 );
@@ -308,7 +308,7 @@
     mbedtls_platform_zeroize( inbuff, KW_SEMIBLOCK_LENGTH * 2 );
     mbedtls_platform_zeroize( outbuff, KW_SEMIBLOCK_LENGTH * 2 );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -335,7 +335,7 @@
 
     if( semiblocks < MIN_SEMIBLOCKS_COUNT )
     {
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
     memcpy( A, input, KW_SEMIBLOCK_LENGTH );
@@ -374,7 +374,7 @@
     mbedtls_platform_zeroize( inbuff, sizeof( inbuff )  );
     mbedtls_platform_zeroize( outbuff, sizeof( outbuff ) );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -394,7 +394,7 @@
     *out_len = 0;
     if( out_size < in_len - KW_SEMIBLOCK_LENGTH )
     {
-        return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
     }
 
     if( mode == MBEDTLS_KW_MODE_KW )
@@ -409,7 +409,7 @@
 #endif
             in_len % KW_SEMIBLOCK_LENGTH != 0 )
         {
-            return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         ret = unwrap( ctx, input, in_len / KW_SEMIBLOCK_LENGTH,
@@ -441,7 +441,7 @@
 #endif
             in_len % KW_SEMIBLOCK_LENGTH != 0 )
         {
-            return(  MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA ;
         }
 
         if( in_len == KW_SEMIBLOCK_LENGTH * 2 )
@@ -526,7 +526,7 @@
     mbedtls_platform_zeroize( &diff, sizeof( diff ) );
     mbedtls_platform_zeroize( A, sizeof( A ) );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* !MBEDTLS_NIST_KW_ALT */
@@ -744,7 +744,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
diff --git a/library/oid.c b/library/oid.c
index f70ceea..3a58a3f 100644
--- a/library/oid.c
+++ b/library/oid.c
@@ -63,16 +63,16 @@
         const TYPE_T *p = (LIST);                                       \
         const mbedtls_oid_descriptor_t *cur =                           \
             (const mbedtls_oid_descriptor_t *) p;                       \
-        if( p == NULL || oid == NULL ) return( NULL );                  \
+        if( p == NULL || oid == NULL ) return NULL ;                  \
         while( cur->asn1 != NULL ) {                                    \
             if( cur->asn1_len == oid->len &&                            \
                 memcmp( cur->asn1, oid->p, oid->len ) == 0 ) {          \
-                return( p );                                            \
+                return p ;                                            \
             }                                                           \
             p++;                                                        \
             cur = (const mbedtls_oid_descriptor_t *) p;                 \
         }                                                               \
-        return( NULL );                                                 \
+        return NULL ;                                                 \
     }
 
 #if !defined(MBEDTLS_X509_REMOVE_INFO)
@@ -84,9 +84,9 @@
 int FN_NAME( const mbedtls_asn1_buf *oid, ATTR1_TYPE * ATTR1 )                  \
 {                                                                       \
     const TYPE_T *data = oid_ ## TYPE_NAME ## _from_asn1( oid );        \
-    if( data == NULL ) return( MBEDTLS_ERR_OID_NOT_FOUND );            \
+    if( data == NULL ) return MBEDTLS_ERR_OID_NOT_FOUND ;            \
     *ATTR1 = data->descriptor.ATTR1;                                    \
-    return( 0 );                                                        \
+    return 0 ;                                                        \
 }
 #endif /* MBEDTLS_X509_REMOVE_INFO */
 
@@ -98,9 +98,9 @@
 int FN_NAME( const mbedtls_asn1_buf *oid, ATTR1_TYPE * ATTR1 )                  \
 {                                                                       \
     const TYPE_T *data = oid_ ## TYPE_NAME ## _from_asn1( oid );        \
-    if( data == NULL ) return( MBEDTLS_ERR_OID_NOT_FOUND );            \
+    if( data == NULL ) return MBEDTLS_ERR_OID_NOT_FOUND ;            \
     *ATTR1 = data->ATTR1;                                               \
-    return( 0 );                                                        \
+    return 0 ;                                                        \
 }
 
 /*
@@ -113,10 +113,10 @@
                                           ATTR2_TYPE * ATTR2 )              \
 {                                                                           \
     const TYPE_T *data = oid_ ## TYPE_NAME ## _from_asn1( oid );            \
-    if( data == NULL ) return( MBEDTLS_ERR_OID_NOT_FOUND );                 \
+    if( data == NULL ) return MBEDTLS_ERR_OID_NOT_FOUND ;                 \
     *(ATTR1) = data->ATTR1;                                                 \
     *(ATTR2) = data->ATTR2;                                                 \
-    return( 0 );                                                            \
+    return 0 ;                                                            \
 }
 
 /*
@@ -131,11 +131,11 @@
         if( cur->ATTR1 == (ATTR1) ) {                                       \
             *oid = cur->descriptor.asn1;                                    \
             *olen = cur->descriptor.asn1_len;                               \
-            return( 0 );                                                    \
+            return 0 ;                                                    \
         }                                                                   \
         cur++;                                                              \
     }                                                                       \
-    return( MBEDTLS_ERR_OID_NOT_FOUND );                                    \
+    return MBEDTLS_ERR_OID_NOT_FOUND ;                                    \
 }
 
 /*
@@ -152,11 +152,11 @@
         if( cur->ATTR1 == (ATTR1) && cur->ATTR2 == (ATTR2) ) {              \
             *oid = cur->descriptor.asn1;                                    \
             *olen = cur->descriptor.asn1_len;                               \
-            return( 0 );                                                    \
+            return 0 ;                                                    \
         }                                                                   \
         cur++;                                                              \
     }                                                                       \
-    return( MBEDTLS_ERR_OID_NOT_FOUND );                                   \
+    return MBEDTLS_ERR_OID_NOT_FOUND ;                                   \
 }
 
 /*
@@ -732,7 +732,7 @@
 #define OID_SAFE_SNPRINTF                               \
     do {                                                \
         if( ret < 0 || (size_t) ret >= n )              \
-            return( MBEDTLS_ERR_OID_BUF_TOO_SMALL );    \
+            return MBEDTLS_ERR_OID_BUF_TOO_SMALL ;    \
                                                         \
         n -= (size_t) ret;                              \
         p += (size_t) ret;                              \
@@ -762,7 +762,7 @@
     {
         /* Prevent overflow in value. */
         if( ( ( value << 7 ) >> 7 ) != value )
-            return( MBEDTLS_ERR_OID_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_OID_BUF_TOO_SMALL ;
 
         value <<= 7;
         value += oid->p[i] & 0x7F;
diff --git a/library/padlock.c b/library/padlock.c
index b8ba105..a034238 100644
--- a/library/padlock.c
+++ b/library/padlock.c
@@ -65,7 +65,7 @@
         flags = edx;
     }
 
-    return( flags & feature );
+    return flags & feature ;
 }
 
 /*
@@ -105,7 +105,7 @@
 
     memcpy( output, blk, 16 );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -127,7 +127,7 @@
 
     if( ( (long) input  & 15 ) != 0 ||
         ( (long) output & 15 ) != 0 )
-        return( MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED );
+        return MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED ;
 
     rk = ctx->rk;
     iw = MBEDTLS_PADLOCK_ALIGN16( buf );
@@ -156,7 +156,7 @@
 
     memcpy( iv, iw, 16 );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_HAVE_X86 */
diff --git a/library/pem.c b/library/pem.c
index 1b40e5e..f637166 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -63,14 +63,14 @@
         if( *s >= '0' && *s <= '9' ) j = *s - '0'; else
         if( *s >= 'A' && *s <= 'F' ) j = *s - '7'; else
         if( *s >= 'a' && *s <= 'f' ) j = *s - 'W'; else
-            return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
+            return MBEDTLS_ERR_PEM_INVALID_ENC_IV ;
 
         k = ( ( i & 1 ) != 0 ) ? j : j << 4;
 
         iv[i >> 1] = (unsigned char)( iv[i >> 1] | k );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static int pem_pbkdf1( unsigned char *key, size_t keylen,
@@ -128,7 +128,7 @@
     mbedtls_md5_free( &md5_ctx );
     mbedtls_platform_zeroize( md5sum, 16 );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_DES_C)
@@ -157,7 +157,7 @@
     mbedtls_des_free( &des_ctx );
     mbedtls_platform_zeroize( des_key, 8 );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -185,7 +185,7 @@
     mbedtls_des3_free( &des3_ctx );
     mbedtls_platform_zeroize( des3_key, 24 );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_DES_C */
 
@@ -215,7 +215,7 @@
     mbedtls_aes_free( &aes_ctx );
     mbedtls_platform_zeroize( aes_key, keylen );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_AES_C */
 
@@ -241,23 +241,23 @@
           ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
 
     if( ctx == NULL )
-        return( MBEDTLS_ERR_PEM_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PEM_BAD_INPUT_DATA ;
 
     s1 = (unsigned char *) strstr( (const char *) data, header );
 
     if( s1 == NULL )
-        return( MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT );
+        return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ;
 
     s2 = (unsigned char *) strstr( (const char *) data, footer );
 
     if( s2 == NULL || s2 <= s1 )
-        return( MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT );
+        return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ;
 
     s1 += strlen( header );
     if( *s1 == ' '  ) s1++;
     if( *s1 == '\r' ) s1++;
     if( *s1 == '\n' ) s1++;
-    else return( MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT );
+    else return MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ;
 
     end = s2;
     end += strlen( footer );
@@ -277,7 +277,7 @@
         s1 += 22;
         if( *s1 == '\r' ) s1++;
         if( *s1 == '\n' ) s1++;
-        else return( MBEDTLS_ERR_PEM_INVALID_DATA );
+        else return MBEDTLS_ERR_PEM_INVALID_DATA ;
 
 
 #if defined(MBEDTLS_DES_C)
@@ -287,7 +287,7 @@
 
             s1 += 23;
             if( s2 - s1 < 16 || pem_get_iv( s1, pem_iv, 8 ) != 0 )
-                return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
+                return MBEDTLS_ERR_PEM_INVALID_ENC_IV ;
 
             s1 += 16;
         }
@@ -297,7 +297,7 @@
 
             s1 += 18;
             if( s2 - s1 < 16 || pem_get_iv( s1, pem_iv, 8) != 0 )
-                return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
+                return MBEDTLS_ERR_PEM_INVALID_ENC_IV ;
 
             s1 += 16;
         }
@@ -307,7 +307,7 @@
         if( s2 - s1 >= 14 && memcmp( s1, "DEK-Info: AES-", 14 ) == 0 )
         {
             if( s2 - s1 < 22 )
-                return( MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG );
+                return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG ;
             else if( memcmp( s1, "DEK-Info: AES-128-CBC,", 22 ) == 0 )
                 enc_alg = MBEDTLS_CIPHER_AES_128_CBC;
             else if( memcmp( s1, "DEK-Info: AES-192-CBC,", 22 ) == 0 )
@@ -315,44 +315,44 @@
             else if( memcmp( s1, "DEK-Info: AES-256-CBC,", 22 ) == 0 )
                 enc_alg = MBEDTLS_CIPHER_AES_256_CBC;
             else
-                return( MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG );
+                return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG ;
 
             s1 += 22;
             if( s2 - s1 < 32 || pem_get_iv( s1, pem_iv, 16 ) != 0 )
-                return( MBEDTLS_ERR_PEM_INVALID_ENC_IV );
+                return MBEDTLS_ERR_PEM_INVALID_ENC_IV ;
 
             s1 += 32;
         }
 #endif /* MBEDTLS_AES_C */
 
         if( enc_alg == MBEDTLS_CIPHER_NONE )
-            return( MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG );
+            return MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG ;
 
         if( *s1 == '\r' ) s1++;
         if( *s1 == '\n' ) s1++;
-        else return( MBEDTLS_ERR_PEM_INVALID_DATA );
+        else return MBEDTLS_ERR_PEM_INVALID_DATA ;
 #else
-        return( MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
           ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
     }
 
     if( s1 >= s2 )
-        return( MBEDTLS_ERR_PEM_INVALID_DATA );
+        return MBEDTLS_ERR_PEM_INVALID_DATA ;
 
     ret = mbedtls_base64_decode( NULL, 0, &len, s1, s2 - s1 );
 
     if( ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PEM_INVALID_DATA, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PEM_INVALID_DATA, ret ) ;
 
     if( ( buf = mbedtls_calloc( 1, len ) ) == NULL )
-        return( MBEDTLS_ERR_PEM_ALLOC_FAILED );
+        return MBEDTLS_ERR_PEM_ALLOC_FAILED ;
 
     if( ( ret = mbedtls_base64_decode( buf, len, &len, s1, s2 - s1 ) ) != 0 )
     {
         mbedtls_platform_zeroize( buf, len );
         mbedtls_free( buf );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PEM_INVALID_DATA, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PEM_INVALID_DATA, ret ) ;
     }
 
     if( enc != 0 )
@@ -363,7 +363,7 @@
         {
             mbedtls_platform_zeroize( buf, len );
             mbedtls_free( buf );
-            return( MBEDTLS_ERR_PEM_PASSWORD_REQUIRED );
+            return MBEDTLS_ERR_PEM_PASSWORD_REQUIRED ;
         }
 
         ret = 0;
@@ -387,7 +387,7 @@
         if( ret != 0 )
         {
             mbedtls_free( buf );
-            return( ret );
+            return ret ;
         }
 
         /*
@@ -400,12 +400,12 @@
         {
             mbedtls_platform_zeroize( buf, len );
             mbedtls_free( buf );
-            return( MBEDTLS_ERR_PEM_PASSWORD_MISMATCH );
+            return MBEDTLS_ERR_PEM_PASSWORD_MISMATCH ;
         }
 #else
         mbedtls_platform_zeroize( buf, len );
         mbedtls_free( buf );
-        return( MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_MD5_C && MBEDTLS_CIPHER_MODE_CBC &&
           ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
     }
@@ -413,7 +413,7 @@
     ctx->buf = buf;
     ctx->buflen = len;
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_pem_free( mbedtls_pem_context *ctx )
@@ -444,18 +444,18 @@
     if( use_len + add_len > buf_len )
     {
         *olen = use_len + add_len;
-        return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL ;
     }
 
     if( use_len != 0 &&
         ( ( encode_buf = mbedtls_calloc( 1, use_len ) ) == NULL ) )
-        return( MBEDTLS_ERR_PEM_ALLOC_FAILED );
+        return MBEDTLS_ERR_PEM_ALLOC_FAILED ;
 
     if( ( ret = mbedtls_base64_encode( encode_buf, use_len, &use_len, der_data,
                                der_len ) ) != 0 )
     {
         mbedtls_free( encode_buf );
-        return( ret );
+        return ret ;
     }
 
     memcpy( p, header, strlen( header ) );
@@ -482,7 +482,7 @@
     memset( buf + *olen, 0, buf_len - *olen );
 
     mbedtls_free( encode_buf );
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PEM_WRITE_C */
 #endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */
diff --git a/library/pk.c b/library/pk.c
index ea4869c..752357f 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -111,21 +111,21 @@
     switch( pk_type ) {
 #if defined(MBEDTLS_RSA_C)
         case MBEDTLS_PK_RSA:
-            return( &mbedtls_rsa_info );
+            return &mbedtls_rsa_info ;
 #endif
 #if defined(MBEDTLS_ECP_C)
         case MBEDTLS_PK_ECKEY:
-            return( &mbedtls_eckey_info );
+            return &mbedtls_eckey_info ;
         case MBEDTLS_PK_ECKEY_DH:
-            return( &mbedtls_eckeydh_info );
+            return &mbedtls_eckeydh_info ;
 #endif
 #if defined(MBEDTLS_ECDSA_C)
         case MBEDTLS_PK_ECDSA:
-            return( &mbedtls_ecdsa_info );
+            return &mbedtls_ecdsa_info ;
 #endif
         /* MBEDTLS_PK_RSA_ALT omitted on purpose */
         default:
-            return( NULL );
+            return NULL ;
     }
 }
 
@@ -136,14 +136,14 @@
 {
     PK_VALIDATE_RET( ctx != NULL );
     if( info == NULL || ctx->pk_info != NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( ( ctx->pk_ctx = info->ctx_alloc_func() ) == NULL )
-        return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+        return MBEDTLS_ERR_PK_ALLOC_FAILED ;
 
     ctx->pk_info = info;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -159,10 +159,10 @@
     psa_key_type_t type;
 
     if( ctx == NULL || ctx->pk_info != NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( PSA_SUCCESS != psa_get_key_attributes( key, &attributes ) )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
     type = psa_get_key_type( &attributes );
     psa_reset_key_attributes( &attributes );
 
@@ -171,14 +171,14 @@
         return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE) ;
 
     if( ( ctx->pk_ctx = info->ctx_alloc_func() ) == NULL )
-        return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+        return MBEDTLS_ERR_PK_ALLOC_FAILED ;
 
     ctx->pk_info = info;
 
     pk_ctx = (psa_key_id_t *) ctx->pk_ctx;
     *pk_ctx = key;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -196,10 +196,10 @@
 
     PK_VALIDATE_RET( ctx != NULL );
     if( ctx->pk_info != NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( ( ctx->pk_ctx = info->ctx_alloc_func() ) == NULL )
-        return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+        return MBEDTLS_ERR_PK_ALLOC_FAILED ;
 
     ctx->pk_info = info;
 
@@ -210,7 +210,7 @@
     rsa_alt->sign_func = sign_func;
     rsa_alt->key_len_func = key_len_func;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */
 
@@ -223,9 +223,9 @@
      * For backward compatibility, also accept NULL instead of a context
      * pointer. */
     if( ctx == NULL || ctx->pk_info == NULL )
-        return( 0 );
+        return 0 ;
 
-    return( ctx->pk_info->can_do( type ) );
+    return ctx->pk_info->can_do( type ) ;
 }
 
 /*
@@ -236,13 +236,13 @@
     const mbedtls_md_info_t *md_info;
 
     if( *hash_len != 0 )
-        return( 0 );
+        return 0 ;
 
     if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL )
-        return( -1 );
+        return -1 ;
 
     *hash_len = mbedtls_md_get_size( md_info );
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
@@ -254,18 +254,18 @@
 {
     /* Don't do anything if already set up or invalid */
     if( ctx == NULL || ctx->pk_info != NULL )
-        return( 0 );
+        return 0 ;
 
     /* Should never happen when we're called */
     if( info->rs_alloc_func == NULL || info->rs_free_func == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( ( ctx->rs_ctx = info->rs_alloc_func() ) == NULL )
-        return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+        return MBEDTLS_ERR_PK_ALLOC_FAILED ;
 
     ctx->pk_info = info;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
 
@@ -285,7 +285,7 @@
 
     if( ctx->pk_info == NULL ||
         pk_hashlen_helper( md_alg, &hash_len ) != 0 )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
     /* optimization: use non-restartable version if restart disabled */
@@ -296,7 +296,7 @@
         int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
         if( ( ret = pk_restart_setup( rs_ctx, ctx->pk_info ) ) != 0 )
-            return( ret );
+            return ret ;
 
         ret = ctx->pk_info->verify_rs_func( ctx->pk_ctx,
                    md_alg, hash, hash_len, sig, sig_len, rs_ctx->rs_ctx );
@@ -304,14 +304,14 @@
         if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
             mbedtls_pk_restart_free( rs_ctx );
 
-        return( ret );
+        return ret ;
     }
 #else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
     (void) rs_ctx;
 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
 
     if( ctx->pk_info->verify_func == NULL )
-        return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 
     return( ctx->pk_info->verify_func( ctx->pk_ctx, md_alg, hash, hash_len,
                                        sig, sig_len ) );
@@ -342,10 +342,10 @@
     PK_VALIDATE_RET( sig != NULL );
 
     if( ctx->pk_info == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( ! mbedtls_pk_can_do( ctx, type ) )
-        return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 
     if( type == MBEDTLS_PK_RSASSA_PSS )
     {
@@ -355,16 +355,16 @@
 
 #if SIZE_MAX > UINT_MAX
         if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len )
-            return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 #endif /* SIZE_MAX > UINT_MAX */
 
         if( options == NULL )
-            return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
         pss_opts = (const mbedtls_pk_rsassa_pss_options *) options;
 
         if( sig_len < mbedtls_pk_get_len( ctx ) )
-            return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
+            return MBEDTLS_ERR_RSA_VERIFY_FAILED ;
 
         ret = mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_pk_rsa( *ctx ),
                                                  md_alg, (unsigned int) hash_len, hash,
@@ -372,22 +372,22 @@
                                                  pss_opts->expected_salt_len,
                                                  sig );
         if( ret != 0 )
-            return( ret );
+            return ret ;
 
         if( sig_len > mbedtls_pk_get_len( ctx ) )
-            return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
+            return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH ;
 
-        return( 0 );
+        return 0 ;
 #else
-        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_RSA_C && MBEDTLS_PKCS1_V21 */
     }
 
     /* General case: no options */
     if( options != NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
-    return( mbedtls_pk_verify( ctx, md_alg, hash, hash_len, sig, sig_len ) );
+    return mbedtls_pk_verify( ctx, md_alg, hash, hash_len, sig, sig_len ) ;
 }
 
 /*
@@ -407,7 +407,7 @@
 
     if( ctx->pk_info == NULL ||
         pk_hashlen_helper( md_alg, &hash_len ) != 0 )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
     /* optimization: use non-restartable version if restart disabled */
@@ -418,7 +418,7 @@
         int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
         if( ( ret = pk_restart_setup( rs_ctx, ctx->pk_info ) ) != 0 )
-            return( ret );
+            return ret ;
 
         ret = ctx->pk_info->sign_rs_func( ctx->pk_ctx, md_alg,
                                           hash, hash_len,
@@ -428,14 +428,14 @@
         if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
             mbedtls_pk_restart_free( rs_ctx );
 
-        return( ret );
+        return ret ;
     }
 #else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
     (void) rs_ctx;
 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
 
     if( ctx->pk_info->sign_func == NULL )
-        return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 
     return( ctx->pk_info->sign_func( ctx->pk_ctx, md_alg,
                                      hash, hash_len,
@@ -470,10 +470,10 @@
     PK_VALIDATE_RET( olen != NULL );
 
     if( ctx->pk_info == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( ctx->pk_info->decrypt_func == NULL )
-        return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 
     return( ctx->pk_info->decrypt_func( ctx->pk_ctx, input, ilen,
                 output, olen, osize, f_rng, p_rng ) );
@@ -493,10 +493,10 @@
     PK_VALIDATE_RET( olen != NULL );
 
     if( ctx->pk_info == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( ctx->pk_info->encrypt_func == NULL )
-        return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 
     return( ctx->pk_info->encrypt_func( ctx->pk_ctx, input, ilen,
                 output, olen, osize, f_rng, p_rng ) );
@@ -516,27 +516,27 @@
     if( pub->pk_info == NULL ||
         prv->pk_info == NULL )
     {
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
     }
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( prv->pk_info->check_pair_func == NULL )
-        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 
     if( prv->pk_info->type == MBEDTLS_PK_RSA_ALT )
     {
         if( pub->pk_info->type != MBEDTLS_PK_RSA )
-            return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+            return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
     }
     else
     {
         if( pub->pk_info != prv->pk_info )
-            return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+            return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
     }
 
-    return( prv->pk_info->check_pair_func( pub->pk_ctx, prv->pk_ctx, f_rng, p_rng ) );
+    return prv->pk_info->check_pair_func( pub->pk_ctx, prv->pk_ctx, f_rng, p_rng ) ;
 }
 
 /*
@@ -547,9 +547,9 @@
     /* For backward compatibility, accept NULL or a context that
      * isn't set up yet, and return a fake value that should be safe. */
     if( ctx == NULL || ctx->pk_info == NULL )
-        return( 0 );
+        return 0 ;
 
-    return( ctx->pk_info->get_bitlen( ctx->pk_ctx ) );
+    return ctx->pk_info->get_bitlen( ctx->pk_ctx ) ;
 }
 
 /*
@@ -559,13 +559,13 @@
 {
     PK_VALIDATE_RET( ctx != NULL );
     if( ctx->pk_info == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     if( ctx->pk_info->debug_func == NULL )
-        return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 
     ctx->pk_info->debug_func( ctx->pk_ctx, items );
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -574,9 +574,9 @@
 const char *mbedtls_pk_get_name( const mbedtls_pk_context *ctx )
 {
     if( ctx == NULL || ctx->pk_info == NULL )
-        return( "invalid PK" );
+        return "invalid PK" ;
 
-    return( ctx->pk_info->name );
+    return ctx->pk_info->name ;
 }
 
 /*
@@ -585,9 +585,9 @@
 mbedtls_pk_type_t mbedtls_pk_get_type( const mbedtls_pk_context *ctx )
 {
     if( ctx == NULL || ctx->pk_info == NULL )
-        return( MBEDTLS_PK_NONE );
+        return MBEDTLS_PK_NONE ;
 
-    return( ctx->pk_info->type );
+    return ctx->pk_info->type ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -605,7 +605,7 @@
     ((void) pk);
     ((void) key);
     ((void) hash_alg);
-    return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+    return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 #else
     const mbedtls_ecp_keypair *ec;
     unsigned char d[MBEDTLS_ECP_MAX_BYTES];
@@ -618,12 +618,12 @@
 
     /* export the private key material in the format PSA wants */
     if( mbedtls_pk_get_type( pk ) != MBEDTLS_PK_ECKEY )
-        return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_PK_TYPE_MISMATCH ;
 
     ec = mbedtls_pk_ec( *pk );
     d_len = ( ec->grp.nbits + 7 ) / 8;
     if( ( ret = mbedtls_mpi_write_binary( &ec->d, d, d_len ) ) != 0 )
-        return( ret );
+        return ret ;
 
     curve_id = mbedtls_ecc_group_to_psa( ec->grp.id, &bits );
     key_type = PSA_KEY_TYPE_ECC_KEY_PAIR( curve_id );
@@ -636,13 +636,13 @@
 
     /* import private key into PSA */
     if( PSA_SUCCESS != psa_import_key( &attributes, d, d_len, key ) )
-        return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+        return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
     /* make PK context wrap the key slot */
     mbedtls_pk_free( pk );
     mbedtls_pk_init( pk );
 
-    return( mbedtls_pk_setup_opaque( pk, *key ) );
+    return mbedtls_pk_setup_opaque( pk, *key ) ;
 #endif /* MBEDTLS_ECP_C */
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
diff --git a/library/pk_wrap.c b/library/pk_wrap.c
index 80c0aad..2b2b758 100644
--- a/library/pk_wrap.c
+++ b/library/pk_wrap.c
@@ -71,7 +71,7 @@
 static size_t rsa_get_bitlen( const void *ctx )
 {
     const mbedtls_rsa_context * rsa = (const mbedtls_rsa_context *) ctx;
-    return( 8 * mbedtls_rsa_get_len( rsa ) );
+    return 8 * mbedtls_rsa_get_len( rsa ) ;
 }
 
 static int rsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
@@ -84,16 +84,16 @@
 
 #if SIZE_MAX > UINT_MAX
     if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 #endif /* SIZE_MAX > UINT_MAX */
 
     if( sig_len < rsa_len )
-        return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
+        return MBEDTLS_ERR_RSA_VERIFY_FAILED ;
 
     if( ( ret = mbedtls_rsa_pkcs1_verify( rsa, md_alg,
                                           (unsigned int) hash_len,
                                           hash, sig ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* The buffer contains a valid signature followed by extra data.
      * We have a special error code for that so that so that callers can
@@ -101,9 +101,9 @@
      * valid signature?" and not just "Does the buffer contain a valid
      * signature?". */
     if( sig_len > rsa_len )
-        return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
+        return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
@@ -115,12 +115,12 @@
 
 #if SIZE_MAX > UINT_MAX
     if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 #endif /* SIZE_MAX > UINT_MAX */
 
     *sig_len = mbedtls_rsa_get_len( rsa );
     if( sig_size < *sig_len )
-        return( MBEDTLS_ERR_PK_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL ;
 
     return( mbedtls_rsa_pkcs1_sign( rsa, f_rng, p_rng,
                                     md_alg, (unsigned int) hash_len,
@@ -135,7 +135,7 @@
     mbedtls_rsa_context * rsa = (mbedtls_rsa_context *) ctx;
 
     if( ilen != mbedtls_rsa_get_len( rsa ) )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     return( mbedtls_rsa_pkcs1_decrypt( rsa, f_rng, p_rng,
                 olen, input, output, osize ) );
@@ -150,7 +150,7 @@
     *olen = mbedtls_rsa_get_len( rsa );
 
     if( *olen > osize )
-        return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
+        return MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE ;
 
     return( mbedtls_rsa_pkcs1_encrypt( rsa, f_rng, p_rng,
                                        ilen, input, output ) );
@@ -173,7 +173,7 @@
     if( ctx != NULL )
         mbedtls_rsa_init( (mbedtls_rsa_context *) ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void rsa_free_wrap( void *ctx )
@@ -238,7 +238,7 @@
 
 static size_t eckey_get_bitlen( const void *ctx )
 {
-    return( ((mbedtls_ecp_keypair *) ctx)->grp.pbits );
+    return ((mbedtls_ecp_keypair *) ctx)->grp.pbits ;
 }
 
 #if defined(MBEDTLS_ECDSA_C)
@@ -266,7 +266,7 @@
 
     mbedtls_ecdsa_free( &ecdsa );
 
-    return( ret );
+    return ret ;
 }
 
 static int eckey_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
@@ -286,7 +286,7 @@
 
     mbedtls_ecdsa_free( &ecdsa );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_ECP_RESTARTABLE)
@@ -327,7 +327,7 @@
         mbedtls_ecdsa_init( &rs_ctx->ecdsa_ctx );
     }
 
-    return( ctx );
+    return ctx ;
 }
 
 static void eckey_rs_free( void *ctx )
@@ -354,7 +354,7 @@
 
     /* Should never happen */
     if( rs == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     /* set up our own sub-context if needed (that is, on first run) */
     if( rs->ecdsa_ctx.grp.pbits == 0 )
@@ -365,7 +365,7 @@
                                            sig, sig_len, &rs->ecdsa_rs ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 
 static int eckey_sign_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
@@ -379,7 +379,7 @@
 
     /* Should never happen */
     if( rs == NULL )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     /* set up our own sub-context if needed (that is, on first run) */
     if( rs->ecdsa_ctx.grp.pbits == 0 )
@@ -390,7 +390,7 @@
                                          f_rng, p_rng, &rs->ecdsa_rs ) );
 
 cleanup:
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_RESTARTABLE */
 #endif /* MBEDTLS_ECDSA_C */
@@ -411,7 +411,7 @@
     if( ctx != NULL )
         mbedtls_ecp_keypair_init( ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void eckey_free_wrap( void *ctx )
@@ -491,7 +491,7 @@
 #if defined(MBEDTLS_ECDSA_C)
 static int ecdsa_can_do( mbedtls_pk_type_t type )
 {
-    return( type == MBEDTLS_PK_ECDSA );
+    return type == MBEDTLS_PK_ECDSA ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -508,7 +508,7 @@
     if( ( ret = mbedtls_asn1_get_tag( from, end, &unpadded_len,
                                       MBEDTLS_ASN1_INTEGER ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     while( unpadded_len > 0 && **from == 0x00 )
@@ -518,14 +518,14 @@
     }
 
     if( unpadded_len > to_len || unpadded_len == 0 )
-        return( MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
+        return MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ;
 
     padding_len = to_len - unpadded_len;
     memset( to, 0x00, padding_len );
     memcpy( to + padding_len, *from, unpadded_len );
     ( *from ) += unpadded_len;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -541,16 +541,16 @@
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &tmp_size,
                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* Extract r */
     if( ( ret = extract_ecdsa_sig_int( p, end, sig, int_size ) ) != 0 )
-        return( ret );
+        return ret ;
     /* Extract s */
     if( ( ret = extract_ecdsa_sig_int( p, end, sig + int_size, int_size ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ecdsa_verify_wrap( void *ctx_arg, mbedtls_md_type_t md_alg,
@@ -576,7 +576,7 @@
     ((void) md_alg);
 
     if( curve == 0 )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     /* mbedtls_pk_write_pubkey() expects a full PK context;
      * re-construct one to make it happy */
@@ -585,7 +585,7 @@
     p = buf + sizeof( buf );
     key_len = mbedtls_pk_write_pubkey( &p, buf, &key );
     if( key_len <= 0 )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
     psa_set_key_type( &attributes, PSA_KEY_TYPE_ECC_PUBLIC_KEY( curve ) );
     psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
@@ -633,7 +633,7 @@
 
 cleanup:
     psa_destroy_key( key_id );
-    return( ret );
+    return ret ;
 }
 #else /* MBEDTLS_USE_PSA_CRYPTO */
 static int ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
@@ -647,9 +647,9 @@
                                 hash, hash_len, sig, sig_len );
 
     if( ret == MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH )
-        return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
+        return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH ;
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -679,9 +679,9 @@
             (mbedtls_ecdsa_restart_ctx *) rs_ctx );
 
     if( ret == MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH )
-        return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
+        return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH ;
 
-    return( ret );
+    return ret ;
 }
 
 static int ecdsa_sign_rs_wrap( void *ctx, mbedtls_md_type_t md_alg,
@@ -705,7 +705,7 @@
     if( ctx != NULL )
         mbedtls_ecdsa_init( (mbedtls_ecdsa_context *) ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void ecdsa_free_wrap( void *ctx )
@@ -722,7 +722,7 @@
     if( ctx != NULL )
         mbedtls_ecdsa_restart_init( ctx );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void ecdsa_rs_free( void *ctx )
@@ -763,14 +763,14 @@
 
 static int rsa_alt_can_do( mbedtls_pk_type_t type )
 {
-    return( type == MBEDTLS_PK_RSA );
+    return type == MBEDTLS_PK_RSA ;
 }
 
 static size_t rsa_alt_get_bitlen( const void *ctx )
 {
     const mbedtls_rsa_alt_context *rsa_alt = (const mbedtls_rsa_alt_context *) ctx;
 
-    return( 8 * rsa_alt->key_len_func( rsa_alt->key ) );
+    return 8 * rsa_alt->key_len_func( rsa_alt->key ) ;
 }
 
 static int rsa_alt_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
@@ -782,14 +782,14 @@
 
 #if SIZE_MAX > UINT_MAX
     if( UINT_MAX < hash_len )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 #endif /* SIZE_MAX > UINT_MAX */
 
     *sig_len = rsa_alt->key_len_func( rsa_alt->key );
     if( *sig_len > MBEDTLS_PK_SIGNATURE_MAX_SIZE )
-        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
     if( *sig_len > sig_size )
-        return( MBEDTLS_ERR_PK_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL ;
 
     return( rsa_alt->sign_func( rsa_alt->key, f_rng, p_rng,
                 md_alg, (unsigned int) hash_len, hash, sig ) );
@@ -806,7 +806,7 @@
     ((void) p_rng);
 
     if( ilen != rsa_alt->key_len_func( rsa_alt->key ) )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     return( rsa_alt->decrypt_func( rsa_alt->key,
                 olen, input, output, osize ) );
@@ -823,7 +823,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( rsa_alt_get_bitlen( prv ) != rsa_get_bitlen( pub ) )
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
 
     memset( hash, 0x2a, sizeof( hash ) );
 
@@ -832,16 +832,16 @@
                                    sig, sizeof( sig ), &sig_len,
                                    f_rng, p_rng ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( rsa_verify_wrap( (void *) pub, MBEDTLS_MD_NONE,
                          hash, sizeof( hash ), sig, sig_len ) != 0 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_RSA_C */
 
@@ -852,7 +852,7 @@
     if( ctx != NULL )
         memset( ctx, 0, sizeof( mbedtls_rsa_alt_context ) );
 
-    return( ctx );
+    return ctx ;
 }
 
 static void rsa_alt_free_wrap( void *ctx )
@@ -898,7 +898,7 @@
 
     /* no _init() function to call, an calloc() already zeroized */
 
-    return( ctx );
+    return ctx ;
 }
 
 static void pk_opaque_free_wrap( void *ctx )
@@ -914,11 +914,11 @@
     psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
 
     if( PSA_SUCCESS != psa_get_key_attributes( *key, &attributes ) )
-        return( 0 );
+        return 0 ;
 
     bits = psa_get_key_bits( &attributes );
     psa_reset_key_attributes( &attributes );
-    return( bits );
+    return bits ;
 }
 
 static int pk_opaque_can_do( mbedtls_pk_type_t type )
@@ -948,7 +948,7 @@
     size_t len = 0;
 
     if( (size_t)( *p - start ) < n_len )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     len = n_len;
     *p -= len;
@@ -965,14 +965,14 @@
 
     /* this is only reached if the signature was invalid */
     if( len == 0 )
-        return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+        return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
 
     /* if the msb is 1, ASN.1 requires that we prepend a 0.
      * Neither r nor s can be 0, so we can assume len > 0 at all times. */
     if( **p & 0x80 )
     {
         if( *p - start < 1 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
         *--(*p) = 0x00;
         len += 1;
@@ -982,7 +982,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
                                                 MBEDTLS_ASN1_INTEGER ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 /* Transcode signature from PSA format to ASN.1 sequence.
@@ -1011,7 +1011,7 @@
     memmove( sig, p, len );
     *sig_len = len;
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_ECDSA_C */
@@ -1031,7 +1031,7 @@
     ((void) sig_len);
     ((void) f_rng);
     ((void) p_rng);
-    return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 #else /* !MBEDTLS_ECDSA_C */
     const psa_key_id_t *key = (const psa_key_id_t *) ctx;
     psa_algorithm_t alg = PSA_ALG_ECDSA( mbedtls_psa_translate_md( md_alg ) );
@@ -1045,10 +1045,10 @@
     status = psa_sign_hash( *key, alg, hash, hash_len,
                             sig, sig_size, sig_len );
     if( status != PSA_SUCCESS )
-        return( mbedtls_psa_err_translate_pk( status ) );
+        return mbedtls_psa_err_translate_pk( status ) ;
 
     /* transcode it to ASN.1 sequence */
-    return( pk_ecdsa_sig_asn1_from_psa( sig, sig_len, sig_size ) );
+    return pk_ecdsa_sig_asn1_from_psa( sig, sig_len, sig_size ) ;
 #endif /* !MBEDTLS_ECDSA_C */
 }
 
diff --git a/library/pkcs12.c b/library/pkcs12.c
index 04b1a6d..8e074dd 100644
--- a/library/pkcs12.c
+++ b/library/pkcs12.c
@@ -60,19 +60,19 @@
                 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) );
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &salt->len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, ret ) ;
 
     salt->p = *p;
     *p += salt->len;
 
     if( ( ret = mbedtls_asn1_get_int( p, end, iterations ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT, ret ) ;
 
     if( *p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #define PKCS12_MAX_PWDLEN 128
@@ -88,14 +88,14 @@
     unsigned char unipwd[PKCS12_MAX_PWDLEN * 2 + 2];
 
     if( pwdlen > PKCS12_MAX_PWDLEN )
-        return( MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA ;
 
     memset( &salt, 0, sizeof(mbedtls_asn1_buf) );
     memset( &unipwd, 0, sizeof(unipwd) );
 
     if( ( ret = pkcs12_parse_pbe_params( pbe_params, &salt,
                                          &iterations ) ) != 0 )
-        return( ret );
+        return ret ;
 
     for( i = 0; i < pwdlen; i++ )
         unipwd[i * 2 + 1] = pwd[i];
@@ -104,19 +104,19 @@
                                    salt.p, salt.len, md_type,
                                    MBEDTLS_PKCS12_DERIVE_KEY, iterations ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( iv == NULL || ivlen == 0 )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_pkcs12_derivation( iv, ivlen, unipwd, pwdlen * 2 + 2,
                                    salt.p, salt.len, md_type,
                                    MBEDTLS_PKCS12_DERIVE_IV, iterations ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
-    return( 0 );
+    return 0 ;
 }
 
 #undef PKCS12_MAX_PWDLEN
@@ -136,7 +136,7 @@
 
     cipher_info = mbedtls_cipher_info_from_type( cipher_type );
     if( cipher_info == NULL )
-        return( MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE ;
 
     keylen = cipher_info->key_bitlen / 8;
 
@@ -144,7 +144,7 @@
                                           key, keylen,
                                           iv, cipher_info->iv_size ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     mbedtls_cipher_init( &cipher_ctx );
@@ -175,7 +175,7 @@
     mbedtls_platform_zeroize( iv,  sizeof( iv  ) );
     mbedtls_cipher_free( &cipher_ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_ASN1_PARSE_C */
@@ -216,16 +216,16 @@
 
     // This version only allows max of 64 bytes of password or salt
     if( datalen > 128 || pwdlen > 64 || saltlen > 64 )
-        return( MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA ;
 
     md_info = mbedtls_md_info_from_type( md_type );
     if( md_info == NULL )
-        return( MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE ;
 
     mbedtls_md_init( &md_ctx );
 
     if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 0 ) ) != 0 )
-        return( ret );
+        return ret ;
     hlen = mbedtls_md_get_size( md_info );
 
     if( hlen <= 32 )
@@ -309,7 +309,7 @@
 
     mbedtls_md_free( &md_ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_PKCS12_C */
diff --git a/library/pkcs5.c b/library/pkcs5.c
index 2b014d9..c7230bc 100644
--- a/library/pkcs5.c
+++ b/library/pkcs5.c
@@ -73,37 +73,37 @@
      */
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &salt->len,
                                       MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) ;
 
     salt->p = p;
     p += salt->len;
 
     if( ( ret = mbedtls_asn1_get_int( &p, end, iterations ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) ;
 
     if( p == end )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_asn1_get_int( &p, end, keylen ) ) != 0 )
     {
         if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) ;
     }
 
     if( p == end )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_asn1_get_alg_null( &p, end, &prf_alg_oid ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) ;
 
     if( mbedtls_oid_get_md_hmac( &prf_alg_oid, md_type ) != 0 )
-        return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE ;
 
     if( p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_pkcs5_pbes2( const mbedtls_asn1_buf *pbe_params, int mode,
@@ -139,36 +139,36 @@
 
     if( ( ret = mbedtls_asn1_get_alg( &p, end, &kdf_alg_oid,
                                       &kdf_alg_params ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) ;
 
     // Only PBKDF2 supported at the moment
     //
     if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS5_PBKDF2, &kdf_alg_oid ) != 0 )
-        return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE ;
 
     if( ( ret = pkcs5_parse_pbkdf2_params( &kdf_alg_params,
                                            &salt, &iterations, &keylen,
                                            &md_type ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     md_info = mbedtls_md_info_from_type( md_type );
     if( md_info == NULL )
-        return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE ;
 
     if( ( ret = mbedtls_asn1_get_alg( &p, end, &enc_scheme_oid,
                               &enc_scheme_params ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PKCS5_INVALID_FORMAT, ret ) ;
     }
 
     if( mbedtls_oid_get_cipher_alg( &enc_scheme_oid, &cipher_alg ) != 0 )
-        return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE ;
 
     cipher_info = mbedtls_cipher_info_from_type( cipher_alg );
     if( cipher_info == NULL )
-        return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE ;
 
     /*
      * The value of keylen from pkcs5_parse_pbkdf2_params() is ignored
@@ -179,7 +179,7 @@
     if( enc_scheme_params.tag != MBEDTLS_ASN1_OCTET_STRING ||
         enc_scheme_params.len != cipher_info->iv_size )
     {
-        return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT );
+        return MBEDTLS_ERR_PKCS5_INVALID_FORMAT ;
     }
 
     mbedtls_md_init( &md_ctx );
@@ -211,7 +211,7 @@
     mbedtls_md_free( &md_ctx );
     mbedtls_cipher_free( &cipher_ctx );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ASN1_PARSE_C */
 
@@ -236,11 +236,11 @@
 
 #if UINT_MAX > 0xFFFFFFFF
     if( iteration_count > 0xFFFFFFFF )
-        return( MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA ;
 #endif
 
     if( ( ret = mbedtls_md_hmac_starts( ctx, password, plen ) ) != 0 )
-        return( ret );
+        return ret ;
     while( key_length )
     {
         // U1 ends up in work
@@ -294,7 +294,7 @@
     mbedtls_platform_zeroize( work, MBEDTLS_MD_MAX_SIZE );
     mbedtls_platform_zeroize( md1, MBEDTLS_MD_MAX_SIZE );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -305,7 +305,7 @@
     if( verbose != 0 )
         mbedtls_printf( "  PBKDF2 (SHA1): skipped\n\n" );
 
-    return( 0 );
+    return 0 ;
 }
 #else
 
@@ -411,7 +411,7 @@
 exit:
     mbedtls_md_free( &sha1_ctx );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SHA1_C */
 
diff --git a/library/pkparse.c b/library/pkparse.c
index fe6aaca..2b4916a 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -80,13 +80,13 @@
     PK_VALIDATE_RET( n != NULL );
 
     if( ( f = fopen( path, "rb" ) ) == NULL )
-        return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
+        return MBEDTLS_ERR_PK_FILE_IO_ERROR ;
 
     fseek( f, 0, SEEK_END );
     if( ( size = ftell( f ) ) == -1 )
     {
         fclose( f );
-        return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
+        return MBEDTLS_ERR_PK_FILE_IO_ERROR ;
     }
     fseek( f, 0, SEEK_SET );
 
@@ -96,7 +96,7 @@
         ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
-        return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+        return MBEDTLS_ERR_PK_ALLOC_FAILED ;
     }
 
     if( fread( *buf, 1, *n, f ) != *n )
@@ -106,7 +106,7 @@
         mbedtls_platform_zeroize( *buf, *n );
         mbedtls_free( *buf );
 
-        return( MBEDTLS_ERR_PK_FILE_IO_ERROR );
+        return MBEDTLS_ERR_PK_FILE_IO_ERROR ;
     }
 
     fclose( f );
@@ -116,7 +116,7 @@
     if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL )
         ++*n;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -134,7 +134,7 @@
     PK_VALIDATE_RET( path != NULL );
 
     if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( pwd == NULL )
         ret = mbedtls_pk_parse_key( ctx, buf, n, NULL, 0, f_rng, p_rng );
@@ -145,7 +145,7 @@
     mbedtls_platform_zeroize( buf, n );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -161,14 +161,14 @@
     PK_VALIDATE_RET( path != NULL );
 
     if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_pk_parse_public_key( ctx, buf, n );
 
     mbedtls_platform_zeroize( buf, n );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -204,7 +204,7 @@
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &params->len, params->tag ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     params->p = *p;
@@ -214,7 +214,7 @@
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
@@ -248,10 +248,10 @@
 
     /* SpecifiedECDomainVersion ::= INTEGER { 1, 2, 3 } */
     if( ( ret = mbedtls_asn1_get_int( &p, end, &ver ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     if( ver < 1 || ver > 3 )
-        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+        return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
 
     /*
      * FieldID { FIELD-ID:IOSet } ::= SEQUENCE { -- Finite field
@@ -261,7 +261,7 @@
      */
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( ret );
+        return ret ;
 
     end_field = p + len;
 
@@ -274,19 +274,19 @@
      * prime-field OBJECT IDENTIFIER ::= { id-fieldType 1 }
      */
     if( ( ret = mbedtls_asn1_get_tag( &p, end_field, &len, MBEDTLS_ASN1_OID ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( len != MBEDTLS_OID_SIZE( MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD ) ||
         memcmp( p, MBEDTLS_OID_ANSI_X9_62_PRIME_FIELD, len ) != 0 )
     {
-        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
     }
 
     p += len;
 
     /* Prime-p ::= INTEGER -- Field of size p. */
     if( ( ret = mbedtls_asn1_get_mpi( &p, end_field, &grp->P ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     grp->pbits = mbedtls_mpi_bitlen( &grp->P );
 
@@ -305,7 +305,7 @@
      */
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( ret );
+        return ret ;
 
     end_curve = p + len;
 
@@ -316,7 +316,7 @@
     if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
         ( ret = mbedtls_mpi_read_binary( &grp->A, p, len ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     p += len;
@@ -324,7 +324,7 @@
     if( ( ret = mbedtls_asn1_get_tag( &p, end_curve, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 ||
         ( ret = mbedtls_mpi_read_binary( &grp->B, p, len ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     p += len;
@@ -341,7 +341,7 @@
      * ECPoint ::= OCTET STRING
      */
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     if( ( ret = mbedtls_ecp_point_read_binary( grp, &grp->G,
                                       ( const unsigned char *) p, len ) ) != 0 )
@@ -357,7 +357,7 @@
             mbedtls_mpi_lset( &grp->G.Y, p[0] - 2 ) != 0 ||
             mbedtls_mpi_lset( &grp->G.Z, 1 ) != 0 )
         {
-            return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+            return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
         }
     }
 
@@ -367,7 +367,7 @@
      * order INTEGER
      */
     if( ( ret = mbedtls_asn1_get_mpi( &p, end, &grp->N ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     grp->nbits = mbedtls_mpi_bitlen( &grp->N );
 
@@ -375,7 +375,7 @@
      * Allow optional elements by purposefully not enforcing p == end here.
      */
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -420,7 +420,7 @@
     if( ret == 0 && *id == MBEDTLS_ECP_DP_NONE )
         ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -442,7 +442,7 @@
 cleanup:
     mbedtls_ecp_group_free( &grp );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_PK_PARSE_EC_EXTENDED */
 
@@ -462,15 +462,15 @@
     if( params->tag == MBEDTLS_ASN1_OID )
     {
         if( mbedtls_oid_get_ec_grp( params, &grp_id ) != 0 )
-            return( MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE );
+            return MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE ;
     }
     else
     {
 #if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
         if( ( ret = pk_group_id_from_specified( params, &grp_id ) ) != 0 )
-            return( ret );
+            return ret ;
 #else
-        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+        return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
 #endif
     }
 
@@ -478,12 +478,12 @@
      * grp may already be initilialized; if so, make sure IDs match
      */
     if( grp->id != MBEDTLS_ECP_DP_NONE && grp->id != grp_id )
-        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+        return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
 
     if( ( ret = mbedtls_ecp_group_load( grp, grp_id ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -509,7 +509,7 @@
      */
     *p = (unsigned char *) end;
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_C */
 
@@ -529,7 +529,7 @@
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) ;
 
     if( *p + len != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
@@ -537,35 +537,35 @@
 
     /* Import N */
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) ;
 
     if( ( ret = mbedtls_rsa_import_raw( rsa, *p, len, NULL, 0, NULL, 0,
                                         NULL, 0, NULL, 0 ) ) != 0 )
-        return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
+        return MBEDTLS_ERR_PK_INVALID_PUBKEY ;
 
     *p += len;
 
     /* Import E */
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len, MBEDTLS_ASN1_INTEGER ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) ;
 
     if( ( ret = mbedtls_rsa_import_raw( rsa, NULL, 0, NULL, 0, NULL, 0,
                                         NULL, 0, *p, len ) ) != 0 )
-        return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
+        return MBEDTLS_ERR_PK_INVALID_PUBKEY ;
 
     *p += len;
 
     if( mbedtls_rsa_complete( rsa ) != 0 ||
         mbedtls_rsa_check_pubkey( rsa ) != 0 )
     {
-        return( MBEDTLS_ERR_PK_INVALID_PUBKEY );
+        return MBEDTLS_ERR_PK_INVALID_PUBKEY ;
     }
 
     if( *p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_RSA_C */
 
@@ -585,10 +585,10 @@
     memset( params, 0, sizeof(mbedtls_asn1_buf) );
 
     if( ( ret = mbedtls_asn1_get_alg( p, end, &alg_oid, params ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_ALG, ret ) ;
 
     if( mbedtls_oid_get_pk_alg( &alg_oid, pk_alg ) != 0 )
-        return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
+        return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG ;
 
     /*
      * No parameters with RSA (only for EC)
@@ -597,10 +597,10 @@
             ( ( params->tag != MBEDTLS_ASN1_NULL && params->tag != 0 ) ||
                 params->len != 0 ) )
     {
-        return( MBEDTLS_ERR_PK_INVALID_ALG );
+        return MBEDTLS_ERR_PK_INVALID_ALG ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -625,26 +625,26 @@
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
                     MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     end = *p + len;
 
     if( ( ret = pk_get_pk_alg( p, end, &pk_alg, &alg_params ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_asn1_get_bitstring_null( p, end, &len ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) ;
 
     if( *p + len != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
     if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
-        return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
+        return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG ;
 
     if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_RSA_C)
     if( pk_alg == MBEDTLS_PK_RSA )
@@ -669,7 +669,7 @@
     if( ret != 0 )
         mbedtls_pk_free( pk );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_RSA_C)
@@ -691,12 +691,12 @@
 
     ret = mbedtls_asn1_get_mpi( p, end, X );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     if( mbedtls_mpi_cmp_int( X, 0 ) == 0 )
-        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+        return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -735,19 +735,19 @@
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     end = p + len;
 
     if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     if( version != 0 )
     {
-        return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
+        return MBEDTLS_ERR_PK_KEY_INVALID_VERSION ;
     }
 
     /* Import N */
@@ -851,7 +851,7 @@
         mbedtls_rsa_free( rsa );
     }
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_RSA_C */
 
@@ -884,24 +884,24 @@
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     end = p + len;
 
     if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     if( version != 1 )
-        return( MBEDTLS_ERR_PK_KEY_INVALID_VERSION );
+        return MBEDTLS_ERR_PK_KEY_INVALID_VERSION ;
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     if( ( ret = mbedtls_mpi_read_binary( &eck->d, p, len ) ) != 0 )
     {
         mbedtls_ecp_keypair_free( eck );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     p += len;
@@ -919,13 +919,13 @@
                 ( ret = pk_use_ecparams( &params, &eck->grp )  ) != 0 )
             {
                 mbedtls_ecp_keypair_free( eck );
-                return( ret );
+                return ret ;
             }
         }
         else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
         {
             mbedtls_ecp_keypair_free( eck );
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
         }
     }
 
@@ -941,7 +941,7 @@
             end2 = p + len;
 
             if( ( ret = mbedtls_asn1_get_bitstring_null( &p, end2, &len ) ) != 0 )
-                return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+                return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
             if( p + len != end2 )
                 return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
@@ -956,13 +956,13 @@
                  * is if the point format is not recognized.
                  */
                 if( ret != MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE )
-                    return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+                    return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
             }
         }
         else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
         {
             mbedtls_ecp_keypair_free( eck );
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
         }
     }
 
@@ -971,16 +971,16 @@
                                  f_rng, p_rng ) ) != 0 )
     {
         mbedtls_ecp_keypair_free( eck );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     if( ( ret = mbedtls_ecp_check_privkey( &eck->grp, &eck->d ) ) != 0 )
     {
         mbedtls_ecp_keypair_free( eck );
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_ECP_C */
 
@@ -1034,34 +1034,34 @@
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     end = p + len;
 
     if( ( ret = mbedtls_asn1_get_int( &p, end, &version ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     if( version != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_VERSION, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_VERSION, ret ) ;
 
     if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, &params ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     if( len < 1 )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT,
                 MBEDTLS_ERR_ASN1_OUT_OF_DATA ) );
 
     if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
-        return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
+        return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG ;
 
     if( ( ret = mbedtls_pk_setup( pk, pk_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_RSA_C)
     if( pk_alg == MBEDTLS_PK_RSA )
@@ -1069,7 +1069,7 @@
         if( ( ret = pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ), p, len ) ) != 0 )
         {
             mbedtls_pk_free( pk );
-            return( ret );
+            return ret ;
         }
     } else
 #endif /* MBEDTLS_RSA_C */
@@ -1080,13 +1080,13 @@
             ( ret = pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ), p, len, f_rng, p_rng ) ) != 0 )
         {
             mbedtls_pk_free( pk );
-            return( ret );
+            return ret ;
         }
     } else
 #endif /* MBEDTLS_ECP_C */
-        return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
+        return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1119,7 +1119,7 @@
     end = p + keylen;
 
     if( pwdlen == 0 )
-        return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
+        return MBEDTLS_ERR_PK_PASSWORD_REQUIRED ;
 
     /*
      * This function parses the EncryptedPrivateKeyInfo object (PKCS#8)
@@ -1139,16 +1139,16 @@
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
     }
 
     end = p + len;
 
     if( ( ret = mbedtls_asn1_get_alg( &p, end, &pbe_alg_oid, &pbe_params ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) ;
 
     buf = p;
 
@@ -1163,9 +1163,9 @@
                                 pwd, pwdlen, p, len, buf ) ) != 0 )
         {
             if( ret == MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH )
-                return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
+                return MBEDTLS_ERR_PK_PASSWORD_MISMATCH ;
 
-            return( ret );
+            return ret ;
         }
 
         decrypted = 1;
@@ -1179,9 +1179,9 @@
                                   p, len, buf ) ) != 0 )
         {
             if( ret == MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH )
-                return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
+                return MBEDTLS_ERR_PK_PASSWORD_MISMATCH ;
 
-            return( ret );
+            return ret ;
         }
 
         decrypted = 1;
@@ -1193,9 +1193,9 @@
     }
 
     if( decrypted == 0 )
-        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 
-    return( pk_parse_key_pkcs8_unencrypted_der( pk, buf, len, f_rng, p_rng ) );
+    return pk_parse_key_pkcs8_unencrypted_der( pk, buf, len, f_rng, p_rng ) ;
 }
 #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
 
@@ -1216,7 +1216,7 @@
 
     PK_VALIDATE_RET( pk != NULL );
     if( keylen == 0 )
-        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+        return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
     PK_VALIDATE_RET( key != NULL );
 
 #if defined(MBEDTLS_PEM_PARSE_C)
@@ -1243,14 +1243,14 @@
         }
 
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
     else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
-        return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
+        return MBEDTLS_ERR_PK_PASSWORD_MISMATCH ;
     else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
-        return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
+        return MBEDTLS_ERR_PK_PASSWORD_REQUIRED ;
     else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_RSA_C */
 
 #if defined(MBEDTLS_ECP_C)
@@ -1275,14 +1275,14 @@
         }
 
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
     else if( ret == MBEDTLS_ERR_PEM_PASSWORD_MISMATCH )
-        return( MBEDTLS_ERR_PK_PASSWORD_MISMATCH );
+        return MBEDTLS_ERR_PK_PASSWORD_MISMATCH ;
     else if( ret == MBEDTLS_ERR_PEM_PASSWORD_REQUIRED )
-        return( MBEDTLS_ERR_PK_PASSWORD_REQUIRED );
+        return MBEDTLS_ERR_PK_PASSWORD_REQUIRED ;
     else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_ECP_C */
 
     /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
@@ -1302,10 +1302,10 @@
         }
 
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
     else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_PKCS12_C) || defined(MBEDTLS_PKCS5_C)
     /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
@@ -1325,10 +1325,10 @@
         }
 
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
     else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
 #else
     ((void) pwd);
@@ -1347,7 +1347,7 @@
         unsigned char *key_copy;
 
         if( ( key_copy = mbedtls_calloc( 1, keylen ) ) == NULL )
-            return( MBEDTLS_ERR_PK_ALLOC_FAILED );
+            return MBEDTLS_ERR_PK_ALLOC_FAILED ;
 
         memcpy( key_copy, key, keylen );
 
@@ -1359,21 +1359,21 @@
     }
 
     if( ret == 0 )
-        return( 0 );
+        return 0 ;
 
     mbedtls_pk_free( pk );
     mbedtls_pk_init( pk );
 
     if( ret == MBEDTLS_ERR_PK_PASSWORD_MISMATCH )
     {
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_PKCS12_C || MBEDTLS_PKCS5_C */
 
     if( ( ret = pk_parse_key_pkcs8_unencrypted_der(
                     pk, key, keylen, f_rng, p_rng ) ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
     mbedtls_pk_free( pk );
@@ -1385,7 +1385,7 @@
     if( mbedtls_pk_setup( pk, pk_info ) == 0 &&
         pk_parse_key_pkcs1_der( mbedtls_pk_rsa( *pk ), key, keylen ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
     mbedtls_pk_free( pk );
@@ -1398,7 +1398,7 @@
         pk_parse_key_sec1_der( mbedtls_pk_ec( *pk ),
                                key, keylen, f_rng, p_rng ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
     mbedtls_pk_free( pk );
 #endif /* MBEDTLS_ECP_C */
@@ -1413,7 +1413,7 @@
      * also ok and in line with the mbedtls_pk_free() calls
      * on failed PEM parsing attempts. */
 
-    return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+    return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
 }
 
 /*
@@ -1434,7 +1434,7 @@
 
     PK_VALIDATE_RET( ctx != NULL );
     if( keylen == 0 )
-        return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
+        return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT ;
     PK_VALIDATE_RET( key != NULL || keylen == 0 );
 
 #if defined(MBEDTLS_PEM_PARSE_C)
@@ -1453,21 +1453,21 @@
     {
         p = pem.buf;
         if( ( pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA ) ) == NULL )
-            return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
+            return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG ;
 
         if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if ( ( ret = pk_get_rsapubkey( &p, p + pem.buflen, mbedtls_pk_rsa( *ctx ) ) ) != 0 )
             mbedtls_pk_free( ctx );
 
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
     else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
     {
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_RSA_C */
 
@@ -1489,41 +1489,41 @@
 
         ret = mbedtls_pk_parse_subpubkey( &p,  p + pem.buflen, ctx );
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
     else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
     {
         mbedtls_pem_free( &pem );
-        return( ret );
+        return ret ;
     }
     mbedtls_pem_free( &pem );
 #endif /* MBEDTLS_PEM_PARSE_C */
 
 #if defined(MBEDTLS_RSA_C)
     if( ( pk_info = mbedtls_pk_info_from_type( MBEDTLS_PK_RSA ) ) == NULL )
-        return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
+        return MBEDTLS_ERR_PK_UNKNOWN_PK_ALG ;
 
     if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
     p = (unsigned char *)key;
     ret = pk_get_rsapubkey( &p, p + keylen, mbedtls_pk_rsa( *ctx ) );
     if( ret == 0 )
     {
-        return( ret );
+        return ret ;
     }
     mbedtls_pk_free( ctx );
     if( ret != ( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
                                     MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) ) )
     {
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_RSA_C */
     p = (unsigned char *) key;
 
     ret = mbedtls_pk_parse_subpubkey( &p, p + keylen, ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_PK_PARSE_C */
diff --git a/library/pkwrite.c b/library/pkwrite.c
index 71cc0f0..4e11a6d 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -94,13 +94,13 @@
 
     mbedtls_mpi_free( &T );
     if( ret < 0 )
-        return( ret );
+        return ret ;
 
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_CONSTRUCTED |
                                                  MBEDTLS_ASN1_SEQUENCE ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 #endif /* MBEDTLS_RSA_C */
 
@@ -119,16 +119,16 @@
                                         MBEDTLS_ECP_PF_UNCOMPRESSED,
                                         &len, buf, sizeof( buf ) ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( *p < start || (size_t)( *p - start ) < len )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     *p -= len;
     memcpy( *p, buf, len );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 /*
@@ -145,11 +145,11 @@
     size_t oid_len;
 
     if( ( ret = mbedtls_oid_get_oid_by_ec_grp( ec->grp.id, &oid, &oid_len ) ) != 0 )
-        return( ret );
+        return ret ;
 
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_oid( p, start, oid, oid_len ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 /*
@@ -169,7 +169,7 @@
 
 exit:
     mbedtls_platform_zeroize( tmp, byte_length );
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_ECP_C */
 
@@ -201,13 +201,13 @@
         psa_key_id_t* key_id = (psa_key_id_t*) key->pk_ctx;
 
         if ( *p < start )
-            return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
 
         buffer_size = (size_t)( *p - start );
         if ( psa_export_public_key( *key_id, start, buffer_size, &len )
              != PSA_SUCCESS )
         {
-            return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_PK_BAD_INPUT_DATA ;
         }
         else
         {
@@ -217,9 +217,9 @@
     }
     else
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
-        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_pk_write_pubkey_der( const mbedtls_pk_context *key, unsigned char *buf, size_t size )
@@ -232,7 +232,7 @@
 
     PK_VALIDATE_RET( key != NULL );
     if( size == 0 )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
     PK_VALIDATE_RET( buf != NULL );
 
     c = buf + size;
@@ -240,7 +240,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_pk_write_pubkey( &c, buf, key ) );
 
     if( c - buf < 1 )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     /*
      *  SubjectPublicKeyInfo  ::=  SEQUENCE  {
@@ -271,18 +271,18 @@
 
         key_id = *((psa_key_id_t*) key->pk_ctx );
         if( PSA_SUCCESS != psa_get_key_attributes( key_id, &attributes ) )
-            return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
         key_type = psa_get_key_type( &attributes );
         bits = psa_get_key_bits( &attributes );
         psa_reset_key_attributes( &attributes );
 
         curve = PSA_KEY_TYPE_ECC_GET_FAMILY( key_type );
         if( curve == 0 )
-            return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 
         ret = mbedtls_psa_get_ecc_oid_from_id( curve, bits, &oid, &oid_len );
         if( ret != 0 )
-            return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 
         /* Write EC algorithm parameters; that's akin
          * to pk_write_ec_param() above. */
@@ -297,7 +297,7 @@
     if( ( ret = mbedtls_oid_get_oid_by_pk_alg( pk_type, &oid,
                                                &oid_len ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_algorithm_identifier( &c, buf, oid, oid_len,
@@ -307,7 +307,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, MBEDTLS_ASN1_CONSTRUCTED |
                                                 MBEDTLS_ASN1_SEQUENCE ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_pk_write_key_der( const mbedtls_pk_context *key, unsigned char *buf, size_t size )
@@ -318,7 +318,7 @@
 
     PK_VALIDATE_RET( key != NULL );
     if( size == 0 )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
     PK_VALIDATE_RET( buf != NULL );
 
     c = buf + size;
@@ -392,7 +392,7 @@
 
         mbedtls_mpi_free( &T );
         if( ret < 0 )
-            return( ret );
+            return ret ;
 
         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, buf, 0 ) );
         MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) );
@@ -423,7 +423,7 @@
         MBEDTLS_ASN1_CHK_ADD( pub_len, pk_write_ec_pubkey( &c, buf, ec ) );
 
         if( c - buf < 1 )
-            return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+            return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
         *--c = 0;
         pub_len += 1;
 
@@ -455,9 +455,9 @@
     }
     else
 #endif /* MBEDTLS_ECP_C */
-        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 
-    return( (int) len );
+    return (int) len ;
 }
 
 #if defined(MBEDTLS_PEM_WRITE_C)
@@ -565,17 +565,17 @@
     if( ( ret = mbedtls_pk_write_pubkey_der( key, output_buf,
                                      sizeof(output_buf) ) ) < 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_PUBLIC_KEY, PEM_END_PUBLIC_KEY,
                                   output_buf + sizeof(output_buf) - ret,
                                   ret, buf, size, &olen ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_pk_write_key_pem( const mbedtls_pk_context *key, unsigned char *buf, size_t size )
@@ -589,7 +589,7 @@
     PK_VALIDATE_RET( buf != NULL || size == 0 );
 
     if( ( ret = mbedtls_pk_write_key_der( key, output_buf, sizeof(output_buf) ) ) < 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_RSA_C)
     if( mbedtls_pk_get_type( key ) == MBEDTLS_PK_RSA )
@@ -607,16 +607,16 @@
     }
     else
 #endif
-        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ;
 
     if( ( ret = mbedtls_pem_write_buffer( begin, end,
                                   output_buf + sizeof(output_buf) - ret,
                                   ret, buf, size, &olen ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PEM_WRITE_C */
 
diff --git a/library/platform.c b/library/platform.c
index e742fde..7ef6625 100644
--- a/library/platform.c
+++ b/library/platform.c
@@ -38,7 +38,7 @@
 {
     ((void) n);
     ((void) size);
-    return( NULL );
+    return NULL ;
 }
 
 #define MBEDTLS_PLATFORM_STD_CALLOC   platform_calloc_uninit
@@ -71,7 +71,7 @@
 {
     mbedtls_calloc_func = calloc_func;
     mbedtls_free_func = free_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_MEMORY &&
           !( defined(MBEDTLS_PLATFORM_CALLOC_MACRO) &&
@@ -88,7 +88,7 @@
     ret = mbedtls_vsnprintf( s, n, fmt, argp );
     va_end( argp );
 
-    return( ret );
+    return ret ;
 }
 #endif
 
@@ -103,7 +103,7 @@
     ((void) s);
     ((void) n);
     ((void) format);
-    return( 0 );
+    return 0 ;
 }
 
 #define MBEDTLS_PLATFORM_STD_SNPRINTF    platform_snprintf_uninit
@@ -118,7 +118,7 @@
                                                  ... ) )
 {
     mbedtls_snprintf = snprintf_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_SNPRINTF_ALT */
 
@@ -130,7 +130,7 @@
 
     /* Avoid calling the invalid parameter handler by checking ourselves */
     if( s == NULL || n == 0 || fmt == NULL )
-        return( -1 );
+        return -1 ;
 
 #if defined(_TRUNCATE)
     ret = vsnprintf_s( s, n, _TRUNCATE, fmt, arg );
@@ -143,7 +143,7 @@
     }
 #endif
 
-    return( ret );
+    return ret ;
 }
 #endif
 
@@ -159,7 +159,7 @@
     ((void) n);
     ((void) format);
     ((void) arg);
-    return( -1 );
+    return -1 ;
 }
 
 #define MBEDTLS_PLATFORM_STD_VSNPRINTF    platform_vsnprintf_uninit
@@ -174,7 +174,7 @@
                                                  va_list arg ) )
 {
     mbedtls_vsnprintf = vsnprintf_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_VSNPRINTF_ALT */
 
@@ -186,7 +186,7 @@
 static int platform_printf_uninit( const char *format, ... )
 {
     ((void) format);
-    return( 0 );
+    return 0 ;
 }
 
 #define MBEDTLS_PLATFORM_STD_PRINTF    platform_printf_uninit
@@ -197,7 +197,7 @@
 int mbedtls_platform_set_printf( int (*printf_func)( const char *, ... ) )
 {
     mbedtls_printf = printf_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_PRINTF_ALT */
 
@@ -210,7 +210,7 @@
 {
     ((void) stream);
     ((void) format);
-    return( 0 );
+    return 0 ;
 }
 
 #define MBEDTLS_PLATFORM_STD_FPRINTF   platform_fprintf_uninit
@@ -222,7 +222,7 @@
 int mbedtls_platform_set_fprintf( int (*fprintf_func)( FILE *, const char *, ... ) )
 {
     mbedtls_fprintf = fprintf_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_FPRINTF_ALT */
 
@@ -244,7 +244,7 @@
 int mbedtls_platform_set_exit( void (*exit_func)( int status ) )
 {
     mbedtls_exit = exit_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_EXIT_ALT */
 
@@ -258,7 +258,7 @@
 static mbedtls_time_t platform_time_uninit( mbedtls_time_t* timer )
 {
     ((void) timer);
-    return( 0 );
+    return 0 ;
 }
 
 #define MBEDTLS_PLATFORM_STD_TIME   platform_time_uninit
@@ -269,7 +269,7 @@
 int mbedtls_platform_set_time( mbedtls_time_t (*time_func)( mbedtls_time_t* timer ) )
 {
     mbedtls_time = time_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_TIME_ALT */
 
@@ -286,17 +286,17 @@
     size_t n;
 
     if( ( file = fopen( MBEDTLS_PLATFORM_STD_NV_SEED_FILE, "rb" ) ) == NULL )
-        return( -1 );
+        return -1 ;
 
     if( ( n = fread( buf, 1, buf_len, file ) ) != buf_len )
     {
         fclose( file );
         mbedtls_platform_zeroize( buf, buf_len );
-        return( -1 );
+        return -1 ;
     }
 
     fclose( file );
-    return( (int)n );
+    return (int)n ;
 }
 
 int mbedtls_platform_std_nv_seed_write( unsigned char *buf, size_t buf_len )
@@ -314,7 +314,7 @@
     }
 
     fclose( file );
-    return( (int)n );
+    return (int)n ;
 }
 #endif /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */
 
@@ -327,7 +327,7 @@
 {
     ((void) buf);
     ((void) buf_len);
-    return( -1 );
+    return -1 ;
 }
 
 #define MBEDTLS_PLATFORM_STD_NV_SEED_READ   platform_nv_seed_read_uninit
@@ -341,7 +341,7 @@
 {
     ((void) buf);
     ((void) buf_len);
-    return( -1 );
+    return -1 ;
 }
 
 #define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE   platform_nv_seed_write_uninit
@@ -358,7 +358,7 @@
 {
     mbedtls_nv_seed_read = nv_seed_read_func;
     mbedtls_nv_seed_write = nv_seed_write_func;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PLATFORM_NV_SEED_ALT */
 #endif /* MBEDTLS_ENTROPY_NV_SEED */
@@ -371,7 +371,7 @@
 {
     (void)ctx;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
diff --git a/library/platform_util.c b/library/platform_util.c
index 3d5cb5b..3c3ebca 100644
--- a/library/platform_util.c
+++ b/library/platform_util.c
@@ -104,15 +104,15 @@
                                       struct tm *tm_buf )
 {
 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
-    return( ( gmtime_s( tm_buf, tt ) == 0 ) ? tm_buf : NULL );
+    return ( gmtime_s( tm_buf, tt ) == 0 ) ? tm_buf : NULL ;
 #elif !defined(PLATFORM_UTIL_USE_GMTIME)
-    return( gmtime_r( tt, tm_buf ) );
+    return gmtime_r( tt, tm_buf ) ;
 #else
     struct tm *lt;
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_lock( &mbedtls_threading_gmtime_mutex ) != 0 )
-        return( NULL );
+        return NULL ;
 #endif /* MBEDTLS_THREADING_C */
 
     lt = gmtime( tt );
@@ -124,10 +124,10 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &mbedtls_threading_gmtime_mutex ) != 0 )
-        return( NULL );
+        return NULL ;
 #endif /* MBEDTLS_THREADING_C */
 
-    return( ( lt == NULL ) ? NULL : tm_buf );
+    return ( lt == NULL ) ? NULL : tm_buf ;
 #endif /* _WIN32 && !EFIX64 && !EFI32 */
 }
 #endif /* MBEDTLS_HAVE_TIME_DATE && MBEDTLS_PLATFORM_GMTIME_R_ALT */
diff --git a/library/poly1305.c b/library/poly1305.c
index 492d145..a81220b 100644
--- a/library/poly1305.c
+++ b/library/poly1305.c
@@ -82,7 +82,7 @@
 #else
 static inline uint64_t mul64( uint32_t a, uint32_t b )
 {
-    return( (uint64_t) a * b );
+    return (uint64_t) a * b ;
 }
 #endif
 
@@ -318,7 +318,7 @@
     mbedtls_platform_zeroize( ctx->queue, sizeof( ctx->queue ) );
     ctx->queue_len = 0U;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_poly1305_update( mbedtls_poly1305_context *ctx,
@@ -382,7 +382,7 @@
         memcpy( ctx->queue, &input[offset], remaining );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_poly1305_finish( mbedtls_poly1305_context *ctx,
@@ -409,7 +409,7 @@
 
     poly1305_compute_mac( ctx, mac );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_poly1305_mac( const unsigned char key[32],
@@ -437,7 +437,7 @@
 
 cleanup:
     mbedtls_poly1305_free( &ctx );
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_POLY1305_ALT */
@@ -518,7 +518,7 @@
             if( verbose != 0 )          \
                 mbedtls_printf args;    \
                                         \
-            return( -1 );               \
+            return -1 ;               \
         }                               \
     }                                   \
     while( 0 )
@@ -549,7 +549,7 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 3574b98..9253ede 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -93,7 +93,7 @@
 
 static int key_type_is_raw_bytes( psa_key_type_t type )
 {
-    return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
+    return PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) ;
 }
 
 /* Values for psa_global_data_t::rng_state */
@@ -117,7 +117,7 @@
 
 #define GUARD_MODULE_INITIALIZED        \
     if( global_data.initialized == 0 )  \
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
 psa_status_t mbedtls_to_psa_error( int ret )
 {
@@ -128,190 +128,190 @@
     switch( low_level_ret != 0 ? low_level_ret : ret )
     {
         case 0:
-            return( PSA_SUCCESS );
+            return PSA_SUCCESS ;
 
         case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
         case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
         case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
         case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
         case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
         case MBEDTLS_ERR_ASN1_INVALID_DATA:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
         case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
-            return( PSA_ERROR_BUFFER_TOO_SMALL );
+            return PSA_ERROR_BUFFER_TOO_SMALL ;
 
 #if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
         case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
 #endif
         case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         case MBEDTLS_ERR_CCM_BAD_INPUT:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_CCM_AUTH_FAILED:
-            return( PSA_ERROR_INVALID_SIGNATURE );
+            return PSA_ERROR_INVALID_SIGNATURE ;
 
         case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
 
         case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
         case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
-            return( PSA_ERROR_INVALID_SIGNATURE );
+            return PSA_ERROR_INVALID_SIGNATURE ;
 
         case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
         case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
-            return( PSA_ERROR_INVALID_PADDING );
+            return PSA_ERROR_INVALID_PADDING ;
         case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
-            return( PSA_ERROR_INVALID_SIGNATURE );
+            return PSA_ERROR_INVALID_SIGNATURE ;
         case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
-            return( PSA_ERROR_CORRUPTION_DETECTED );
+            return PSA_ERROR_CORRUPTION_DETECTED ;
 
 #if !( defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) ||      \
        defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) )
         /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
          * functions are passed a CTR_DRBG instance. */
         case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_ENTROPY );
+            return PSA_ERROR_INSUFFICIENT_ENTROPY ;
         case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
         case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
-            return( PSA_ERROR_INSUFFICIENT_ENTROPY );
+            return PSA_ERROR_INSUFFICIENT_ENTROPY ;
 #endif
 
         case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
         case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
         case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_ENTROPY );
+            return PSA_ERROR_INSUFFICIENT_ENTROPY ;
 
         case MBEDTLS_ERR_GCM_AUTH_FAILED:
-            return( PSA_ERROR_INVALID_SIGNATURE );
+            return PSA_ERROR_INVALID_SIGNATURE ;
         case MBEDTLS_ERR_GCM_BAD_INPUT:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
 
 #if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) &&        \
     defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
         /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
          * functions are passed a HMAC_DRBG instance. */
         case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_ENTROPY );
+            return PSA_ERROR_INSUFFICIENT_ENTROPY ;
         case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
         case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
-            return( PSA_ERROR_INSUFFICIENT_ENTROPY );
+            return PSA_ERROR_INSUFFICIENT_ENTROPY ;
 #endif
 
         case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_MD_ALLOC_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
         case MBEDTLS_ERR_MD_FILE_IO_ERROR:
-            return( PSA_ERROR_STORAGE_FAILURE );
+            return PSA_ERROR_STORAGE_FAILURE ;
 
         case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
-            return( PSA_ERROR_STORAGE_FAILURE );
+            return PSA_ERROR_STORAGE_FAILURE ;
         case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
-            return( PSA_ERROR_BUFFER_TOO_SMALL );
+            return PSA_ERROR_BUFFER_TOO_SMALL ;
         case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_MPI_ALLOC_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
         case MBEDTLS_ERR_PK_ALLOC_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
         case MBEDTLS_ERR_PK_TYPE_MISMATCH:
         case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_PK_FILE_IO_ERROR:
-            return( PSA_ERROR_STORAGE_FAILURE );
+            return PSA_ERROR_STORAGE_FAILURE ;
         case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
         case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
         case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
-            return( PSA_ERROR_NOT_PERMITTED );
+            return PSA_ERROR_NOT_PERMITTED ;
         case MBEDTLS_ERR_PK_INVALID_PUBKEY:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_PK_INVALID_ALG:
         case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
         case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
-            return( PSA_ERROR_INVALID_SIGNATURE );
+            return PSA_ERROR_INVALID_SIGNATURE ;
         case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
-            return( PSA_ERROR_BUFFER_TOO_SMALL );
+            return PSA_ERROR_BUFFER_TOO_SMALL ;
 
         case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
-            return( PSA_ERROR_HARDWARE_FAILURE );
+            return PSA_ERROR_HARDWARE_FAILURE ;
         case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_RSA_INVALID_PADDING:
-            return( PSA_ERROR_INVALID_PADDING );
+            return PSA_ERROR_INVALID_PADDING ;
         case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
-            return( PSA_ERROR_HARDWARE_FAILURE );
+            return PSA_ERROR_HARDWARE_FAILURE ;
         case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
         case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
-            return( PSA_ERROR_CORRUPTION_DETECTED );
+            return PSA_ERROR_CORRUPTION_DETECTED ;
         case MBEDTLS_ERR_RSA_VERIFY_FAILED:
-            return( PSA_ERROR_INVALID_SIGNATURE );
+            return PSA_ERROR_INVALID_SIGNATURE ;
         case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
-            return( PSA_ERROR_BUFFER_TOO_SMALL );
+            return PSA_ERROR_BUFFER_TOO_SMALL ;
         case MBEDTLS_ERR_RSA_RNG_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_ENTROPY );
+            return PSA_ERROR_INSUFFICIENT_ENTROPY ;
 
         case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
         case MBEDTLS_ERR_ECP_INVALID_KEY:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
-            return( PSA_ERROR_BUFFER_TOO_SMALL );
+            return PSA_ERROR_BUFFER_TOO_SMALL ;
         case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
         case MBEDTLS_ERR_ECP_VERIFY_FAILED:
-            return( PSA_ERROR_INVALID_SIGNATURE );
+            return PSA_ERROR_INVALID_SIGNATURE ;
         case MBEDTLS_ERR_ECP_ALLOC_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
         case MBEDTLS_ERR_ECP_RANDOM_FAILED:
-            return( PSA_ERROR_INSUFFICIENT_ENTROPY );
+            return PSA_ERROR_INSUFFICIENT_ENTROPY ;
 
         case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
-            return( PSA_ERROR_CORRUPTION_DETECTED );
+            return PSA_ERROR_CORRUPTION_DETECTED ;
 
         default:
-            return( PSA_ERROR_GENERIC_ERROR );
+            return PSA_ERROR_GENERIC_ERROR ;
     }
 }
 
@@ -325,7 +325,7 @@
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
 static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
 {
-    return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
+    return psa_key_lifetime_is_external( slot->attr.lifetime ) ;
 }
 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
 
@@ -349,26 +349,26 @@
             {
 #if defined(PSA_WANT_ECC_SECP_R1_192)
                 case 192:
-                    return( MBEDTLS_ECP_DP_SECP192R1 );
+                    return MBEDTLS_ECP_DP_SECP192R1 ;
 #endif
 #if defined(PSA_WANT_ECC_SECP_R1_224)
                 case 224:
-                    return( MBEDTLS_ECP_DP_SECP224R1 );
+                    return MBEDTLS_ECP_DP_SECP224R1 ;
 #endif
 #if defined(PSA_WANT_ECC_SECP_R1_256)
                 case 256:
-                    return( MBEDTLS_ECP_DP_SECP256R1 );
+                    return MBEDTLS_ECP_DP_SECP256R1 ;
 #endif
 #if defined(PSA_WANT_ECC_SECP_R1_384)
                 case 384:
-                    return( MBEDTLS_ECP_DP_SECP384R1 );
+                    return MBEDTLS_ECP_DP_SECP384R1 ;
 #endif
 #if defined(PSA_WANT_ECC_SECP_R1_521)
                 case 521:
-                    return( MBEDTLS_ECP_DP_SECP521R1 );
+                    return MBEDTLS_ECP_DP_SECP521R1 ;
                 case 528:
                     if( bits_is_sloppy )
-                        return( MBEDTLS_ECP_DP_SECP521R1 );
+                        return MBEDTLS_ECP_DP_SECP521R1 ;
                     break;
 #endif
             }
@@ -379,15 +379,15 @@
             {
 #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
                 case 256:
-                    return( MBEDTLS_ECP_DP_BP256R1 );
+                    return MBEDTLS_ECP_DP_BP256R1 ;
 #endif
 #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
                 case 384:
-                    return( MBEDTLS_ECP_DP_BP384R1 );
+                    return MBEDTLS_ECP_DP_BP384R1 ;
 #endif
 #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
                 case 512:
-                    return( MBEDTLS_ECP_DP_BP512R1 );
+                    return MBEDTLS_ECP_DP_BP512R1 ;
 #endif
             }
             break;
@@ -397,15 +397,15 @@
             {
 #if defined(PSA_WANT_ECC_MONTGOMERY_255)
                 case 255:
-                    return( MBEDTLS_ECP_DP_CURVE25519 );
+                    return MBEDTLS_ECP_DP_CURVE25519 ;
                 case 256:
                     if( bits_is_sloppy )
-                        return( MBEDTLS_ECP_DP_CURVE25519 );
+                        return MBEDTLS_ECP_DP_CURVE25519 ;
                     break;
 #endif
 #if defined(PSA_WANT_ECC_MONTGOMERY_448)
                 case 448:
-                    return( MBEDTLS_ECP_DP_CURVE448 );
+                    return MBEDTLS_ECP_DP_CURVE448 ;
 #endif
             }
             break;
@@ -415,22 +415,22 @@
             {
 #if defined(PSA_WANT_ECC_SECP_K1_192)
                 case 192:
-                    return( MBEDTLS_ECP_DP_SECP192K1 );
+                    return MBEDTLS_ECP_DP_SECP192K1 ;
 #endif
 #if defined(PSA_WANT_ECC_SECP_K1_224)
                 case 224:
-                    return( MBEDTLS_ECP_DP_SECP224K1 );
+                    return MBEDTLS_ECP_DP_SECP224K1 ;
 #endif
 #if defined(PSA_WANT_ECC_SECP_K1_256)
                 case 256:
-                    return( MBEDTLS_ECP_DP_SECP256K1 );
+                    return MBEDTLS_ECP_DP_SECP256K1 ;
 #endif
             }
             break;
     }
 
     (void) bits_is_sloppy;
-    return( MBEDTLS_ECP_DP_NONE );
+    return MBEDTLS_ECP_DP_NONE ;
 }
 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
         * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
@@ -450,34 +450,34 @@
 #if defined(PSA_WANT_KEY_TYPE_AES)
         case PSA_KEY_TYPE_AES:
             if( bits != 128 && bits != 192 && bits != 256 )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
             break;
 #endif
 #if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
         case PSA_KEY_TYPE_CAMELLIA:
             if( bits != 128 && bits != 192 && bits != 256 )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
             break;
 #endif
 #if defined(PSA_WANT_KEY_TYPE_DES)
         case PSA_KEY_TYPE_DES:
             if( bits != 64 && bits != 128 && bits != 192 )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
             break;
 #endif
 #if defined(PSA_WANT_KEY_TYPE_CHACHA20)
         case PSA_KEY_TYPE_CHACHA20:
             if( bits != 256 )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
             break;
 #endif
         default:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
     }
     if( bits % 8 != 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /** Check whether a given key type is valid for use with a given MAC algorithm
@@ -501,7 +501,7 @@
     if( PSA_ALG_IS_HMAC( algorithm ) )
     {
         if( key_type == PSA_KEY_TYPE_HMAC )
-            return( PSA_SUCCESS );
+            return PSA_SUCCESS ;
     }
 
     if( PSA_ALG_IS_BLOCK_CIPHER_MAC( algorithm ) )
@@ -514,25 +514,25 @@
             /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
              * the block length (larger than 1) for block ciphers. */
             if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type ) > 1 )
-                return( PSA_SUCCESS );
+                return PSA_SUCCESS ;
         }
     }
 
-    return( PSA_ERROR_INVALID_ARGUMENT );
+    return PSA_ERROR_INVALID_ARGUMENT ;
 }
 
 psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
                                           size_t buffer_length )
 {
     if( slot->key.data != NULL )
-        return( PSA_ERROR_ALREADY_EXISTS );
+        return PSA_ERROR_ALREADY_EXISTS ;
 
     slot->key.data = mbedtls_calloc( 1, buffer_length );
     if( slot->key.data == NULL )
-        return( PSA_ERROR_INSUFFICIENT_MEMORY );
+        return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
     slot->key.bytes = buffer_length;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
@@ -542,10 +542,10 @@
     psa_status_t status = psa_allocate_buffer_to_slot( slot,
                                                        data_length );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     memcpy( slot->key.data, data, data_length );
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_import_key_into_slot(
@@ -559,7 +559,7 @@
 
     /* zero-length keys are never supported. */
     if( data_length == 0 )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     if( key_type_is_raw_bytes( type ) )
     {
@@ -567,23 +567,23 @@
 
         /* Ensure that the bytes-to-bits conversion hasn't overflown. */
         if( data_length > SIZE_MAX / 8 )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* Enforce a size limit, and in particular ensure that the bit
          * size fits in its representation type. */
         if( ( *bits ) > PSA_MAX_KEY_BITS )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         status = validate_unstructured_key_bit_size( type, *bits );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
 
         /* Copy the key material. */
         memcpy( key_buffer, data, data_length );
         *key_buffer_length = data_length;
         (void)key_buffer_size;
 
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
     else if( PSA_KEY_TYPE_IS_ASYMMETRIC( type ) )
     {
@@ -613,7 +613,7 @@
         * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
     }
 
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 /** Calculate the intersection of two algorithm usage policies.
@@ -627,7 +627,7 @@
 {
     /* Common case: both sides actually specify the same policy. */
     if( alg1 == alg2 )
-        return( alg1 );
+        return alg1 ;
     /* If the policies are from the same hash-and-sign family, check
      * if one is a wildcard. If so the other has the specific algorithm. */
     if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
@@ -635,9 +635,9 @@
         ( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
     {
         if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
-            return( alg2 );
+            return alg2 ;
         if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
-            return( alg1 );
+            return alg1 ;
     }
     /* If the policies are from the same AEAD family, check whether
      * one of them is a minimum-tag-length wildcard. Calculate the most
@@ -661,12 +661,12 @@
         if( ( ( alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
             ( alg1_len <= alg2_len ) )
         {
-            return( alg2 );
+            return alg2 ;
         }
         if( ( ( alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
             ( alg2_len <= alg1_len ) )
         {
-            return( alg1 );
+            return alg1 ;
         }
     }
     /* If the policies are from the same MAC family, check whether one
@@ -679,7 +679,7 @@
         /* Validate the combination of key type and algorithm. Since the base
          * algorithm of alg1 and alg2 are the same, we only need this once. */
         if( PSA_SUCCESS != psa_mac_key_can_do( alg1, key_type ) )
-            return( 0 );
+            return 0 ;
 
         /* Get the (exact or at-least) output lengths for both sides of the
          * requested intersection. None of the currently supported algorithms
@@ -697,7 +697,7 @@
         if( ( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
             ( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
         {
-            return( PSA_ALG_AT_LEAST_THIS_LENGTH_MAC( alg1, restricted_len ) );
+            return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC( alg1, restricted_len ) ;
         }
 
         /* If only one is an at-least-this-length policy, the intersection would
@@ -705,11 +705,11 @@
          * equal to or larger than the shortest allowed length. */
         if( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
         {
-            return( ( alg1_len <= alg2_len ) ? alg2 : 0 );
+            return ( alg1_len <= alg2_len ) ? alg2 : 0 ;
         }
         if( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
         {
-            return( ( alg2_len <= alg1_len ) ? alg1 : 0 );
+            return ( alg2_len <= alg1_len ) ? alg1 : 0 ;
         }
 
         /* If none of them are wildcards, check whether they define the same tag
@@ -717,10 +717,10 @@
          * the other specific-length. Ensure to always return the
          * specific-length version for the intersection. */
         if( alg1_len == alg2_len )
-            return( PSA_ALG_TRUNCATED_MAC( alg1, alg1_len ) );
+            return PSA_ALG_TRUNCATED_MAC( alg1, alg1_len ) ;
     }
     /* If the policies are incompatible, allow nothing. */
-    return( 0 );
+    return 0 ;
 }
 
 static int psa_key_algorithm_permits( psa_key_type_t key_type,
@@ -729,7 +729,7 @@
 {
     /* Common case: the policy only allows requested_alg. */
     if( requested_alg == policy_alg )
-        return( 1 );
+        return 1 ;
     /* If policy_alg is a hash-and-sign with a wildcard for the hash,
      * and requested_alg is the same hash-and-sign family with any hash,
      * then requested_alg is compliant with policy_alg. */
@@ -761,7 +761,7 @@
         /* Validate the combination of key type and algorithm. Since the policy
          * and requested algorithms are the same, we only need this once. */
         if( PSA_SUCCESS != psa_mac_key_can_do( policy_alg, key_type ) )
-            return( 0 );
+            return 0 ;
 
         /* Get both the requested output length for the algorithm which is to be
          * verified, and the default output length for the base algorithm.
@@ -777,14 +777,14 @@
         /* If the policy is default-length, only allow an algorithm with
          * a declared exact-length matching the default. */
         if( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == 0 )
-            return( requested_output_length == default_output_length );
+            return requested_output_length == default_output_length ;
 
         /* If the requested algorithm is default-length, allow it if the policy
          * length exactly matches the default length. */
         if( PSA_MAC_TRUNCATED_LENGTH( requested_alg ) == 0 &&
             PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == default_output_length )
         {
-            return( 1 );
+            return 1 ;
         }
 
         /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
@@ -806,7 +806,7 @@
                 policy_alg );
     }
     /* If it isn't explicitly permitted, it's forbidden. */
-    return( 0 );
+    return 0 ;
 }
 
 /** Test whether a policy permits an algorithm.
@@ -830,17 +830,17 @@
 {
     /* '0' is not a valid algorithm */
     if( alg == 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     /* A requested algorithm cannot be a wildcard. */
     if( PSA_ALG_IS_WILDCARD( alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     if( psa_key_algorithm_permits( key_type, policy->alg, alg ) ||
         psa_key_algorithm_permits( key_type, policy->alg2, alg ) )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     else
-        return( PSA_ERROR_NOT_PERMITTED );
+        return PSA_ERROR_NOT_PERMITTED ;
 }
 
 /** Restrict a key policy based on a constraint.
@@ -873,13 +873,13 @@
         psa_key_policy_algorithm_intersection( key_type, policy->alg2,
                                                constraint->alg2 );
     if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     policy->usage &= constraint->usage;
     policy->alg = intersection_alg;
     policy->alg2 = intersection_alg2;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /** Get the description of a key given its identifier and policy constraints
@@ -906,7 +906,7 @@
 
     status = psa_get_and_lock_key_slot( key, p_slot );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     slot = *p_slot;
 
     /* Enforce that usage policy for the key slot contains all the flags
@@ -932,13 +932,13 @@
             goto error;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 
 error:
     *p_slot = NULL;
     psa_unlock_key_slot( slot );
 
-    return( status );
+    return status ;
 }
 
 /** Get a key slot containing a transparent key and lock it.
@@ -963,16 +963,16 @@
     psa_status_t status = psa_get_and_lock_key_slot_with_policy( key, p_slot,
                                                                  usage, alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     if( psa_key_slot_is_external( *p_slot ) )
     {
         psa_unlock_key_slot( *p_slot );
         *p_slot = NULL;
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 #else /* MBEDTLS_PSA_CRYPTO_SE_C */
 /* With no secure element support, all keys are transparent. */
@@ -991,7 +991,7 @@
     slot->key.data = NULL;
     slot->key.bytes = 0;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /** Completely wipe a slot in memory, including its policy.
@@ -1023,7 +1023,7 @@
      * been wiped. Clear remaining metadata. We can call memset and not
      * zeroize because the metadata is not particularly sensitive. */
     memset( slot, 0, sizeof( *slot ) );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
@@ -1036,7 +1036,7 @@
 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
 
     if( mbedtls_svc_key_id_is_null( key ) )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     /*
      * Get the description of the key in a key slot. In case of a persistent
@@ -1047,7 +1047,7 @@
      */
     status = psa_get_and_lock_key_slot( key, &slot );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     /*
      * If the key slot containing the key description is under access by the
@@ -1059,7 +1059,7 @@
     if( slot->lock_count > 1 )
     {
        psa_unlock_key_slot( slot );
-       return( PSA_ERROR_GENERIC_ERROR );
+       return PSA_ERROR_GENERIC_ERROR ;
     }
 
     if( PSA_KEY_LIFETIME_IS_READ_ONLY( slot->attr.lifetime ) )
@@ -1139,7 +1139,7 @@
     /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
     if( status != PSA_SUCCESS )
         overall_status = status;
-    return( overall_status );
+    return overall_status ;
 }
 
 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
@@ -1181,7 +1181,7 @@
     mbedtls_mpi_free( &mpi );
     if( ret != 0 )
         mbedtls_free( buffer );
-    return( mbedtls_to_psa_error( ret ) );
+    return mbedtls_to_psa_error( ret ) ;
 }
 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
         * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
@@ -1199,7 +1199,7 @@
 
     status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     attributes->core = slot->attr;
     attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
@@ -1254,7 +1254,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
@@ -1265,10 +1265,10 @@
     if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
     {
         *slot_number = attributes->slot_number;
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
     else
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 }
 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
 
@@ -1279,12 +1279,12 @@
                                                     size_t *data_length )
 {
     if( key_buffer_size > data_size )
-        return( PSA_ERROR_BUFFER_TOO_SMALL );
+        return PSA_ERROR_BUFFER_TOO_SMALL ;
     memcpy( data, key_buffer, key_buffer_size );
     memset( data + key_buffer_size, 0,
             data_size - key_buffer_size );
     *data_length = key_buffer_size;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_export_key_internal(
@@ -1307,7 +1307,7 @@
         /* This shouldn't happen in the reference implementation, but
            it is valid for a special-purpose implementation to omit
            support for exporting certain key types. */
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 }
 
@@ -1324,7 +1324,7 @@
      * valid key representation. This way we know that data must be a valid
      * pointer and we can do things like memset(data, ..., data_size). */
     if( data_size == 0 )
-        return( PSA_ERROR_BUFFER_TOO_SMALL );
+        return PSA_ERROR_BUFFER_TOO_SMALL ;
 
     /* Set the key to empty now, so that even when there are errors, we always
      * set data_length to a value between 0 and data_size. On error, setting
@@ -1339,7 +1339,7 @@
     status = psa_get_and_lock_key_slot_with_policy( key, &slot,
                                                     PSA_KEY_USAGE_EXPORT, 0 );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     psa_key_attributes_t attributes = {
         .core = slot->attr
@@ -1350,7 +1350,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 psa_status_t psa_export_public_key_internal(
@@ -1385,7 +1385,7 @@
                                                        data_length ) );
 #else
             /* We don't know how to convert a private RSA key to public. */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
         * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
         }
@@ -1401,7 +1401,7 @@
                                                        data_length ) );
 #else
             /* We don't know how to convert a private ECC key to public */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
         * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
         }
@@ -1411,7 +1411,7 @@
         /* This shouldn't happen in the reference implementation, but
            it is valid for a special-purpose implementation to omit
            support for exporting certain key types. */
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 }
 
@@ -1428,7 +1428,7 @@
      * valid key representation. This way we know that data must be a valid
      * pointer and we can do things like memset(data, ..., data_size). */
     if( data_size == 0 )
-        return( PSA_ERROR_BUFFER_TOO_SMALL );
+        return PSA_ERROR_BUFFER_TOO_SMALL ;
 
     /* Set the key to empty now, so that even when there are errors, we always
      * set data_length to a value between 0 and data_size. On error, setting
@@ -1439,7 +1439,7 @@
     /* Exporting a public key doesn't require a usage flag. */
     status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
     {
@@ -1457,7 +1457,7 @@
 exit:
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 #if defined(static_assert)
@@ -1487,9 +1487,9 @@
                              PSA_KEY_USAGE_VERIFY_HASH |
                              PSA_KEY_USAGE_VERIFY_DERIVATION |
                              PSA_KEY_USAGE_DERIVE ) ) != 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /** Validate the internal consistency of key attributes.
@@ -1515,40 +1515,40 @@
 
     status = psa_validate_key_location( lifetime, p_drv );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     status = psa_validate_key_persistence( lifetime );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
     {
         if( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key ) != 0 )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
     else
     {
         if( !psa_is_valid_key_id( psa_get_key_id( attributes ), 0 ) )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 
     status = psa_validate_key_policy( &attributes->core.policy );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     /* Refuse to create overly large keys.
      * Note that this doesn't trigger on import if the attributes don't
      * explicitly specify a size (so psa_get_key_bits returns 0), so
      * psa_import_key() needs its own checks. */
     if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     /* Reject invalid flags. These should not be reachable through the API. */
     if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
                                      MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /** Prepare a key slot to receive key material.
@@ -1595,11 +1595,11 @@
 
     status = psa_validate_key_attributes( attributes, p_drv );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     slot = *p_slot;
 
     /* We're storing the declared bit-size of the key. It's up to each
@@ -1651,7 +1651,7 @@
         status = psa_find_se_slot_for_key( attributes, method, *p_drv,
                                            &slot_number );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
 
         if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
         {
@@ -1663,7 +1663,7 @@
             if( status != PSA_SUCCESS )
             {
                 (void) psa_crypto_stop_transaction( );
-                return( status );
+                return status ;
             }
         }
 
@@ -1674,11 +1674,11 @@
     if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
     {
         /* Key registration only makes sense with a secure element. */
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     }
 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /** Finalize the creation of a key once its key material has been set.
@@ -1765,7 +1765,7 @@
         if( status != PSA_SUCCESS )
         {
             psa_destroy_persistent_key( slot->attr.id );
-            return( status );
+            return status ;
         }
         status = psa_crypto_stop_transaction( );
     }
@@ -1779,7 +1779,7 @@
             *key = MBEDTLS_SVC_KEY_ID_INIT;
     }
 
-    return( status );
+    return status ;
 }
 
 /** Abort the creation of a key.
@@ -1838,7 +1838,7 @@
     if( attributes->core.type != 0 )
     {
         if( attributes->core.type != slot->attr.type )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 
     if( attributes->domain_parameters_size != 0 )
@@ -1857,7 +1857,7 @@
                                       slot->key.bytes,
                                       &rsa );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
 
             mbedtls_mpi_init( &actual );
             mbedtls_mpi_init( &required );
@@ -1878,23 +1878,23 @@
             mbedtls_mpi_free( &actual );
             mbedtls_mpi_free( &required );
             if( ret != 0)
-                return( mbedtls_to_psa_error( ret ) );
+                return mbedtls_to_psa_error( ret ) ;
         }
         else
 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
         * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
         {
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         }
     }
 
     if( attributes->core.bits != 0 )
     {
         if( attributes->core.bits != slot->attr.bits )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
@@ -1913,7 +1913,7 @@
      * This also rejects any key which might be encoded as an empty string,
      * which is never valid. */
     if( data_length == 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
                                      &slot, &driver );
@@ -1957,7 +1957,7 @@
     if( status != PSA_SUCCESS )
         psa_fail_key_creation( slot, driver );
 
-    return( status );
+    return status ;
 }
 
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
@@ -1974,9 +1974,9 @@
      * secure element, but not all secure elements support this
      * and the driver HAL doesn't currently support it. */
     if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     if( psa_get_key_bits( attributes ) == 0 )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
                                      &slot, &driver );
@@ -1991,7 +1991,7 @@
 
     /* Registration doesn't keep the key in RAM. */
     psa_close_key( key );
-    return( status );
+    return status ;
 }
 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
 
@@ -2002,12 +2002,12 @@
                                                            source->key.data,
                                                            source->key.bytes );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     target->attr.type = source->attr.type;
     target->attr.bits = source->attr.bits;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
@@ -2075,7 +2075,7 @@
 
     unlock_status = psa_unlock_key_slot( source_slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 
@@ -2088,12 +2088,12 @@
 {
     /* Aborting a non-active operation is allowed */
     if( operation->id == 0 )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     psa_status_t status = psa_driver_wrapper_hash_abort( operation );
     operation->id = 0;
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
@@ -2142,7 +2142,7 @@
     /* Don't require hash implementations to behave correctly on a
      * zero-length input, which may have an invalid pointer. */
     if( input_length == 0 )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     status = psa_driver_wrapper_hash_update( operation, input, input_length );
 
@@ -2150,7 +2150,7 @@
     if( status != PSA_SUCCESS )
         psa_hash_abort( operation );
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
@@ -2160,12 +2160,12 @@
 {
     *hash_length = 0;
     if( operation->id == 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     psa_status_t status = psa_driver_wrapper_hash_finish(
                             operation, hash, hash_size, hash_length );
     psa_hash_abort( operation );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
@@ -2195,7 +2195,7 @@
     if( status != PSA_SUCCESS )
         psa_hash_abort(operation);
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_hash_compute( psa_algorithm_t alg,
@@ -2205,7 +2205,7 @@
 {
     *hash_length = 0;
     if( !PSA_ALG_IS_HASH( alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     return( psa_driver_wrapper_hash_compute( alg, input, input_length,
                                              hash, hash_size, hash_length ) );
@@ -2219,19 +2219,19 @@
     size_t actual_hash_length;
 
     if( !PSA_ALG_IS_HASH( alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     psa_status_t status = psa_driver_wrapper_hash_compute(
                             alg, input, input_length,
                             actual_hash, sizeof(actual_hash),
                             &actual_hash_length );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     if( actual_hash_length != hash_length )
-        return( PSA_ERROR_INVALID_SIGNATURE );
+        return PSA_ERROR_INVALID_SIGNATURE ;
     if( mbedtls_psa_safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
-        return( PSA_ERROR_INVALID_SIGNATURE );
-    return( PSA_SUCCESS );
+        return PSA_ERROR_INVALID_SIGNATURE ;
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
@@ -2240,7 +2240,7 @@
     if( source_operation->id == 0 ||
         target_operation->id != 0 )
     {
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 
     psa_status_t status = psa_driver_wrapper_hash_clone( source_operation,
@@ -2248,7 +2248,7 @@
     if( status != PSA_SUCCESS )
         psa_hash_abort( target_operation );
 
-    return( status );
+    return status ;
 }
 
 
@@ -2260,14 +2260,14 @@
 {
     /* Aborting a non-active operation is allowed */
     if( operation->id == 0 )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     psa_status_t status = psa_driver_wrapper_mac_abort( operation );
     operation->mac_size = 0;
     operation->is_sign = 0;
     operation->id = 0;
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t psa_mac_finalize_alg_and_key_validation(
@@ -2280,12 +2280,12 @@
     size_t key_bits = psa_get_key_bits( attributes );
 
     if( ! PSA_ALG_IS_MAC( alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     /* Validate the combination of key type and algorithm */
     status = psa_mac_key_can_do( alg, key_type );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     /* Get the output length for the algorithm and key combination */
     *mac_size = PSA_MAC_LENGTH( key_type, key_bits, alg );
@@ -2296,7 +2296,7 @@
          * brute-forced. Ancient protocols with 32-bit MACs do exist,
          * so we make this our minimum, even though 32 bits is still
          * too small for security. */
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 
     if( *mac_size > PSA_MAC_LENGTH( key_type, key_bits,
@@ -2304,10 +2304,10 @@
     {
         /* It's impossible to "truncate" to a larger length than the full length
          * of the algorithm. */
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
@@ -2368,21 +2368,21 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
                                  mbedtls_svc_key_id_t key,
                                  psa_algorithm_t alg )
 {
-    return( psa_mac_setup( operation, key, alg, 1 ) );
+    return psa_mac_setup( operation, key, alg, 1 ) ;
 }
 
 psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
                                    mbedtls_svc_key_id_t key,
                                    psa_algorithm_t alg )
 {
-    return( psa_mac_setup( operation, key, alg, 0 ) );
+    return psa_mac_setup( operation, key, alg, 0 ) ;
 }
 
 psa_status_t psa_mac_update( psa_mac_operation_t *operation,
@@ -2390,19 +2390,19 @@
                              size_t input_length )
 {
     if( operation->id == 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     /* Don't require hash implementations to behave correctly on a
      * zero-length input, which may have an invalid pointer. */
     if( input_length == 0 )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     psa_status_t status = psa_driver_wrapper_mac_update( operation,
                                                          input, input_length );
     if( status != PSA_SUCCESS )
         psa_mac_abort( operation );
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
@@ -2462,7 +2462,7 @@
 
     abort_status = psa_mac_abort( operation );
 
-    return( status == PSA_SUCCESS ? abort_status : status );
+    return status == PSA_SUCCESS ? abort_status : status ;
 }
 
 psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
@@ -2496,7 +2496,7 @@
 exit:
     abort_status = psa_mac_abort( operation );
 
-    return( status == PSA_SUCCESS ? abort_status : status );
+    return status == PSA_SUCCESS ? abort_status : status ;
 }
 
 static psa_status_t psa_mac_compute_internal( mbedtls_svc_key_id_t key,
@@ -2559,7 +2559,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 psa_status_t psa_mac_compute( mbedtls_svc_key_id_t key,
@@ -2607,7 +2607,7 @@
 exit:
     mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
 
-    return ( status );
+    return status ;
 }
 
 /****************************************************************/
@@ -2620,21 +2620,21 @@
     if( input_is_message )
     {
         if( ! PSA_ALG_IS_SIGN_MESSAGE( alg ) )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
 
         if ( PSA_ALG_IS_HASH_AND_SIGN( alg ) )
         {
             if( ! PSA_ALG_IS_HASH( PSA_ALG_SIGN_GET_HASH( alg ) ) )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
         }
     }
     else
     {
         if( ! PSA_ALG_IS_HASH_AND_SIGN( alg ) )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t psa_sign_internal( mbedtls_svc_key_id_t key,
@@ -2661,7 +2661,7 @@
      * buffer can in principle be empty since it doesn't actually have
      * to be a hash.) */
     if( signature_size == 0 )
-        return( PSA_ERROR_BUFFER_TOO_SMALL );
+        return PSA_ERROR_BUFFER_TOO_SMALL ;
 
     status = psa_get_and_lock_key_slot_with_policy(
                 key, &slot,
@@ -2714,7 +2714,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 static psa_status_t psa_verify_internal( mbedtls_svc_key_id_t key,
@@ -2740,7 +2740,7 @@
                 alg );
 
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     psa_key_attributes_t attributes = {
       .core = slot->attr
@@ -2763,7 +2763,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 
 }
 
@@ -2799,7 +2799,7 @@
                     signature, signature_size, signature_length );
     }
 
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t psa_sign_message( mbedtls_svc_key_id_t key,
@@ -2846,7 +2846,7 @@
                     signature, signature_length );
     }
 
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t psa_verify_message( mbedtls_svc_key_id_t key,
@@ -2884,7 +2884,7 @@
         }
         else
         {
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         }
     }
     else
@@ -2904,7 +2904,7 @@
         }
         else
         {
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         }
     }
 
@@ -2916,7 +2916,7 @@
     (void)signature_size;
     (void)signature_length;
 
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
@@ -2955,7 +2955,7 @@
         }
         else
         {
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         }
     }
     else
@@ -2975,7 +2975,7 @@
         }
         else
         {
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         }
     }
 
@@ -2986,7 +2986,7 @@
     (void)signature;
     (void)signature_length;
 
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
@@ -3009,7 +3009,7 @@
     const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
     mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
 
-    return( mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg ) );
+    return mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg ) ;
 }
 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
 
@@ -3036,12 +3036,12 @@
     *output_length = 0;
 
     if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     status = psa_get_and_lock_transparent_key_slot_with_policy(
                  key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
             PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
     {
@@ -3119,7 +3119,7 @@
 exit:
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
@@ -3145,12 +3145,12 @@
     *output_length = 0;
 
     if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     status = psa_get_and_lock_transparent_key_slot_with_policy(
                  key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
     {
         status = PSA_ERROR_INVALID_ARGUMENT;
@@ -3227,7 +3227,7 @@
 exit:
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 
@@ -3300,21 +3300,21 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
                                        mbedtls_svc_key_id_t key,
                                        psa_algorithm_t alg )
 {
-    return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
+    return psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) ;
 }
 
 psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
                                        mbedtls_svc_key_id_t key,
                                        psa_algorithm_t alg )
 {
-    return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
+    return psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) ;
 }
 
 psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
@@ -3361,7 +3361,7 @@
     else
         psa_cipher_abort( operation );
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
@@ -3397,7 +3397,7 @@
         operation->iv_set = 1;
     else
         psa_cipher_abort( operation );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
@@ -3432,7 +3432,7 @@
     if( status != PSA_SUCCESS )
         psa_cipher_abort( operation );
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
@@ -3461,13 +3461,13 @@
 
 exit:
     if( status == PSA_SUCCESS )
-        return( psa_cipher_abort( operation ) );
+        return psa_cipher_abort( operation ) ;
     else
     {
         *output_length = 0;
         (void) psa_cipher_abort( operation );
 
-        return( status );
+        return status ;
     }
 }
 
@@ -3478,7 +3478,7 @@
         /* The object has (apparently) been initialized but it is not (yet)
          * in use. It's ok to call abort on such an object, and there's
          * nothing to do. */
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
 
     psa_driver_wrapper_cipher_abort( operation );
@@ -3487,7 +3487,7 @@
     operation->iv_set = 0;
     operation->iv_required = 0;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_cipher_encrypt( mbedtls_svc_key_id_t key,
@@ -3507,13 +3507,13 @@
     *output_length = 0;
 
     if( ! PSA_ALG_IS_CIPHER( alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     status = psa_get_and_lock_key_slot_with_policy( key, &slot,
                                                     PSA_KEY_USAGE_ENCRYPT,
                                                     alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     psa_key_attributes_t attributes = {
       .core = slot->attr
@@ -3543,7 +3543,7 @@
 exit:
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 psa_status_t psa_cipher_decrypt( mbedtls_svc_key_id_t key,
@@ -3561,13 +3561,13 @@
     *output_length = 0;
 
     if( ! PSA_ALG_IS_CIPHER( alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     status = psa_get_and_lock_key_slot_with_policy( key, &slot,
                                                     PSA_KEY_USAGE_DECRYPT,
                                                     alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     psa_key_attributes_t attributes = {
       .core = slot->attr
@@ -3587,7 +3587,7 @@
 exit:
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 
@@ -3613,12 +3613,12 @@
     *ciphertext_length = 0;
 
     if( !PSA_ALG_IS_AEAD( alg ) || PSA_ALG_IS_WILDCARD( alg ) )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     status = psa_get_and_lock_key_slot_with_policy(
                  key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     psa_key_attributes_t attributes = {
       .core = slot->attr
@@ -3637,7 +3637,7 @@
 
     psa_unlock_key_slot( slot );
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
@@ -3658,12 +3658,12 @@
     *plaintext_length = 0;
 
     if( !PSA_ALG_IS_AEAD( alg ) || PSA_ALG_IS_WILDCARD( alg ) )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     status = psa_get_and_lock_key_slot_with_policy(
                  key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     psa_key_attributes_t attributes = {
       .core = slot->attr
@@ -3682,7 +3682,7 @@
 
     psa_unlock_key_slot( slot );
 
-    return( status );
+    return status ;
 }
 
 /****************************************************************/
@@ -3719,7 +3719,7 @@
                                                 PSA_ALG_HMAC( hash_alg ) );
 
     psa_reset_key_attributes( &attributes );
-    return( status );
+    return status ;
 }
 #endif /* KDF algorithms reliant on HMAC */
 
@@ -3732,9 +3732,9 @@
     const psa_key_derivation_operation_t *operation )
 {
     if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
-        return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
+        return PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) ;
     else
-        return( operation->alg );
+        return operation->alg ;
 }
 
 psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
@@ -3795,7 +3795,7 @@
         status = PSA_ERROR_BAD_STATE;
     }
     mbedtls_platform_zeroize( operation, sizeof( *operation ) );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
@@ -3804,22 +3804,22 @@
     if( operation->alg == 0 )
     {
         /* This is a blank key derivation operation. */
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 
     *capacity = operation->capacity;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
                                          size_t capacity )
 {
     if( operation->alg == 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     if( capacity > operation->capacity )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     operation->capacity = capacity;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
@@ -3835,7 +3835,7 @@
     psa_status_t status;
 
     if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     hkdf->state = HKDF_STATE_OUTPUT;
 
     while( output_length != 0 )
@@ -3856,7 +3856,7 @@
          * object was corrupted or if this function is called directly
          * inside the library. */
         if( hkdf->block_number == 0xff )
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
 
         /* We need a new block */
         ++hkdf->block_number;
@@ -3867,7 +3867,7 @@
                                                 hkdf->prk,
                                                 hash_length );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
 
         if( hkdf->block_number != 1 )
         {
@@ -3875,26 +3875,26 @@
                                      hkdf->output_block,
                                      hash_length );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
         }
         status = psa_mac_update( &hkdf->hmac,
                                  hkdf->info,
                                  hkdf->info_length );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
         status = psa_mac_update( &hkdf->hmac,
                                  &hkdf->block_number, 1 );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
         status = psa_mac_sign_finish( &hkdf->hmac,
                                       hkdf->output_block,
                                       sizeof( hkdf->output_block ),
                                       &hmac_output_length );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
 
@@ -3916,7 +3916,7 @@
      * object was corrupted or if this function is called directly
      * inside the library. */
     if( tls12_prf->block_number == 0xff )
-        return( PSA_ERROR_CORRUPTION_DETECTED );
+        return PSA_ERROR_CORRUPTION_DETECTED ;
 
     /* We need a new block */
     ++tls12_prf->block_number;
@@ -4007,7 +4007,7 @@
     if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
         status = cleanup_status;
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t psa_key_derivation_tls12_prf_read(
@@ -4029,7 +4029,7 @@
         case PSA_TLS12_PRF_STATE_OUTPUT:
             break;
         default:
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
 
     while( output_length != 0 )
@@ -4040,7 +4040,7 @@
             status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
                                                                        alg );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
 
             continue;
         }
@@ -4057,7 +4057,7 @@
         tls12_prf->left_in_block -= length;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
         * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
@@ -4073,7 +4073,7 @@
     if( operation->alg == 0 )
     {
         /* This is a blank operation. */
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 
     if( output_length > operation->capacity )
@@ -4092,7 +4092,7 @@
          * INSUFFICIENT_CAPACITY, which is right for a finished
          * operation, for consistency with the case when
          * output_length > 0. */
-        return( PSA_ERROR_INSUFFICIENT_DATA );
+        return PSA_ERROR_INSUFFICIENT_DATA ;
     }
     operation->capacity -= output_length;
 
@@ -4119,7 +4119,7 @@
         * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
     {
         (void) kdf_alg;
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 
 exit:
@@ -4134,7 +4134,7 @@
         operation->alg = alg;
         memset( output, '!', output_length );
     }
-    return( status );
+    return status ;
 }
 
 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
@@ -4159,12 +4159,12 @@
     psa_status_t status;
 
     if( ! key_type_is_raw_bytes( slot->attr.type ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     if( bits % 8 != 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     data = mbedtls_calloc( 1, bytes );
     if( data == NULL )
-        return( PSA_ERROR_INSUFFICIENT_MEMORY );
+        return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
     status = psa_key_derivation_output_bytes( operation, data, bytes );
     if( status != PSA_SUCCESS )
@@ -4193,7 +4193,7 @@
 
 exit:
     mbedtls_free( data );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
@@ -4209,10 +4209,10 @@
     /* Reject any attempt to create a zero-length key so that we don't
      * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
     if( psa_get_key_bits( attributes ) == 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     if( ! operation->can_output_key )
-        return( PSA_ERROR_NOT_PERMITTED );
+        return PSA_ERROR_NOT_PERMITTED ;
 
     status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE, attributes,
                                      &slot, &driver );
@@ -4234,7 +4234,7 @@
     if( status != PSA_SUCCESS )
         psa_fail_key_creation( slot, driver );
 
-    return( status );
+    return status ;
 }
 
 
@@ -4277,18 +4277,18 @@
         psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
         size_t hash_size = PSA_HASH_LENGTH( hash_alg );
         if( hash_size == 0 )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
               PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
             ! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
         {
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         }
         operation->capacity = 255 * hash_size;
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
 
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 #endif /* AT_LEAST_ONE_BUILTIN_KDF */
 
@@ -4298,17 +4298,17 @@
     psa_status_t status;
 
     if( operation->alg != 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
     {
 #if defined(AT_LEAST_ONE_BUILTIN_KDF)
         psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
         status = psa_key_derivation_setup_kdf( operation, kdf_alg );
 #else
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* AT_LEAST_ONE_BUILTIN_KDF */
     }
     else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
@@ -4316,15 +4316,15 @@
 #if defined(AT_LEAST_ONE_BUILTIN_KDF)
         status = psa_key_derivation_setup_kdf( operation, alg );
 #else
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* AT_LEAST_ONE_BUILTIN_KDF */
     }
     else
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     if( status == PSA_SUCCESS )
         operation->alg = alg;
-    return( status );
+    return status ;
 }
 
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
@@ -4339,16 +4339,16 @@
     {
         case PSA_KEY_DERIVATION_INPUT_SALT:
             if( hkdf->state != HKDF_STATE_INIT )
-                return( PSA_ERROR_BAD_STATE );
+                return PSA_ERROR_BAD_STATE ;
             else
             {
                 status = psa_key_derivation_start_hmac( &hkdf->hmac,
                                                         hash_alg,
                                                         data, data_length );
                 if( status != PSA_SUCCESS )
-                    return( status );
+                    return status ;
                 hkdf->state = HKDF_STATE_STARTED;
-                return( PSA_SUCCESS );
+                return PSA_SUCCESS ;
             }
         case PSA_KEY_DERIVATION_INPUT_SECRET:
             /* If no salt was provided, use an empty salt. */
@@ -4358,42 +4358,42 @@
                                                         hash_alg,
                                                         NULL, 0 );
                 if( status != PSA_SUCCESS )
-                    return( status );
+                    return status ;
                 hkdf->state = HKDF_STATE_STARTED;
             }
             if( hkdf->state != HKDF_STATE_STARTED )
-                return( PSA_ERROR_BAD_STATE );
+                return PSA_ERROR_BAD_STATE ;
             status = psa_mac_update( &hkdf->hmac,
                                      data, data_length );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
             status = psa_mac_sign_finish( &hkdf->hmac,
                                           hkdf->prk,
                                           sizeof( hkdf->prk ),
                                           &data_length );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
             hkdf->offset_in_block = PSA_HASH_LENGTH( hash_alg );
             hkdf->block_number = 0;
             hkdf->state = HKDF_STATE_KEYED;
-            return( PSA_SUCCESS );
+            return PSA_SUCCESS ;
         case PSA_KEY_DERIVATION_INPUT_INFO:
             if( hkdf->state == HKDF_STATE_OUTPUT )
-                return( PSA_ERROR_BAD_STATE );
+                return PSA_ERROR_BAD_STATE ;
             if( hkdf->info_set )
-                return( PSA_ERROR_BAD_STATE );
+                return PSA_ERROR_BAD_STATE ;
             hkdf->info_length = data_length;
             if( data_length != 0 )
             {
                 hkdf->info = mbedtls_calloc( 1, data_length );
                 if( hkdf->info == NULL )
-                    return( PSA_ERROR_INSUFFICIENT_MEMORY );
+                    return PSA_ERROR_INSUFFICIENT_MEMORY ;
                 memcpy( hkdf->info, data, data_length );
             }
             hkdf->info_set = 1;
-            return( PSA_SUCCESS );
+            return PSA_SUCCESS ;
         default:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
@@ -4405,13 +4405,13 @@
                                             size_t data_length )
 {
     if( prf->state != PSA_TLS12_PRF_STATE_INIT )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     if( data_length != 0 )
     {
         prf->seed = mbedtls_calloc( 1, data_length );
         if( prf->seed == NULL )
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
         memcpy( prf->seed, data, data_length );
         prf->seed_length = data_length;
@@ -4419,7 +4419,7 @@
 
     prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
@@ -4427,13 +4427,13 @@
                                            size_t data_length )
 {
     if( prf->state != PSA_TLS12_PRF_STATE_SEED_SET )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     if( data_length != 0 )
     {
         prf->secret = mbedtls_calloc( 1, data_length );
         if( prf->secret == NULL )
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
         memcpy( prf->secret, data, data_length );
         prf->secret_length = data_length;
@@ -4441,7 +4441,7 @@
 
     prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
@@ -4449,13 +4449,13 @@
                                              size_t data_length )
 {
     if( prf->state != PSA_TLS12_PRF_STATE_KEY_SET )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     if( data_length != 0 )
     {
         prf->label = mbedtls_calloc( 1, data_length );
         if( prf->label == NULL )
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
         memcpy( prf->label, data, data_length );
         prf->label_length = data_length;
@@ -4463,7 +4463,7 @@
 
     prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
@@ -4474,13 +4474,13 @@
     switch( step )
     {
         case PSA_KEY_DERIVATION_INPUT_SEED:
-            return( psa_tls12_prf_set_seed( prf, data, data_length ) );
+            return psa_tls12_prf_set_seed( prf, data, data_length ) ;
         case PSA_KEY_DERIVATION_INPUT_SECRET:
-            return( psa_tls12_prf_set_key( prf, data, data_length ) );
+            return psa_tls12_prf_set_key( prf, data, data_length ) ;
         case PSA_KEY_DERIVATION_INPUT_LABEL:
-            return( psa_tls12_prf_set_label( prf, data, data_length ) );
+            return psa_tls12_prf_set_label( prf, data, data_length ) ;
         default:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
@@ -4497,7 +4497,7 @@
     uint8_t *cur = pms;
 
     if( data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     /* Quoting RFC 4279, Section 2:
      *
@@ -4518,7 +4518,7 @@
     status = psa_tls12_prf_set_key( prf, pms, cur - pms );
 
     mbedtls_platform_zeroize( pms, sizeof( pms ) );
-    return( status );
+    return status ;
 }
 
 static psa_status_t psa_tls12_prf_psk_to_ms_input(
@@ -4533,7 +4533,7 @@
                                                  data, data_length ) );
     }
 
-    return( psa_tls12_prf_input( prf, step, data, data_length ) );
+    return psa_tls12_prf_input( prf, step, data, data_length ) ;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
 
@@ -4554,21 +4554,21 @@
     {
         case PSA_KEY_DERIVATION_INPUT_SECRET:
             if( key_type == PSA_KEY_TYPE_DERIVE )
-                return( PSA_SUCCESS );
+                return PSA_SUCCESS ;
             if( key_type == PSA_KEY_TYPE_NONE )
-                return( PSA_SUCCESS );
+                return PSA_SUCCESS ;
             break;
         case PSA_KEY_DERIVATION_INPUT_LABEL:
         case PSA_KEY_DERIVATION_INPUT_SALT:
         case PSA_KEY_DERIVATION_INPUT_INFO:
         case PSA_KEY_DERIVATION_INPUT_SEED:
             if( key_type == PSA_KEY_TYPE_RAW_DATA )
-                return( PSA_SUCCESS );
+                return PSA_SUCCESS ;
             if( key_type == PSA_KEY_TYPE_NONE )
-                return( PSA_SUCCESS );
+                return PSA_SUCCESS ;
             break;
     }
-    return( PSA_ERROR_INVALID_ARGUMENT );
+    return PSA_ERROR_INVALID_ARGUMENT ;
 }
 
 static psa_status_t psa_key_derivation_input_internal(
@@ -4615,13 +4615,13 @@
         (void) data;
         (void) data_length;
         (void) kdf_alg;
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 
 exit:
     if( status != PSA_SUCCESS )
         psa_key_derivation_abort( operation );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_key_derivation_input_bytes(
@@ -4649,7 +4649,7 @@
     if( status != PSA_SUCCESS )
     {
         psa_key_derivation_abort( operation );
-        return( status );
+        return status ;
     }
 
     /* Passing a key object as a SECRET input unlocks the permission
@@ -4664,7 +4664,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 
@@ -4724,7 +4724,7 @@
     mbedtls_ecp_keypair_free( their_key );
     mbedtls_free( their_key );
 
-    return( status );
+    return status ;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
 
@@ -4743,7 +4743,7 @@
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
         case PSA_ALG_ECDH:
             if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
             mbedtls_ecp_keypair *ecp = NULL;
             psa_status_t status = mbedtls_psa_ecp_load_representation(
                                       private_key->attr.type,
@@ -4752,14 +4752,14 @@
                                       private_key->key.bytes,
                                       &ecp );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
             status = psa_key_agreement_ecdh( peer_key, peer_key_length,
                                              ecp,
                                              shared_secret, shared_secret_size,
                                              shared_secret_length );
             mbedtls_ecp_keypair_free( ecp );
             mbedtls_free( ecp );
-            return( status );
+            return status ;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
         default:
             (void) private_key;
@@ -4768,7 +4768,7 @@
             (void) shared_secret;
             (void) shared_secret_size;
             (void) shared_secret_length;
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
     }
 }
 
@@ -4806,7 +4806,7 @@
                                                 shared_secret_length );
 exit:
     mbedtls_platform_zeroize( shared_secret, shared_secret_length );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
@@ -4820,11 +4820,11 @@
     psa_key_slot_t *slot;
 
     if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     status = psa_get_and_lock_transparent_key_slot_with_policy(
                  private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     status = psa_key_agreement_internal( operation, step,
                                          slot,
                                          peer_key, peer_key_length );
@@ -4840,7 +4840,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
@@ -4886,7 +4886,7 @@
 
     unlock_status = psa_unlock_key_slot( slot );
 
-    return( ( status == PSA_SUCCESS ) ? unlock_status : status );
+    return ( status == PSA_SUCCESS ) ? unlock_status : status ;
 }
 
 
@@ -4944,7 +4944,7 @@
 #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
     /* Do nothing: the external RNG seeds itself. */
     (void) rng;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
     const unsigned char drbg_seed[] = "PSA";
     int ret = mbedtls_psa_drbg_seed( &rng->entropy,
@@ -4965,12 +4965,12 @@
                                                            output, output_size,
                                                            &output_length );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     /* Breaking up a request into smaller chunks is currently not supported
      * for the extrernal RNG interface. */
     if( output_length != output_size )
-        return( PSA_ERROR_INSUFFICIENT_ENTROPY );
-    return( PSA_SUCCESS );
+        return PSA_ERROR_INSUFFICIENT_ENTROPY ;
+    return PSA_SUCCESS ;
 
 #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
 
@@ -4983,11 +4983,11 @@
         int ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
                                           output, request_size );
         if( ret != 0 )
-            return( mbedtls_to_psa_error( ret ) );
+            return mbedtls_to_psa_error( ret ) ;
         output_size -= request_size;
         output += request_size;
     }
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
 }
 
@@ -5017,9 +5017,9 @@
     (void) p_rng;
     psa_status_t status = psa_generate_random( output, output_size );
     if( status == PSA_SUCCESS )
-        return( 0 );
+        return 0 ;
     else
-        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ;
 }
 #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
 
@@ -5030,14 +5030,14 @@
                                          size_t seed_size )
 {
     if( global_data.initialized )
-        return( PSA_ERROR_NOT_PERMITTED );
+        return PSA_ERROR_NOT_PERMITTED ;
 
     if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
           ( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
           ( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
 
-    return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
+    return mbedtls_psa_storage_inject_entropy( seed, seed_size ) ;
 }
 #endif /* MBEDTLS_PSA_INJECT_ENTROPY */
 
@@ -5063,19 +5063,19 @@
     {
         status = validate_unstructured_key_bit_size( type, bits );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
     }
     else
 #if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
     if( PSA_KEY_TYPE_IS_RSA( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
     {
         if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* Accept only byte-aligned keys, for the same reasons as
          * in psa_import_rsa_key(). */
         if( bits % 8 != 0 )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
     }
     else
 #endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */
@@ -5084,15 +5084,15 @@
     if( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
     {
         /* To avoid empty block, return successfully here. */
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
     else
 #endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
     {
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_generate_key_internal(
@@ -5104,13 +5104,13 @@
 
     if( ( attributes->domain_parameters == NULL ) &&
         ( attributes->domain_parameters_size != 0 ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     if( key_type_is_raw_bytes( type ) )
     {
         status = psa_generate_random( key_buffer, key_buffer_size );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
 
 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
         if( type == PSA_KEY_TYPE_DES )
@@ -5144,10 +5144,10 @@
 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
     {
         (void)key_buffer_length;
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
@@ -5163,7 +5163,7 @@
     /* Reject any attempt to create a zero-length key so that we don't
      * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
     if( psa_get_key_bits( attributes ) == 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE, attributes,
                                      &slot, &driver );
@@ -5213,7 +5213,7 @@
     if( status != PSA_SUCCESS )
         psa_fail_key_creation( slot, driver );
 
-    return( status );
+    return status ;
 }
 
 /****************************************************************/
@@ -5226,10 +5226,10 @@
     void (* entropy_free )( mbedtls_entropy_context *ctx ) )
 {
     if( global_data.rng_state != RNG_NOT_INITIALIZED )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     global_data.rng.entropy_init = entropy_init;
     global_data.rng.entropy_free = entropy_free;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 #endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
 
@@ -5272,7 +5272,7 @@
         default:
             /* We found an unsupported transaction in the storage.
              * We don't know what state the storage is in. Give up. */
-            return( PSA_ERROR_DATA_INVALID );
+            return PSA_ERROR_DATA_INVALID ;
     }
 }
 #endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
@@ -5283,7 +5283,7 @@
 
     /* Double initialization is explicitly allowed. */
     if( global_data.initialized != 0 )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     /* Initialize and seed the random generator. */
     mbedtls_psa_random_init( &global_data.rng );
@@ -5325,7 +5325,7 @@
 exit:
     if( status != PSA_SUCCESS )
         mbedtls_psa_crypto_free( );
-    return( status );
+    return status ;
 }
 
 #endif /* MBEDTLS_PSA_CRYPTO_C */
diff --git a/library/psa_crypto_aead.c b/library/psa_crypto_aead.c
index 356679c..8fca495 100644
--- a/library/psa_crypto_aead.c
+++ b/library/psa_crypto_aead.c
@@ -91,7 +91,7 @@
                                                 attributes->core.type, key_bits,
                                                 &cipher_id );
     if( cipher_info == NULL )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) )
     {
@@ -103,14 +103,14 @@
              * The call to mbedtls_ccm_encrypt_and_tag or
              * mbedtls_ccm_auth_decrypt will validate the tag length. */
             if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
 
             mbedtls_ccm_init( &operation->ctx.ccm );
             status = mbedtls_to_psa_error(
                 mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
                                     key_buffer, (unsigned int) key_bits ) );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
 
@@ -122,14 +122,14 @@
              * The call to mbedtls_gcm_crypt_and_tag or
              * mbedtls_gcm_auth_decrypt will validate the tag length. */
             if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 )
-                return( PSA_ERROR_INVALID_ARGUMENT );
+                return PSA_ERROR_INVALID_ARGUMENT ;
 
             mbedtls_gcm_init( &operation->ctx.gcm );
             status = mbedtls_to_psa_error(
                 mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
                                     key_buffer, (unsigned int) key_bits ) );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
 
@@ -139,31 +139,31 @@
             full_tag_length = 16;
             /* We only support the default tag length. */
             if( alg != PSA_ALG_CHACHA20_POLY1305 )
-                return( PSA_ERROR_NOT_SUPPORTED );
+                return PSA_ERROR_NOT_SUPPORTED ;
 
             mbedtls_chachapoly_init( &operation->ctx.chachapoly );
             status = mbedtls_to_psa_error(
                 mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
                                            key_buffer ) );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
             break;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
 
         default:
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
     }
 
     if( PSA_AEAD_TAG_LENGTH( attributes->core.type,
                              key_bits, alg )
         > full_tag_length )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     operation->tag_length = PSA_AEAD_TAG_LENGTH( attributes->core.type,
                                                  key_bits,
                                                  alg );
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t mbedtls_psa_aead_encrypt(
@@ -243,7 +243,7 @@
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
     {
         (void) tag;
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 
     if( status == PSA_SUCCESS )
@@ -252,7 +252,7 @@
 exit:
     psa_aead_abort_internal( &operation );
 
-    return( status );
+    return status ;
 }
 
 /* Locate the tag in a ciphertext buffer containing the encrypted data
@@ -268,12 +268,12 @@
 {
     size_t payload_length;
     if( tag_length > ciphertext_length )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     payload_length = ciphertext_length - tag_length;
     if( payload_length > plaintext_size )
-        return( PSA_ERROR_BUFFER_TOO_SMALL );
+        return PSA_ERROR_BUFFER_TOO_SMALL ;
     *p_tag = ciphertext + payload_length;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t mbedtls_psa_aead_decrypt(
@@ -349,7 +349,7 @@
     else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
     {
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 
     if( status == PSA_SUCCESS )
@@ -360,7 +360,7 @@
 
     if( status == PSA_SUCCESS )
         *plaintext_length = ciphertext_length - operation.tag_length;
-    return( status );
+    return status ;
 }
 
 #endif /* MBEDTLS_PSA_CRYPTO_C */
diff --git a/library/psa_crypto_cipher.c b/library/psa_crypto_cipher.c
index d8c722b..67d3fd0 100644
--- a/library/psa_crypto_cipher.c
+++ b/library/psa_crypto_cipher.c
@@ -102,13 +102,13 @@
                 mode = MBEDTLS_MODE_CHACHAPOLY;
                 break;
             default:
-                return( NULL );
+                return NULL ;
         }
     }
     else if( alg == PSA_ALG_CMAC )
         mode = MBEDTLS_MODE_ECB;
     else
-        return( NULL );
+        return NULL ;
 
     switch( key_type )
     {
@@ -135,7 +135,7 @@
             cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
             break;
         default:
-            return( NULL );
+            return NULL ;
     }
     if( cipher_id != NULL )
         *cipher_id = cipher_id_tmp;
@@ -167,7 +167,7 @@
     cipher_info = mbedtls_cipher_info_from_psa( alg, key_type,
                                                 key_bits, NULL );
     if( cipher_info == NULL )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
     if( ret != 0 )
@@ -219,7 +219,7 @@
     operation->iv_length = PSA_CIPHER_IV_LENGTH( key_type, alg );
 
 exit:
-    return( mbedtls_to_psa_error( ret ) );
+    return mbedtls_to_psa_error( ret ) ;
 }
 
 static psa_status_t cipher_encrypt_setup(
@@ -248,7 +248,7 @@
                             const uint8_t *iv, size_t iv_length )
 {
     if( iv_length != operation->iv_length )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     return( mbedtls_to_psa_error(
                 mbedtls_cipher_set_iv( &operation->ctx.cipher,
@@ -340,7 +340,7 @@
     status = PSA_SUCCESS;
 
 exit:
-    return( status );
+    return status ;
 }
 
 static psa_status_t cipher_update( mbedtls_psa_cipher_operation_t *operation,
@@ -369,7 +369,7 @@
     }
 
     if( output_size < expected_output_size )
-        return( PSA_ERROR_BUFFER_TOO_SMALL );
+        return PSA_ERROR_BUFFER_TOO_SMALL ;
 
     if( operation->alg == PSA_ALG_ECB_NO_PADDING )
     {
@@ -390,10 +390,10 @@
                                    input_length, output, output_length ) );
 
         if( *output_length > output_size )
-            return( PSA_ERROR_CORRUPTION_DETECTED );
+            return PSA_ERROR_CORRUPTION_DETECTED ;
     }
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t cipher_finish( mbedtls_psa_cipher_operation_t *operation,
@@ -432,7 +432,7 @@
     mbedtls_platform_zeroize( temp_output_buffer,
                               sizeof( temp_output_buffer ) );
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t cipher_abort( mbedtls_psa_cipher_operation_t *operation )
@@ -440,11 +440,11 @@
     /* Sanity check (shouldn't happen: operation->alg should
      * always have been initialized to a valid value). */
     if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     mbedtls_cipher_free( &operation->ctx.cipher );
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t cipher_encrypt( const psa_key_attributes_t *attributes,
@@ -497,7 +497,7 @@
         status = cipher_abort( &operation );
     else
         cipher_abort( &operation );
-    return( status );
+    return status ;
 }
 
 static psa_status_t cipher_decrypt( const psa_key_attributes_t *attributes,
@@ -546,7 +546,7 @@
         status = cipher_abort( &operation );
     else
         cipher_abort( &operation );
-    return( status );
+    return status ;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER || PSA_CRYPTO_DRIVER_TEST */
 
@@ -575,7 +575,7 @@
                                         const uint8_t *iv,
                                         size_t iv_length )
 {
-    return( cipher_set_iv( operation, iv, iv_length ) );
+    return cipher_set_iv( operation, iv, iv_length ) ;
 }
 
 psa_status_t mbedtls_psa_cipher_update( mbedtls_psa_cipher_operation_t *operation,
@@ -594,12 +594,12 @@
                                         size_t output_size,
                                         size_t *output_length )
 {
-    return( cipher_finish( operation, output, output_size, output_length ) );
+    return cipher_finish( operation, output, output_size, output_length ) ;
 }
 
 psa_status_t mbedtls_psa_cipher_abort( mbedtls_psa_cipher_operation_t *operation )
 {
-    return( cipher_abort( operation ) );
+    return cipher_abort( operation ) ;
 }
 
 psa_status_t mbedtls_psa_cipher_encrypt( const psa_key_attributes_t *attributes,
@@ -662,7 +662,7 @@
     mbedtls_psa_cipher_operation_t *operation,
     const uint8_t *iv, size_t iv_length )
 {
-    return( cipher_set_iv( operation, iv, iv_length ) );
+    return cipher_set_iv( operation, iv, iv_length ) ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_cipher_update(
@@ -678,13 +678,13 @@
     mbedtls_psa_cipher_operation_t *operation,
     uint8_t *output, size_t output_size, size_t *output_length )
 {
-    return( cipher_finish( operation, output, output_size, output_length ) );
+    return cipher_finish( operation, output, output_size, output_length ) ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_cipher_abort(
     mbedtls_psa_cipher_operation_t *operation )
 {
-    return( cipher_abort( operation ) );
+    return cipher_abort( operation ) ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_cipher_encrypt(
diff --git a/library/psa_crypto_client.c b/library/psa_crypto_client.c
index 629feb7..7dc36a8 100644
--- a/library/psa_crypto_client.c
+++ b/library/psa_crypto_client.c
@@ -47,7 +47,7 @@
     {
         copy = mbedtls_calloc( 1, data_length );
         if( copy == NULL )
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
         memcpy( copy, data, data_length );
     }
     /* After this point, this function is guaranteed to succeed, so it
@@ -63,7 +63,7 @@
     attributes->domain_parameters = copy;
     attributes->domain_parameters_size = data_length;
     attributes->core.type = type;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_get_key_domain_parameters(
@@ -71,12 +71,12 @@
     uint8_t *data, size_t data_size, size_t *data_length )
 {
     if( attributes->domain_parameters_size > data_size )
-        return( PSA_ERROR_BUFFER_TOO_SMALL );
+        return PSA_ERROR_BUFFER_TOO_SMALL ;
     *data_length = attributes->domain_parameters_size;
     if( attributes->domain_parameters_size != 0 )
         memcpy( data, attributes->domain_parameters,
                 attributes->domain_parameters_size );
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 #endif /* MBEDTLS_PSA_CRYPTO_CLIENT */
diff --git a/library/psa_crypto_core.h b/library/psa_crypto_core.h
index 91757b5..3265022 100644
--- a/library/psa_crypto_core.h
+++ b/library/psa_crypto_core.h
@@ -43,7 +43,7 @@
     for( i = 0; i < n; i++ )
         diff |= a[i] ^ b[i];
 
-    return( diff );
+    return diff ;
 }
 
 /** The data structure representing a key slot, containing key material
@@ -103,7 +103,7 @@
  */
 static inline int psa_is_key_slot_occupied( const psa_key_slot_t *slot )
 {
-    return( slot->attr.type != 0 );
+    return slot->attr.type != 0 ;
 }
 
 /** Test whether a key slot is locked.
@@ -116,7 +116,7 @@
  */
 static inline int psa_is_key_slot_locked( const psa_key_slot_t *slot )
 {
-    return( slot->lock_count > 0 );
+    return slot->lock_count > 0 ;
 }
 
 /** Retrieve flags from psa_key_slot_t::attr::core::flags.
@@ -130,7 +130,7 @@
 static inline uint16_t psa_key_slot_get_flags( const psa_key_slot_t *slot,
                                                uint16_t mask )
 {
-    return( slot->attr.flags & mask );
+    return slot->attr.flags & mask ;
 }
 
 /** Set flags in psa_key_slot_t::attr::core::flags.
diff --git a/library/psa_crypto_driver_wrappers.c b/library/psa_crypto_driver_wrappers.c
index 38d0e30..2d5095e 100644
--- a/library/psa_crypto_driver_wrappers.c
+++ b/library/psa_crypto_driver_wrappers.c
@@ -102,7 +102,7 @@
                         signature_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
             break;
@@ -122,7 +122,7 @@
                         signature_size,
                         signature_length );
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
             break;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
@@ -175,7 +175,7 @@
                         signature_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
             break;
@@ -194,7 +194,7 @@
                         signature,
                         signature_length ) );
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
             break;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
@@ -231,7 +231,7 @@
             drv->asymmetric->p_sign == NULL )
         {
             /* Key is defined in SE, but we have no way to exercise it */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         }
         return( drv->asymmetric->p_sign(
                     drv_context, *( (psa_key_slot_number_t *)key_buffer ),
@@ -262,7 +262,7 @@
                                                            signature_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
             /* Fell through, meaning no accelerator supports this operation */
@@ -294,7 +294,7 @@
         default:
             /* Key is declared with a lifetime not known to us */
             (void)status;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -315,7 +315,7 @@
             drv->asymmetric->p_verify == NULL )
         {
             /* Key is defined in SE, but we have no way to exercise it */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         }
         return( drv->asymmetric->p_verify(
                     drv_context, *( (psa_key_slot_number_t *)key_buffer ),
@@ -346,7 +346,7 @@
                          signature_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 
@@ -376,7 +376,7 @@
         default:
             /* Key is declared with a lifetime not known to us */
             (void)status;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -415,7 +415,7 @@
                         psa_get_key_id( attributes ) ) ) )
             {
                 *key_buffer_size = sizeof( psa_drv_slot_number_t );
-                return( PSA_SUCCESS );
+                return PSA_SUCCESS ;
             }
 #endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
             *key_buffer_size = mbedtls_test_size_function( key_type, key_bits );
@@ -426,7 +426,7 @@
         default:
             (void)key_type;
             (void)key_bits;
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
     }
 }
 
@@ -450,7 +450,7 @@
             drv->key_management->p_generate == NULL )
         {
             /* Key is defined as being in SE, but we have no way to generate it */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         }
         return( drv->key_management->p_generate(
             drv_context,
@@ -499,7 +499,7 @@
             break;
     }
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_driver_wrapper_import_key(
@@ -524,7 +524,7 @@
     {
         if( drv->key_management == NULL ||
             drv->key_management->p_import == NULL )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* The driver should set the number of key bits, however in
          * case it doesn't, we initialize bits to an invalid value. */
@@ -535,12 +535,12 @@
             attributes, data, data_length, bits );
 
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
 
         if( (*bits) > PSA_MAX_KEY_BITS )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
 #endif /* PSA_CRYPTO_SE_C */
 
@@ -558,7 +558,7 @@
                          key_buffer_length, bits );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
             /* Fell through, meaning no accelerator supports this operation */
@@ -571,7 +571,7 @@
             /* Importing a key with external storage in not yet supported.
              * Return in error indicating that the lifetime is not valid. */
             (void)status;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 
 }
@@ -596,7 +596,7 @@
         if( ( drv->key_management == NULL   ) ||
             ( drv->key_management->p_export == NULL ) )
         {
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         }
 
         return( drv->key_management->p_export(
@@ -630,7 +630,7 @@
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
             /* Key is declared with a lifetime not known to us */
-            return( status );
+            return status ;
     }
 }
 
@@ -654,7 +654,7 @@
         if( ( drv->key_management == NULL ) ||
             ( drv->key_management->p_export_public == NULL ) )
         {
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         }
 
         return( drv->key_management->p_export_public(
@@ -680,7 +680,7 @@
                          data_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
             /* Fell through, meaning no accelerator supports this operation */
@@ -705,7 +705,7 @@
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
             /* Key is declared with a lifetime not known to us */
-            return( status );
+            return status ;
     }
 }
 
@@ -729,7 +729,7 @@
             (void) key_buffer;
             (void) key_buffer_size;
             (void) key_buffer_length;
-            return( PSA_ERROR_DOES_NOT_EXIST );
+            return PSA_ERROR_DOES_NOT_EXIST ;
     }
 }
 
@@ -769,7 +769,7 @@
                                                               output_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 
@@ -784,7 +784,7 @@
                                                 output_size,
                                                 output_length ) );
 #else
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
 
         /* Add cases for opaque driver here */
@@ -814,7 +814,7 @@
             (void)output;
             (void)output_size;
             (void)output_length;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -851,7 +851,7 @@
                                                               output_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 
@@ -866,7 +866,7 @@
                                                 output_size,
                                                 output_length ) );
 #else
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
 
         /* Add cases for opaque driver here */
@@ -896,7 +896,7 @@
             (void)output;
             (void)output_size;
             (void)output_length;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -928,7 +928,7 @@
                 operation->id = PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID;
 
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
@@ -942,9 +942,9 @@
                 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
 
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* Add cases for opaque driver here */
 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
@@ -959,7 +959,7 @@
             if( status == PSA_SUCCESS )
                 operation->id = PSA_CRYPTO_OPAQUE_TEST_DRIVER_ID;
 
-            return( status );
+            return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
@@ -968,7 +968,7 @@
             (void)key_buffer;
             (void)key_buffer_size;
             (void)alg;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1000,7 +1000,7 @@
                 operation->id = PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID;
 
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
@@ -1013,9 +1013,9 @@
             if( status == PSA_SUCCESS )
                 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
 
-            return( status );
+            return status ;
 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* Add cases for opaque driver here */
 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
@@ -1030,7 +1030,7 @@
             if( status == PSA_SUCCESS )
                 operation->id = PSA_CRYPTO_OPAQUE_TEST_DRIVER_ID;
 
-            return( status );
+            return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
@@ -1039,7 +1039,7 @@
             (void)key_buffer;
             (void)key_buffer_size;
             (void)alg;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1075,7 +1075,7 @@
     (void)iv;
     (void)iv_length;
 
-    return( PSA_ERROR_INVALID_ARGUMENT );
+    return PSA_ERROR_INVALID_ARGUMENT ;
 }
 
 psa_status_t psa_driver_wrapper_cipher_update(
@@ -1121,7 +1121,7 @@
     (void)output_size;
     (void)output_length;
 
-    return( PSA_ERROR_INVALID_ARGUMENT );
+    return PSA_ERROR_INVALID_ARGUMENT ;
 }
 
 psa_status_t psa_driver_wrapper_cipher_finish(
@@ -1159,7 +1159,7 @@
     (void)output_size;
     (void)output_length;
 
-    return( PSA_ERROR_INVALID_ARGUMENT );
+    return PSA_ERROR_INVALID_ARGUMENT ;
 }
 
 psa_status_t psa_driver_wrapper_cipher_abort(
@@ -1171,7 +1171,7 @@
     {
 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
         case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
-            return( mbedtls_psa_cipher_abort( &operation->ctx.mbedtls_ctx ) );
+            return mbedtls_psa_cipher_abort( &operation->ctx.mbedtls_ctx ) ;
 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
 
 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
@@ -1182,7 +1182,7 @@
             mbedtls_platform_zeroize(
                 &operation->ctx.transparent_test_driver_ctx,
                 sizeof( operation->ctx.transparent_test_driver_ctx ) );
-            return( status );
+            return status ;
 
         case PSA_CRYPTO_OPAQUE_TEST_DRIVER_ID:
             status = mbedtls_test_opaque_cipher_abort(
@@ -1190,13 +1190,13 @@
             mbedtls_platform_zeroize(
                 &operation->ctx.opaque_test_driver_ctx,
                 sizeof( operation->ctx.opaque_test_driver_ctx ) );
-            return( status );
+            return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
     }
 
     (void)status;
-    return( PSA_ERROR_INVALID_ARGUMENT );
+    return PSA_ERROR_INVALID_ARGUMENT ;
 }
 
 /*
@@ -1217,7 +1217,7 @@
     status = mbedtls_test_transparent_hash_compute(
                 alg, input, input_length, hash, hash_size, hash_length );
     if( status != PSA_ERROR_NOT_SUPPORTED )
-        return( status );
+        return status ;
 #endif
 
     /* If software fallback is compiled in, try fallback */
@@ -1225,7 +1225,7 @@
     status = mbedtls_psa_hash_compute( alg, input, input_length,
                                        hash, hash_size, hash_length );
     if( status != PSA_ERROR_NOT_SUPPORTED )
-        return( status );
+        return status ;
 #endif
     (void) status;
     (void) alg;
@@ -1235,7 +1235,7 @@
     (void) hash_size;
     (void) hash_length;
 
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t psa_driver_wrapper_hash_setup(
@@ -1252,7 +1252,7 @@
         operation->id = PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID;
 
     if( status != PSA_ERROR_NOT_SUPPORTED )
-        return( status );
+        return status ;
 #endif
 
     /* If software fallback is compiled in, try fallback */
@@ -1262,13 +1262,13 @@
         operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
 
     if( status != PSA_ERROR_NOT_SUPPORTED )
-        return( status );
+        return status ;
 #endif
     /* Nothing left to try if we fall through here */
     (void) status;
     (void) operation;
     (void) alg;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t psa_driver_wrapper_hash_clone(
@@ -1292,7 +1292,7 @@
 #endif
         default:
             (void) target_operation;
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
 }
 
@@ -1317,7 +1317,7 @@
         default:
             (void) input;
             (void) input_length;
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
 }
 
@@ -1344,7 +1344,7 @@
             (void) hash;
             (void) hash_size;
             (void) hash_length;
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
 }
 
@@ -1355,7 +1355,7 @@
     {
 #if defined(MBEDTLS_PSA_BUILTIN_HASH)
         case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
-            return( mbedtls_psa_hash_abort( &operation->ctx.mbedtls_ctx ) );
+            return mbedtls_psa_hash_abort( &operation->ctx.mbedtls_ctx ) ;
 #endif
 #if defined(PSA_CRYPTO_DRIVER_TEST)
         case PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID:
@@ -1363,7 +1363,7 @@
                         &operation->ctx.test_driver_ctx ) );
 #endif
         default:
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
 }
 
@@ -1397,7 +1397,7 @@
                          ciphertext, ciphertext_size, ciphertext_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 
@@ -1415,7 +1415,7 @@
         default:
             /* Key is declared with a lifetime not known to us */
             (void)status;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1449,7 +1449,7 @@
                         plaintext, plaintext_size, plaintext_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 
@@ -1467,7 +1467,7 @@
         default:
             /* Key is declared with a lifetime not known to us */
             (void)status;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1503,7 +1503,7 @@
                 mac, mac_size, mac_length );
             /* Declared with fallback == true */
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
@@ -1513,9 +1513,9 @@
                 input, input_length,
                 mac, mac_size, mac_length );
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* Add cases for opaque driver here */
 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
@@ -1525,7 +1525,7 @@
                 attributes, key_buffer, key_buffer_size, alg,
                 input, input_length,
                 mac, mac_size, mac_length );
-            return( status );
+            return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
@@ -1539,7 +1539,7 @@
             (void) mac_size;
             (void) mac_length;
             (void) status;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1571,7 +1571,7 @@
                 operation->id = PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID;
 
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
@@ -1584,9 +1584,9 @@
                 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
 
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* Add cases for opaque driver here */
 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
@@ -1601,7 +1601,7 @@
             if( status == PSA_SUCCESS )
                 operation->id = PSA_CRYPTO_OPAQUE_TEST_DRIVER_ID;
 
-            return( status );
+            return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
@@ -1610,7 +1610,7 @@
             (void) key_buffer;
             (void) key_buffer_size;
             (void) alg;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1642,7 +1642,7 @@
                 operation->id = PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID;
 
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
@@ -1655,9 +1655,9 @@
                 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
 
             if( status != PSA_ERROR_NOT_SUPPORTED )
-                return( status );
+                return status ;
 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
 
         /* Add cases for opaque driver here */
 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
@@ -1672,7 +1672,7 @@
             if( status == PSA_SUCCESS )
                 operation->id = PSA_CRYPTO_OPAQUE_TEST_DRIVER_ID;
 
-            return( status );
+            return status ;
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
@@ -1681,7 +1681,7 @@
             (void) key_buffer;
             (void) key_buffer_size;
             (void) alg;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1714,7 +1714,7 @@
         default:
             (void) input;
             (void) input_length;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1749,7 +1749,7 @@
             (void) mac;
             (void) mac_size;
             (void) mac_length;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1782,7 +1782,7 @@
         default:
             (void) mac;
             (void) mac_length;
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
@@ -1793,7 +1793,7 @@
     {
 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
         case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
-            return( mbedtls_psa_mac_abort( &operation->ctx.mbedtls_ctx ) );
+            return mbedtls_psa_mac_abort( &operation->ctx.mbedtls_ctx ) ;
 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
 
 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
@@ -1807,7 +1807,7 @@
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
         default:
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 }
 
diff --git a/library/psa_crypto_ecp.c b/library/psa_crypto_ecp.c
index 3ce232c..f50898b 100644
--- a/library/psa_crypto_ecp.c
+++ b/library/psa_crypto_ecp.c
@@ -92,7 +92,7 @@
          * So its data length is 2m+1 where m is the curve size in bits.
          */
         if( ( data_length & 1 ) == 0 )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         curve_bytes = data_length / 2;
 
         /* Montgomery public keys are represented in compressed format, meaning
@@ -106,7 +106,7 @@
     {
         /* With an explicit bit-size, the data must have the matching length. */
         if( curve_bytes != PSA_BITS_TO_BYTES( curve_bits ) )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
     else
     {
@@ -119,7 +119,7 @@
     /* Allocate and initialize a key representation. */
     ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
     if( ecp == NULL )
-        return( PSA_ERROR_INSUFFICIENT_MEMORY );
+        return PSA_ERROR_INSUFFICIENT_MEMORY ;
     mbedtls_ecp_keypair_init( ecp );
 
     /* Load the group. */
@@ -179,7 +179,7 @@
         mbedtls_free( ecp );
     }
 
-    return( status );
+    return status ;
 }
 #endif /* defined(BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
         * defined(BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
@@ -227,7 +227,7 @@
     mbedtls_ecp_keypair_free( ecp );
     mbedtls_free( ecp );
 
-    return( status );
+    return status ;
 }
 
 psa_status_t mbedtls_psa_ecp_export_key( psa_key_type_t type,
@@ -249,7 +249,7 @@
                                  mbedtls_psa_get_random,
                                  MBEDTLS_PSA_RANDOM_STATE ) );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
         }
 
         status = mbedtls_to_psa_error(
@@ -261,12 +261,12 @@
         if( status != PSA_SUCCESS )
             memset( data, 0, data_size );
 
-        return( status );
+        return status ;
     }
     else
     {
         if( data_size < PSA_BITS_TO_BYTES( ecp->grp.nbits ) )
-            return( PSA_ERROR_BUFFER_TOO_SMALL );
+            return PSA_ERROR_BUFFER_TOO_SMALL ;
 
         status = mbedtls_to_psa_error(
                     mbedtls_ecp_write_key( ecp,
@@ -277,7 +277,7 @@
         else
             memset( data, 0, data_size );
 
-        return( status );
+        return status ;
     }
 }
 
@@ -293,7 +293,7 @@
         attributes->core.type, attributes->core.bits,
         key_buffer, key_buffer_size, &ecp );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     status = mbedtls_psa_ecp_export_key(
                  PSA_KEY_TYPE_ECC_PUBLIC_KEY(
@@ -303,7 +303,7 @@
     mbedtls_ecp_keypair_free( ecp );
     mbedtls_free( ecp );
 
-    return( status );
+    return status ;
 }
 #endif /* defined(BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
         * defined(BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
@@ -326,10 +326,10 @@
     mbedtls_ecp_keypair ecp;
 
     if( attributes->domain_parameters_size != 0 )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     mbedtls_ecp_keypair_init( &ecp );
     ret = mbedtls_ecp_gen_key( grp_id, &ecp,
@@ -338,7 +338,7 @@
     if( ret != 0 )
     {
         mbedtls_ecp_keypair_free( &ecp );
-        return( mbedtls_to_psa_error( ret ) );
+        return mbedtls_to_psa_error( ret ) ;
     }
 
     status = mbedtls_to_psa_error(
@@ -349,7 +349,7 @@
     if( status == PSA_SUCCESS )
         *key_buffer_length = key_buffer_size;
 
-    return( status );
+    return status ;
 }
 #endif /* defined(BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
 
@@ -377,7 +377,7 @@
                                                   key_buffer_size,
                                                   &ecp );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
     mbedtls_mpi_init( &r );
@@ -430,7 +430,7 @@
     mbedtls_ecp_keypair_free( ecp );
     mbedtls_free( ecp );
 
-    return( mbedtls_to_psa_error( ret ) );
+    return mbedtls_to_psa_error( ret ) ;
 }
 
 static psa_status_t ecdsa_verify_hash(
@@ -453,7 +453,7 @@
                                                   key_buffer_size,
                                                   &ecp );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
     mbedtls_mpi_init( &r );
@@ -489,7 +489,7 @@
     mbedtls_ecp_keypair_free( ecp );
     mbedtls_free( ecp );
 
-    return( mbedtls_to_psa_error( ret ) );
+    return mbedtls_to_psa_error( ret ) ;
 }
 
 #endif /* defined(BUILTIN_ALG_ECDSA) || \
@@ -632,7 +632,7 @@
     (void)signature;
     (void)signature_size;
     (void)signature_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 #endif
 }
 
@@ -656,7 +656,7 @@
     (void)hash_length;
     (void)signature;
     (void)signature_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 #endif
 }
 
diff --git a/library/psa_crypto_hash.c b/library/psa_crypto_hash.c
index 92dcbba..0093428 100644
--- a/library/psa_crypto_hash.c
+++ b/library/psa_crypto_hash.c
@@ -70,34 +70,34 @@
     {
 #if defined(MBEDTLS_MD5_C)
         case PSA_ALG_MD5:
-            return( &mbedtls_md5_info );
+            return &mbedtls_md5_info ;
 #endif
 #if defined(MBEDTLS_RIPEMD160_C)
         case PSA_ALG_RIPEMD160:
-            return( &mbedtls_ripemd160_info );
+            return &mbedtls_ripemd160_info ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case PSA_ALG_SHA_1:
-            return( &mbedtls_sha1_info );
+            return &mbedtls_sha1_info ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case PSA_ALG_SHA_224:
-            return( &mbedtls_sha224_info );
+            return &mbedtls_sha224_info ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case PSA_ALG_SHA_256:
-            return( &mbedtls_sha256_info );
+            return &mbedtls_sha256_info ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case PSA_ALG_SHA_384:
-            return( &mbedtls_sha384_info );
+            return &mbedtls_sha384_info ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case PSA_ALG_SHA_512:
-            return( &mbedtls_sha512_info );
+            return &mbedtls_sha512_info ;
 #endif
         default:
-            return( NULL );
+            return NULL ;
     }
 }
 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
@@ -154,10 +154,10 @@
             break;
 #endif
         default:
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
     operation->alg = 0;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t hash_setup(
@@ -169,7 +169,7 @@
     /* A context must be freshly initialized before it can be set up. */
     if( operation->alg != 0 )
     {
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 
     switch( alg )
@@ -225,7 +225,7 @@
         operation->alg = alg;
     else
         hash_abort( operation );
-    return( mbedtls_to_psa_error( ret ) );
+    return mbedtls_to_psa_error( ret ) ;
 }
 
 static psa_status_t hash_clone(
@@ -235,7 +235,7 @@
     switch( source_operation->alg )
     {
         case 0:
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
 #if defined(BUILTIN_ALG_MD5)
         case PSA_ALG_MD5:
             mbedtls_md5_clone( &target_operation->ctx.md5,
@@ -281,11 +281,11 @@
         default:
             (void) source_operation;
             (void) target_operation;
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
     }
 
     target_operation->alg = source_operation->alg;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t hash_update(
@@ -342,10 +342,10 @@
         default:
             (void) input;
             (void) input_length;
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
 
-    return( mbedtls_to_psa_error( ret ) );
+    return mbedtls_to_psa_error( ret ) ;
 }
 
 static psa_status_t hash_finish(
@@ -412,14 +412,14 @@
 #endif
         default:
             (void) hash;
-            return( PSA_ERROR_BAD_STATE );
+            return PSA_ERROR_BAD_STATE ;
     }
     status = mbedtls_to_psa_error( ret );
 
 exit:
     if( status == PSA_SUCCESS )
         *hash_length = actual_hash_length;
-    return( status );
+    return status ;
 }
 
 static psa_status_t hash_compute(
@@ -448,9 +448,9 @@
 exit:
     abort_status = hash_abort( &operation );
     if( status == PSA_SUCCESS )
-        return( abort_status );
+        return abort_status ;
     else
-        return( status );
+        return status ;
 
 }
 #endif /* MBEDTLS_PSA_BUILTIN_HASH || PSA_CRYPTO_DRIVER_TEST */
@@ -472,14 +472,14 @@
     mbedtls_psa_hash_operation_t *operation,
     psa_algorithm_t alg )
 {
-    return( hash_setup( operation, alg ) );
+    return hash_setup( operation, alg ) ;
 }
 
 psa_status_t mbedtls_psa_hash_clone(
     const mbedtls_psa_hash_operation_t *source_operation,
     mbedtls_psa_hash_operation_t *target_operation )
 {
-    return( hash_clone( source_operation, target_operation ) );
+    return hash_clone( source_operation, target_operation ) ;
 }
 
 psa_status_t mbedtls_psa_hash_update(
@@ -487,7 +487,7 @@
     const uint8_t *input,
     size_t input_length )
 {
-    return( hash_update( operation, input, input_length ) );
+    return hash_update( operation, input, input_length ) ;
 }
 
 psa_status_t mbedtls_psa_hash_finish(
@@ -496,13 +496,13 @@
     size_t hash_size,
     size_t *hash_length )
 {
-    return( hash_finish( operation, hash, hash_size, hash_length ) );
+    return hash_finish( operation, hash, hash_size, hash_length ) ;
 }
 
 psa_status_t mbedtls_psa_hash_abort(
     mbedtls_psa_hash_operation_t *operation )
 {
-    return( hash_abort( operation ) );
+    return hash_abort( operation ) ;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_HASH */
 
@@ -517,34 +517,34 @@
     {
 #if defined(MBEDTLS_PSA_ACCEL_ALG_MD5)
         case PSA_ALG_MD5:
-            return( 1 );
+            return 1 ;
 #endif
 #if defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160)
         case PSA_ALG_RIPEMD160:
-            return( 1 );
+            return 1 ;
 #endif
 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1)
         case PSA_ALG_SHA_1:
-            return( 1 );
+            return 1 ;
 #endif
 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224)
         case PSA_ALG_SHA_224:
-            return( 1 );
+            return 1 ;
 #endif
 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256)
         case PSA_ALG_SHA_256:
-            return( 1 );
+            return 1 ;
 #endif
 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384)
         case PSA_ALG_SHA_384:
-            return( 1 );
+            return 1 ;
 #endif
 #if defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512)
         case PSA_ALG_SHA_512:
-            return( 1 );
+            return 1 ;
 #endif
         default:
-            return( 0 );
+            return 0 ;
     }
 }
 
@@ -560,7 +560,7 @@
         return( hash_compute( alg, input, input_length,
                               hash, hash_size, hash_length ) );
     else
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_hash_setup(
@@ -568,9 +568,9 @@
     psa_algorithm_t alg )
 {
     if( is_hash_accelerated( alg ) )
-        return( hash_setup( operation, alg ) );
+        return hash_setup( operation, alg ) ;
     else
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_hash_clone(
@@ -578,9 +578,9 @@
     mbedtls_transparent_test_driver_hash_operation_t *target_operation )
 {
     if( is_hash_accelerated( source_operation->alg ) )
-        return( hash_clone( source_operation, target_operation ) );
+        return hash_clone( source_operation, target_operation ) ;
     else
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_hash_update(
@@ -589,9 +589,9 @@
     size_t input_length )
 {
     if( is_hash_accelerated( operation->alg ) )
-        return( hash_update( operation, input, input_length ) );
+        return hash_update( operation, input, input_length ) ;
     else
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_hash_finish(
@@ -601,15 +601,15 @@
     size_t *hash_length )
 {
     if( is_hash_accelerated( operation->alg ) )
-        return( hash_finish( operation, hash, hash_size, hash_length ) );
+        return hash_finish( operation, hash, hash_size, hash_length ) ;
     else
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_hash_abort(
     mbedtls_transparent_test_driver_hash_operation_t *operation )
 {
-    return( hash_abort( operation ) );
+    return hash_abort( operation ) ;
 }
 
 #endif /* PSA_CRYPTO_DRIVER_TEST */
diff --git a/library/psa_crypto_mac.c b/library/psa_crypto_mac.c
index 2c079d4..0f87a8d 100644
--- a/library/psa_crypto_mac.c
+++ b/library/psa_crypto_mac.c
@@ -47,21 +47,21 @@
     switch( alg )
     {
         case PSA_ALG_MD5:
-            return( 64 );
+            return 64 ;
         case PSA_ALG_RIPEMD160:
-            return( 64 );
+            return 64 ;
         case PSA_ALG_SHA_1:
-            return( 64 );
+            return 64 ;
         case PSA_ALG_SHA_224:
-            return( 64 );
+            return 64 ;
         case PSA_ALG_SHA_256:
-            return( 64 );
+            return 64 ;
         case PSA_ALG_SHA_384:
-            return( 128 );
+            return 128 ;
         case PSA_ALG_SHA_512:
-            return( 128 );
+            return 128 ;
         default:
-            return( 0 );
+            return 0 ;
     }
 }
 
@@ -69,7 +69,7 @@
     mbedtls_psa_hmac_operation_t *hmac )
 {
     mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
-    return( psa_hash_abort( &hmac->hash_ctx ) );
+    return psa_hash_abort( &hmac->hash_ctx ) ;
 }
 
 static psa_status_t psa_hmac_setup_internal(
@@ -93,11 +93,11 @@
      * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
      * because that triggers -Wlogical-op on GCC 7.3. */
     if( block_size > sizeof( ipad ) )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     if( block_size > sizeof( hmac->opad ) )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     if( block_size < hash_size )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     if( key_length > block_size )
     {
@@ -134,7 +134,7 @@
 cleanup:
     mbedtls_platform_zeroize( ipad, sizeof( ipad ) );
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t psa_hmac_update_internal(
@@ -142,7 +142,7 @@
     const uint8_t *data,
     size_t data_length )
 {
-    return( psa_hash_update( &hmac->hash_ctx, data, data_length ) );
+    return psa_hash_update( &hmac->hash_ctx, data, data_length ) ;
 }
 
 static psa_status_t psa_hmac_finish_internal(
@@ -158,7 +158,7 @@
 
     status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     /* From here on, tmp needs to be wiped. */
 
     status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
@@ -181,7 +181,7 @@
 
 exit:
     mbedtls_platform_zeroize( tmp, hash_size );
-    return( status );
+    return status ;
 }
 #endif /* BUILTIN_ALG_HMAC */
 
@@ -198,7 +198,7 @@
     if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_DES &&
         ( psa_get_key_bits( attributes ) == 64 ||
           psa_get_key_bits( attributes ) == 128 ) )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 #endif
 
     const mbedtls_cipher_info_t * cipher_info =
@@ -209,7 +209,7 @@
             NULL );
 
     if( cipher_info == NULL )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
     if( ret != 0 )
@@ -219,7 +219,7 @@
                                       key_buffer,
                                       psa_get_key_bits( attributes ) );
 exit:
-    return( mbedtls_to_psa_error( ret ) );
+    return mbedtls_to_psa_error( ret ) ;
 }
 #endif /* BUILTIN_ALG_CMAC */
 
@@ -260,7 +260,7 @@
 
     if( status != PSA_SUCCESS )
         memset( operation, 0, sizeof( *operation ) );
-    return( status );
+    return status ;
 }
 
 static psa_status_t mac_abort( mbedtls_psa_mac_operation_t *operation )
@@ -270,7 +270,7 @@
         /* The object has (apparently) been initialized but it is not
          * in use. It's ok to call abort on such an object, and there's
          * nothing to do. */
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
     else
 #if defined(BUILTIN_ALG_CMAC)
@@ -295,7 +295,7 @@
 
     operation->alg = 0;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 
 bad_state:
     /* If abort is called on an uninitialized object, we can't trust
@@ -303,7 +303,7 @@
      * This may result in a memory leak if a pointer gets overwritten,
      * but it's too late to do anything about this. */
     memset( operation, 0, sizeof( *operation ) );
-    return( PSA_ERROR_BAD_STATE );
+    return PSA_ERROR_BAD_STATE ;
 }
 
 static psa_status_t mac_setup( mbedtls_psa_mac_operation_t *operation,
@@ -316,11 +316,11 @@
 
     /* A context must be freshly initialized before it can be set up. */
     if( operation->alg != 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     status = mac_init( operation, alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
 #if defined(BUILTIN_ALG_CMAC)
     if( PSA_ALG_FULL_LENGTH_MAC( alg ) == PSA_ALG_CMAC )
@@ -352,7 +352,7 @@
     if( status != PSA_SUCCESS )
         mac_abort( operation );
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t mac_update(
@@ -361,7 +361,7 @@
     size_t input_length )
 {
     if( operation->alg == 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
 #if defined(BUILTIN_ALG_CMAC)
     if( PSA_ALG_FULL_LENGTH_MAC( operation->alg ) == PSA_ALG_CMAC )
@@ -385,7 +385,7 @@
          * a setup function. */
         (void) input;
         (void) input_length;
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 }
 
@@ -401,7 +401,7 @@
         if( ret == 0 )
             memcpy( mac, tmp, mac_size );
         mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
-        return( mbedtls_to_psa_error( ret ) );
+        return mbedtls_to_psa_error( ret ) ;
     }
     else
 #endif /* BUILTIN_ALG_CMAC */
@@ -419,7 +419,7 @@
         (void) operation;
         (void) mac;
         (void) mac_size;
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
     }
 }
 
@@ -432,14 +432,14 @@
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
 
     if( operation->alg == 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     status = mac_finish_internal( operation, mac, mac_size );
 
     if( status == PSA_SUCCESS )
         *mac_length = mac_size;
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t mac_verify_finish(
@@ -451,11 +451,11 @@
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
 
     if( operation->alg == 0 )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     /* Consistency check: requested MAC length fits our local buffer */
     if( mac_length > sizeof( actual_mac ) )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     status = mac_finish_internal( operation, actual_mac, mac_length );
     if( status != PSA_SUCCESS )
@@ -467,7 +467,7 @@
 cleanup:
     mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t mac_compute(
@@ -504,7 +504,7 @@
 exit:
     mac_abort( &operation );
 
-    return( status );
+    return status ;
 }
 
 #endif /* BUILTIN_ALG_HMAC || BUILTIN_ALG_CMAC */
@@ -553,7 +553,7 @@
     const uint8_t *input,
     size_t input_length )
 {
-    return( mac_update( operation, input, input_length ) );
+    return mac_update( operation, input, input_length ) ;
 }
 
 psa_status_t mbedtls_psa_mac_sign_finish(
@@ -562,7 +562,7 @@
     size_t mac_size,
     size_t *mac_length )
 {
-    return( mac_sign_finish( operation, mac, mac_size, mac_length ) );
+    return mac_sign_finish( operation, mac, mac_size, mac_length ) ;
 }
 
 psa_status_t mbedtls_psa_mac_verify_finish(
@@ -570,13 +570,13 @@
     const uint8_t *mac,
     size_t mac_length )
 {
-    return( mac_verify_finish( operation, mac, mac_length ) );
+    return mac_verify_finish( operation, mac, mac_length ) ;
 }
 
 psa_status_t mbedtls_psa_mac_abort(
     mbedtls_psa_mac_operation_t *operation )
 {
-    return( mac_abort( operation ) );
+    return mac_abort( operation ) ;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
 
@@ -589,17 +589,17 @@
 {
 #if defined(MBEDTLS_PSA_ACCEL_ALG_HMAC)
     if( PSA_ALG_IS_HMAC( alg ) )
-        return( 1 );
+        return 1 ;
 #endif
 
     switch( PSA_ALG_FULL_LENGTH_MAC( alg ) )
     {
 #if defined(MBEDTLS_PSA_ACCEL_ALG_CMAC)
         case PSA_ALG_CMAC:
-            return( 1 );
+            return 1 ;
 #endif
         default:
-            return( 0 );
+            return 0 ;
     }
 }
 
@@ -619,7 +619,7 @@
                              input, input_length,
                              mac, mac_size, mac_length ) );
     else
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_mac_sign_setup(
@@ -633,7 +633,7 @@
         return( mac_setup( operation, attributes,
                            key_buffer, key_buffer_size, alg ) );
     else
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_mac_verify_setup(
@@ -647,7 +647,7 @@
         return( mac_setup( operation, attributes,
                            key_buffer, key_buffer_size, alg ) );
     else
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_mac_update(
@@ -656,9 +656,9 @@
     size_t input_length )
 {
     if( is_mac_accelerated( operation->alg ) )
-        return( mac_update( operation, input, input_length ) );
+        return mac_update( operation, input, input_length ) ;
     else
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_mac_sign_finish(
@@ -668,9 +668,9 @@
     size_t *mac_length )
 {
     if( is_mac_accelerated( operation->alg ) )
-        return( mac_sign_finish( operation, mac, mac_size, mac_length ) );
+        return mac_sign_finish( operation, mac, mac_size, mac_length ) ;
     else
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_mac_verify_finish(
@@ -679,15 +679,15 @@
     size_t mac_length )
 {
     if( is_mac_accelerated( operation->alg ) )
-        return( mac_verify_finish( operation, mac, mac_length ) );
+        return mac_verify_finish( operation, mac, mac_length ) ;
     else
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 }
 
 psa_status_t mbedtls_transparent_test_driver_mac_abort(
     mbedtls_transparent_test_driver_mac_operation_t *operation )
 {
-    return( mac_abort( operation ) );
+    return mac_abort( operation ) ;
 }
 
 psa_status_t mbedtls_opaque_test_driver_mac_compute(
@@ -711,7 +711,7 @@
     (void) mac;
     (void) mac_size;
     (void) mac_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_opaque_test_driver_mac_sign_setup(
@@ -727,7 +727,7 @@
     (void) key_buffer;
     (void) key_buffer_size;
     (void) alg;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_opaque_test_driver_mac_verify_setup(
@@ -743,7 +743,7 @@
     (void) key_buffer;
     (void) key_buffer_size;
     (void) alg;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_opaque_test_driver_mac_update(
@@ -755,7 +755,7 @@
     (void) operation;
     (void) input;
     (void) input_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_opaque_test_driver_mac_sign_finish(
@@ -769,7 +769,7 @@
     (void) mac;
     (void) mac_size;
     (void) mac_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_opaque_test_driver_mac_verify_finish(
@@ -781,7 +781,7 @@
     (void) operation;
     (void) mac;
     (void) mac_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 psa_status_t mbedtls_opaque_test_driver_mac_abort(
@@ -789,7 +789,7 @@
 {
     /* Opaque driver testing is not implemented yet through this mechanism. */
     (void) operation;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 }
 
 #endif /* PSA_CRYPTO_DRIVER_TEST */
diff --git a/library/psa_crypto_rsa.c b/library/psa_crypto_rsa.c
index d85b86c..65233b0 100644
--- a/library/psa_crypto_rsa.c
+++ b/library/psa_crypto_rsa.c
@@ -93,7 +93,7 @@
             status = PSA_ERROR_NOT_SUPPORTED;
     }
     mbedtls_mpi_free( &n );
-    return( status );
+    return status ;
 }
 
 psa_status_t mbedtls_psa_rsa_load_representation(
@@ -144,7 +144,7 @@
 
 exit:
     mbedtls_pk_free( &ctx );
-    return( status );
+    return status ;
 }
 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
         * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) ||
@@ -189,7 +189,7 @@
     mbedtls_rsa_free( rsa );
     mbedtls_free( rsa );
 
-    return( status );
+    return status ;
 }
 
 psa_status_t mbedtls_psa_rsa_export_key( psa_key_type_t type,
@@ -219,7 +219,7 @@
     {
         /* Clean up in case pk_write failed halfway through. */
         memset( data, 0, data_size );
-        return( mbedtls_to_psa_error( ret ) );
+        return mbedtls_to_psa_error( ret ) ;
     }
 
     /* The mbedtls_pk_xxx functions write to the end of the buffer.
@@ -237,14 +237,14 @@
     }
 
     *data_length = ret;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 #else
     (void) type;
     (void) rsa;
     (void) data;
     (void) data_size;
     (void) data_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* MBEDTLS_PK_WRITE_C */
 }
 
@@ -259,7 +259,7 @@
     status = mbedtls_psa_rsa_load_representation(
                  attributes->core.type, key_buffer, key_buffer_size, &rsa );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     status = mbedtls_psa_rsa_export_key( PSA_KEY_TYPE_RSA_PUBLIC_KEY,
                                          rsa,
@@ -270,7 +270,7 @@
     mbedtls_rsa_free( rsa );
     mbedtls_free( rsa );
 
-    return( status );
+    return status ;
 }
 #endif /* defined(BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
         * defined(BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
@@ -287,20 +287,20 @@
     if( domain_parameters_size == 0 )
     {
         *exponent = 65537;
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
 
     /* Mbed TLS encodes the public exponent as an int. For simplicity, only
      * support values that fit in a 32-bit integer, which is larger than
      * int on just about every platform anyway. */
     if( domain_parameters_size > sizeof( acc ) )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     for( i = 0; i < domain_parameters_size; i++ )
         acc = ( acc << 8 ) | domain_parameters[i];
     if( acc > INT_MAX )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     *exponent = acc;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t rsa_generate_key(
@@ -316,7 +316,7 @@
                                     attributes->domain_parameters_size,
                                     &exponent );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     mbedtls_rsa_init( &rsa );
     ret = mbedtls_rsa_gen_key( &rsa,
@@ -325,14 +325,14 @@
                                (unsigned int)attributes->core.bits,
                                exponent );
     if( ret != 0 )
-        return( mbedtls_to_psa_error( ret ) );
+        return mbedtls_to_psa_error( ret ) ;
 
     status = mbedtls_psa_rsa_export_key( attributes->core.type,
                                          &rsa, key_buffer, key_buffer_size,
                                          key_buffer_length );
     mbedtls_rsa_free( &rsa );
 
-    return( status );
+    return status ;
 }
 #endif /* defined(BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
         * defined(MBEDTLS_GENPRIME) */
@@ -358,19 +358,19 @@
      * overflow later. */
 #if SIZE_MAX > UINT_MAX
     if( hash_length > UINT_MAX )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 #endif
 
     /* For signatures using a hash, the hash length must be correct. */
     if( alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
     {
         if( md_info == NULL )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         if( mbedtls_md_get_size( md_info ) != hash_length )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static psa_status_t rsa_sign_hash(
@@ -389,7 +389,7 @@
                                                   key_buffer_size,
                                                   &rsa );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
     if( status != PSA_SUCCESS )
@@ -450,7 +450,7 @@
     mbedtls_rsa_free( rsa );
     mbedtls_free( rsa );
 
-    return( status );
+    return status ;
 }
 
 static psa_status_t rsa_verify_hash(
@@ -528,7 +528,7 @@
     mbedtls_rsa_free( rsa );
     mbedtls_free( rsa );
 
-    return( status );
+    return status ;
 }
 
 #endif /* defined(BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
@@ -669,7 +669,7 @@
     (void)signature;
     (void)signature_size;
     (void)signature_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 #endif
 }
 
@@ -695,7 +695,7 @@
     (void)hash_length;
     (void)signature;
     (void)signature_length;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 #endif
 }
 #endif /* defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN) ||
diff --git a/library/psa_crypto_se.c b/library/psa_crypto_se.c
index 56678d6..8b185cf 100644
--- a/library/psa_crypto_se.c
+++ b/library/psa_crypto_se.c
@@ -82,25 +82,25 @@
      * (which designates transparent keys). Make sure we never return
      * a driver entry for location 0. */
     if( location == 0 )
-        return( NULL );
+        return NULL ;
     for( i = 0; i < PSA_MAX_SE_DRIVERS; i++ )
     {
         if( driver_table[i].location == location )
-            return( &driver_table[i] );
+            return &driver_table[i] ;
     }
-    return( NULL );
+    return NULL ;
 }
 
 const psa_drv_se_t *psa_get_se_driver_methods(
     const psa_se_drv_table_entry_t *driver )
 {
-    return( driver->methods );
+    return driver->methods ;
 }
 
 psa_drv_se_context_t *psa_get_se_driver_context(
     psa_se_drv_table_entry_t *driver )
 {
-    return( &driver->u.context );
+    return &driver->u.context ;
 }
 
 int psa_get_se_driver( psa_key_lifetime_t lifetime,
@@ -112,7 +112,7 @@
         *p_methods = ( driver ? driver->methods : NULL );
     if( p_drv_context != NULL )
         *p_drv_context = ( driver ? &driver->u.context : NULL );
-    return( driver != NULL );
+    return driver != NULL ;
 }
 
 
@@ -126,17 +126,17 @@
     psa_storage_uid_t *uid )
 {
     if( driver->location > PSA_MAX_SE_LOCATION )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
 #if SIZE_MAX > UINT32_MAX
     /* ITS file sizes are limited to 32 bits. */
     if( driver->u.internal.persistent_data_size > UINT32_MAX )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 #endif
 
     /* See the documentation of PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE. */
     *uid = PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE + driver->location;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_load_se_persistent_data(
@@ -148,7 +148,7 @@
 
     status = psa_get_se_driver_its_file_uid( driver, &uid );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     /* Read the amount of persistent data that the driver requests.
      * If the data in storage is larger, it is truncated. If the data
@@ -171,7 +171,7 @@
 
     status = psa_get_se_driver_its_file_uid( driver, &uid );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     /* psa_get_se_driver_its_file_uid ensures that the size_t
      * persistent_data_size is in range, but compilers don't know that,
@@ -186,9 +186,9 @@
 {
     psa_storage_uid_t uid;
     if( location > PSA_MAX_SE_LOCATION )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     uid = PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE + location;
-    return( psa_its_remove( uid ) );
+    return psa_its_remove( uid ) ;
 }
 
 psa_status_t psa_find_se_slot_for_key(
@@ -203,11 +203,11 @@
 
     /* If the location is wrong, it's a bug in the library. */
     if( driver->location != key_location )
-        return( PSA_ERROR_CORRUPTION_DETECTED );
+        return PSA_ERROR_CORRUPTION_DETECTED ;
 
     /* If the driver doesn't support key creation in any way, give up now. */
     if( driver->methods->key_management == NULL )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     if( psa_get_key_slot_number( attributes, slot_number ) == PSA_SUCCESS )
     {
@@ -218,7 +218,7 @@
         psa_drv_se_validate_slot_number_t p_validate_slot_number =
             driver->methods->key_management->p_validate_slot_number;
         if( p_validate_slot_number == NULL )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         status = p_validate_slot_number( &driver->u.context,
                                          driver->u.internal.persistent_data,
                                          attributes, method,
@@ -228,7 +228,7 @@
     {
         /* The application didn't specify a slot number. This doesn't
          * make sense when registering a slot. */
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     }
     else
     {
@@ -237,13 +237,13 @@
         psa_drv_se_allocate_key_t p_allocate =
             driver->methods->key_management->p_allocate;
         if( p_allocate == NULL )
-            return( PSA_ERROR_NOT_SUPPORTED );
+            return PSA_ERROR_NOT_SUPPORTED ;
         status = p_allocate( &driver->u.context,
                              driver->u.internal.persistent_data,
                              attributes, method,
                              slot_number );
     }
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_destroy_se_key( psa_se_drv_table_entry_t *driver,
@@ -261,13 +261,13 @@
      * keys, it's really a lack of permission. */
     if( driver->methods->key_management == NULL ||
         driver->methods->key_management->p_destroy == NULL )
-        return( PSA_ERROR_NOT_PERMITTED );
+        return PSA_ERROR_NOT_PERMITTED ;
     status = driver->methods->key_management->p_destroy(
         &driver->u.context,
         driver->u.internal.persistent_data,
         slot_number );
     storage_status = psa_save_se_persistent_data( driver );
-    return( status == PSA_SUCCESS ? storage_status : status );
+    return status == PSA_SUCCESS ? storage_status : status ;
 }
 
 psa_status_t psa_init_all_se_drivers( void )
@@ -286,13 +286,13 @@
                 driver->u.internal.persistent_data,
                 driver->location );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
             status = psa_save_se_persistent_data( driver );
             if( status != PSA_SUCCESS )
-                return( status );
+                return status ;
         }
     }
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 
@@ -309,7 +309,7 @@
     psa_status_t status;
 
     if( methods->hal_version != PSA_DRV_SE_HAL_VERSION )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     /* Driver table entries are 0-initialized. 0 is not a valid driver
      * location because it means a transparent key. */
 #if defined(static_assert)
@@ -317,9 +317,9 @@
                    "Secure element support requires 0 to mean a local key" );
 #endif
     if( location == PSA_KEY_LOCATION_LOCAL_STORAGE )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
     if( location > PSA_MAX_SE_LOCATION )
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 
     for( i = 0; i < PSA_MAX_SE_DRIVERS; i++ )
     {
@@ -329,10 +329,10 @@
          * entry. Since entries are created in order and never deleted,
          * there can't be a used entry after the first free entry. */
         if( driver_table[i].location == location )
-            return( PSA_ERROR_ALREADY_EXISTS );
+            return PSA_ERROR_ALREADY_EXISTS ;
     }
     if( i == PSA_MAX_SE_DRIVERS )
-        return( PSA_ERROR_INSUFFICIENT_MEMORY );
+        return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
     driver_table[i].location = location;
     driver_table[i].methods = methods;
@@ -356,11 +356,11 @@
             goto error;
     }
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 
 error:
     memset( &driver_table[i], 0, sizeof( driver_table[i] ) );
-    return( status );
+    return status ;
 }
 
 void psa_unregister_all_se_drivers( void )
diff --git a/library/psa_crypto_slot_management.c b/library/psa_crypto_slot_management.c
index a5c43b1..942f8b4 100644
--- a/library/psa_crypto_slot_management.c
+++ b/library/psa_crypto_slot_management.c
@@ -57,14 +57,14 @@
 
     if( ( PSA_KEY_ID_USER_MIN <= key_id ) &&
         ( key_id <= PSA_KEY_ID_USER_MAX ) )
-        return( 1 );
+        return 1 ;
 
     if( vendor_ok &&
         ( PSA_KEY_ID_VENDOR_MIN <= key_id ) &&
         ( key_id <= PSA_KEY_ID_VENDOR_MAX ) )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /** Get the description in memory of a key given its identifier and lock it.
@@ -124,7 +124,7 @@
     else
     {
         if ( !psa_is_valid_key_id( key, 1 ) )
-            return( PSA_ERROR_INVALID_HANDLE );
+            return PSA_ERROR_INVALID_HANDLE ;
 
         for( slot_idx = 0; slot_idx < MBEDTLS_PSA_KEY_SLOT_COUNT; slot_idx++ )
         {
@@ -143,7 +143,7 @@
             *p_slot = slot;
     }
 
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_initialize_key_slots( void )
@@ -152,7 +152,7 @@
      * guarantee that the key slots are initialized to all-zero, which
      * means that all the key slots are in a valid, empty state. */
     global_data.key_slots_initialized = 1;
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 void psa_wipe_all_key_slots( void )
@@ -222,7 +222,7 @@
             ( (psa_key_id_t)( selected_slot - global_data.key_slots ) );
         *p_slot = selected_slot;
 
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
     status = PSA_ERROR_INSUFFICIENT_MEMORY;
 
@@ -230,7 +230,7 @@
     *p_slot = NULL;
     *volatile_key_id = 0;
 
-    return( status );
+    return status ;
 }
 
 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
@@ -270,7 +270,7 @@
 
 exit:
     psa_free_persistent_key_data( key_data, key_data_length );
-    return( status );
+    return status ;
 }
 #endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C */
 
@@ -288,14 +288,14 @@
     if( ! psa_key_id_is_builtin(
             MBEDTLS_SVC_KEY_ID_GET_KEY_ID( slot->attr.id ) ) )
     {
-        return( PSA_ERROR_DOES_NOT_EXIST );
+        return PSA_ERROR_DOES_NOT_EXIST ;
     }
 
     /* Check the platform function to see whether this key actually exists */
     status = mbedtls_psa_platform_get_builtin_key(
                 slot->attr.id, &lifetime, &slot_number );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     /* Set required key attributes to ensure get_builtin_key can retrieve the
      * full attributes. */
@@ -312,7 +312,7 @@
         /* Builtin keys cannot be defined by the attributes alone */
         if( status == PSA_SUCCESS )
             status = PSA_ERROR_CORRUPTION_DETECTED;
-        return( status );
+        return status ;
     }
 
     /* If the key should exist according to the platform, then ask the driver
@@ -320,13 +320,13 @@
     status = psa_driver_wrapper_get_key_buffer_size( &attributes,
                                                      &key_buffer_size );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     /* Allocate a buffer of the required size and load the builtin key directly
      * into the (now properly sized) slot buffer. */
     status = psa_allocate_buffer_to_slot( slot, key_buffer_size );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     status = psa_driver_wrapper_get_builtin_key(
                 slot_number, &attributes,
@@ -341,7 +341,7 @@
 exit:
     if( status != PSA_SUCCESS )
         psa_remove_key_data_from_memory( slot );
-    return( status );
+    return status ;
 }
 #endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
 
@@ -352,7 +352,7 @@
 
     *p_slot = NULL;
     if( ! global_data.key_slots_initialized )
-        return( PSA_ERROR_BAD_STATE );
+        return PSA_ERROR_BAD_STATE ;
 
     /*
      * On success, the pointer to the slot is passed directly to the caller
@@ -360,7 +360,7 @@
      */
     status = psa_get_and_lock_key_slot_in_memory( key, p_slot );
     if( status != PSA_ERROR_DOES_NOT_EXIST )
-        return( status );
+        return status ;
 
     /* Loading keys from storage requires support for such a mechanism */
 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) || \
@@ -369,7 +369,7 @@
 
     status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     (*p_slot)->attr.id = key;
     (*p_slot)->attr.lifetime = PSA_KEY_LIFETIME_PERSISTENT;
@@ -395,21 +395,21 @@
         /* Add implicit usage flags. */
         psa_extend_key_usage_flags( &(*p_slot)->attr.policy.usage );
 
-    return( status );
+    return status ;
 #else /* MBEDTLS_PSA_CRYPTO_STORAGE_C || MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
-    return( PSA_ERROR_INVALID_HANDLE );
+    return PSA_ERROR_INVALID_HANDLE ;
 #endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C || MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
 }
 
 psa_status_t psa_unlock_key_slot( psa_key_slot_t *slot )
 {
     if( slot == NULL )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     if( slot->lock_count > 0 )
     {
         slot->lock_count--;
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
 
    /*
@@ -421,7 +421,7 @@
     * execution of the test suite is stopped in error if the assertion fails.
     */
     MBEDTLS_TEST_HOOK_TEST_ASSERT( slot->lock_count > 0 );
-    return( PSA_ERROR_CORRUPTION_DETECTED );
+    return PSA_ERROR_CORRUPTION_DETECTED ;
 }
 
 psa_status_t psa_validate_key_location( psa_key_lifetime_t lifetime,
@@ -436,7 +436,7 @@
         {
             if (p_drv != NULL)
                 *p_drv = driver;
-            return( PSA_SUCCESS );
+            return PSA_SUCCESS ;
         }
 #else /* MBEDTLS_PSA_CRYPTO_SE_C */
         (void) p_drv;
@@ -444,16 +444,16 @@
 
 #if defined(MBEDTLS_PSA_CRYPTO_DRIVERS)
         /* Key location for external keys gets checked by the wrapper */
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 #else /* MBEDTLS_PSA_CRYPTO_DRIVERS */
         /* No support for external lifetimes at all, or dynamic interface
          * did not find driver for requested lifetime. */
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 #endif /* MBEDTLS_PSA_CRYPTO_DRIVERS */
     }
     else
         /* Local/internal keys are always valid */
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 }
 
 psa_status_t psa_validate_key_persistence( psa_key_lifetime_t lifetime )
@@ -461,18 +461,18 @@
     if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
     {
         /* Volatile keys are always supported */
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
     }
     else
     {
         /* Persistent keys require storage support */
 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
         if( PSA_KEY_LIFETIME_IS_READ_ONLY( lifetime ) )
-            return( PSA_ERROR_INVALID_ARGUMENT );
+            return PSA_ERROR_INVALID_ARGUMENT ;
         else
-            return( PSA_SUCCESS );
+            return PSA_SUCCESS ;
 #else /* MBEDTLS_PSA_CRYPTO_STORAGE_C */
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* !MBEDTLS_PSA_CRYPTO_STORAGE_C */
     }
 }
@@ -490,17 +490,17 @@
         if( status == PSA_ERROR_INVALID_HANDLE )
             status = PSA_ERROR_DOES_NOT_EXIST;
 
-        return( status );
+        return status ;
     }
 
     *handle = key;
 
-    return( psa_unlock_key_slot( slot ) );
+    return psa_unlock_key_slot( slot ) ;
 
 #else /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
     (void) key;
     *handle = PSA_KEY_HANDLE_INIT;
-    return( PSA_ERROR_NOT_SUPPORTED );
+    return PSA_ERROR_NOT_SUPPORTED ;
 #endif /* !defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
 }
 
@@ -510,7 +510,7 @@
     psa_key_slot_t *slot;
 
     if( psa_key_handle_is_null( handle ) )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     status = psa_get_and_lock_key_slot_in_memory( handle, &slot );
     if( status != PSA_SUCCESS )
@@ -518,12 +518,12 @@
         if( status == PSA_ERROR_DOES_NOT_EXIST )
             status = PSA_ERROR_INVALID_HANDLE;
 
-        return( status );
+        return status ;
     }
     if( slot->lock_count <= 1 )
-        return( psa_wipe_key_slot( slot ) );
+        return psa_wipe_key_slot( slot ) ;
     else
-        return( psa_unlock_key_slot( slot ) );
+        return psa_unlock_key_slot( slot ) ;
 }
 
 psa_status_t psa_purge_key( mbedtls_svc_key_id_t key )
@@ -533,13 +533,13 @@
 
     status = psa_get_and_lock_key_slot_in_memory( key, &slot );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     if( ( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) ) &&
         ( slot->lock_count <= 1 ) )
-        return( psa_wipe_key_slot( slot ) );
+        return psa_wipe_key_slot( slot ) ;
     else
-        return( psa_unlock_key_slot( slot ) );
+        return psa_unlock_key_slot( slot ) ;
 }
 
 void mbedtls_psa_get_stats( mbedtls_psa_stats_t *stats )
diff --git a/library/psa_crypto_slot_management.h b/library/psa_crypto_slot_management.h
index d539bdd..c81791e 100644
--- a/library/psa_crypto_slot_management.h
+++ b/library/psa_crypto_slot_management.h
@@ -140,11 +140,11 @@
 static inline psa_status_t psa_lock_key_slot( psa_key_slot_t *slot )
 {
     if( slot->lock_count >= SIZE_MAX )
-        return( PSA_ERROR_CORRUPTION_DETECTED );
+        return PSA_ERROR_CORRUPTION_DETECTED ;
 
     slot->lock_count++;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /** Unlock a key slot.
diff --git a/library/psa_crypto_storage.c b/library/psa_crypto_storage.c
index 09cbab4..f6ec39c 100644
--- a/library/psa_crypto_storage.c
+++ b/library/psa_crypto_storage.c
@@ -70,7 +70,7 @@
      * psa_is_key_id_valid() in psa_crypto_slot_management.c
      * is responsible for ensuring that key identifiers do not have a
      * value that is reserved for non-key files. */
-    return( key );
+    return key ;
 #endif
 }
 
@@ -101,13 +101,13 @@
 
     status = psa_its_get_info( data_identifier, &data_identifier_info );
     if( status  != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     status = psa_its_get( data_identifier, 0, (uint32_t) data_size, data, &data_length );
     if( data_size  != data_length )
-        return( PSA_ERROR_DATA_INVALID );
+        return PSA_ERROR_DATA_INVALID ;
 
-    return( status );
+    return status ;
 }
 
 int psa_is_key_present_in_storage( const mbedtls_svc_key_id_t key )
@@ -119,8 +119,8 @@
     ret = psa_its_get_info( data_identifier, &data_identifier_info );
 
     if( ret == PSA_ERROR_DOES_NOT_EXIST )
-        return( 0 );
-    return( 1 );
+        return 0 ;
+    return 1 ;
 }
 
 /**
@@ -149,12 +149,12 @@
     struct psa_storage_info_t data_identifier_info;
 
     if( psa_is_key_present_in_storage( key ) == 1 )
-        return( PSA_ERROR_ALREADY_EXISTS );
+        return PSA_ERROR_ALREADY_EXISTS ;
 
     status = psa_its_set( data_identifier, (uint32_t) data_length, data, 0 );
     if( status != PSA_SUCCESS )
     {
-        return( PSA_ERROR_DATA_INVALID );
+        return PSA_ERROR_DATA_INVALID ;
     }
 
     status = psa_its_get_info( data_identifier, &data_identifier_info );
@@ -178,7 +178,7 @@
          * nothing else we can do. */
         (void) psa_its_remove( data_identifier );
     }
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_destroy_persistent_key( const mbedtls_svc_key_id_t key )
@@ -189,16 +189,16 @@
 
     ret = psa_its_get_info( data_identifier, &data_identifier_info );
     if( ret == PSA_ERROR_DOES_NOT_EXIST )
-        return( PSA_SUCCESS );
+        return PSA_SUCCESS ;
 
     if( psa_its_remove( data_identifier ) != PSA_SUCCESS )
-        return( PSA_ERROR_DATA_INVALID );
+        return PSA_ERROR_DATA_INVALID ;
 
     ret = psa_its_get_info( data_identifier, &data_identifier_info );
     if( ret != PSA_ERROR_DOES_NOT_EXIST )
-        return( PSA_ERROR_DATA_INVALID );
+        return PSA_ERROR_DATA_INVALID ;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /**
@@ -223,11 +223,11 @@
 
     status = psa_its_get_info( data_identifier, &data_identifier_info );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     *data_length = (size_t) data_identifier_info.size;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 /*
@@ -313,8 +313,8 @@
 {
     if( memcmp( data, PSA_KEY_STORAGE_MAGIC_HEADER,
                 PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH ) != 0 )
-        return( PSA_ERROR_DATA_INVALID );
-    return( PSA_SUCCESS );
+        return PSA_ERROR_DATA_INVALID ;
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_parse_key_data_from_storage( const uint8_t *storage_data,
@@ -329,20 +329,20 @@
     uint32_t version;
 
     if( storage_data_length < sizeof(*storage_format) )
-        return( PSA_ERROR_DATA_INVALID );
+        return PSA_ERROR_DATA_INVALID ;
 
     status = check_magic_header( storage_data );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     GET_UINT32_LE( version, storage_format->version, 0 );
     if( version != 0 )
-        return( PSA_ERROR_DATA_INVALID );
+        return PSA_ERROR_DATA_INVALID ;
 
     GET_UINT32_LE( *key_data_length, storage_format->data_len, 0 );
     if( *key_data_length > ( storage_data_length - sizeof(*storage_format) ) ||
         *key_data_length > PSA_CRYPTO_MAX_STORAGE_SIZE )
-        return( PSA_ERROR_DATA_INVALID );
+        return PSA_ERROR_DATA_INVALID ;
 
     if( *key_data_length == 0 )
     {
@@ -352,7 +352,7 @@
     {
         *key_data = mbedtls_calloc( 1, *key_data_length );
         if( *key_data == NULL )
-            return( PSA_ERROR_INSUFFICIENT_MEMORY );
+            return PSA_ERROR_INSUFFICIENT_MEMORY ;
         memcpy( *key_data, storage_format->key_data, *key_data_length );
     }
 
@@ -363,7 +363,7 @@
     GET_UINT32_LE( attr->policy.alg, storage_format->policy, sizeof( uint32_t ) );
     GET_UINT32_LE( attr->policy.alg2, storage_format->policy, 2 * sizeof( uint32_t ) );
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_save_persistent_key( const psa_core_key_attributes_t *attr,
@@ -376,15 +376,15 @@
 
     /* All keys saved to persistent storage always have a key context */
     if( data == NULL || data_length == 0 )
-        return( PSA_ERROR_INVALID_ARGUMENT );
+        return PSA_ERROR_INVALID_ARGUMENT ;
 
     if( data_length > PSA_CRYPTO_MAX_STORAGE_SIZE )
-        return( PSA_ERROR_INSUFFICIENT_STORAGE );
+        return PSA_ERROR_INSUFFICIENT_STORAGE ;
     storage_data_length = data_length + sizeof( psa_persistent_key_storage_format );
 
     storage_data = mbedtls_calloc( 1, storage_data_length );
     if( storage_data == NULL )
-        return( PSA_ERROR_INSUFFICIENT_MEMORY );
+        return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
     psa_format_key_data_for_storage( data, data_length, attr, storage_data );
 
@@ -393,7 +393,7 @@
 
     mbedtls_free( storage_data );
 
-    return( status );
+    return status ;
 }
 
 void psa_free_persistent_key_data( uint8_t *key_data, size_t key_data_length )
@@ -416,12 +416,12 @@
 
     status = psa_crypto_storage_get_data_length( key, &storage_data_length );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     loaded_data = mbedtls_calloc( 1, storage_data_length );
 
     if( loaded_data == NULL )
-        return( PSA_ERROR_INSUFFICIENT_MEMORY );
+        return PSA_ERROR_INSUFFICIENT_MEMORY ;
 
     status = psa_crypto_storage_load( key, loaded_data, storage_data_length );
     if( status != PSA_SUCCESS )
@@ -437,7 +437,7 @@
 
 exit:
     mbedtls_free( loaded_data );
-    return( status );
+    return status ;
 }
 
 
@@ -459,10 +459,10 @@
     {
         /* This shouldn't happen: we're trying to start a transaction while
          * there is still a transaction that hasn't been replayed. */
-        return( PSA_ERROR_CORRUPTION_DETECTED );
+        return PSA_ERROR_CORRUPTION_DETECTED ;
     }
     else if( status != PSA_ERROR_DOES_NOT_EXIST )
-        return( status );
+        return status ;
     return( psa_its_set( PSA_CRYPTO_ITS_TRANSACTION_UID,
                          sizeof( psa_crypto_transaction ),
                          &psa_crypto_transaction,
@@ -477,10 +477,10 @@
                           sizeof( psa_crypto_transaction ),
                           &psa_crypto_transaction, &length );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
     if( length != sizeof( psa_crypto_transaction ) )
-        return( PSA_ERROR_DATA_INVALID );
-    return( PSA_SUCCESS );
+        return PSA_ERROR_DATA_INVALID ;
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_crypto_stop_transaction( void )
@@ -490,7 +490,7 @@
      * finished now. It's too late to go back, so zero out the in-memory
      * data. */
     memset( &psa_crypto_transaction, 0, sizeof( psa_crypto_transaction ) );
-    return( status );
+    return status ;
 }
 
 #endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
@@ -519,7 +519,7 @@
         /* You should not be here. Seed needs to be injected only once */
         status = PSA_ERROR_NOT_PERMITTED;
     }
-    return( status );
+    return status ;
 }
 #endif /* MBEDTLS_PSA_INJECT_ENTROPY */
 
diff --git a/library/psa_its_file.c b/library/psa_its_file.c
index 492be1c..106d1c3 100644
--- a/library/psa_its_file.c
+++ b/library/psa_its_file.c
@@ -100,14 +100,14 @@
     psa_its_fill_filename( uid, filename );
     *p_stream = fopen( filename, "rb" );
     if( *p_stream == NULL )
-        return( PSA_ERROR_DOES_NOT_EXIST );
+        return PSA_ERROR_DOES_NOT_EXIST ;
 
     n = fread( &header, 1, sizeof( header ), *p_stream );
     if( n != sizeof( header ) )
-        return( PSA_ERROR_DATA_CORRUPT );
+        return PSA_ERROR_DATA_CORRUPT ;
     if( memcmp( header.magic, PSA_ITS_MAGIC_STRING,
                 PSA_ITS_MAGIC_LENGTH ) != 0 )
-        return( PSA_ERROR_DATA_CORRUPT );
+        return PSA_ERROR_DATA_CORRUPT ;
 
     p_info->size = ( header.size[0] |
                      header.size[1] << 8 |
@@ -117,7 +117,7 @@
                       header.flags[1] << 8 |
                       header.flags[2] << 16 |
                       header.flags[3] << 24 );
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 psa_status_t psa_its_get_info( psa_storage_uid_t uid,
@@ -128,7 +128,7 @@
     status = psa_its_read_file( uid, p_info, &stream );
     if( stream != NULL )
         fclose( stream );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_its_get( psa_storage_uid_t uid,
@@ -176,7 +176,7 @@
 exit:
     if( stream != NULL )
         fclose( stream );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_its_set( psa_storage_uid_t uid,
@@ -235,7 +235,7 @@
      * temporary file doesn't exist and so remove() is expected to fail.
      * Thus we just ignore the return status of remove(). */
     (void) remove( PSA_ITS_STORAGE_TEMP );
-    return( status );
+    return status ;
 }
 
 psa_status_t psa_its_remove( psa_storage_uid_t uid )
@@ -245,11 +245,11 @@
     psa_its_fill_filename( uid, filename );
     stream = fopen( filename, "rb" );
     if( stream == NULL )
-        return( PSA_ERROR_DOES_NOT_EXIST );
+        return PSA_ERROR_DOES_NOT_EXIST ;
     fclose( stream );
     if( remove( filename ) != 0 )
-        return( PSA_ERROR_STORAGE_FAILURE );
-    return( PSA_SUCCESS );
+        return PSA_ERROR_STORAGE_FAILURE ;
+    return PSA_SUCCESS ;
 }
 
 #endif /* MBEDTLS_PSA_ITS_FILE_C */
diff --git a/library/ripemd160.c b/library/ripemd160.c
index d2ccbbe..1553558 100644
--- a/library/ripemd160.c
+++ b/library/ripemd160.c
@@ -100,7 +100,7 @@
     ctx->state[3] = 0x10325476;
     ctx->state[4] = 0xC3D2E1F0;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_RIPEMD160_PROCESS_ALT)
@@ -297,7 +297,7 @@
     /* Zeroise variables to clear sensitive data from memory. */
     mbedtls_platform_zeroize( &local, sizeof( local ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_RIPEMD160_PROCESS_ALT */
@@ -314,7 +314,7 @@
     uint32_t left;
 
     if( ilen == 0 )
-        return( 0 );
+        return 0 ;
 
     left = ctx->total[0] & 0x3F;
     fill = 64 - left;
@@ -330,7 +330,7 @@
         memcpy( (void *) (ctx->buffer + left), input, fill );
 
         if( ( ret = mbedtls_internal_ripemd160_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += fill;
         ilen  -= fill;
@@ -340,7 +340,7 @@
     while( ilen >= 64 )
     {
         if( ( ret = mbedtls_internal_ripemd160_process( ctx, input ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += 64;
         ilen  -= 64;
@@ -351,7 +351,7 @@
         memcpy( (void *) (ctx->buffer + left), input, ilen );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static const unsigned char ripemd160_padding[64] =
@@ -385,11 +385,11 @@
 
     ret = mbedtls_ripemd160_update( ctx, ripemd160_padding, padn );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_ripemd160_update( ctx, msglen, 8 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     PUT_UINT32_LE( ctx->state[0], output,  0 );
     PUT_UINT32_LE( ctx->state[1], output,  4 );
@@ -397,7 +397,7 @@
     PUT_UINT32_LE( ctx->state[3], output, 12 );
     PUT_UINT32_LE( ctx->state[4], output, 16 );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* ! MBEDTLS_RIPEMD160_ALT */
@@ -426,7 +426,7 @@
 exit:
     mbedtls_ripemd160_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -480,7 +480,7 @@
     int i, ret = 0;
     unsigned char output[20];
 
-    memset( output, 0, sizeof output );
+    memset( output, 0, sizeof(output) );
 
     for( i = 0; i < TESTS; i++ )
     {
@@ -505,13 +505,13 @@
     if( verbose != 0 )
         mbedtls_printf( "\n" );
 
-    return( 0 );
+    return 0 ;
 
 fail:
     if( verbose != 0 )
         mbedtls_printf( "failed\n" );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/rsa.c b/library/rsa.c
index e818e6d..5cded9c 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -84,7 +84,7 @@
     for( i = 0; i < n; i++ )
         diff |= A[i] ^ B[i];
 
-    return( diff );
+    return diff ;
 }
 #endif /* MBEDTLS_PKCS1_V15 */
 
@@ -102,13 +102,13 @@
         ( D != NULL && ( ret = mbedtls_mpi_copy( &ctx->D, D ) ) != 0 ) ||
         ( E != NULL && ( ret = mbedtls_mpi_copy( &ctx->E, E ) ) != 0 ) )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
     }
 
     if( N != NULL )
         ctx->len = mbedtls_mpi_size( &ctx->N );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_rsa_import_raw( mbedtls_rsa_context *ctx,
@@ -142,9 +142,9 @@
 cleanup:
 
     if( ret != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -164,7 +164,7 @@
     if( ctx->len != mbedtls_mpi_size( &ctx->N ) ||
         ctx->len > MBEDTLS_MPI_MAX_SIZE )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 
     /*
@@ -176,7 +176,7 @@
     if( mbedtls_mpi_cmp_int( &ctx->N, 0 ) <= 0 ||
         mbedtls_mpi_get_bit( &ctx->N, 0 ) == 0  )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 
 #if !defined(MBEDTLS_RSA_NO_CRT)
@@ -189,7 +189,7 @@
           mbedtls_mpi_cmp_int( &ctx->Q, 0 ) <= 0 ||
           mbedtls_mpi_get_bit( &ctx->Q, 0 ) == 0  ) )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 #endif /* !MBEDTLS_RSA_NO_CRT */
 
@@ -199,19 +199,19 @@
 
     /* Always need E for public key operations */
     if( mbedtls_mpi_cmp_int( &ctx->E, 0 ) <= 0 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_RSA_NO_CRT)
     /* For private key operations, use D or DP & DQ
      * as (unblinded) exponents. */
     if( is_priv && mbedtls_mpi_cmp_int( &ctx->D, 0 ) <= 0 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 #else
     if( is_priv &&
         ( mbedtls_mpi_cmp_int( &ctx->DP, 0 ) <= 0 ||
           mbedtls_mpi_cmp_int( &ctx->DQ, 0 ) <= 0  ) )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 #endif /* MBEDTLS_RSA_NO_CRT */
 
@@ -223,7 +223,7 @@
         ( mbedtls_mpi_cmp_int( &ctx->P, 0 ) <= 0 ||
           mbedtls_mpi_cmp_int( &ctx->Q, 0 ) <= 0 ) )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 #endif
 
@@ -233,11 +233,11 @@
     if( is_priv &&
         mbedtls_mpi_cmp_int( &ctx->QP, 0 ) <= 0 )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_rsa_complete( mbedtls_rsa_context *ctx )
@@ -282,7 +282,7 @@
     is_priv = n_missing || pq_missing || d_missing;
 
     if( !is_priv && !is_pub )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     /*
      * Step 1: Deduce N if P, Q are provided.
@@ -293,7 +293,7 @@
         if( ( ret = mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P,
                                          &ctx->Q ) ) != 0 )
         {
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
         }
 
         ctx->len = mbedtls_mpi_size( &ctx->N );
@@ -308,7 +308,7 @@
         ret = mbedtls_rsa_deduce_primes( &ctx->N, &ctx->E, &ctx->D,
                                          &ctx->P, &ctx->Q );
         if( ret != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
 
     }
     else if( d_missing )
@@ -318,7 +318,7 @@
                                                          &ctx->E,
                                                          &ctx->D ) ) != 0 )
         {
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
         }
     }
 
@@ -333,7 +333,7 @@
         ret = mbedtls_rsa_deduce_crt( &ctx->P,  &ctx->Q,  &ctx->D,
                                       &ctx->DP, &ctx->DQ, &ctx->QP );
         if( ret != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
     }
 #endif /* MBEDTLS_RSA_NO_CRT */
 
@@ -341,7 +341,7 @@
      * Step 3: Basic sanity checks
      */
 
-    return( rsa_check_context( ctx, is_priv, 1 ) );
+    return rsa_check_context( ctx, is_priv, 1 ) ;
 }
 
 int mbedtls_rsa_export_raw( const mbedtls_rsa_context *ctx,
@@ -368,7 +368,7 @@
         /* If we're trying to export private parameters for a public key,
          * something must be wrong. */
         if( P != NULL || Q != NULL || D != NULL )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     }
 
@@ -389,7 +389,7 @@
 
 cleanup:
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_rsa_export( const mbedtls_rsa_context *ctx,
@@ -413,7 +413,7 @@
         /* If we're trying to export private parameters for a public key,
          * something must be wrong. */
         if( P != NULL || Q != NULL || D != NULL )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     }
 
@@ -425,10 +425,10 @@
         ( D != NULL && ( ret = mbedtls_mpi_copy( D, &ctx->D ) ) != 0 ) ||
         ( E != NULL && ( ret = mbedtls_mpi_copy( E, &ctx->E ) ) != 0 ) )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -453,7 +453,7 @@
         mbedtls_mpi_cmp_int( &ctx->E, 0 ) != 0;
 
     if( !is_priv )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
 #if !defined(MBEDTLS_RSA_NO_CRT)
     /* Export all requested blinding parameters. */
@@ -461,17 +461,17 @@
         ( DQ != NULL && ( ret = mbedtls_mpi_copy( DQ, &ctx->DQ ) ) != 0 ) ||
         ( QP != NULL && ( ret = mbedtls_mpi_copy( QP, &ctx->QP ) ) != 0 ) )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
     }
 #else
     if( ( ret = mbedtls_rsa_deduce_crt( &ctx->P, &ctx->Q, &ctx->D,
                                         DP, DQ, QP ) ) != 0 )
     {
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret ) ;
     }
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -512,7 +512,7 @@
             break;
 #endif
         default:
-            return( MBEDTLS_ERR_RSA_INVALID_PADDING );
+            return MBEDTLS_ERR_RSA_INVALID_PADDING ;
     }
 
     if( ( padding == MBEDTLS_RSA_PKCS_V21 ) &&
@@ -522,13 +522,13 @@
 
         md_info = mbedtls_md_info_from_type( hash_id );
         if( md_info == NULL )
-            return( MBEDTLS_ERR_RSA_INVALID_PADDING );
+            return MBEDTLS_ERR_RSA_INVALID_PADDING ;
     }
 
     ctx->padding = padding;
     ctx->hash_id = hash_id;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -537,7 +537,7 @@
 
 size_t mbedtls_rsa_get_len( const mbedtls_rsa_context *ctx )
 {
-    return( ctx->len );
+    return ctx->len ;
 }
 
 
@@ -658,10 +658,10 @@
 
         if( ( -ret & ~0x7f ) == 0 )
             ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_KEY_GEN_FAILED, ret );
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_GENPRIME */
@@ -674,21 +674,21 @@
     RSA_VALIDATE_RET( ctx != NULL );
 
     if( rsa_check_context( ctx, 0 /* public */, 0 /* no blinding */ ) != 0 )
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
 
     if( mbedtls_mpi_bitlen( &ctx->N ) < 128 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 
     if( mbedtls_mpi_get_bit( &ctx->E, 0 ) == 0 ||
         mbedtls_mpi_bitlen( &ctx->E )     < 2  ||
         mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -701,24 +701,24 @@
     if( mbedtls_rsa_check_pubkey( ctx ) != 0 ||
         rsa_check_context( ctx, 1 /* private */, 1 /* blinding */ ) != 0 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 
     if( mbedtls_rsa_validate_params( &ctx->N, &ctx->P, &ctx->Q,
                                      &ctx->D, &ctx->E, NULL, NULL ) != 0 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 
 #if !defined(MBEDTLS_RSA_NO_CRT)
     else if( mbedtls_rsa_validate_crt( &ctx->P, &ctx->Q, &ctx->D,
                                        &ctx->DP, &ctx->DQ, &ctx->QP ) != 0 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -733,16 +733,16 @@
     if( mbedtls_rsa_check_pubkey( pub )  != 0 ||
         mbedtls_rsa_check_privkey( prv ) != 0 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 
     if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 ||
         mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
     {
-        return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
+        return MBEDTLS_ERR_RSA_KEY_CHECK_FAILED ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -760,13 +760,13 @@
     RSA_VALIDATE_RET( output != NULL );
 
     if( rsa_check_context( ctx, 0 /* public */, 0 /* no blinding */ ) )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     mbedtls_mpi_init( &T );
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
@@ -784,15 +784,15 @@
 cleanup:
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
     mbedtls_mpi_free( &T );
 
     if( ret != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_PUBLIC_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_PUBLIC_FAILED, ret ) ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -857,7 +857,7 @@
 cleanup:
     mbedtls_mpi_free( &R );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -930,17 +930,17 @@
     RSA_VALIDATE_RET( output != NULL );
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     if( rsa_check_context( ctx, 1 /* private key checks */,
                                 1 /* blinding on        */ ) != 0 )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     /* MPI Initialization */
@@ -1073,7 +1073,7 @@
 cleanup:
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
     mbedtls_mpi_free( &P1 );
@@ -1097,9 +1097,9 @@
     mbedtls_mpi_free( &I );
 
     if( ret != 0 && ret >= -0x007f )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_PRIVATE_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_PRIVATE_FAILED, ret ) ;
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_PKCS1_V21)
@@ -1156,7 +1156,7 @@
 exit:
     mbedtls_platform_zeroize( mask, sizeof( mask ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_PKCS1_V21 */
 
@@ -1185,18 +1185,18 @@
     RSA_VALIDATE_RET( label_len == 0 || label != NULL );
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
     if( md_info == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     olen = ctx->len;
     hlen = mbedtls_md_get_size( md_info );
 
     /* first comparison checks for overflow */
     if( ilen + 2 * hlen + 2 < ilen || olen < ilen + 2 * hlen + 2 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     memset( output, 0, olen );
 
@@ -1204,13 +1204,13 @@
 
     /* Generate a random octet string seed */
     if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) ;
 
     p += hlen;
 
     /* Construct DB */
     if( ( ret = mbedtls_md( md_info, label, label_len, p ) ) != 0 )
-        return( ret );
+        return ret ;
     p += hlen;
     p += olen - 2 * hlen - 2 - ilen;
     *p++ = 1;
@@ -1235,9 +1235,9 @@
     mbedtls_md_free( &md_ctx );
 
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( mbedtls_rsa_public(  ctx, output, output ) );
+    return mbedtls_rsa_public(  ctx, output, output ) ;
 }
 #endif /* MBEDTLS_PKCS1_V21 */
 
@@ -1263,14 +1263,14 @@
 
     /* first comparison checks for overflow */
     if( ilen + 11 < ilen || olen < ilen + 11 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     nb_pad = olen - 3 - ilen;
 
     *p++ = 0;
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     *p++ = MBEDTLS_RSA_CRYPT;
 
@@ -1284,7 +1284,7 @@
 
         /* Check if RNG failed to generate data */
         if( rng_dl == 0 || ret != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) ;
 
         p++;
     }
@@ -1293,7 +1293,7 @@
     if( ilen != 0 )
         memcpy( p, input, ilen );
 
-    return( mbedtls_rsa_public(  ctx, output, output ) );
+    return mbedtls_rsa_public(  ctx, output, output ) ;
 }
 #endif /* MBEDTLS_PKCS1_V15 */
 
@@ -1326,7 +1326,7 @@
 #endif
 
         default:
-            return( MBEDTLS_ERR_RSA_INVALID_PADDING );
+            return MBEDTLS_ERR_RSA_INVALID_PADDING ;
     }
 }
 
@@ -1362,22 +1362,22 @@
      * Parameters sanity checks
      */
     if( ctx->padding != MBEDTLS_RSA_PKCS_V21 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     ilen = ctx->len;
 
     if( ilen < 16 || ilen > sizeof( buf ) )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
     if( md_info == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     hlen = mbedtls_md_get_size( md_info );
 
     // checking for integer underflow
     if( 2 * hlen + 2 > ilen )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     /*
      * RSA operation
@@ -1468,7 +1468,7 @@
     mbedtls_platform_zeroize( buf, sizeof( buf ) );
     mbedtls_platform_zeroize( lhash, sizeof( lhash ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_PKCS1_V21 */
 
@@ -1605,10 +1605,10 @@
                            output_max_len );
 
     if( ctx->padding != MBEDTLS_RSA_PKCS_V15 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     if( ilen < 16 || ilen > sizeof( buf ) )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     ret = mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
 
@@ -1711,7 +1711,7 @@
 cleanup:
     mbedtls_platform_zeroize( buf, sizeof( buf ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_PKCS1_V15 */
 
@@ -1747,7 +1747,7 @@
 #endif
 
         default:
-            return( MBEDTLS_ERR_RSA_INVALID_PADDING );
+            return MBEDTLS_ERR_RSA_INVALID_PADDING ;
     }
 }
 
@@ -1776,10 +1776,10 @@
     RSA_VALIDATE_RET( sig != NULL );
 
     if( ctx->padding != MBEDTLS_RSA_PKCS_V21 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     if( f_rng == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     olen = ctx->len;
 
@@ -1788,15 +1788,15 @@
         /* Gather length of hash to sign */
         md_info = mbedtls_md_info_from_type( md_alg );
         if( md_info == NULL )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
         if( hashlen != mbedtls_md_get_size( md_info ) )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 
     md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
     if( md_info == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     hlen = mbedtls_md_get_size( md_info );
 
@@ -1811,7 +1811,7 @@
         * (PKCS#1 v2.2) §9.1.1 step 3. */
         min_slen = hlen - 2;
         if( olen < hlen + min_slen + 2 )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
         else if( olen >= hlen + hlen + 2 )
             slen = hlen;
         else
@@ -1819,7 +1819,7 @@
     }
     else if ( (saltlen < 0) || (saltlen + hlen + 2 > olen) )
     {
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
     else
     {
@@ -1836,7 +1836,7 @@
     /* Generate salt of length slen in place in the encoded message */
     salt = p;
     if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_RSA_RNG_FAILED, ret ) ;
 
     p += slen;
 
@@ -1875,7 +1875,7 @@
     mbedtls_md_free( &md_ctx );
 
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     return mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig );
 }
@@ -1952,20 +1952,20 @@
     {
         const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
         if( md_info == NULL )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
         if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
         if( hashlen != mbedtls_md_get_size( md_info ) )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
         /* Double-check that 8 + hashlen + oid_size can be used as a
          * 1-byte ASN.1 length encoding and that there's no overflow. */
         if( 8 + hashlen + oid_size  >= 0x80         ||
             10 + hashlen            <  hashlen      ||
             10 + hashlen + oid_size <  10 + hashlen )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
         /*
          * Static bounds check:
@@ -1976,13 +1976,13 @@
          * - Need oid_size bytes for hash alg OID.
          */
         if( nb_pad < 10 + hashlen + oid_size )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
         nb_pad -= 10 + hashlen + oid_size;
     }
     else
     {
         if( nb_pad < hashlen )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
         nb_pad -= hashlen;
     }
@@ -1990,7 +1990,7 @@
     /* Need space for signature header and padding delimiter (3 bytes),
      * and 8 bytes for the minimal padding */
     if( nb_pad < 3 + 8 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     nb_pad -= 3;
 
     /* Now nb_pad is the amount of memory to be filled
@@ -2007,7 +2007,7 @@
     if( md_alg == MBEDTLS_MD_NONE )
     {
         memcpy( p, hash, hashlen );
-        return( 0 );
+        return 0 ;
     }
 
     /* Signing hashed data, add corresponding ASN.1 structure
@@ -2043,10 +2043,10 @@
     if( p != dst + dst_len )
     {
         mbedtls_platform_zeroize( dst, dst_len );
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2070,7 +2070,7 @@
     RSA_VALIDATE_RET( sig != NULL );
 
     if( ctx->padding != MBEDTLS_RSA_PKCS_V15 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     /*
      * Prepare PKCS1-v1.5 encoding (padding and hash identifier)
@@ -2078,7 +2078,7 @@
 
     if( ( ret = rsa_rsassa_pkcs1_v15_encode( md_alg, hashlen, hash,
                                              ctx->len, sig ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* Private key operation
      *
@@ -2088,13 +2088,13 @@
 
     sig_try = mbedtls_calloc( 1, ctx->len );
     if( sig_try == NULL )
-        return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+        return MBEDTLS_ERR_MPI_ALLOC_FAILED ;
 
     verif = mbedtls_calloc( 1, ctx->len );
     if( verif == NULL )
     {
         mbedtls_free( sig_try );
-        return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+        return MBEDTLS_ERR_MPI_ALLOC_FAILED ;
     }
 
     MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
@@ -2112,7 +2112,7 @@
     mbedtls_free( sig_try );
     mbedtls_free( verif );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_PKCS1_V15 */
 
@@ -2148,7 +2148,7 @@
 #endif
 
         default:
-            return( MBEDTLS_ERR_RSA_INVALID_PADDING );
+            return MBEDTLS_ERR_RSA_INVALID_PADDING ;
     }
 }
 
@@ -2185,32 +2185,32 @@
     siglen = ctx->len;
 
     if( siglen < 16 || siglen > sizeof( buf ) )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     ret = mbedtls_rsa_public(  ctx, sig, buf );
 
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     p = buf;
 
     if( buf[siglen - 1] != 0xBC )
-        return( MBEDTLS_ERR_RSA_INVALID_PADDING );
+        return MBEDTLS_ERR_RSA_INVALID_PADDING ;
 
     if( md_alg != MBEDTLS_MD_NONE )
     {
         /* Gather length of hash to sign */
         md_info = mbedtls_md_info_from_type( md_alg );
         if( md_info == NULL )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
         if( hashlen != mbedtls_md_get_size( md_info ) )
-            return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     }
 
     md_info = mbedtls_md_info_from_type( mgf1_hash_id );
     if( md_info == NULL )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     hlen = mbedtls_md_get_size( md_info );
 
@@ -2222,7 +2222,7 @@
     msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
 
     if( buf[0] >> ( 8 - siglen * 8 + msb ) )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
 
     /* Compensate for boundary condition when applying mask */
     if( msb % 8 == 0 )
@@ -2232,7 +2232,7 @@
     }
 
     if( siglen < hlen + 2 )
-        return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_RSA_BAD_INPUT_DATA ;
     hash_start = p + siglen - hlen - 1;
 
     mbedtls_md_init( &md_ctx );
@@ -2291,7 +2291,7 @@
 exit:
     mbedtls_md_free( &md_ctx );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2393,7 +2393,7 @@
         mbedtls_free( encoded_expected );
     }
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_PKCS1_V15 */
 
@@ -2427,7 +2427,7 @@
 #endif
 
         default:
-            return( MBEDTLS_ERR_RSA_INVALID_PADDING );
+            return MBEDTLS_ERR_RSA_INVALID_PADDING ;
     }
 }
 
@@ -2469,7 +2469,7 @@
     if( ret != 0 )
         mbedtls_rsa_free( dst );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2570,7 +2570,7 @@
     arc4random_buf( output, len );
 #endif /* !OpenBSD && !NetBSD */
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PKCS1_V15 */
 
@@ -2672,7 +2672,7 @@
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
-        return( 1 );
+        return 1 ;
     }
 
     if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL,
@@ -2712,7 +2712,7 @@
 #else /* MBEDTLS_PKCS1_V15 */
     ((void) verbose);
 #endif /* MBEDTLS_PKCS1_V15 */
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/rsa_alt_helpers.c b/library/rsa_alt_helpers.c
index dff2d93..34ae7e1 100644
--- a/library/rsa_alt_helpers.c
+++ b/library/rsa_alt_helpers.c
@@ -86,7 +86,7 @@
     const size_t num_primes = sizeof( primes ) / sizeof( *primes );
 
     if( P == NULL || Q == NULL || P->p != NULL || Q->p != NULL )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     if( mbedtls_mpi_cmp_int( N, 0 ) <= 0 ||
         mbedtls_mpi_cmp_int( D, 1 ) <= 0 ||
@@ -94,7 +94,7 @@
         mbedtls_mpi_cmp_int( E, 1 ) <= 0 ||
         mbedtls_mpi_cmp_mpi( E, N ) >= 0 )
     {
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
     }
 
     /*
@@ -187,7 +187,7 @@
 
     mbedtls_mpi_free( &K );
     mbedtls_mpi_free( &T );
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -203,13 +203,13 @@
     mbedtls_mpi K, L;
 
     if( D == NULL || mbedtls_mpi_cmp_int( D, 0 ) != 0 )
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
 
     if( mbedtls_mpi_cmp_int( P, 1 ) <= 0 ||
         mbedtls_mpi_cmp_int( Q, 1 ) <= 0 ||
         mbedtls_mpi_cmp_int( E, 0 ) == 0 )
     {
-        return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_MPI_BAD_INPUT_DATA ;
     }
 
     mbedtls_mpi_init( &K );
@@ -234,7 +234,7 @@
     mbedtls_mpi_free( &K );
     mbedtls_mpi_free( &L );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_rsa_deduce_crt( const mbedtls_mpi *P, const mbedtls_mpi *Q,
@@ -268,7 +268,7 @@
 cleanup:
     mbedtls_mpi_free( &K );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -392,7 +392,7 @@
         ret += MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
     }
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -480,7 +480,7 @@
     mbedtls_mpi_free( &K );
     mbedtls_mpi_free( &L );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_RSA_C */
diff --git a/library/sha1.c b/library/sha1.c
index 545d093..582b91b 100644
--- a/library/sha1.c
+++ b/library/sha1.c
@@ -111,7 +111,7 @@
     ctx->state[3] = 0x10325476;
     ctx->state[4] = 0xC3D2E1F0;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_SHA1_PROCESS_ALT)
@@ -284,7 +284,7 @@
     /* Zeroise buffers and variables to clear sensitive data from memory. */
     mbedtls_platform_zeroize( &local, sizeof( local ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_SHA1_PROCESS_ALT */
@@ -304,7 +304,7 @@
     SHA1_VALIDATE_RET( ilen == 0 || input != NULL );
 
     if( ilen == 0 )
-        return( 0 );
+        return 0 ;
 
     left = ctx->total[0] & 0x3F;
     fill = 64 - left;
@@ -320,7 +320,7 @@
         memcpy( (void *) (ctx->buffer + left), input, fill );
 
         if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += fill;
         ilen  -= fill;
@@ -330,7 +330,7 @@
     while( ilen >= 64 )
     {
         if( ( ret = mbedtls_internal_sha1_process( ctx, input ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += 64;
         ilen  -= 64;
@@ -339,7 +339,7 @@
     if( ilen > 0 )
         memcpy( (void *) (ctx->buffer + left), input, ilen );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -373,7 +373,7 @@
         memset( ctx->buffer + used, 0, 64 - used );
 
         if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         memset( ctx->buffer, 0, 56 );
     }
@@ -389,7 +389,7 @@
     PUT_UINT32_BE( low,  ctx->buffer, 60 );
 
     if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /*
      * Output final state
@@ -400,7 +400,7 @@
     PUT_UINT32_BE( ctx->state[3], output, 12 );
     PUT_UINT32_BE( ctx->state[4], output, 16 );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_SHA1_ALT */
@@ -432,7 +432,7 @@
 exit:
     mbedtls_sha1_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -528,7 +528,7 @@
 exit:
     mbedtls_sha1_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/sha256.c b/library/sha256.c
index 6ec6da2..017bac6 100644
--- a/library/sha256.c
+++ b/library/sha256.c
@@ -142,7 +142,7 @@
 
     ctx->is224 = is224;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_SHA256_PROCESS_ALT)
@@ -277,7 +277,7 @@
     /* Zeroise buffers and variables to clear sensitive data from memory. */
     mbedtls_platform_zeroize( &local, sizeof( local ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_SHA256_PROCESS_ALT */
@@ -297,7 +297,7 @@
     SHA256_VALIDATE_RET( ilen == 0 || input != NULL );
 
     if( ilen == 0 )
-        return( 0 );
+        return 0 ;
 
     left = ctx->total[0] & 0x3F;
     fill = 64 - left;
@@ -313,7 +313,7 @@
         memcpy( (void *) (ctx->buffer + left), input, fill );
 
         if( ( ret = mbedtls_internal_sha256_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += fill;
         ilen  -= fill;
@@ -323,7 +323,7 @@
     while( ilen >= 64 )
     {
         if( ( ret = mbedtls_internal_sha256_process( ctx, input ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += 64;
         ilen  -= 64;
@@ -332,7 +332,7 @@
     if( ilen > 0 )
         memcpy( (void *) (ctx->buffer + left), input, ilen );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -366,7 +366,7 @@
         memset( ctx->buffer + used, 0, 64 - used );
 
         if( ( ret = mbedtls_internal_sha256_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         memset( ctx->buffer, 0, 56 );
     }
@@ -382,7 +382,7 @@
     PUT_UINT32_BE( low,  ctx->buffer, 60 );
 
     if( ( ret = mbedtls_internal_sha256_process( ctx, ctx->buffer ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /*
      * Output final state
@@ -400,7 +400,7 @@
 #endif
         PUT_UINT32_BE( ctx->state[7], output, 28 );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_SHA256_ALT */
@@ -439,7 +439,7 @@
 exit:
     mbedtls_sha256_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -509,7 +509,7 @@
         if( verbose != 0 )
             mbedtls_printf( "Buffer allocation failed\n" );
 
-        return( 1 );
+        return 1 ;
     }
 
     mbedtls_sha256_init( &ctx );
@@ -572,7 +572,7 @@
     mbedtls_sha256_free( &ctx );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SELF_TEST */
diff --git a/library/sha512.c b/library/sha512.c
index 6511c6e..d3f36e3 100644
--- a/library/sha512.c
+++ b/library/sha512.c
@@ -150,7 +150,7 @@
     else
     {
 #if !defined(MBEDTLS_SHA384_C)
-        return( MBEDTLS_ERR_SHA512_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SHA512_BAD_INPUT_DATA ;
 #else
         /* SHA-384 */
         ctx->state[0] = UL64(0xCBBB9D5DC1059ED8);
@@ -168,7 +168,7 @@
     ctx->is384 = is384;
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_SHA512_PROCESS_ALT)
@@ -319,7 +319,7 @@
     /* Zeroise buffers and variables to clear sensitive data from memory. */
     mbedtls_platform_zeroize( &local, sizeof( local ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_SHA512_PROCESS_ALT */
@@ -339,7 +339,7 @@
     SHA512_VALIDATE_RET( ilen == 0 || input != NULL );
 
     if( ilen == 0 )
-        return( 0 );
+        return 0 ;
 
     left = (unsigned int) (ctx->total[0] & 0x7F);
     fill = 128 - left;
@@ -354,7 +354,7 @@
         memcpy( (void *) (ctx->buffer + left), input, fill );
 
         if( ( ret = mbedtls_internal_sha512_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += fill;
         ilen  -= fill;
@@ -364,7 +364,7 @@
     while( ilen >= 128 )
     {
         if( ( ret = mbedtls_internal_sha512_process( ctx, input ) ) != 0 )
-            return( ret );
+            return ret ;
 
         input += 128;
         ilen  -= 128;
@@ -373,7 +373,7 @@
     if( ilen > 0 )
         memcpy( (void *) (ctx->buffer + left), input, ilen );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -407,7 +407,7 @@
         memset( ctx->buffer + used, 0, 128 - used );
 
         if( ( ret = mbedtls_internal_sha512_process( ctx, ctx->buffer ) ) != 0 )
-            return( ret );
+            return ret ;
 
         memset( ctx->buffer, 0, 112 );
     }
@@ -423,7 +423,7 @@
     sha512_put_uint64_be( low,  ctx->buffer, 120 );
 
     if( ( ret = mbedtls_internal_sha512_process( ctx, ctx->buffer ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /*
      * Output final state
@@ -443,7 +443,7 @@
         sha512_put_uint64_be( ctx->state[7], output, 56 );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_SHA512_ALT */
@@ -481,7 +481,7 @@
 exit:
     mbedtls_sha512_free( &ctx );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SELF_TEST)
@@ -574,7 +574,7 @@
         if( verbose != 0 )
             mbedtls_printf( "Buffer allocation failed\n" );
 
-        return( 1 );
+        return 1 ;
     }
 
     mbedtls_sha512_init( &ctx );
@@ -639,7 +639,7 @@
     mbedtls_sha512_free( &ctx );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 
 #undef ARRAY_LENGTH
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index fe4f30c..a2ee0a2 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -85,7 +85,7 @@
         ret = 0;
     }
 
-    return( ret );
+    return ret ;
 }
 
 
@@ -100,7 +100,7 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_lock( &cache->mutex ) != 0 )
-        return( 1 );
+        return 1 ;
 #endif
 
     ret = ssl_cache_find_entry( cache, session_id, session_id_len, &entry );
@@ -121,7 +121,7 @@
         ret = 1;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 static int ssl_cache_pick_writing_slot( mbedtls_ssl_cache_context *cache,
@@ -188,7 +188,7 @@
         /* Create new entry */
         cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
         if( cur == NULL )
-            return( 1 );
+            return 1 ;
 
         /* Append to the end of the linked list. */
         if( last == NULL )
@@ -208,12 +208,12 @@
     {
         /* This should only happen on an ill-configured cache
          * with max_entries == 0. */
-        return( 1 );
+        return 1 ;
     }
 #else /* MBEDTLS_HAVE_TIME */
     /* Reuse first entry in chain, but move to last place. */
     if( cache->chain == NULL )
-        return( 1 );
+        return 1 ;
 
     old = cache->chain;
     cache->chain = old->next;
@@ -241,7 +241,7 @@
     }
 
     *dst = cur;
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_cache_set( void *data,
@@ -258,7 +258,7 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &cache->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     ret = ssl_cache_pick_writing_slot( cache,
@@ -314,7 +314,7 @@
     if( session_serialized != NULL )
         mbedtls_platform_zeroize( session_serialized, session_serialized_len );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_HAVE_TIME)
diff --git a/library/ssl_ciphersuites.c b/library/ssl_ciphersuites.c
index a3ee157..e7eaee2 100644
--- a/library/ssl_ciphersuites.c
+++ b/library/ssl_ciphersuites.c
@@ -1905,7 +1905,7 @@
 #if defined(MBEDTLS_SSL_CIPHERSUITES)
 const int *mbedtls_ssl_list_ciphersuites( void )
 {
-    return( ciphersuite_preference );
+    return ciphersuite_preference ;
 }
 #else
 #define MAX_CIPHERSUITES    sizeof( ciphersuite_definitions     ) /         \
@@ -1917,7 +1917,7 @@
 {
     (void)cs_info;
 
-    return( 0 );
+    return 0 ;
 }
 
 const int *mbedtls_ssl_list_ciphersuites( void )
@@ -1947,7 +1947,7 @@
         supported_init = 1;
     }
 
-    return( supported_ciphersuites );
+    return supported_ciphersuites ;
 }
 #endif /* MBEDTLS_SSL_CIPHERSUITES */
 
@@ -1957,17 +1957,17 @@
     const mbedtls_ssl_ciphersuite_t *cur = ciphersuite_definitions;
 
     if( NULL == ciphersuite_name )
-        return( NULL );
+        return NULL ;
 
     while( cur->id != 0 )
     {
         if( 0 == strcmp( cur->name, ciphersuite_name ) )
-            return( cur );
+            return cur ;
 
         cur++;
     }
 
-    return( NULL );
+    return NULL ;
 }
 
 const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_id( int ciphersuite )
@@ -1977,12 +1977,12 @@
     while( cur->id != 0 )
     {
         if( cur->id == ciphersuite )
-            return( cur );
+            return cur ;
 
         cur++;
     }
 
-    return( NULL );
+    return NULL ;
 }
 
 const char *mbedtls_ssl_get_ciphersuite_name( const int ciphersuite_id )
@@ -1992,9 +1992,9 @@
     cur = mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
 
     if( cur == NULL )
-        return( "unknown" );
+        return "unknown" ;
 
-    return( cur->name );
+    return cur->name ;
 }
 
 int mbedtls_ssl_get_ciphersuite_id( const char *ciphersuite_name )
@@ -2004,9 +2004,9 @@
     cur = mbedtls_ssl_ciphersuite_from_string( ciphersuite_name );
 
     if( cur == NULL )
-        return( 0 );
+        return 0 ;
 
-    return( cur->id );
+    return cur->id ;
 }
 
 #if defined(MBEDTLS_PK_C)
@@ -2018,17 +2018,17 @@
         case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
         case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
         case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
-            return( MBEDTLS_PK_RSA );
+            return MBEDTLS_PK_RSA ;
 
         case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
-            return( MBEDTLS_PK_ECDSA );
+            return MBEDTLS_PK_ECDSA ;
 
         case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
         case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
-            return( MBEDTLS_PK_ECKEY );
+            return MBEDTLS_PK_ECKEY ;
 
         default:
-            return( MBEDTLS_PK_NONE );
+            return MBEDTLS_PK_NONE ;
     }
 }
 
@@ -2039,13 +2039,13 @@
         case MBEDTLS_KEY_EXCHANGE_RSA:
         case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
         case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
-            return( MBEDTLS_PK_RSA );
+            return MBEDTLS_PK_RSA ;
 
         case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
-            return( MBEDTLS_PK_ECDSA );
+            return MBEDTLS_PK_ECDSA ;
 
         default:
-            return( MBEDTLS_PK_NONE );
+            return MBEDTLS_PK_NONE ;
     }
 }
 
@@ -2063,10 +2063,10 @@
         case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
         case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
         case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
-            return( 1 );
+            return 1 ;
 
         default:
-            return( 0 );
+            return 0 ;
     }
 }
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED*/
@@ -2080,10 +2080,10 @@
         case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
         case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
         case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
-            return( 1 );
+            return 1 ;
 
         default:
-            return( 0 );
+            return 0 ;
     }
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index e0a1c24..d9944cf 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -56,18 +56,18 @@
     if( conf->psk_identity     == NULL ||
         conf->psk_identity_len == 0     )
     {
-        return( 0 );
+        return 0 ;
     }
 
     if( conf->psk != NULL && conf->psk_len != 0 )
-        return( 1 );
+        return 1 ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
-        return( 1 );
+        return 1 ;
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -76,13 +76,13 @@
     if( conf->psk_identity     == NULL ||
         conf->psk_identity_len == 0     )
     {
-        return( 0 );
+        return 0 ;
     }
 
     if( conf->psk != NULL && conf->psk_len != 0 )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -100,7 +100,7 @@
     *olen = 0;
 
     if( ssl->hostname == NULL )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding server name extension: %s",
@@ -153,7 +153,7 @@
 
     *olen = hostname_len + 9;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
@@ -171,7 +171,7 @@
      * initial ClientHello, in which case also adding the renegotiation
      * info extension is NOT RECOMMENDED as per RFC 5746 Section 3.4. */
     if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding renegotiation extension" ) );
@@ -194,7 +194,7 @@
 
     *olen = 5 + ssl->verify_data_len;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_RENEGOTIATION */
 
@@ -219,13 +219,13 @@
     *olen = 0;
 
     if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding signature_algorithms extension" ) );
 
     if( ssl->conf->sig_hashes == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+        return MBEDTLS_ERR_SSL_BAD_CONFIG ;
 
     for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
     {
@@ -239,13 +239,13 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 3,
                 ( "length in bytes of sig-hash-alg extension too big" ) );
-            return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+            return MBEDTLS_ERR_SSL_BAD_CONFIG ;
         }
     }
 
     /* Empty signature algorithms list, this is a configuration error. */
     if( sig_alg_len == 0 )
-        return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+        return MBEDTLS_ERR_SSL_BAD_CONFIG ;
 
     MBEDTLS_SSL_CHK_BUF_PTR( p, end, sig_alg_len + 6 );
 
@@ -294,7 +294,7 @@
 
     *olen = 6 + sig_alg_len;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
           MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
@@ -318,7 +318,7 @@
         ( "client hello, adding supported_elliptic_curves extension" ) );
 
     if( ssl->conf->curve_list == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+        return MBEDTLS_ERR_SSL_BAD_CONFIG ;
 
     for( grp_id = ssl->conf->curve_list;
          *grp_id != MBEDTLS_ECP_DP_NONE;
@@ -329,7 +329,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 1,
                 ( "invalid curve in ssl configuration" ) );
-            return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+            return MBEDTLS_ERR_SSL_BAD_CONFIG ;
         }
         elliptic_curve_len += 2;
 
@@ -337,13 +337,13 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 3,
                 ( "malformed supported_elliptic_curves extension in config" ) );
-            return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+            return MBEDTLS_ERR_SSL_BAD_CONFIG ;
         }
     }
 
     /* Empty elliptic curve list, this is a configuration error. */
     if( elliptic_curve_len == 0 )
-        return( MBEDTLS_ERR_SSL_BAD_CONFIG );
+        return MBEDTLS_ERR_SSL_BAD_CONFIG ;
 
     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 + elliptic_curve_len );
 
@@ -371,7 +371,7 @@
 
     *olen = 6 + elliptic_curve_len;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
@@ -401,7 +401,7 @@
 
     *olen = 6;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
           MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
@@ -420,7 +420,7 @@
 
     /* Skip costly extension if we can't use EC J-PAKE anyway */
     if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding ecjpake_kkpp extension" ) );
@@ -447,14 +447,14 @@
         {
             MBEDTLS_SSL_DEBUG_RET( 1 ,
                 "mbedtls_ecjpake_write_round_one", ret );
-            return( ret );
+            return ret ;
         }
 
         ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
         if( ssl->handshake->ecjpake_cache == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
         }
 
         memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
@@ -475,7 +475,7 @@
 
     *olen = kkpp_len + 4;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
 
@@ -501,7 +501,7 @@
     if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
         ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
     {
-        return( 0 );
+        return 0 ;
     }
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding CID extension" ) );
 
@@ -521,7 +521,7 @@
 
     *olen = ssl->own_cid_len + 5;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
@@ -536,7 +536,7 @@
     *olen = 0;
 
     if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding max_fragment_length extension" ) );
@@ -555,7 +555,7 @@
 
     *olen = 5;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
@@ -570,7 +570,7 @@
     *olen = 0;
 
     if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding encrypt_then_mac extension" ) );
@@ -585,7 +585,7 @@
 
     *olen = 4;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
 
@@ -600,7 +600,7 @@
     *olen = 0;
 
     if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding extended_master_secret extension" ) );
@@ -617,7 +617,7 @@
 
     *olen = 4;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
 
@@ -633,7 +633,7 @@
     *olen = 0;
 
     if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "client hello, adding session ticket extension" ) );
@@ -650,7 +650,7 @@
     *olen = 4;
 
     if( ssl->session_negotiate->ticket == NULL || tlen == 0 )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
         ( "sending session ticket of length %" MBEDTLS_PRINTF_SIZET, tlen ) );
@@ -659,7 +659,7 @@
 
     *olen += tlen;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
@@ -676,7 +676,7 @@
     *olen = 0;
 
     if( ssl->conf->alpn_list == NULL )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
 
@@ -720,7 +720,7 @@
     buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
     buf[3] = (unsigned char)( ( ( *olen - 4 )      ) & 0xFF );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_ALPN */
 
@@ -740,7 +740,7 @@
         ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
         ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
     {
-        return( 0 );
+        return 0 ;
     }
 
     /* RFC 5764 section 4.1.1
@@ -813,7 +813,7 @@
                       "illegal DTLS-SRTP protection profile %d",
                       ssl->conf->dtls_srtp_profile_list[protection_profiles_index]
                     ) );
-            return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
+            return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED ;
         }
     }
 
@@ -840,7 +840,7 @@
      */
     *olen = p - buf;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_SRTP */
 
@@ -862,7 +862,7 @@
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
         ssl->handshake->verify_cookie != NULL )
     {
-        return( 0 );
+        return 0 ;
     }
 #endif
 
@@ -877,15 +877,15 @@
                                 (long long) t ) );
 #else
     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
-        return( ret );
+        return ret ;
 
     p += 4;
 #endif /* MBEDTLS_HAVE_TIME */
 
     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /**
@@ -905,22 +905,22 @@
 {
     (void) ssl;
     if( suite_info == NULL )
-        return( 1 );
+        return 1 ;
 
     if( suite_info->min_minor_ver > max_minor_ver ||
             suite_info->max_minor_ver < min_minor_ver )
-        return( 1 );
+        return 1 ;
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
             ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
-        return( 1 );
+        return 1 ;
 #endif
 
 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
     if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
             mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
-        return( 1 );
+        return 1 ;
 #endif
 
     /* Don't suggest PSK-based ciphersuite if no PSK is available. */
@@ -928,11 +928,11 @@
     if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
         ssl_conf_has_static_psk( ssl->conf ) == 0 )
     {
-        return( 1 );
+        return 1 ;
     }
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
@@ -956,7 +956,7 @@
     if( ssl->conf->f_rng == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
-        return( MBEDTLS_ERR_SSL_NO_RNG );
+        return MBEDTLS_ERR_SSL_NO_RNG ;
     }
 
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
@@ -971,7 +971,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
             ( "configured max major version is invalid, consider using mbedtls_ssl_config_defaults()" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     buf = ssl->out_msg;
@@ -1012,7 +1012,7 @@
     if( ( ret = ssl_generate_random( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
-        return( ret );
+        return ret ;
     }
 
     memcpy( p, ssl->handshake->randbytes, 32 );
@@ -1058,7 +1058,7 @@
                                     ssl->session_negotiate->id, 32 );
 
             if( ret != 0 )
-                return( ret );
+                return ret ;
 
             ssl->session_negotiate->id_len = n = 32;
         }
@@ -1195,7 +1195,7 @@
                                         end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_hostname_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1207,7 +1207,7 @@
                                              end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_renegotiation_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1218,7 +1218,7 @@
                                                     end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_signature_algorithms_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1231,7 +1231,7 @@
                                                              end, &olen ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_supported_elliptic_curves_ext", ret );
-            return( ret );
+            return ret ;
         }
         ext_len += olen;
 
@@ -1239,7 +1239,7 @@
                                                            end, &olen ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_supported_point_formats_ext", ret );
-            return( ret );
+            return ret ;
         }
         ext_len += olen;
     }
@@ -1250,7 +1250,7 @@
                                             end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_ecjpake_kkpp_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1259,7 +1259,7 @@
     if( ( ret = ssl_write_cid_ext( ssl, p + 2 + ext_len, end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_cid_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
@@ -1269,7 +1269,7 @@
                                                    end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_max_fragment_length_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1279,7 +1279,7 @@
                                                 end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_encrypt_then_mac_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1289,7 +1289,7 @@
                                            end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_extended_ms_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1299,7 +1299,7 @@
                                     end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_alpn_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1309,7 +1309,7 @@
                                         end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_use_srtp_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1319,7 +1319,7 @@
                                               end, &olen ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_session_ticket_ext", ret );
-        return( ret );
+        return ret ;
     }
     ext_len += olen;
 #endif
@@ -1353,7 +1353,7 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -1361,13 +1361,13 @@
         ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
@@ -1390,7 +1390,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-            return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
         }
     }
     else
@@ -1404,13 +1404,13 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-            return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
         }
 
         ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
@@ -1432,10 +1432,10 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
@@ -1454,7 +1454,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension unexpected" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
-        return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
+        return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ;
     }
 
     if( len == 0 )
@@ -1462,7 +1462,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                      MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     peer_cid_len = *buf++;
@@ -1473,7 +1473,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                      MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
 
     if( len != peer_cid_len )
@@ -1481,7 +1481,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                      MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
@@ -1491,7 +1491,7 @@
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
     MBEDTLS_SSL_DEBUG_BUF( 3, "Server CID", buf, peer_cid_len );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
@@ -1509,14 +1509,14 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
-        return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
+        return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ;
     }
 
     ((void) buf);
 
     ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
 
@@ -1534,14 +1534,14 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
-        return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
+        return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ;
     }
 
     ((void) buf);
 
     ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
 
@@ -1559,14 +1559,14 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
-        return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
+        return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ;
     }
 
     ((void) buf);
 
     ssl->handshake->new_session_ticket = 1;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
@@ -1584,7 +1584,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     list_size = buf[0];
 
@@ -1602,7 +1602,7 @@
                                               p[0] );
 #endif
             MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
-            return( 0 );
+            return 0 ;
         }
 
         list_size--;
@@ -1612,7 +1612,7 @@
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
     mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                     MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-    return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+    return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
 }
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
           MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
@@ -1628,7 +1628,7 @@
         MBEDTLS_KEY_EXCHANGE_ECJPAKE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
-        return( 0 );
+        return 0 ;
     }
 
     /* If we got here, we no longer need our cached extension */
@@ -1644,10 +1644,10 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
 
@@ -1666,7 +1666,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT );
-        return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
+        return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ;
     }
 
     /*
@@ -1684,7 +1684,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     list_len = ( buf[0] << 8 ) | buf[1];
@@ -1692,7 +1692,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     name_len = buf[2];
@@ -1700,7 +1700,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* Check that the server chosen protocol was in our list and save it */
@@ -1710,14 +1710,14 @@
             memcmp( buf + 3, *p, name_len ) == 0 )
         {
             ssl->alpn_chosen = *p;
-            return( 0 );
+            return 0 ;
         }
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) );
     mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                     MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-    return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+    return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
 }
 #endif /* MBEDTLS_SSL_ALPN */
 
@@ -1734,7 +1734,7 @@
     if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
         ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
         ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
-        return( 0 );
+        return 0 ;
 
     /* RFC 5764 section 4.1.1
      * uint8 SRTPProtectionProfile[2];
@@ -1759,7 +1759,7 @@
      *                                      and optional srtp_mki
      */
     if( ( len < 5 ) || ( len != ( buf[4] + 5u ) ) )
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
 
     /*
      * get the server protection profile
@@ -1770,7 +1770,7 @@
      * one protection profile in server Hello
      */
     if( (  buf[0] != 0 ) || ( buf[1] != 2 ) )
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
 
     server_protection_profile_value = ( buf[2] << 8 ) | buf[3];
     server_protection = mbedtls_ssl_check_srtp_profile_value(
@@ -1804,7 +1804,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     /* If server does not use mki in its reply, make sure the client won't keep
@@ -1825,7 +1825,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
 #if defined (MBEDTLS_DEBUG_C)
     if( len > 5 )
@@ -1834,7 +1834,7 @@
                                                   ssl->dtls_srtp_info.mki_len );
     }
 #endif
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_SRTP */
 
@@ -1860,7 +1860,7 @@
             ( "incoming HelloVerifyRequest message is too short" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                     MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /*
@@ -1887,7 +1887,7 @@
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                      MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
 
-        return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
+        return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ;
     }
 
     cookie_len = *p++;
@@ -1897,7 +1897,7 @@
             ( "cookie length does not match incoming message size" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                     MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
 
@@ -1907,7 +1907,7 @@
     if( ssl->handshake->verify_cookie  == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     }
 
     memcpy( ssl->handshake->verify_cookie, p, cookie_len );
@@ -1921,7 +1921,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
@@ -1944,7 +1944,7 @@
     {
         /* No alert on a read error. */
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     buf = ssl->in_msg;
@@ -1961,14 +1961,14 @@
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1,
                     ( "renegotiation requested, but not honored by server" ) );
-                return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+                return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
             }
 
             MBEDTLS_SSL_DEBUG_MSG( 1,
                 ( "non-handshake message during renegotiation" ) );
 
             ssl->keep_current_message = 1;
-            return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
+            return MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO ;
         }
 #endif /* MBEDTLS_SSL_RENEGOTIATION */
 
@@ -1977,7 +1977,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -1987,7 +1987,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
-            return( ssl_parse_hello_verify_request( ssl ) );
+            return ssl_parse_hello_verify_request( ssl ) ;
         }
         else
         {
@@ -2005,7 +2005,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /*
@@ -2042,7 +2042,7 @@
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                      MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
 
-        return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
+        return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu",
@@ -2062,7 +2062,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
@@ -2078,7 +2078,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
     }
     else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
@@ -2090,7 +2090,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* ciphersuite (used later) */
@@ -2109,7 +2109,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
     }
 
     /*
@@ -2122,7 +2122,7 @@
             ( "ciphersuite info for %04x not found", (unsigned int)i ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     mbedtls_ssl_optimize_checksum( ssl, ssl->handshake->ciphersuite_info );
@@ -2163,7 +2163,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -2187,7 +2187,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
 
         if( ssl->conf->ciphersuite_list[i++] ==
@@ -2207,7 +2207,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3,
@@ -2229,7 +2229,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
     ssl->session_negotiate->compression = comp;
 
@@ -2251,7 +2251,7 @@
             mbedtls_ssl_send_alert_message(
                 ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         switch( ext_id )
@@ -2264,7 +2264,7 @@
 
             if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
                                                       ext_size ) ) != 0 )
-                return( ret );
+                return ret ;
 
             break;
 
@@ -2276,7 +2276,7 @@
             if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
                             ext + 4, ext_size ) ) != 0 )
             {
-                return( ret );
+                return ret ;
             }
 
             break;
@@ -2290,7 +2290,7 @@
                                            ext + 4,
                                            ext_size ) ) != 0 )
             {
-                return( ret );
+                return ret ;
             }
 
             break;
@@ -2303,7 +2303,7 @@
             if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
                             ext + 4, ext_size ) ) != 0 )
             {
-                return( ret );
+                return ret ;
             }
 
             break;
@@ -2317,7 +2317,7 @@
             if( ( ret = ssl_parse_extended_ms_ext( ssl,
                             ext + 4, ext_size ) ) != 0 )
             {
-                return( ret );
+                return ret ;
             }
 
             break;
@@ -2330,7 +2330,7 @@
             if( ( ret = ssl_parse_session_ticket_ext( ssl,
                             ext + 4, ext_size ) ) != 0 )
             {
-                return( ret );
+                return ret ;
             }
 
             break;
@@ -2345,7 +2345,7 @@
             if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
                             ext + 4, ext_size ) ) != 0 )
             {
-                return( ret );
+                return ret ;
             }
 
             break;
@@ -2359,7 +2359,7 @@
             if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
                             ext + 4, ext_size ) ) != 0 )
             {
-                return( ret );
+                return ret ;
             }
 
             break;
@@ -2370,7 +2370,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
 
             if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
-                return( ret );
+                return ret ;
 
             break;
 #endif /* MBEDTLS_SSL_ALPN */
@@ -2380,7 +2380,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found use_srtp extension" ) );
 
             if( ( ret = ssl_parse_use_srtp_ext( ssl, ext + 4, ext_size ) ) != 0 )
-                return( ret );
+                return ret ;
 
             break;
 #endif /* MBEDTLS_SSL_DTLS_SRTP */
@@ -2396,7 +2396,7 @@
         if( ext_len > 0 && ext_len < 4 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
     }
 
@@ -2444,12 +2444,12 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
@@ -2474,7 +2474,7 @@
                                          p, end ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
-        return( ret );
+        return ret ;
     }
 
     dhm_actual_bitlen = mbedtls_dhm_get_bitlen( &ssl->handshake->dhm_ctx );
@@ -2483,14 +2483,14 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %" MBEDTLS_PRINTF_SIZET " < %u",
                                     dhm_actual_bitlen,
                                     ssl->conf->dhm_min_bitlen ) );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P  );
     MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G  );
     MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
@@ -2514,7 +2514,7 @@
     if( curve_info == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
@@ -2525,12 +2525,12 @@
     if( ssl->handshake->ecdh_ctx.grp.nbits < 163 ||
         ssl->handshake->ecdh_ctx.grp.nbits > 521 )
 #endif
-        return( -1 );
+        return -1 ;
 
     MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
                             MBEDTLS_DEBUG_ECDH_QP );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
@@ -2555,11 +2555,11 @@
      */
 
     if( end - *p < 4 )
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
 
     /* First byte is curve_type; only named_curve is handled */
     if( *(*p)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
 
     /* Next two bytes are the namedcurve value */
     tls_id = *(*p)++;
@@ -2570,10 +2570,10 @@
     if( ( handshake->ecdh_psa_type =
           mbedtls_psa_parse_tls_ecc_group( tls_id, &ecdh_bits ) ) == 0 )
     {
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
     if( ecdh_bits > 0xffff )
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     handshake->ecdh_bits = (uint16_t) ecdh_bits;
 
     /*
@@ -2582,7 +2582,7 @@
 
     ecpoint_len = *(*p)++;
     if( (size_t)( end - *p ) < ecpoint_len )
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
 
     if( mbedtls_psa_tls_ecpoint_to_psa_ec(
                                     *p, ecpoint_len,
@@ -2590,11 +2590,11 @@
                                     sizeof( handshake->ecdh_psa_peerkey ),
                                     &handshake->ecdh_psa_peerkey_len ) != 0 )
     {
-        return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+        return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
     }
 
     *p += ecpoint_len;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
             ( MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
@@ -2625,17 +2625,17 @@
         if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
             ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
 #endif
-        return( ret );
+        return ret ;
     }
 
     if( ssl_check_server_ecdh_params( ssl ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
             ( "bad server key exchange message (ECDHE curve)" ) );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
@@ -2659,7 +2659,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
             ( "bad server key exchange message (psk_identity_hint length)" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     len = (*p)[0] << 8 | (*p)[1];
     *p += 2;
@@ -2668,7 +2668,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
             ( "bad server key exchange message (psk_identity_hint length)" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /*
@@ -2679,7 +2679,7 @@
     *p += len;
     ret = 0;
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
 
@@ -2700,7 +2700,7 @@
     if( offset + len_bytes > MBEDTLS_SSL_OUT_CONTENT_LEN )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
-        return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
     }
 
     /*
@@ -2717,7 +2717,7 @@
     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
-        return( ret );
+        return ret ;
     }
 
     ssl->handshake->pmslen = 48;
@@ -2729,7 +2729,7 @@
     {
         /* Should never happen */
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
     peer_pk = &ssl->session_negotiate->peer_cert->pk;
 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
@@ -2740,7 +2740,7 @@
     if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_RSA ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
-        return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ;
     }
 
     if( ( ret = mbedtls_pk_encrypt( peer_pk,
@@ -2750,7 +2750,7 @@
                             ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
-        return( ret );
+        return ret ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
@@ -2766,7 +2766,7 @@
     /* We don't need the peer's public key anymore. Free it. */
     mbedtls_pk_free( peer_pk );
 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
@@ -2788,11 +2788,11 @@
     /* Only in TLS 1.2 */
     if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
     {
-        return( 0 );
+        return 0 ;
     }
 
     if( (*p) + 2 > end )
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
 
     /*
      * Get hash algorithm
@@ -2802,7 +2802,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
             ( "Server used unsupported HashAlgorithm %d", *(p)[0] ) );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     /*
@@ -2813,7 +2813,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
             ( "server used unsupported SignatureAlgorithm %d", (*p)[1] ) );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     /*
@@ -2823,7 +2823,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
             ( "server used HashAlgorithm %d that was not offered", *(p)[0] ) );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d",
@@ -2832,7 +2832,7 @@
                                 (*p)[0] ) );
     *p += 2;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
@@ -2854,7 +2854,7 @@
     {
         /* Should never happen */
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
     peer_pk = &ssl->session_negotiate->peer_cert->pk;
 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
@@ -2862,7 +2862,7 @@
     if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_ECKEY ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
-        return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ;
     }
 
     peer_key = mbedtls_pk_ec( *peer_pk );
@@ -2871,13 +2871,13 @@
                                  MBEDTLS_ECDH_THEIRS ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
-        return( ret );
+        return ret ;
     }
 
     if( ssl_check_server_ecdh_params( ssl ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
-        return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
+        return MBEDTLS_ERR_SSL_BAD_CERTIFICATE ;
     }
 
 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
@@ -2887,7 +2887,7 @@
     mbedtls_pk_free( peer_pk );
 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
           MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
@@ -2906,7 +2906,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
     ((void) p);
     ((void) end);
@@ -2924,12 +2924,12 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-            return( ret );
+            return ret ;
         }
 
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
     ((void) p);
     ((void) end);
@@ -2947,7 +2947,7 @@
     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
@@ -2957,7 +2957,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     /*
@@ -2982,7 +2982,7 @@
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
 
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
@@ -3008,7 +3008,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
     } /* FALLTROUGH */
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
@@ -3033,7 +3033,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
     }
     else
@@ -3052,7 +3052,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
     }
     else
@@ -3073,7 +3073,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
     }
     else
@@ -3092,14 +3092,14 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-            return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
         }
     }
     else
 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
@@ -3130,7 +3130,7 @@
                     ssl,
                     MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                     MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-                return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+                return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
             }
 
             if( pk_alg !=
@@ -3142,14 +3142,14 @@
                     ssl,
                     MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                     MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-                return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+                return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
             }
         }
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         /*
@@ -3163,7 +3163,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
         sig_len = ( p[0] << 8 ) | p[1];
         p += 2;
@@ -3175,7 +3175,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
@@ -3190,13 +3190,13 @@
                                                           params, params_len,
                                                           md_alg );
             if( ret != 0 )
-                return( ret );
+                return ret ;
         }
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
@@ -3208,7 +3208,7 @@
         {
             /* Should never happen */
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
         peer_pk = &ssl->session_negotiate->peer_cert->pk;
 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
@@ -3223,7 +3223,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-            return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
+            return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ;
         }
 
 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
@@ -3246,7 +3246,7 @@
             if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
                 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
 #endif
-            return( ret );
+            return ret ;
         }
 
 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
@@ -3263,7 +3263,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if ! defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
@@ -3278,11 +3278,11 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 }
 #else /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
@@ -3300,13 +3300,13 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
@@ -3316,7 +3316,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     ssl->state++;
@@ -3364,7 +3364,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
     n = cert_type_len;
@@ -3384,7 +3384,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* supported_signature_algorithms */
@@ -3419,7 +3419,7 @@
                 ssl,
                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
 #if defined(MBEDTLS_DEBUG_C)
@@ -3446,13 +3446,13 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
 exit:
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 
@@ -3465,13 +3465,13 @@
     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     if( ssl->in_hslen  != mbedtls_ssl_hs_hdr_len( ssl ) ||
@@ -3480,7 +3480,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     ssl->state++;
@@ -3492,7 +3492,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
@@ -3525,7 +3525,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
-            return( ret );
+            return ret ;
         }
 
         MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X  );
@@ -3538,7 +3538,7 @@
                                   ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
-            return( ret );
+            return ret ;
         }
 
         MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K  );
@@ -3586,7 +3586,7 @@
         status = psa_generate_key( &key_attributes,
                                    &handshake->ecdh_psa_privkey );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
 
         /* Export the public part of the ECDH private key from PSA
          * and convert it to ECPoint format used in ClientKeyExchange. */
@@ -3594,14 +3594,14 @@
                                         own_pubkey, sizeof( own_pubkey ),
                                         &own_pubkey_len );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
 
         if( mbedtls_psa_tls_psa_ec_to_ecpoint( own_pubkey,
                                                own_pubkey_len,
                                                &own_pubkey_ecpoint,
                                                &own_pubkey_ecpoint_len ) != 0 )
         {
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
         }
 
         /* Copy ECPoint structure to outgoing message buffer. */
@@ -3621,11 +3621,11 @@
                                         sizeof( ssl->handshake->premaster ),
                                         &ssl->handshake->pmslen );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
 
         status = psa_destroy_key( handshake->ecdh_psa_privkey );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
         handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
     }
     else
@@ -3667,7 +3667,7 @@
             if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
                 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
 #endif
-            return( ret );
+            return ret ;
         }
 
         MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
@@ -3695,7 +3695,7 @@
             if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
                 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
 #endif
-            return( ret );
+            return ret ;
         }
 
         MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
@@ -3717,7 +3717,7 @@
             /* We don't offer PSK suites if we don't have a PSK,
              * and we check that the server's choice is among the
              * ciphersuites we offered, so this should never happen. */
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         header_len = 4;
@@ -3727,7 +3727,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 1,
                 ( "psk identity too long or SSL buffer too short" ) );
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 
         ssl->out_msg[header_len++] = (unsigned char)( content_len >> 8 );
@@ -3751,12 +3751,12 @@
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
             /* Opaque PSKs are currently only supported for PSK-only suites. */
             if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
-                return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+                return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
             if( ( ret = ssl_write_encrypted_pms( ssl, header_len,
                                                  &content_len, 2 ) ) != 0 )
-                return( ret );
+                return ret ;
         }
         else
 #endif
@@ -3766,7 +3766,7 @@
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
             /* Opaque PSKs are currently only supported for PSK-only suites. */
             if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
-                return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+                return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
             /*
@@ -3779,7 +3779,7 @@
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1,
                     ( "psk identity or DHM size too long or SSL buffer too short" ) );
-                return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
             }
 
             ssl->out_msg[header_len++] = (unsigned char)( content_len >> 8 );
@@ -3792,7 +3792,7 @@
             if( ret != 0 )
             {
                 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
-                return( ret );
+                return ret ;
             }
         }
         else
@@ -3803,7 +3803,7 @@
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
             /* Opaque PSKs are currently only supported for PSK-only suites. */
             if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
-                return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+                return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
             /*
@@ -3817,7 +3817,7 @@
             if( ret != 0 )
             {
                 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
-                return( ret );
+                return ret ;
             }
 
             MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
@@ -3827,7 +3827,7 @@
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO) &&          \
@@ -3847,7 +3847,7 @@
         {
             MBEDTLS_SSL_DEBUG_RET( 1,
                 "mbedtls_ssl_psk_derive_premaster", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -3858,7 +3858,7 @@
         header_len = 4;
         if( ( ret = ssl_write_encrypted_pms( ssl, header_len,
                                              &content_len, 0 ) ) != 0 )
-            return( ret );
+            return ret ;
     }
     else
 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
@@ -3875,7 +3875,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
-            return( ret );
+            return ret ;
         }
 
         ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
@@ -3884,7 +3884,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -3892,7 +3892,7 @@
     {
         ((void) ciphersuite_info);
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     ssl->out_msglen  = header_len + content_len;
@@ -3904,12 +3904,12 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
@@ -3924,18 +3924,18 @@
     if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
-        return( ret );
+        return ret ;
     }
 
     if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 }
 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
@@ -3968,27 +3968,27 @@
     if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
-        return( ret );
+        return ret ;
     }
 
     if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     if( mbedtls_ssl_own_key( ssl ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
-        return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
+        return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ;
     }
 
     /*
@@ -4042,7 +4042,7 @@
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
@@ -4062,7 +4062,7 @@
         if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
             ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
 #endif
-        return( ret );
+        return ret ;
     }
 
     ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
@@ -4077,12 +4077,12 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 
@@ -4100,7 +4100,7 @@
     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
@@ -4110,7 +4110,7 @@
             ssl,
             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
             MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     /*
@@ -4129,7 +4129,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
@@ -4144,7 +4144,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %" MBEDTLS_PRINTF_SIZET, ticket_len ) );
@@ -4158,7 +4158,7 @@
      * to send a ticket after all, so just forget it
      */
     if( ticket_len == 0 )
-        return( 0 );
+        return 0 ;
 
     if( ssl->session != NULL && ssl->session->ticket != NULL )
     {
@@ -4180,7 +4180,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     }
 
     memcpy( ticket, msg + 6, ticket_len );
@@ -4199,7 +4199,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
@@ -4211,19 +4211,19 @@
     int ret = 0;
 
     if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
 
     if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
         ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
     {
         if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
@@ -4334,9 +4334,9 @@
 
        default:
            MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
-           return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+           return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
    }
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SSL_CLI_C */
diff --git a/library/ssl_cookie.c b/library/ssl_cookie.c
index 40b8913..f310a64 100644
--- a/library/ssl_cookie.c
+++ b/library/ssl_cookie.c
@@ -102,19 +102,19 @@
     unsigned char key[COOKIE_MD_OUTLEN];
 
     if( ( ret = f_rng( p_rng, key, sizeof( key ) ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_md_setup( &ctx->hmac_ctx, mbedtls_md_info_from_type( COOKIE_MD ), 1 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_md_hmac_starts( &ctx->hmac_ctx, key, sizeof( key ) );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     mbedtls_platform_zeroize( key, sizeof( key ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -134,13 +134,13 @@
         mbedtls_md_hmac_update( hmac_ctx, cli_id, cli_id_len ) != 0 ||
         mbedtls_md_hmac_finish( hmac_ctx, hmac_out ) != 0 )
     {
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     memcpy( *p, hmac_out, COOKIE_HMAC_LEN );
     *p += COOKIE_HMAC_LEN;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -155,7 +155,7 @@
     unsigned long t;
 
     if( ctx == NULL || cli_id == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     MBEDTLS_SSL_CHK_BUF_PTR( *p, end, COOKIE_LEN );
 
@@ -173,7 +173,7 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret ) ;
 #endif
 
     ret = ssl_cookie_hmac( &ctx->hmac_ctx, *p - 4,
@@ -185,7 +185,7 @@
                 MBEDTLS_ERR_THREADING_MUTEX_ERROR ) );
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -202,14 +202,14 @@
     unsigned long cur_time, cookie_time;
 
     if( ctx == NULL || cli_id == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( cookie_len != COOKIE_LEN )
-        return( -1 );
+        return -1 ;
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret ) ;
 #endif
 
     if( ssl_cookie_hmac( &ctx->hmac_ctx, cookie,
@@ -224,10 +224,10 @@
 #endif
 
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     if( mbedtls_ssl_safer_memcmp( cookie + 4, ref_hmac, sizeof( ref_hmac ) ) != 0 )
-        return( -1 );
+        return -1 ;
 
 #if defined(MBEDTLS_HAVE_TIME)
     cur_time = (unsigned long) mbedtls_time( NULL );
@@ -241,8 +241,8 @@
                   ( (unsigned long) cookie[3]       );
 
     if( ctx->timeout != 0 && cur_time - cookie_time > ctx->timeout )
-        return( -1 );
+        return -1 ;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_COOKIE_C */
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index cc19f47..de33e4e 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -350,7 +350,7 @@
     do {                                                                 \
         if( mbedtls_ssl_chk_buf_ptr( ( cur ), ( end ), ( need ) ) != 0 ) \
         {                                                                \
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );                  \
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;                  \
         }                                                                \
     } while( 0 )
 
@@ -753,10 +753,10 @@
         const mbedtls_ssl_transform *transform )
 {
 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
-    return( transform->maclen == 0 && transform->taglen != 0 );
+    return transform->maclen == 0 && transform->taglen != 0 ;
 #else
     (void) transform;
-    return( 1 );
+    return 1 ;
 #endif
 }
 
@@ -1015,10 +1015,10 @@
     {
         *psk = NULL;
         *psk_len = 0;
-        return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
+        return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -1033,12 +1033,12 @@
     const mbedtls_ssl_context *ssl )
 {
     if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
-        return( ssl->handshake->psk_opaque );
+        return ssl->handshake->psk_opaque ;
 
     if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
-        return( ssl->conf->psk_opaque );
+        return ssl->conf->psk_opaque ;
 
-    return( MBEDTLS_SVC_KEY_ID_INIT );
+    return MBEDTLS_SVC_KEY_ID_INIT ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -1076,7 +1076,7 @@
             return srtp_profile_value;
         default: break;
     }
-    return( MBEDTLS_TLS_SRTP_UNSET );
+    return MBEDTLS_TLS_SRTP_UNSET ;
 }
 #endif
 
@@ -1090,7 +1090,7 @@
     else
         key_cert = ssl->conf->key_cert;
 
-    return( key_cert == NULL ? NULL : key_cert->key );
+    return key_cert == NULL ? NULL : key_cert->key ;
 }
 
 static inline mbedtls_x509_crt *mbedtls_ssl_own_cert( mbedtls_ssl_context *ssl )
@@ -1102,7 +1102,7 @@
     else
         key_cert = ssl->conf->key_cert;
 
-    return( key_cert == NULL ? NULL : key_cert->cert );
+    return key_cert == NULL ? NULL : key_cert->cert ;
 }
 
 /*
@@ -1134,12 +1134,12 @@
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
-        return( 13 );
+        return 13 ;
     }
     else
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
     {
-        return( 5 );
+        return 5 ;
     }
 }
 
@@ -1152,11 +1152,11 @@
 {
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-        return( 12 );
+        return 12 ;
 #else
     ((void) ssl);
 #endif
-    return( 4 );
+    return 4 ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -1192,7 +1192,7 @@
         diff |= x ^ y;
     }
 
-    return( diff );
+    return diff ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
@@ -1222,11 +1222,11 @@
 {
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-        return( 2 );
+        return 2 ;
 #else
     ((void) ssl);
 #endif
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 76cc2b1..df75e6d 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -75,15 +75,15 @@
 int mbedtls_ssl_check_timer( mbedtls_ssl_context *ssl )
 {
     if( ssl->f_get_timer == NULL )
-        return( 0 );
+        return 0 ;
 
     if( ssl->f_get_timer( ssl->p_timer ) == 2 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
-        return( -1 );
+        return -1 ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
@@ -145,7 +145,7 @@
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
-    return( ret );
+    return ret ;
 }
 
 #define SSL_DONT_FORCE_FLUSH 0
@@ -174,9 +174,9 @@
 #endif
 
     if( mtu != 0 && mtu < out_buf_len )
-        return( mtu );
+        return mtu ;
 
-    return( out_buf_len );
+    return out_buf_len ;
 }
 
 static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
@@ -189,7 +189,7 @@
     if( bytes_written > mtu )
     {
         /* Should never happen... */
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     return( (int) ( mtu - bytes_written ) );
@@ -217,29 +217,29 @@
      * write datagrams larger than MFL + Record Expansion Overhead.
      */
     if( max_len <= ssl->out_left )
-        return( 0 );
+        return 0 ;
 
     max_len -= ssl->out_left;
 #endif
 
     ret = ssl_get_remaining_space_in_datagram( ssl );
     if( ret < 0 )
-        return( ret );
+        return ret ;
     remaining = (size_t) ret;
 
     ret = mbedtls_ssl_get_record_expansion( ssl );
     if( ret < 0 )
-        return( ret );
+        return ret ;
     expansion = (size_t) ret;
 
     if( remaining <= expansion )
-        return( 0 );
+        return 0 ;
 
     remaining -= expansion;
     if( remaining >= max_len )
         remaining = max_len;
 
-    return( (int) remaining );
+    return (int) remaining ;
 }
 
 /*
@@ -251,7 +251,7 @@
     uint32_t new_timeout;
 
     if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max )
-        return( -1 );
+        return -1 ;
 
     /* Implement the final paragraph of RFC 6347 section 4.1.1.1
      * in the following way: after the initial transmission and a first
@@ -278,7 +278,7 @@
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %lu millisecs",
                         (unsigned long) ssl->handshake->retransmit_timeout ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
@@ -299,7 +299,7 @@
 static size_t ssl_compute_padding_length( size_t len,
                                           size_t granularity )
 {
-    return( ( granularity - ( len + 1 ) % granularity ) % granularity );
+    return ( granularity - ( len + 1 ) % granularity ) % granularity ;
 }
 
 /* This functions transforms a (D)TLS plaintext fragment and a record content
@@ -340,19 +340,19 @@
 
     /* Write real content type */
     if( remaining == 0 )
-        return( -1 );
+        return -1 ;
     content[ len ] = rec_type;
     len++;
     remaining--;
 
     if( remaining < pad )
-        return( -1 );
+        return -1 ;
     memset( content + len, 0, pad );
     len += pad;
     remaining -= pad;
 
     *content_size = len;
-    return( 0 );
+    return 0 ;
 }
 
 /* This function parses a (D)TLSInnerPlaintext structure.
@@ -367,14 +367,14 @@
     do
     {
         if( remaining == 0 )
-            return( -1 );
+            return -1 ;
         remaining--;
     } while( content[ remaining ] == 0 );
 
     *content_size = remaining;
     *rec_type = content[ remaining ];
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID ||
           MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
@@ -452,7 +452,7 @@
 static int ssl_transform_aead_dynamic_iv_is_explicit(
                                 mbedtls_ssl_transform const *transform )
 {
-    return( transform->ivlen != transform->fixed_ivlen );
+    return transform->ivlen != transform->fixed_ivlen ;
 }
 
 /* Compute IV := ( fixed_iv || 0 ) XOR ( 0 || dynamic_IV )
@@ -529,7 +529,7 @@
     if( transform == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
     if( rec == NULL
         || rec->buf == NULL
@@ -541,7 +541,7 @@
         )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     data = rec->buf + rec->data_offset;
@@ -557,7 +557,7 @@
                                     " too large, maximum %" MBEDTLS_PRINTF_SIZET,
                                     rec->data_len,
                                     (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     /* The following two code paths implement the (D)TLSInnerPlaintext
@@ -584,7 +584,7 @@
                                        rec->type,
                                        padding ) != 0 )
         {
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 
         rec->type = MBEDTLS_SSL_MSG_APPLICATION_DATA;
@@ -617,7 +617,7 @@
                         rec->type,
                         padding ) != 0 )
         {
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 
         rec->type = MBEDTLS_SSL_MSG_CID;
@@ -640,7 +640,7 @@
         if( post_avail < transform->maclen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
         unsigned char mac[MBEDTLS_SSL_MAC_ADD];
@@ -684,13 +684,13 @@
                                    data, &olen ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
-            return( ret );
+            return ret ;
         }
 
         if( rec->data_len != olen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
     }
     else
@@ -714,7 +714,7 @@
         if( post_avail < transform->taglen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 
         /*
@@ -769,7 +769,7 @@
                    transform->taglen ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt_ext", ret );
-            return( ret );
+            return ret ;
         }
         MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
                                data + rec->data_len - transform->taglen,
@@ -785,7 +785,7 @@
             if( rec->data_offset < dynamic_iv_len )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
-                return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
             }
 
             memcpy( data - dynamic_iv_len, dynamic_iv, dynamic_iv_len );
@@ -814,7 +814,7 @@
         if( post_avail < padlen + 1 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 
         for( i = 0; i <= padlen; i++ )
@@ -831,13 +831,13 @@
         if( f_rng == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         if( rec->data_offset < transform->ivlen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 
         /*
@@ -845,7 +845,7 @@
          */
         ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
         if( ret != 0 )
-            return( ret );
+            return ret ;
 
         memcpy( data - transform->ivlen, transform->iv_enc, transform->ivlen );
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
@@ -863,13 +863,13 @@
                                    data, &olen ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
-            return( ret );
+            return ret ;
         }
 
         if( rec->data_len != olen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         data             -= transform->ivlen;
@@ -893,7 +893,7 @@
             if( post_avail < transform->maclen)
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
-                return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+                return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
             }
 
             ssl_extract_add_data_from_record( add_data, &add_data_len,
@@ -922,19 +922,19 @@
 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC) */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     /* Make extra sure authentication was performed, exactly once */
     if( auth_done != 1 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)
@@ -985,7 +985,7 @@
     /* mask = (x < y) ? 0xff... : 0x00... */
     const size_t mask = mbedtls_ssl_cf_mask_from_bit( sub1 );
 
-    return( mask );
+    return mask ;
 }
 
 /*
@@ -1001,7 +1001,7 @@
  */
 static size_t mbedtls_ssl_cf_mask_ge( size_t x, size_t y )
 {
-    return( ~mbedtls_ssl_cf_mask_lt( x, y ) );
+    return ~mbedtls_ssl_cf_mask_lt( x, y ) ;
 }
 
 /*
@@ -1037,7 +1037,7 @@
     /* diff1 = (x != y) ? 1 : 0 */
     const size_t diff1 = diff_msb >> ( sizeof( diff_msb ) * 8 - 1 );
 
-    return( 1 ^ diff1 );
+    return 1 ^ diff1 ;
 }
 
 /*
@@ -1148,7 +1148,7 @@
 
 cleanup:
     mbedtls_md_free( &aux );
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1199,7 +1199,7 @@
         rec->buf_len - rec->data_offset < rec->data_len )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     data = rec->buf + rec->data_offset;
@@ -1212,7 +1212,7 @@
     if( rec->cid_len != transform->in_cid_len ||
         memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 )
     {
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_CID ;
     }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
@@ -1227,13 +1227,13 @@
                                    data, &olen ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
-            return( ret );
+            return ret ;
         }
 
         if( rec->data_len != olen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
     }
     else
@@ -1266,7 +1266,7 @@
                                             " ) < explicit_iv_len (%" MBEDTLS_PRINTF_SIZET ") ",
                                             rec->data_len,
                                             dynamic_iv_len ) );
-                return( MBEDTLS_ERR_SSL_INVALID_MAC );
+                return MBEDTLS_ERR_SSL_INVALID_MAC ;
             }
             dynamic_iv = data;
 
@@ -1286,7 +1286,7 @@
                                         ") < taglen (%" MBEDTLS_PRINTF_SIZET ") ",
                                         rec->data_len,
                                         transform->taglen ) );
-            return( MBEDTLS_ERR_SSL_INVALID_MAC );
+            return MBEDTLS_ERR_SSL_INVALID_MAC ;
         }
         rec->data_len -= transform->taglen;
 
@@ -1331,9 +1331,9 @@
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt_ext", ret );
 
             if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
-                return( MBEDTLS_ERR_SSL_INVALID_MAC );
+                return MBEDTLS_ERR_SSL_INVALID_MAC ;
 
-            return( ret );
+            return ret ;
         }
         auth_done++;
 
@@ -1341,7 +1341,7 @@
         if( olen != rec->data_len )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
     }
     else
@@ -1389,7 +1389,7 @@
                                 "+ 1 ) ( + expl IV )", rec->data_len,
                                 transform->ivlen,
                                 transform->maclen ) );
-            return( MBEDTLS_ERR_SSL_INVALID_MAC );
+            return MBEDTLS_ERR_SSL_INVALID_MAC ;
         }
 
         /*
@@ -1436,7 +1436,7 @@
                                           transform->maclen ) != 0 )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
-                return( MBEDTLS_ERR_SSL_INVALID_MAC );
+                return MBEDTLS_ERR_SSL_INVALID_MAC ;
             }
             auth_done++;
         }
@@ -1454,7 +1454,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%" MBEDTLS_PRINTF_SIZET
                                         ") %% ivlen (%" MBEDTLS_PRINTF_SIZET ") != 0",
                                         rec->data_len, transform->ivlen ) );
-            return( MBEDTLS_ERR_SSL_INVALID_MAC );
+            return MBEDTLS_ERR_SSL_INVALID_MAC ;
         }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
@@ -1476,14 +1476,14 @@
                                    data, rec->data_len, data, &olen ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
-            return( ret );
+            return ret ;
         }
 
         /* Double-check that length hasn't changed during decryption. */
         if( rec->data_len != olen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         /* Safe since data_len >= minlen + maclen + 1, so after having
@@ -1573,7 +1573,7 @@
 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
 #if defined(MBEDTLS_SSL_DEBUG_ALL)
@@ -1629,7 +1629,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cf_hmac", ret );
-            return( ret );
+            return ret ;
         }
 
         mbedtls_ssl_cf_memcpy_offset( mac_peer, data,
@@ -1658,14 +1658,14 @@
      * Finally check the correct flag
      */
     if( correct == 0 )
-        return( MBEDTLS_ERR_SSL_INVALID_MAC );
+        return MBEDTLS_ERR_SSL_INVALID_MAC ;
 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
 
     /* Make extra sure authentication was performed, exactly once */
     if( auth_done != 1 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
@@ -1676,7 +1676,7 @@
                                          &rec->type );
 
         if( ret != 0 )
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
 
@@ -1686,13 +1686,13 @@
         ret = ssl_parse_inner_plaintext( data, &rec->data_len,
                                          &rec->type );
         if( ret != 0 )
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #undef MAC_NONE
@@ -1730,13 +1730,13 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
                             "or mbedtls_ssl_set_bio()" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     if( nb_want > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -1759,7 +1759,7 @@
             if( ssl->in_left < ssl->next_record_offset )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-                return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+                return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
             }
 
             ssl->in_left -= ssl->next_record_offset;
@@ -1787,7 +1787,7 @@
         if( nb_want <= ssl->in_left)
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
-            return( 0 );
+            return 0 ;
         }
 
         /*
@@ -1798,7 +1798,7 @@
         if( ssl->in_left != 0 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         /*
@@ -1831,7 +1831,7 @@
             MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
 
             if( ret == 0 )
-                return( MBEDTLS_ERR_SSL_CONN_EOF );
+                return MBEDTLS_ERR_SSL_CONN_EOF ;
         }
 
         if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
@@ -1844,16 +1844,16 @@
                 if( ssl_double_retransmit_timeout( ssl ) != 0 )
                 {
                     MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
-                    return( MBEDTLS_ERR_SSL_TIMEOUT );
+                    return MBEDTLS_ERR_SSL_TIMEOUT ;
                 }
 
                 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
                 {
                     MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
-                    return( ret );
+                    return ret ;
                 }
 
-                return( MBEDTLS_ERR_SSL_WANT_READ );
+                return MBEDTLS_ERR_SSL_WANT_READ ;
             }
 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
             else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
@@ -1863,16 +1863,16 @@
                 {
                     MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend_hello_request",
                                            ret );
-                    return( ret );
+                    return ret ;
                 }
 
-                return( MBEDTLS_ERR_SSL_WANT_READ );
+                return MBEDTLS_ERR_SSL_WANT_READ ;
             }
 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
         }
 
         if( ret < 0 )
-            return( ret );
+            return ret ;
 
         ssl->in_left = ret;
     }
@@ -1910,17 +1910,17 @@
             MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
 
             if( ret == 0 )
-                return( MBEDTLS_ERR_SSL_CONN_EOF );
+                return MBEDTLS_ERR_SSL_CONN_EOF ;
 
             if( ret < 0 )
-                return( ret );
+                return ret ;
 
             if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > (int)SIZE_MAX ) )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1,
                     ( "f_recv returned %d bytes but only %" MBEDTLS_PRINTF_SIZET " were requested",
                     ret, len ) );
-                return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+                return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
             }
 
             ssl->in_left += ret;
@@ -1929,7 +1929,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1946,14 +1946,14 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
                             "or mbedtls_ssl_set_bio()" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     /* Avoid incrementing counter if data is flushed */
     if( ssl->out_left == 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
-        return( 0 );
+        return 0 ;
     }
 
     while( ssl->out_left > 0 )
@@ -1968,14 +1968,14 @@
         MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
 
         if( ret <= 0 )
-            return( ret );
+            return ret ;
 
         if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > (int)SIZE_MAX ) )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1,
                 ( "f_send returned %d bytes but only %" MBEDTLS_PRINTF_SIZET " bytes were sent",
                 ret, ssl->out_left ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         ssl->out_left -= ret;
@@ -1995,7 +1995,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2017,7 +2017,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %" MBEDTLS_PRINTF_SIZET " bytes failed",
                             sizeof( mbedtls_ssl_flight_item ) ) );
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     }
 
     if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
@@ -2025,7 +2025,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %" MBEDTLS_PRINTF_SIZET " bytes failed",
                                     ssl->out_msglen ) );
         mbedtls_free( msg );
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     }
 
     /* Copy current handshake message with headers */
@@ -2046,7 +2046,7 @@
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2079,7 +2079,7 @@
     if( ssl->transform_out == ssl->handshake->alt_transform_out )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
@@ -2097,7 +2097,7 @@
     /* Adjust to the newly activated transform */
     mbedtls_ssl_update_out_pointers( ssl, ssl->transform_out );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2113,7 +2113,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -2136,7 +2136,7 @@
         ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
         ret = ssl_swap_epochs( ssl );
         if( ret != 0 )
-            return( ret );
+            return ret ;
 
         ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
     }
@@ -2161,12 +2161,12 @@
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
             ret = ssl_swap_epochs( ssl );
             if( ret != 0 )
-                return( ret );
+                return ret ;
         }
 
         ret = ssl_get_remaining_payload_in_datagram( ssl );
         if( ret < 0 )
-            return( ret );
+            return ret ;
         max_frag_len = (size_t) ret;
 
         /* CCS is copied as is, while HS messages may need fragmentation */
@@ -2175,7 +2175,7 @@
             if( max_frag_len == 0 )
             {
                 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
-                    return( ret );
+                    return ret ;
 
                 continue;
             }
@@ -2201,11 +2201,11 @@
                 {
                     ret = ssl_swap_epochs( ssl );
                     if( ret != 0 )
-                        return( ret );
+                        return ret ;
                 }
 
                 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
-                    return( ret );
+                    return ret ;
 
                 continue;
             }
@@ -2264,12 +2264,12 @@
         if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
-            return( ret );
+            return ret ;
         }
     }
 
     if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* Update state and set timer */
     if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
@@ -2282,7 +2282,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2375,7 +2375,7 @@
         ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     /* Whenever we send anything different from a
@@ -2385,7 +2385,7 @@
         ssl->handshake == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -2394,7 +2394,7 @@
         ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 #endif
 
@@ -2413,7 +2413,7 @@
                                     ", maximum %" MBEDTLS_PRINTF_SIZET,
                                     ssl->out_msglen,
                                     (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     /*
@@ -2442,7 +2442,7 @@
                               "size %" MBEDTLS_PRINTF_SIZET ", maximum %" MBEDTLS_PRINTF_SIZET,
                                hs_len,
                                (size_t) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
-                return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+                return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
             }
 
             memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
@@ -2482,7 +2482,7 @@
         if( ( ret = ssl_flight_append( ssl ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -2491,13 +2491,13 @@
         if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
-            return( ret );
+            return ret ;
         }
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2562,13 +2562,13 @@
                                          ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
             {
                 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
-                return( ret );
+                return ret ;
             }
 
             if( rec.data_offset != 0 )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-                return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+                return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
             }
 
             /* Update the record content type and CID. */
@@ -2590,12 +2590,12 @@
         {
             ret = ssl_get_remaining_space_in_datagram( ssl );
             if( ret < 0 )
-                return( ret );
+                return ret ;
 
             if( protected_record_size > (size_t) ret )
             {
                 /* Should never happen */
-                return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+                return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
             }
         }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
@@ -2623,7 +2623,7 @@
         if( i == mbedtls_ssl_ep_len( ssl ) )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
-            return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
+            return MBEDTLS_ERR_SSL_COUNTER_WRAPPING ;
         }
     }
 
@@ -2637,7 +2637,7 @@
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
                                    ret );
-            return( ret );
+            return ret ;
         }
 
         remaining = (size_t) ret;
@@ -2656,12 +2656,12 @@
         ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -2672,9 +2672,9 @@
         memcmp( ssl->in_msg + 6, "\0\0\0",        3 ) != 0 ||
         memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
     {
-        return( 1 );
+        return 1 ;
     }
-    return( 0 );
+    return 0 ;
 }
 
 static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
@@ -2700,15 +2700,15 @@
     frag_len = ssl_get_hs_frag_len( ssl );
 
     if( frag_off > msg_len )
-        return( -1 );
+        return -1 ;
 
     if( frag_len > msg_len - frag_off )
-        return( -1 );
+        return -1 ;
 
     if( frag_len + 12 > ssl->in_msglen )
-        return( -1 );
+        return -1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2763,13 +2763,13 @@
 
     for( i = 0; i < len / 8; i++ )
         if( mask[i] != 0xFF )
-            return( -1 );
+            return -1 ;
 
     for( i = 0; i < len % 8; i++ )
         if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
-            return( -1 );
+            return -1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /* msg_len does not include the handshake header */
@@ -2784,7 +2784,7 @@
     if( add_bitmap )
         alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap       */
 
-    return( alloc_len );
+    return alloc_len ;
 }
 
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
@@ -2802,7 +2802,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %" MBEDTLS_PRINTF_SIZET,
                             ssl->in_msglen ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 
     ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
@@ -2820,7 +2820,7 @@
         if( ssl_check_hs_header( ssl ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
 
         if( ssl->handshake != NULL &&
@@ -2834,7 +2834,7 @@
                 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
                                             recv_msg_seq,
                                             ssl->handshake->in_msg_seq ) );
-                return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
+                return MBEDTLS_ERR_SSL_EARLY_MESSAGE ;
             }
 
             /* Retransmit only on last message from previous flight, to avoid
@@ -2851,7 +2851,7 @@
                 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
                 {
                     MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
-                    return( ret );
+                    return ret ;
                 }
             }
             else
@@ -2862,7 +2862,7 @@
                                     ssl->handshake->in_msg_seq ) );
             }
 
-            return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
+            return MBEDTLS_ERR_SSL_CONTINUE_PROCESSING ;
         }
         /* Wait until message completion to increment in_msg_seq */
 
@@ -2873,7 +2873,7 @@
         if( ssl_hs_is_proper_fragment( ssl ) == 1 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
-            return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
+            return MBEDTLS_ERR_SSL_EARLY_MESSAGE ;
         }
     }
     else
@@ -2882,10 +2882,10 @@
     if( ssl->in_msglen < ssl->in_hslen )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
@@ -2984,20 +2984,20 @@
     uint64_t bit;
 
     if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
-        return( 0 );
+        return 0 ;
 
     if( rec_seqnum > ssl->in_window_top )
-        return( 0 );
+        return 0 ;
 
     bit = ssl->in_window_top - rec_seqnum;
 
     if( bit >= 64 )
-        return( -1 );
+        return -1 ;
 
     if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
-        return( -1 );
+        return -1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -3090,22 +3090,22 @@
         in[3] != 0 || in[4] != 0 ||
         in[19] != 0 || in[20] != 0 || in[21] != 0 )
     {
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     sid_len = in[59];
     if( sid_len > in_len - 61 )
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
 
     cookie_len = in[60 + sid_len];
     if( cookie_len > in_len - 60 )
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
 
     if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
                         cli_id, cli_id_len ) == 0 )
     {
         /* Valid cookie */
-        return( 0 );
+        return 0 ;
     }
 
     /*
@@ -3129,7 +3129,7 @@
      * Minimum length is 28.
      */
     if( buf_len < 28 )
-        return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
 
     /* Copy most fields and adapt others */
     memcpy( obuf, in, 25 );
@@ -3142,7 +3142,7 @@
     if( f_cookie_write( p_cookie,
                         &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
     {
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     *olen = p - obuf;
@@ -3157,7 +3157,7 @@
     obuf[11] = (unsigned char)( ( *olen - 13 ) >>  8 );
     obuf[12] = (unsigned char)( ( *olen - 13 )       );
 
-    return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
+    return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ;
 }
 
 /*
@@ -3192,7 +3192,7 @@
          * drop the record. */
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "no cookie callbacks, "
                                     "can't check reconnect validity" ) );
-        return( 0 );
+        return 0 ;
     }
 
     ret = ssl_check_dtls_clihlo_cookie(
@@ -3218,7 +3218,7 @@
         MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", send_ret );
         (void) send_ret;
 
-        return( 0 );
+        return 0 ;
     }
 
     if( ret == 0 )
@@ -3227,13 +3227,13 @@
         if( ( ret = mbedtls_ssl_session_reset_int( ssl, 1 ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
-            return( ret );
+            return ret ;
         }
 
-        return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
+        return MBEDTLS_ERR_SSL_CLIENT_RECONNECT ;
     }
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
 
@@ -3244,10 +3244,10 @@
         record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
         record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
     {
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -3319,7 +3319,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header of length %u",
                  (unsigned) len,
                  (unsigned)( rec_hdr_len_len + rec_hdr_len_len ) ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 
     /*
@@ -3359,7 +3359,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header including CID, length %u",
                 (unsigned) len,
                 (unsigned)( rec_hdr_len_offset + rec_hdr_len_len ) ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
 
         /* configured CID len is guaranteed at most 255, see
@@ -3374,7 +3374,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type %u",
                                         (unsigned) rec->type ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
     }
 
@@ -3391,13 +3391,13 @@
     if( major_ver != ssl->major_ver )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 
     if( minor_ver > ssl->conf->max_minor_ver )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 
     /*
@@ -3436,7 +3436,7 @@
     rec->buf_len = rec->data_offset + rec->data_len;
 
     if( rec->data_len == 0 )
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        return MBEDTLS_ERR_SSL_INVALID_RECORD ;
 
     /*
      * DTLS-related tests.
@@ -3462,7 +3462,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "Datagram of length %u too small to contain record of advertised length %u.",
                              (unsigned) len,
                              (unsigned)( rec->data_offset + rec->data_len ) ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
 
         /* Records from other, non-matching epochs are silently discarded.
@@ -3479,10 +3479,10 @@
             if( rec_epoch == (unsigned) ssl->in_epoch + 1 )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
-                return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
+                return MBEDTLS_ERR_SSL_EARLY_MESSAGE ;
             }
 
-            return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
+            return MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ;
         }
 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
         /* For records from the correct epoch, check whether their
@@ -3491,13 +3491,13 @@
             &rec->ctr[0] ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
-            return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
+            return MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ;
         }
 #endif
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
-    return( 0 );
+    return 0 ;
 }
 
 
@@ -3521,10 +3521,10 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
                                     "from the same port" ) );
-        return( ssl_handle_possible_reconnect( ssl ) );
+        return ssl_handle_possible_reconnect( ssl ) ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
 
@@ -3558,7 +3558,7 @@
             }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
-            return( ret );
+            return ret ;
         }
 
         if( old_msg_type != rec->type )
@@ -3581,7 +3581,7 @@
         if( ssl_check_record_type( rec->type ) )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
@@ -3593,7 +3593,7 @@
             {
                 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
-                return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+                return MBEDTLS_ERR_SSL_INVALID_RECORD ;
             }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
@@ -3610,7 +3610,7 @@
                 /* Treat the records as if they were not properly authenticated,
                  * thereby failing the connection if we see more than allowed
                  * by the configured bad MAC threshold. */
-                return( MBEDTLS_ERR_SSL_INVALID_MAC );
+                return MBEDTLS_ERR_SSL_INVALID_MAC ;
             }
         }
         else
@@ -3633,7 +3633,7 @@
             if( i == mbedtls_ssl_ep_len( ssl ) )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
-                return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
+                return MBEDTLS_ERR_SSL_COUNTER_WRAPPING ;
             }
         }
 
@@ -3651,10 +3651,10 @@
     if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        return MBEDTLS_ERR_SSL_INVALID_RECORD ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -3683,7 +3683,7 @@
 
             ret = ssl_consume_current_message( ssl );
             if( ret != 0 )
-                return( ret );
+                return ret ;
 
             if( ssl_record_is_in_progress( ssl ) == 0 )
             {
@@ -3709,7 +3709,7 @@
                     if( ret != 0 )
                     {
                         MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
-                        return( ret );
+                        return ret ;
                     }
                 }
             }
@@ -3722,7 +3722,7 @@
                 /* Buffer future message */
                 ret = ssl_buffer_message( ssl );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
 
                 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
             }
@@ -3734,7 +3734,7 @@
         if( 0 != ret )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
-            return( ret );
+            return ret ;
         }
 
         if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
@@ -3751,16 +3751,16 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
 static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
 {
     if( ssl->in_left > ssl->next_record_offset )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
@@ -3770,7 +3770,7 @@
     int ret = 0;
 
     if( hs == NULL )
-        return( -1 );
+        return -1 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
 
@@ -3831,7 +3831,7 @@
         if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
@@ -3857,7 +3857,7 @@
 exit:
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
-    return( ret );
+    return ret ;
 }
 
 static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
@@ -3876,7 +3876,7 @@
                      hs->buffering.total_bytes_buffered ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
-        return( 0 );
+        return 0 ;
     }
 
     /* We don't have enough space to buffer the next expected handshake
@@ -3895,11 +3895,11 @@
                          hs->buffering.total_bytes_buffered ) )
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
-            return( 0 );
+            return 0 ;
         }
     }
 
-    return( -1 );
+    return -1 ;
 }
 
 static int ssl_buffer_message( mbedtls_ssl_context *ssl )
@@ -3908,7 +3908,7 @@
     mbedtls_ssl_handshake_params * const hs = ssl->handshake;
 
     if( hs == NULL )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
 
@@ -3932,7 +3932,7 @@
             if( recv_msg_seq < ssl->handshake->in_msg_seq )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-                return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+                return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
             }
 
             recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
@@ -3977,7 +3977,7 @@
                     MBEDTLS_SSL_DTLS_MAX_BUFFERING )
                 {
                     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-                    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+                    return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
                 }
 
                 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
@@ -4102,7 +4102,7 @@
 exit:
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
@@ -4139,7 +4139,7 @@
         if( ssl->in_offt != NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         /*
@@ -4182,7 +4182,7 @@
     /* Case (4): Application data */
     else if( ssl->in_offt != NULL )
     {
-        return( 0 );
+        return 0 ;
     }
     /* Everything else (CCS & Alerts) */
     else
@@ -4190,15 +4190,15 @@
         ssl->in_msglen = 0;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
 {
     if( ssl->in_msglen > 0 )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -4231,22 +4231,22 @@
     size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
 #endif
     if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-        return( 0 );
+        return 0 ;
 
     if( hs == NULL )
-        return( 0 );
+        return 0 ;
 
     rec       = hs->buffering.future_record.data;
     rec_len   = hs->buffering.future_record.len;
     rec_epoch = hs->buffering.future_record.epoch;
 
     if( rec == NULL )
-        return( 0 );
+        return 0 ;
 
     /* Only consider loading future records if the
      * input buffer is empty. */
     if( ssl_next_record_is_in_datagram( ssl ) == 1 )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
 
@@ -4262,7 +4262,7 @@
     if( rec_len > in_buf_len - (size_t)( ssl->in_hdr - ssl->in_buf ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     memcpy( ssl->in_hdr, rec, rec_len );
@@ -4273,7 +4273,7 @@
 
 exit:
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
@@ -4283,16 +4283,16 @@
 
     /* Don't buffer future records outside handshakes. */
     if( hs == NULL )
-        return( 0 );
+        return 0 ;
 
     /* Only buffer handshake records (we are only interested
      * in Finished messages). */
     if( rec->type != MBEDTLS_SSL_MSG_HANDSHAKE )
-        return( 0 );
+        return 0 ;
 
     /* Don't buffer more than one future epoch record. */
     if( hs->buffering.future_record.data != NULL )
-        return( 0 );
+        return 0 ;
 
     /* Don't buffer record if there's not enough buffering space remaining. */
     if( rec->buf_len > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
@@ -4304,7 +4304,7 @@
                                     " bytes buffered) -- ignore\n",
                         rec->buf_len, (size_t) MBEDTLS_SSL_DTLS_MAX_BUFFERING,
                         hs->buffering.total_bytes_buffered ) );
-        return( 0 );
+        return 0 ;
     }
 
     /* Buffer record */
@@ -4323,13 +4323,13 @@
     {
         /* If we run out of RAM trying to buffer a
          * record from the next epoch, just ignore. */
-        return( 0 );
+        return 0 ;
     }
 
     memcpy( hs->buffering.future_record.data, rec->buf, rec->buf_len );
 
     hs->buffering.total_bytes_buffered += rec->buf_len;
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
@@ -4348,7 +4348,7 @@
      * essentially be no-ops. */
     ret = ssl_load_buffered_record( ssl );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
     /* Ensure that we have enough space available for the default form
@@ -4358,7 +4358,7 @@
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
-        return( ret );
+        return ret ;
     }
 
     ret = ssl_parse_record_header( ssl, ssl->in_hdr, ssl->in_left, &rec );
@@ -4371,7 +4371,7 @@
             {
                 ret = ssl_buffer_future_record( ssl, &rec );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
 
                 /* Fall through to handling of unexpected records */
                 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
@@ -4396,7 +4396,7 @@
                 ret = ssl_check_client_reconnect( ssl );
                 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_client_reconnect", ret );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
 #endif
 
                 /* Skip unexpected record (but not whole datagram) */
@@ -4416,12 +4416,12 @@
             }
 
             /* Get next record */
-            return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
+            return MBEDTLS_ERR_SSL_CONTINUE_PROCESSING ;
         }
         else
 #endif
         {
-            return( ret );
+            return ret ;
         }
     }
 
@@ -4445,7 +4445,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
-            return( ret );
+            return ret ;
         }
 
         ssl->in_left = 0;
@@ -4477,14 +4477,14 @@
                                 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
                     }
 #endif
-                    return( ret );
+                    return ret ;
                 }
 
                 if( ssl->conf->badmac_limit != 0 &&
                     ++ssl->badmac_seen >= ssl->conf->badmac_limit )
                 {
                     MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
-                    return( MBEDTLS_ERR_SSL_INVALID_MAC );
+                    return MBEDTLS_ERR_SSL_INVALID_MAC ;
                 }
 
                 /* As above, invalid records cause
@@ -4494,10 +4494,10 @@
                 ssl->in_left = 0;
 
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
-                return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
+                return MBEDTLS_ERR_SSL_CONTINUE_PROCESSING ;
             }
 
-            return( ret );
+            return ret ;
         }
         else
 #endif
@@ -4511,7 +4511,7 @@
                         MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
             }
 #endif
-            return( ret );
+            return ret ;
         }
     }
 
@@ -4538,7 +4538,7 @@
     ssl->in_len[0] = (unsigned char)( rec.data_len >> 8 );
     ssl->in_len[1] = (unsigned char)( rec.data_len      );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
@@ -4552,7 +4552,7 @@
     {
         if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
         {
-            return( ret );
+            return ret ;
         }
     }
 
@@ -4562,14 +4562,14 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %" MBEDTLS_PRINTF_SIZET,
                            ssl->in_msglen ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
 
         if( ssl->in_msg[0] != 1 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
                                         ssl->in_msg[0] ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -4580,11 +4580,11 @@
             if( ssl->handshake == NULL )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
-                return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
+                return MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ;
             }
 
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
-            return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
+            return MBEDTLS_ERR_SSL_EARLY_MESSAGE ;
         }
 #endif
     }
@@ -4598,7 +4598,7 @@
                currently support this. */
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %" MBEDTLS_PRINTF_SIZET,
                            ssl->in_msglen ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return MBEDTLS_ERR_SSL_INVALID_RECORD ;
         }
 
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%u:%u]",
@@ -4611,14 +4611,14 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
                            ssl->in_msg[1] ) );
-            return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
+            return MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE ;
         }
 
         if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
             ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
-            return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
+            return MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY ;
         }
 
 #if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
@@ -4627,7 +4627,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a no renegotiation alert" ) );
             /* Will be handled when trying to parse ServerHello */
-            return( 0 );
+            return 0 ;
         }
 #endif
         /* Silently ignore: fetch new message */
@@ -4648,7 +4648,7 @@
             )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
-            return( MBEDTLS_ERR_SSL_NON_FATAL );
+            return MBEDTLS_ERR_SSL_NON_FATAL ;
         }
 
         if( ssl->handshake != NULL &&
@@ -4659,7 +4659,7 @@
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
@@ -4676,7 +4676,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ssl == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
@@ -4689,11 +4689,11 @@
     if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
-        return( ret );
+        return ret ;
     }
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
@@ -4711,12 +4711,12 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
@@ -4728,7 +4728,7 @@
     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
@@ -4736,7 +4736,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     /* CCS records are only accepted if they have length 1 and content '1',
@@ -4763,7 +4763,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
             /* This is highly unlikely to happen for legitimate reasons, so
                treat it as an attack and don't send an alert. */
-            return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
+            return MBEDTLS_ERR_SSL_COUNTER_WRAPPING ;
         }
     }
     else
@@ -4776,7 +4776,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Once ssl->out_hdr as the address of the beginning of the
@@ -4791,9 +4791,9 @@
                         mbedtls_ssl_transform const *transform )
 {
     if( transform->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
-        return( 0 );
+        return 0 ;
 
-    return( transform->ivlen - transform->fixed_ivlen );
+    return transform->ivlen - transform->fixed_ivlen ;
 }
 
 void mbedtls_ssl_update_out_pointers( mbedtls_ssl_context *ssl,
@@ -4911,7 +4911,7 @@
  */
 size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
 {
-    return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
+    return ssl->in_offt == NULL ? 0 : ssl->in_msglen ;
 }
 
 int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
@@ -4924,7 +4924,7 @@
     if( ssl->keep_current_message == 1 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
-        return( 1 );
+        return 1 ;
     }
 
     /*
@@ -4936,7 +4936,7 @@
         ssl->in_left > ssl->next_record_offset )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
-        return( 1 );
+        return 1 ;
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
@@ -4947,7 +4947,7 @@
     if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
-        return( 1 );
+        return 1 ;
     }
 
     /*
@@ -4956,7 +4956,7 @@
     if( ssl->in_offt != NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
-        return( 1 );
+        return 1 ;
     }
 
     /*
@@ -4966,7 +4966,7 @@
      */
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
-    return( 0 );
+    return 0 ;
 }
 
 
@@ -4979,7 +4979,7 @@
     size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
 
     if( transform == NULL )
-        return( (int) out_hdr_len );
+        return (int) out_hdr_len ;
 
     switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
     {
@@ -5013,7 +5013,7 @@
 
         default:
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
@@ -5038,7 +5038,7 @@
         ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
         ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
     {
-        return( 0 );
+        return 0 ;
     }
 
     in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
@@ -5048,11 +5048,11 @@
 
     if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
-    return( mbedtls_ssl_renegotiate( ssl ) );
+    return mbedtls_ssl_renegotiate( ssl ) ;
 }
 #endif /* MBEDTLS_SSL_RENEGOTIATION */
 
@@ -5086,10 +5086,10 @@
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
         if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
         {
-            return( 0 );
+            return 0 ;
         }
 #endif
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 #endif /* MBEDTLS_SSL_CLI_C */
 
@@ -5103,10 +5103,10 @@
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
         if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
         {
-            return( 0 );
+            return 0 ;
         }
 #endif
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 #endif /* MBEDTLS_SSL_SRV_C */
 
@@ -5135,7 +5135,7 @@
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation",
                                    ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -5152,12 +5152,12 @@
                          MBEDTLS_SSL_ALERT_LEVEL_WARNING,
                          MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
         {
-            return( ret );
+            return ret ;
         }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -5169,7 +5169,7 @@
     size_t n;
 
     if( ssl == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
 
@@ -5177,13 +5177,13 @@
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
         if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( ssl->handshake != NULL &&
             ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
         {
             if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
-                return( ret );
+                return ret ;
         }
     }
 #endif
@@ -5206,7 +5206,7 @@
         ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
-        return( ret );
+        return ret ;
     }
 #endif
 
@@ -5217,7 +5217,7 @@
             ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -5234,10 +5234,10 @@
         if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
         {
             if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
-                return( 0 );
+                return 0 ;
 
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-            return( ret );
+            return ret ;
         }
 
         if( ssl->in_msglen  == 0 &&
@@ -5249,10 +5249,10 @@
             if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
             {
                 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
-                    return( 0 );
+                    return 0 ;
 
                 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-                return( ret );
+                return ret ;
             }
         }
 
@@ -5263,7 +5263,7 @@
             {
                 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_handle_hs_message_post_handshake",
                                           ret );
-                return( ret );
+                return ret ;
             }
 
             /* At this point, we don't know whether the renegotiation triggered
@@ -5298,7 +5298,7 @@
                 {
                     MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
                                         "but not honored by client" ) );
-                    return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+                    return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
                 }
             }
         }
@@ -5308,13 +5308,13 @@
         if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
-            return( MBEDTLS_ERR_SSL_WANT_READ );
+            return MBEDTLS_ERR_SSL_WANT_READ ;
         }
 
         if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
-            return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+            return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
         }
 
         ssl->in_offt = ssl->in_msg;
@@ -5336,7 +5336,7 @@
             {
                 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend_hello_request",
                                        ret );
-                return( ret );
+                return ret ;
             }
         }
 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
@@ -5367,7 +5367,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
 
-    return( (int) n );
+    return (int) n ;
 }
 
 /*
@@ -5391,7 +5391,7 @@
     if( ret < 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
-        return( ret );
+        return ret ;
     }
 
     if( len > max_len )
@@ -5403,7 +5403,7 @@
                                 "maximum fragment length: %" MBEDTLS_PRINTF_SIZET
                                 " > %" MBEDTLS_PRINTF_SIZET,
                                 len, max_len ) );
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
         }
         else
 #endif
@@ -5421,7 +5421,7 @@
         if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -5438,11 +5438,11 @@
         if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
-            return( ret );
+            return ret ;
         }
     }
 
-    return( (int) len );
+    return (int) len ;
 }
 
 /*
@@ -5455,13 +5455,13 @@
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
 
     if( ssl == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
     if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
-        return( ret );
+        return ret ;
     }
 #endif
 
@@ -5470,7 +5470,7 @@
         if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -5478,7 +5478,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -5489,12 +5489,12 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ssl == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
 
     if( ssl->out_left != 0 )
-        return( mbedtls_ssl_flush_output( ssl ) );
+        return mbedtls_ssl_flush_output( ssl ) ;
 
     if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
     {
@@ -5503,13 +5503,13 @@
                         MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
-            return( ret );
+            return ret ;
         }
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index d82ec04..4cb3606 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -51,17 +51,17 @@
                                  size_t ilen )
 {
     if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     mbedtls_free( ssl->cli_id );
 
     if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
     memcpy( ssl->cli_id, info, ilen );
     ssl->cli_id_len = ilen;
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
@@ -91,7 +91,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
     if( servername_list_size + 2 != len )
@@ -99,7 +99,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     p = buf + 2;
@@ -111,7 +111,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
@@ -123,9 +123,9 @@
                 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                         MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
-                return( MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
+                return MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME ;
             }
-            return( 0 );
+            return 0 ;
         }
 
         servername_list_size -= hostname_len + 3;
@@ -137,10 +137,10 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
@@ -148,20 +148,20 @@
 static int ssl_conf_has_psk_or_cb( mbedtls_ssl_config const *conf )
 {
     if( conf->f_psk != NULL )
-        return( 1 );
+        return 1 ;
 
     if( conf->psk_identity_len == 0 || conf->psk_identity == NULL )
-        return( 0 );
+        return 0 ;
 
     if( conf->psk != NULL && conf->psk_len != 0 )
-        return( 1 );
+        return 1 ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
-        return( 1 );
+        return 1 ;
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -173,15 +173,15 @@
          * the static configuration is irrelevant. */
 
         if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
-            return( 1 );
+            return 1 ;
 
-        return( 0 );
+        return 0 ;
     }
 
     if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
@@ -202,7 +202,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-            return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
         }
     }
     else
@@ -213,13 +213,13 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-            return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
         }
 
         ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
@@ -253,7 +253,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
     if( sig_alg_list_size + 2 != len ||
@@ -262,7 +262,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* Currently we only guarantee signing the ServerKeyExchange message according
@@ -308,7 +308,7 @@
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
           MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
@@ -327,7 +327,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
     if( list_size + 2 != len ||
@@ -336,7 +336,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* Should never happen unless client duplicates the extension */
@@ -345,7 +345,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
 
     /* Don't allow our peer to make us allocate too much memory,
@@ -358,7 +358,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     }
 
     ssl->handshake->curves = curves;
@@ -378,7 +378,7 @@
         p += 2;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
@@ -393,7 +393,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     list_size = buf[0];
 
@@ -411,14 +411,14 @@
                                               p[0] );
 #endif
             MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
-            return( 0 );
+            return 0 ;
         }
 
         list_size--;
         p++;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
           MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
@@ -433,7 +433,7 @@
     if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
-        return( 0 );
+        return 0 ;
     }
 
     if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
@@ -442,13 +442,13 @@
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( ret );
+        return ret ;
     }
 
     /* Only mark the extension as OK when we're sure it is */
     ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
 
@@ -462,12 +462,12 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
 
     ssl->session_negotiate->mfl_code = buf[0];
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
@@ -484,7 +484,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
 
     /*
@@ -501,7 +501,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     peer_cid_len = *buf++;
@@ -512,7 +512,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* Ignore CID if the user has disabled its use. */
@@ -521,7 +521,7 @@
         /* Leave ssl->handshake->cid_in_use in its default
          * value of MBEDTLS_SSL_CID_DISABLED. */
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "Client sent CID extension, but CID disabled" ) );
-        return( 0 );
+        return 0 ;
     }
 
     if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX )
@@ -529,7 +529,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-        return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
     }
 
     ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
@@ -539,7 +539,7 @@
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
     MBEDTLS_SSL_DEBUG_BUF( 3, "Client CID", buf, peer_cid_len );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
@@ -553,7 +553,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     ((void) buf);
@@ -563,7 +563,7 @@
         ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
 
@@ -577,7 +577,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     ((void) buf);
@@ -587,7 +587,7 @@
         ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
 
@@ -604,7 +604,7 @@
     if( ssl->conf->f_ticket_parse == NULL ||
         ssl->conf->f_ticket_write == NULL )
     {
-        return( 0 );
+        return 0 ;
     }
 
     /* Remember the client asked us to send a new ticket */
@@ -613,13 +613,13 @@
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %" MBEDTLS_PRINTF_SIZET, len ) );
 
     if( len == 0 )
-        return( 0 );
+        return 0 ;
 
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
     if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_SSL_RENEGOTIATION */
 
@@ -638,7 +638,7 @@
         else
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
 
-        return( 0 );
+        return 0 ;
     }
 
     /*
@@ -661,7 +661,7 @@
     /* Don't send a new ticket after all, this one is OK */
     ssl->handshake->new_session_ticket = 0;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
@@ -675,7 +675,7 @@
 
     /* If ALPN not configured, just ignore the extension */
     if( ssl->conf->alpn_list == NULL )
-        return( 0 );
+        return 0 ;
 
     /*
      * opaque ProtocolName<1..2^8-1>;
@@ -690,7 +690,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     list_len = ( buf[0] << 8 ) | buf[1];
@@ -698,7 +698,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /*
@@ -715,7 +715,7 @@
         {
             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         /* Empty strings MUST NOT be included */
@@ -723,7 +723,7 @@
         {
             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
     }
 
@@ -741,7 +741,7 @@
                 memcmp( theirs, *ours, cur_len ) == 0 )
             {
                 ssl->alpn_chosen = *ours;
-                return( 0 );
+                return 0 ;
             }
         }
     }
@@ -749,7 +749,7 @@
     /* If we get there, no match was found */
     mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                             MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
-    return( MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
+    return MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL ;
 }
 #endif /* MBEDTLS_SSL_ALPN */
 
@@ -770,7 +770,7 @@
         ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
         ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
     {
-        return( 0 );
+        return 0 ;
     }
 
     /* RFC5764 section 4.1.1
@@ -794,7 +794,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
    ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET;
@@ -809,7 +809,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     /*
      * parse the extension list values are defined in
@@ -854,7 +854,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* Parse the mki only if present and mki is supported locally */
@@ -869,7 +869,7 @@
                                                 ssl->dtls_srtp_info.mki_len );
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_SRTP */
 
@@ -891,11 +891,11 @@
     while( *crv != NULL )
     {
         if( (*crv)->grp_id == grp_id )
-            return( 0 );
+            return 0 ;
         crv++;
     }
 
-    return( -1 );
+    return -1 ;
 }
 #endif /* MBEDTLS_ECDSA_C */
 
@@ -919,14 +919,14 @@
         list = ssl->conf->key_cert;
 
     if( pk_alg == MBEDTLS_PK_NONE )
-        return( 0 );
+        return 0 ;
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
 
     if( list == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
-        return( -1 );
+        return -1 ;
     }
 
     for( cur = list; cur != NULL; cur = cur->next )
@@ -996,10 +996,10 @@
         ssl->handshake->key_cert = cur;
         MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
                           ssl->handshake->key_cert->cert );
-        return( 0 );
+        return 0 ;
     }
 
-    return( -1 );
+    return -1 ;
 }
 #endif /* MBEDTLS_X509_CRT_PARSE_C */
 
@@ -1021,7 +1021,7 @@
     if( suite_info == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %#04x (%s)",
@@ -1031,13 +1031,13 @@
         suite_info->max_minor_ver < ssl->minor_ver )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
-        return( 0 );
+        return 0 ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
         ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
-        return( 0 );
+        return 0 ;
 #endif
 
 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
@@ -1046,7 +1046,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
                                     "not configured or ext missing" ) );
-        return( 0 );
+        return 0 ;
     }
 #endif
 
@@ -1058,7 +1058,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
                             "no common elliptic curve" ) );
-        return( 0 );
+        return 0 ;
     }
 #endif
 
@@ -1069,7 +1069,7 @@
         ssl_conf_has_psk_or_cb( ssl->conf ) == 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
-        return( 0 );
+        return 0 ;
     }
 #endif
 
@@ -1085,7 +1085,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no suitable hash algorithm "
                                         "for signature algorithm %u", (unsigned) sig_type ) );
-            return( 0 );
+            return 0 ;
         }
     }
 
@@ -1104,12 +1104,12 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
                             "no suitable certificate" ) );
-        return( 0 );
+        return 0 ;
     }
 #endif
 
     *ciphersuite_info = suite_info;
-    return( 0 );
+    return 0 ;
 }
 
 /* This function doesn't alert on errors that happen early during
@@ -1160,7 +1160,7 @@
         {
             /* No alert on a read error. */
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -1183,7 +1183,7 @@
     if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, message len.: %d",
@@ -1201,7 +1201,7 @@
     if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
+        return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ;
     }
 
     /* For DTLS if this is the initial handshake, remember the client sequence
@@ -1217,7 +1217,7 @@
         if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
 
         memcpy( ssl->cur_out_ctr + 2, ssl->in_ctr + 2, 6 );
@@ -1251,14 +1251,14 @@
         if( msg_len > MBEDTLS_SSL_IN_CONTENT_LEN )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
 
         if( ( ret = mbedtls_ssl_fetch_input( ssl,
                        mbedtls_ssl_in_hdr_len( ssl ) + msg_len ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
-            return( ret );
+            return ret ;
         }
 
     /* Done reading this record, get ready for the next one */
@@ -1287,7 +1287,7 @@
     if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
@@ -1295,7 +1295,7 @@
     if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
@@ -1306,7 +1306,7 @@
         msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -1328,7 +1328,7 @@
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
                                     "%u (expected %u)", cli_msg_seq,
                                     ssl->handshake->in_msg_seq ) );
-                return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+                return MBEDTLS_ERR_SSL_DECODE_ERROR ;
             }
 
             ssl->handshake->in_msg_seq++;
@@ -1350,7 +1350,7 @@
             memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
-            return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
         }
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
@@ -1382,7 +1382,7 @@
     if( msg_len < 38 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /*
@@ -1406,7 +1406,7 @@
                             ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                      MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
-        return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
+        return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ;
     }
 
     if( ssl->major_ver > ssl->conf->max_major_ver )
@@ -1435,7 +1435,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
@@ -1460,7 +1460,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
@@ -1494,7 +1494,7 @@
             {
                 /* This may be an attacker's probe, so don't send an alert */
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
-                return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+                return MBEDTLS_ERR_SSL_DECODE_ERROR ;
             }
 
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
@@ -1519,7 +1519,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
@@ -1539,7 +1539,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
@@ -1562,7 +1562,7 @@
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-                return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+                return MBEDTLS_ERR_SSL_DECODE_ERROR ;
             }
 
             ext_len = ( buf[ext_offset + 0] << 8 )
@@ -1573,7 +1573,7 @@
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-                return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+                return MBEDTLS_ERR_SSL_DECODE_ERROR ;
             }
         }
         else
@@ -1590,7 +1590,7 @@
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                                MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-                return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+                return MBEDTLS_ERR_SSL_DECODE_ERROR ;
             }
             ext_id   = ( ( ext[0] <<  8 ) | ( ext[1] ) );
             ext_size = ( ( ext[2] <<  8 ) | ( ext[3] ) );
@@ -1600,7 +1600,7 @@
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                                 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-                return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+                return MBEDTLS_ERR_SSL_DECODE_ERROR ;
             }
             switch( ext_id )
             {
@@ -1612,7 +1612,7 @@
 
                 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
 
@@ -1624,7 +1624,7 @@
 
                 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
@@ -1634,7 +1634,7 @@
 
                 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
 
                 sig_hash_alg_ext_present = 1;
                 break;
@@ -1648,7 +1648,7 @@
 
                 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 
             case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
@@ -1657,7 +1657,7 @@
 
                 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
           MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
@@ -1668,7 +1668,7 @@
 
                 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
 
@@ -1678,7 +1678,7 @@
 
                 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
@@ -1688,7 +1688,7 @@
 
                 ret = ssl_parse_cid_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
@@ -1698,7 +1698,7 @@
 
                 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
 
@@ -1708,7 +1708,7 @@
 
                 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
 
@@ -1718,7 +1718,7 @@
 
                 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
@@ -1728,7 +1728,7 @@
 
                 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
@@ -1738,7 +1738,7 @@
 
                 ret = ssl_parse_use_srtp_ext( ssl, ext + 4, ext_size );
                 if( ret != 0 )
-                    return( ret );
+                    return ret ;
                 break;
 #endif /* MBEDTLS_SSL_DTLS_SRTP */
 
@@ -1786,7 +1786,7 @@
                                             "during renegotiation" ) );
                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                                 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-                return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+                return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
             }
 #endif
             ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
@@ -1831,7 +1831,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
     /*
@@ -1856,7 +1856,7 @@
 
                 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
                                                    &ciphersuite_info ) ) != 0 )
-                    return( ret );
+                    return ret ;
 
                 if( ciphersuite_info != NULL )
                     goto have_ciphersuite;
@@ -1873,7 +1873,7 @@
 
                 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
                                                    &ciphersuite_info ) ) != 0 )
-                    return( ret );
+                    return ret ;
 
                 if( ciphersuite_info != NULL )
                     goto have_ciphersuite;
@@ -1886,14 +1886,14 @@
                             "but none of them usable" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
     else
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
 have_ciphersuite:
@@ -1933,7 +1933,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
@@ -2354,7 +2354,7 @@
     if( ssl->conf->f_cookie_write == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     /* Skip length byte until we know the length */
@@ -2365,7 +2365,7 @@
                                      ssl->cli_id, ssl->cli_id_len ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
-        return( ret );
+        return ret ;
     }
 
     *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
@@ -2381,7 +2381,7 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -2389,13 +2389,13 @@
         ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
 
@@ -2465,14 +2465,14 @@
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
 
-        return( ssl_write_hello_verify_request( ssl ) );
+        return ssl_write_hello_verify_request( ssl ) ;
     }
 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
 
     if( ssl->conf->f_rng == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
-        return( MBEDTLS_ERR_SSL_NO_RNG );
+        return MBEDTLS_ERR_SSL_NO_RNG ;
     }
 
     /*
@@ -2503,13 +2503,13 @@
                                 (long long) t ) );
 #else
     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
-        return( ret );
+        return ret ;
 
     p += 4;
 #endif /* MBEDTLS_HAVE_TIME */
 
     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
-        return( ret );
+        return ret ;
 
     p += 28;
 
@@ -2543,7 +2543,7 @@
             ssl->session_negotiate->id_len = n = 32;
             if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
                                     n ) ) != 0 )
-                return( ret );
+                return ret ;
         }
     }
     else
@@ -2557,7 +2557,7 @@
         if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -2661,7 +2661,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
 
-    return( ret );
+    return ret ;
 }
 
 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
@@ -2676,11 +2676,11 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 }
 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
@@ -2710,7 +2710,7 @@
         authmode == MBEDTLS_SSL_VERIFY_NONE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
-        return( 0 );
+        return 0 ;
     }
 
     /*
@@ -2848,7 +2848,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 
@@ -2861,7 +2861,7 @@
     if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
-        return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
+        return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ;
     }
 
     if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
@@ -2869,10 +2869,10 @@
                                  MBEDTLS_ECDH_OURS ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
           MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
@@ -2898,7 +2898,7 @@
         mbedtls_ssl_set_async_operation_data( ssl, NULL );
     }
     MBEDTLS_SSL_DEBUG_RET( 2, "ssl_resume_server_key_exchange", ret );
-    return( ret );
+    return ret ;
 }
 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) &&
           defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
@@ -2956,7 +2956,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
-            return( ret );
+            return ret ;
         }
 
         ssl->out_msglen += len;
@@ -2991,7 +2991,7 @@
         if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
         }
 
         /*
@@ -3008,7 +3008,7 @@
                                            &ssl->conf->dhm_G ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_set_group", ret );
-            return( ret );
+            return ret ;
         }
 
         if( ( ret = mbedtls_dhm_make_params(
@@ -3018,7 +3018,7 @@
                   ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
-            return( ret );
+            return ret ;
         }
 
 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
@@ -3063,7 +3063,7 @@
         if( curve == NULL || *curve == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
-            return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
         }
 
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
@@ -3072,7 +3072,7 @@
                                         (*curve)->grp_id ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
-            return( ret );
+            return ret ;
         }
 
         if( ( ret = mbedtls_ecdh_make_params(
@@ -3082,7 +3082,7 @@
                   ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
-            return( ret );
+            return ret ;
         }
 
 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
@@ -3132,13 +3132,13 @@
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
                 /* (... because we choose a cipher suite
                  *      only if there is a matching hash.) */
-                return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+                return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
             }
         }
         else
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
@@ -3155,13 +3155,13 @@
                                                           dig_signed_len,
                                                           md_alg );
             if( ret != 0 )
-                return( ret );
+                return ret ;
         }
         else
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
@@ -3208,13 +3208,13 @@
                 break;
             case 0:
                 ssl->handshake->async_in_progress = 1;
-                return( ssl_resume_server_key_exchange( ssl, signature_len ) );
+                return ssl_resume_server_key_exchange( ssl, signature_len ) ;
             case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
                 ssl->handshake->async_in_progress = 1;
-                return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
+                return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ;
             default:
                 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_sign_start", ret );
-                return( ret );
+                return ret ;
             }
         }
 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
@@ -3222,7 +3222,7 @@
         if( mbedtls_ssl_own_key( ssl ) == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
-            return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
+            return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ;
         }
 
         /* Append the signature to ssl->out_msg, leaving 2 bytes for the
@@ -3239,12 +3239,12 @@
                                      ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
-            return( ret );
+            return ret ;
         }
     }
 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Prepare the ServerKeyExchange message and send it. For ciphersuites
@@ -3280,7 +3280,7 @@
          * ServerKeyExchange, so end here. */
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
 
@@ -3311,7 +3311,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange (pending)" ) );
         else
             ssl->out_msglen = 0;
-        return( ret );
+        return ret ;
     }
 
     /* If there is a signature, write its length.
@@ -3341,11 +3341,11 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
@@ -3368,7 +3368,7 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -3376,13 +3376,13 @@
         ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
@@ -3399,7 +3399,7 @@
     if( *p + 2 > end )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     n = ( (*p)[0] << 8 ) | (*p)[1];
@@ -3408,20 +3408,20 @@
     if( *p + n > end )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     *p += n;
 
     MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
@@ -3443,7 +3443,7 @@
         mbedtls_ssl_set_async_operation_data( ssl, NULL );
     }
     MBEDTLS_SSL_DEBUG_RET( 2, "ssl_decrypt_encrypted_pms", ret );
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
 
@@ -3476,20 +3476,20 @@
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
     if ( p + 2 > end ) {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
     if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
         *p++ != ( ( len      ) & 0xFF ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 #endif
 
     if( p + len != end )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /*
@@ -3514,10 +3514,10 @@
                                             peer_pmssize ) );
         case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
             ssl->handshake->async_in_progress = 1;
-            return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
+            return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ;
         default:
             MBEDTLS_SSL_DEBUG_RET( 1, "f_async_decrypt_start", ret );
-            return( ret );
+            return ret ;
         }
     }
 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
@@ -3525,13 +3525,13 @@
     if( ! mbedtls_pk_can_do( private_key, MBEDTLS_PK_RSA ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
-        return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
+        return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ;
     }
 
     ret = mbedtls_pk_decrypt( private_key, p, len,
                               peer_pms, peer_pmslen, peer_pmssize,
                               ssl->conf->f_rng, ssl->conf->p_rng );
-    return( ret );
+    return ret ;
 }
 
 static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
@@ -3564,7 +3564,7 @@
 
 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
     if ( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
-        return( ret );
+        return ret ;
 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
 
     mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
@@ -3605,7 +3605,7 @@
     {
         /* It's ok to abort on an RNG failure, since this does not reveal
          * anything about the RSA decryption. */
-        return( ret );
+        return ret ;
     }
 
 #if defined(MBEDTLS_SSL_DEBUG_ALL)
@@ -3617,7 +3617,7 @@
         sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
     ssl->handshake->pmslen = 48;
 
@@ -3626,7 +3626,7 @@
     for( i = 0; i < ssl->handshake->pmslen; i++ )
         pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
           MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
@@ -3641,7 +3641,7 @@
     if( ssl_conf_has_psk_or_cb( ssl->conf ) == 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
-        return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
+        return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ;
     }
 
     /*
@@ -3650,7 +3650,7 @@
     if( end - *p < 2 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     n = ( (*p)[0] << 8 ) | (*p)[1];
@@ -3659,7 +3659,7 @@
     if( n == 0 || n > end - *p )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     if( ssl->conf->f_psk != NULL )
@@ -3683,12 +3683,12 @@
         MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY );
-        return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
+        return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY ;
     }
 
     *p += n;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
 
@@ -3719,7 +3719,7 @@
     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
@@ -3728,13 +3728,13 @@
     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
@@ -3743,13 +3743,13 @@
         if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
-            return( ret );
+            return ret ;
         }
 
         if( p != end )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
@@ -3759,7 +3759,7 @@
                                       ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K  );
@@ -3779,7 +3779,7 @@
                                       p, end - p) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
@@ -3792,7 +3792,7 @@
                                        ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
@@ -3809,13 +3809,13 @@
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
-            return( ret );
+            return ret ;
         }
 
         if( p != end )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -3829,7 +3829,7 @@
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -3853,26 +3853,26 @@
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
-            return( ret );
+            return ret ;
         }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
         /* Opaque PSKs are currently only supported for PSK-only. */
         if( ssl_use_opaque_psk( ssl ) == 1 )
-            return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 #endif
 
         if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
-            return( ret );
+            return ret ;
         }
 
         if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -3883,31 +3883,31 @@
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
-            return( ret );
+            return ret ;
         }
         if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
-            return( ret );
+            return ret ;
         }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
         /* Opaque PSKs are currently only supported for PSK-only. */
         if( ssl_use_opaque_psk( ssl ) == 1 )
-            return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 #endif
 
         if( p != end )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -3918,20 +3918,20 @@
         if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
-            return( ret );
+            return ret ;
         }
 
         if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
                                        p, end - p ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
         /* Opaque PSKs are currently only supported for PSK-only. */
         if( ssl_use_opaque_psk( ssl ) == 1 )
-            return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 #endif
 
         MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
@@ -3941,7 +3941,7 @@
                         ciphersuite_info->key_exchange ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -3952,7 +3952,7 @@
         if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -3965,7 +3965,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
@@ -3974,27 +3974,27 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
-        return( ret );
+        return ret ;
     }
 
     ssl->state++;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
@@ -4009,11 +4009,11 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 }
 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
@@ -4037,7 +4037,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
@@ -4045,14 +4045,14 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
     if( ssl->session_negotiate->peer_cert_digest == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 
@@ -4061,7 +4061,7 @@
     if( 0 != ret )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record" ), ret );
-        return( ret );
+        return ret ;
     }
 
     ssl->state++;
@@ -4071,7 +4071,7 @@
         ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     i = mbedtls_ssl_hs_hdr_len( ssl );
@@ -4082,7 +4082,7 @@
     if( ssl->session_negotiate->peer_cert == NULL )
     {
         /* Should never happen */
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
     peer_pk = &ssl->session_negotiate->peer_cert->pk;
 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
@@ -4099,7 +4099,7 @@
         if( i + 2 > ssl->in_hslen )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         /*
@@ -4111,7 +4111,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
                                 " for verify message" ) );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
 
 #if !defined(MBEDTLS_MD_SHA1)
@@ -4132,7 +4132,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
                                 " for verify message" ) );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
 
         /*
@@ -4141,7 +4141,7 @@
         if( !mbedtls_pk_can_do( peer_pk, pk_alg ) )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
-            return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+            return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ;
         }
 
         i++;
@@ -4150,13 +4150,13 @@
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     if( i + 2 > ssl->in_hslen )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
@@ -4165,7 +4165,7 @@
     if( i + sig_len != ssl->in_hslen )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* Calculate hash and verify signature */
@@ -4179,14 +4179,14 @@
                            ssl->in_msg + i, sig_len ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
-        return( ret );
+        return ret ;
     }
 
     mbedtls_ssl_update_handshake_status( ssl );
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
 
@@ -4242,12 +4242,12 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
 
@@ -4259,19 +4259,19 @@
     int ret = 0;
 
     if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
 
     if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
         ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
     {
         if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
@@ -4290,7 +4290,7 @@
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
         case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
-            return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
+            return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ;
 #endif
 
         /*
@@ -4376,10 +4376,10 @@
 
         default:
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
-    return( ret );
+    return ret ;
 }
 
 void mbedtls_ssl_conf_preference_order( mbedtls_ssl_config *conf, int order )
diff --git a/library/ssl_ticket.c b/library/ssl_ticket.c
index 940e1a6..9226762 100644
--- a/library/ssl_ticket.c
+++ b/library/ssl_ticket.c
@@ -78,10 +78,10 @@
 #endif
 
     if( ( ret = ctx->f_rng( ctx->p_rng, key->name, sizeof( key->name ) ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = ctx->f_rng( ctx->p_rng, buf, sizeof( buf ) ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* With GCM and CCM, same context can encrypt & decrypt */
     ret = mbedtls_cipher_setkey( &key->ctx, buf,
@@ -90,7 +90,7 @@
 
     mbedtls_platform_zeroize( buf, sizeof( buf ) );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -109,16 +109,16 @@
         if( current_time >= key_time &&
             current_time - key_time < ctx->ticket_lifetime )
         {
-            return( 0 );
+            return 0 ;
         }
 
         ctx->active = 1 - ctx->active;
 
-        return( ssl_ticket_gen_key( ctx, ctx->active ) );
+        return ssl_ticket_gen_key( ctx, ctx->active ) ;
     }
     else
 #endif /* MBEDTLS_HAVE_TIME */
-        return( 0 );
+        return 0 ;
 }
 
 /*
@@ -139,46 +139,46 @@
 
     cipher_info = mbedtls_cipher_info_from_type( cipher);
     if( cipher_info == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( cipher_info->mode != MBEDTLS_MODE_GCM &&
         cipher_info->mode != MBEDTLS_MODE_CCM )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     if( cipher_info->key_bitlen > 8 * MAX_KEY_BYTES )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     ret = mbedtls_cipher_setup_psa( &ctx->keys[0].ctx,
                                     cipher_info, TICKET_AUTH_TAG_BYTES );
     if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
-        return( ret );
+        return ret ;
     /* We don't yet expect to support all ciphers through PSA,
      * so allow fallback to ordinary mbedtls_cipher_setup(). */
     if( ret == MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
     if( ( ret = mbedtls_cipher_setup( &ctx->keys[0].ctx, cipher_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     ret = mbedtls_cipher_setup_psa( &ctx->keys[1].ctx,
                                     cipher_info, TICKET_AUTH_TAG_BYTES );
     if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
-        return( ret );
+        return ret ;
     if( ret == MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE )
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
     if( ( ret = mbedtls_cipher_setup( &ctx->keys[1].ctx, cipher_info ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = ssl_ticket_gen_key( ctx, 0 ) ) != 0 ||
         ( ret = ssl_ticket_gen_key( ctx, 1 ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -214,7 +214,7 @@
     *tlen = 0;
 
     if( ctx == NULL || ctx->f_rng == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     /* We need at least 4 bytes for key_name, 12 for IV, 2 for len 16 for tag,
      * in addition to session itself, that will be checked when writing it. */
@@ -222,7 +222,7 @@
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     if( ( ret = ssl_ticket_update_keys( ctx ) ) != 0 )
@@ -270,10 +270,10 @@
 cleanup:
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -287,9 +287,9 @@
 
     for( i = 0; i < sizeof( ctx->keys ) / sizeof( *ctx->keys ); i++ )
         if( memcmp( name, ctx->keys[i].name, 4 ) == 0 )
-            return( &ctx->keys[i] );
+            return &ctx->keys[i] ;
 
-    return( NULL );
+    return NULL ;
 }
 
 /*
@@ -310,14 +310,14 @@
     size_t enc_len, clear_len;
 
     if( ctx == NULL || ctx->f_rng == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( len < TICKET_MIN_LEN )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
-        return( ret );
+        return ret ;
 #endif
 
     if( ( ret = ssl_ticket_update_keys( ctx ) ) != 0 )
@@ -381,10 +381,10 @@
 cleanup:
 #if defined(MBEDTLS_THREADING_C)
     if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index bb5ddc4..644a0e9 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -61,17 +61,17 @@
                           int ignore_other_cid )
 {
     if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
         ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     conf->ignore_unexpected_cid = ignore_other_cid;
     conf->cid_len = len;
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
@@ -80,13 +80,13 @@
                          size_t own_cid_len )
 {
     if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl->negotiate_cid = enable;
     if( enable == MBEDTLS_SSL_CID_DISABLED )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
-        return( 0 );
+        return 0 ;
     }
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
     MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
@@ -96,7 +96,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
                                     (unsigned) own_cid_len,
                                     (unsigned) ssl->conf->cid_len ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     memcpy( ssl->own_cid, own_cid, own_cid_len );
@@ -104,7 +104,7 @@
      * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
     ssl->own_cid_len = (uint8_t) own_cid_len;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
@@ -117,7 +117,7 @@
     if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
         ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
@@ -127,7 +127,7 @@
     if( ssl->transform_in->in_cid_len  == 0 &&
         ssl->transform_in->out_cid_len == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
     if( peer_cid_len != NULL )
@@ -142,7 +142,7 @@
 
     *enabled = MBEDTLS_SSL_CID_ENABLED;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
@@ -162,7 +162,7 @@
     switch( mfl )
     {
     case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
-        return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
+        return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ;
     case MBEDTLS_SSL_MAX_FRAG_LEN_512:
         return 512;
     case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
@@ -172,7 +172,7 @@
     case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
         return 4096;
     default:
-        return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
+        return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ;
     }
 }
 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
@@ -192,7 +192,7 @@
 
         dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
         if( dst->peer_cert == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
         mbedtls_x509_crt_init( dst->peer_cert );
 
@@ -201,7 +201,7 @@
         {
             mbedtls_free( dst->peer_cert );
             dst->peer_cert = NULL;
-            return( ret );
+            return ret ;
         }
     }
 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
@@ -210,7 +210,7 @@
         dst->peer_cert_digest =
             mbedtls_calloc( 1, src->peer_cert_digest_len );
         if( dst->peer_cert_digest == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
         memcpy( dst->peer_cert_digest, src->peer_cert_digest,
                 src->peer_cert_digest_len );
@@ -226,13 +226,13 @@
     {
         dst->ticket = mbedtls_calloc( 1, src->ticket_len );
         if( dst->ticket == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
         memcpy( dst->ticket, src->ticket, src->ticket_len );
     }
 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
@@ -338,7 +338,7 @@
 
     status = psa_key_derivation_setup( derivation, alg );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
     if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
     {
@@ -346,7 +346,7 @@
                                                  PSA_KEY_DERIVATION_INPUT_SEED,
                                                  seed, seed_length );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
 
         if( mbedtls_svc_key_id_is_null( key ) )
         {
@@ -360,24 +360,24 @@
                 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
         }
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
 
         status = psa_key_derivation_input_bytes( derivation,
                                                  PSA_KEY_DERIVATION_INPUT_LABEL,
                                                  label, label_length );
         if( status != PSA_SUCCESS )
-            return( status );
+            return status ;
     }
     else
     {
-        return( PSA_ERROR_NOT_SUPPORTED );
+        return PSA_ERROR_NOT_SUPPORTED ;
     }
 
     status = psa_key_derivation_set_capacity( derivation, capacity );
     if( status != PSA_SUCCESS )
-        return( status );
+        return status ;
 
-    return( PSA_SUCCESS );
+    return PSA_SUCCESS ;
 }
 
 static int tls_prf_generic( mbedtls_md_type_t md_type,
@@ -413,7 +413,7 @@
 
         status = psa_import_key( &key_attributes, secret, slen, &master_key );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
     }
 
     status = setup_psa_key_derivation( &derivation,
@@ -426,7 +426,7 @@
     {
         psa_key_derivation_abort( &derivation );
         psa_destroy_key( master_key );
-        return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+        return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
     }
 
     status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
@@ -434,22 +434,22 @@
     {
         psa_key_derivation_abort( &derivation );
         psa_destroy_key( master_key );
-        return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+        return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
     }
 
     status = psa_key_derivation_abort( &derivation );
     if( status != PSA_SUCCESS )
     {
         psa_destroy_key( master_key );
-        return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+        return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
     }
 
     if( ! mbedtls_svc_key_id_is_null( master_key ) )
         status = psa_destroy_key( master_key );
     if( status != PSA_SUCCESS )
-        return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+        return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
 
-    return( 0 );
+    return 0 ;
 }
 
 #else /* MBEDTLS_USE_PSA_CRYPTO */
@@ -472,7 +472,7 @@
     mbedtls_md_init( &md_ctx );
 
     if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 
     md_len = mbedtls_md_get_size( md_info );
 
@@ -523,7 +523,7 @@
 
     mbedtls_free( tmp );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 #if defined(MBEDTLS_SHA256_C)
@@ -574,15 +574,15 @@
         /* If we've used a callback to select the PSK,
          * the static configuration is irrelevant. */
         if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
-            return( 1 );
+            return 1 ;
 
-        return( 0 );
+        return 0 ;
     }
 
     if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
           MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
@@ -594,19 +594,19 @@
 #if defined(MBEDTLS_SHA384_C)
     if( tls_prf == tls_prf_sha384 )
     {
-        return( MBEDTLS_SSL_TLS_PRF_SHA384 );
+        return MBEDTLS_SSL_TLS_PRF_SHA384 ;
     }
     else
 #endif
 #if defined(MBEDTLS_SHA256_C)
     if( tls_prf == tls_prf_sha256 )
     {
-        return( MBEDTLS_SSL_TLS_PRF_SHA256 );
+        return MBEDTLS_SSL_TLS_PRF_SHA256 ;
     }
     else
 #endif
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
-    return( MBEDTLS_SSL_TLS_PRF_NONE );
+    return MBEDTLS_SSL_TLS_PRF_NONE ;
 }
 #endif /* MBEDTLS_SSL_EXPORT_KEYS */
 
@@ -633,10 +633,10 @@
 #endif /* MBEDTLS_SHA256_C */
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
     default:
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
     }
 
-    return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
+    return tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) ;
 }
 
 /* Type for the TLS PRF */
@@ -721,7 +721,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
                                     ciphersuite ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
@@ -729,7 +729,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
                                     ciphersuite_info->cipher ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
@@ -737,7 +737,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
                             (unsigned) ciphersuite_info->mac ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
@@ -767,7 +767,7 @@
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
@@ -887,7 +887,7 @@
 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
@@ -1097,7 +1097,7 @@
 
 end:
     mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -1140,10 +1140,10 @@
 #endif
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
     {
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1201,7 +1201,7 @@
     if( handshake->resume != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
-        return( 0 );
+        return 0 ;
     }
 
 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
@@ -1247,7 +1247,7 @@
         if( status != PSA_SUCCESS )
         {
             psa_key_derivation_abort( &derivation );
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
         }
 
         status = psa_key_derivation_output_bytes( &derivation,
@@ -1256,12 +1256,12 @@
         if( status != PSA_SUCCESS )
         {
             psa_key_derivation_abort( &derivation );
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
         }
 
         status = psa_key_derivation_abort( &derivation );
         if( status != PSA_SUCCESS )
-            return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
+            return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ;
     }
     else
 #endif
@@ -1273,7 +1273,7 @@
         if( ret != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
-            return( ret );
+            return ret ;
         }
 
         MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
@@ -1284,7 +1284,7 @@
                                   sizeof(handshake->premaster) );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
@@ -1302,7 +1302,7 @@
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
-        return( ret );
+        return ret ;
     }
 
     /* Compute master secret if needed */
@@ -1312,7 +1312,7 @@
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
-        return( ret );
+        return ret ;
     }
 
     /* Swap the client and server random values:
@@ -1343,7 +1343,7 @@
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
-        return( ret );
+        return ret ;
     }
 
     /* We no longer need Server/ClientHello.random values */
@@ -1352,7 +1352,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
@@ -1471,7 +1471,7 @@
          * checked before calling this function
          */
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     /*
@@ -1485,13 +1485,13 @@
     if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
     {
         if( end - p < 2 )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         *(p++) = (unsigned char)( psk_len >> 8 );
         *(p++) = (unsigned char)( psk_len      );
 
         if( end < p || (size_t)( end - p ) < psk_len )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         memset( p, 0, psk_len );
         p += psk_len;
@@ -1506,7 +1506,7 @@
          * and is 48 bytes long
          */
         if( end - p < 2 )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         *p++ = 0;
         *p++ = 48;
@@ -1526,7 +1526,7 @@
                                       ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
-            return( ret );
+            return ret ;
         }
         *(p++) = (unsigned char)( len >> 8 );
         *(p++) = (unsigned char)( len );
@@ -1547,7 +1547,7 @@
                                        ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
-            return( ret );
+            return ret ;
         }
 
         *(p++) = (unsigned char)( zlen >> 8 );
@@ -1561,25 +1561,25 @@
 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     /* opaque psk<0..2^16-1>; */
     if( end - p < 2 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     *(p++) = (unsigned char)( psk_len >> 8 );
     *(p++) = (unsigned char)( psk_len      );
 
     if( end < p || (size_t)( end - p ) < psk_len )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     memcpy( p, psk, psk_len );
     p += psk_len;
 
     ssl->handshake->pmslen = p - ssl->handshake->premaster;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
 
@@ -1605,11 +1605,11 @@
         if( ++ssl->renego_records_seen > doublings )
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
-            return( 0 );
+            return 0 ;
         }
     }
 
-    return( ssl_write_hello_request( ssl ) );
+    return ssl_write_hello_request( ssl ) ;
 }
 #endif
 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
@@ -1653,11 +1653,11 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 }
 
 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
@@ -1671,11 +1671,11 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
-    return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+    return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 }
 
 #else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
@@ -1695,7 +1695,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
         ssl->state++;
-        return( 0 );
+        return 0 ;
     }
 
 #if defined(MBEDTLS_SSL_CLI_C)
@@ -1705,7 +1705,7 @@
         {
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
             ssl->state++;
-            return( 0 );
+            return 0 ;
         }
     }
 #endif /* MBEDTLS_SSL_CLI_C */
@@ -1716,7 +1716,7 @@
         {
             /* Should never happen because we shouldn't have picked the
              * ciphersuite if we don't have a certificate. */
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
     }
 #endif
@@ -1743,7 +1743,7 @@
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
                                         " > %" MBEDTLS_PRINTF_SIZET,
                            i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
-            return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+            return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
         }
 
         ssl->out_msg[i    ] = (unsigned char)( n >> 16 );
@@ -1767,12 +1767,12 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
@@ -1785,12 +1785,12 @@
     mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
 
     if( peer_crt == NULL )
-        return( -1 );
+        return -1 ;
 
     if( peer_crt->raw.len != crt_buf_len )
-        return( -1 );
+        return -1 ;
 
-    return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
+    return memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) ;
 }
 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
@@ -1808,17 +1808,17 @@
     size_t digest_len;
 
     if( peer_cert_digest == NULL || digest_info == NULL )
-        return( -1 );
+        return -1 ;
 
     digest_len = mbedtls_md_get_size( digest_info );
     if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
-        return( -1 );
+        return -1 ;
 
     ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
     if( ret != 0 )
-        return( -1 );
+        return -1 ;
 
-    return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
+    return memcmp( tmp_digest, peer_cert_digest, digest_len ) ;
 }
 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
@@ -1842,14 +1842,14 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE  )
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
@@ -1857,7 +1857,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     i = mbedtls_ssl_hs_hdr_len( ssl );
@@ -1873,7 +1873,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
@@ -1888,7 +1888,7 @@
             mbedtls_ssl_send_alert_message( ssl,
                               MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                               MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
         /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
          * anything beyond 2**16 ~ 64K. */
@@ -1898,7 +1898,7 @@
             mbedtls_ssl_send_alert_message( ssl,
                             MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                             MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
-            return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
+            return MBEDTLS_ERR_SSL_BAD_CERTIFICATE ;
         }
 
         /* Read length of the next CRT in the chain. */
@@ -1912,7 +1912,7 @@
             mbedtls_ssl_send_alert_message( ssl,
                                  MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                  MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-            return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+            return MBEDTLS_ERR_SSL_DECODE_ERROR ;
         }
 
         /* Check if we're handling the first CRT in the chain. */
@@ -1934,7 +1934,7 @@
                 mbedtls_ssl_send_alert_message( ssl,
                                                 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                                 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
-                return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
+                return MBEDTLS_ERR_SSL_BAD_CERTIFICATE ;
             }
 
             /* Now we can safely free the original chain. */
@@ -1971,21 +1971,21 @@
             crt_parse_der_failed:
                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
                 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
-                return( ret );
+                return ret ;
         }
 
         i += n;
     }
 
     MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_SRV_C)
 static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
 {
     if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
-        return( -1 );
+        return -1 ;
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
     if( ssl->in_hslen   == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
@@ -1994,10 +1994,10 @@
         memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
-        return( 0 );
+        return 0 ;
     }
 
-    return( -1 );
+    return -1 ;
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 }
 #endif /* MBEDTLS_SSL_SRV_C */
@@ -2017,26 +2017,26 @@
         ssl->handshake->ciphersuite_info;
 
     if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
-        return( SSL_CERTIFICATE_SKIP );
+        return SSL_CERTIFICATE_SKIP ;
 
 #if defined(MBEDTLS_SSL_SRV_C)
     if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
     {
         if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
-            return( SSL_CERTIFICATE_SKIP );
+            return SSL_CERTIFICATE_SKIP ;
 
         if( authmode == MBEDTLS_SSL_VERIFY_NONE )
         {
             ssl->session_negotiate->verify_result =
                 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
-            return( SSL_CERTIFICATE_SKIP );
+            return SSL_CERTIFICATE_SKIP ;
         }
     }
 #else
     ((void) authmode);
 #endif /* MBEDTLS_SSL_SRV_C */
 
-    return( SSL_CERTIFICATE_EXPECTED );
+    return SSL_CERTIFICATE_EXPECTED ;
 }
 
 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
@@ -2053,7 +2053,7 @@
     void *p_vrfy;
 
     if( authmode == MBEDTLS_SSL_VERIFY_NONE )
-        return( 0 );
+        return 0 ;
 
     if( ssl->f_vrfy != NULL )
     {
@@ -2125,7 +2125,7 @@
 
 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
     if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
-        return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
+        return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS ;
 #endif
 
     /*
@@ -2223,7 +2223,7 @@
     }
 #endif /* MBEDTLS_DEBUG_C */
 
-    return( ret );
+    return ret ;
 }
 
 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
@@ -2242,7 +2242,7 @@
                                         MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
 
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     }
 
     ret = mbedtls_md( mbedtls_md_info_from_type(
@@ -2255,7 +2255,7 @@
     ssl->session_negotiate->peer_cert_digest_len =
         MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
 
-    return( ret );
+    return ret ;
 }
 
 static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
@@ -2271,10 +2271,10 @@
     if( ret != 0 )
     {
         /* We should have parsed the public key before. */
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 
@@ -2424,7 +2424,7 @@
         mbedtls_free( chain );
     }
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
 
@@ -2836,7 +2836,7 @@
         if( i == 0 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
-            return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
+            return MBEDTLS_ERR_SSL_COUNTER_WRAPPING ;
         }
     }
     else
@@ -2854,7 +2854,7 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -2862,13 +2862,13 @@
         ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
-        return( ret );
+        return ret ;
     }
 #endif
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 #define SSL_MAX_HASH_LEN 12
@@ -2886,7 +2886,7 @@
     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
-        return( ret );
+        return ret ;
     }
 
     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
@@ -2894,7 +2894,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     hash_len = 12;
@@ -2903,7 +2903,7 @@
     {
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
-        return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
+        return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ;
     }
 
     if( ssl->in_hslen  != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
@@ -2911,7 +2911,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
-        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return MBEDTLS_ERR_SSL_DECODE_ERROR ;
     }
 
     if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
@@ -2920,7 +2920,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ;
     }
 
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
@@ -2949,7 +2949,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
@@ -3080,7 +3080,7 @@
         ssl->transform_negotiate = NULL;
         ssl->session_negotiate = NULL;
 
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     }
 
     /* Initialize structures */
@@ -3102,7 +3102,7 @@
     }
 #endif
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
@@ -3117,7 +3117,7 @@
     ((void) cli_id);
     ((void) cli_id_len);
 
-    return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 }
 
 static int ssl_cookie_check_dummy( void *ctx,
@@ -3130,7 +3130,7 @@
     ((void) cli_id);
     ((void) cli_id_len);
 
-    return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+    return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 }
 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
 
@@ -3193,7 +3193,7 @@
     if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
         goto error;
 
-    return( 0 );
+    return 0 ;
 
 error:
     mbedtls_free( ssl->in_buf );
@@ -3220,7 +3220,7 @@
     ssl->out_iv = NULL;
     ssl->out_msg = NULL;
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -3331,9 +3331,9 @@
 #endif
 
     if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -3342,7 +3342,7 @@
  */
 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
 {
-    return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
+    return mbedtls_ssl_session_reset_int( ssl, 0 ) ;
 }
 
 /*
@@ -3476,19 +3476,19 @@
         ssl->session_negotiate == NULL ||
         ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     if( ssl->handshake->resume == 1 )
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 
     if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
                                           session ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ssl->handshake->resume = 1;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_CLI_C */
 
@@ -3514,7 +3514,7 @@
 
     new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
     if( new_cert == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
     new_cert->cert = cert;
     new_cert->key  = key;
@@ -3533,14 +3533,14 @@
         cur->next = new_cert;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
                               mbedtls_x509_crt *own_cert,
                               mbedtls_pk_context *pk_key )
 {
-    return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
+    return ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) ;
 }
 
 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
@@ -3619,7 +3619,7 @@
     mbedtls_ecjpake_role role;
 
     if( ssl->handshake == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
         role = MBEDTLS_ECJPAKE_SERVER;
@@ -3640,13 +3640,13 @@
 {
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
-        return( 1 );
+        return 1 ;
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
     if( conf->psk != NULL )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
@@ -3696,17 +3696,17 @@
         ( psk_identity_len >> 16 ) != 0    ||
         psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
     if( conf->psk_identity == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
     conf->psk_identity_len = psk_identity_len;
     memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
@@ -3717,18 +3717,18 @@
 
     /* We currently only support one PSK, raw or opaque. */
     if( ssl_conf_psk_is_configured( conf ) )
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 
     /* Check and set raw PSK */
     if( psk == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     if( psk_len == 0 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     if( psk_len > MBEDTLS_PSK_MAX_LEN )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
     conf->psk_len = psk_len;
     memcpy( conf->psk, psk, conf->psk_len );
 
@@ -3737,7 +3737,7 @@
     if( ret != 0 )
         ssl_conf_remove_psk( conf );
 
-    return( ret );
+    return ret ;
 }
 
 static void ssl_remove_psk( mbedtls_ssl_context *ssl )
@@ -3762,20 +3762,20 @@
                             const unsigned char *psk, size_t psk_len )
 {
     if( psk == NULL || ssl->handshake == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( psk_len > MBEDTLS_PSK_MAX_LEN )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl_remove_psk( ssl );
 
     if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
-        return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+        return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
     ssl->handshake->psk_len = psk_len;
     memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -3788,11 +3788,11 @@
 
     /* We currently only support one PSK, raw or opaque. */
     if( ssl_conf_psk_is_configured( conf ) )
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 
     /* Check and set opaque PSK */
     if( mbedtls_svc_key_id_is_null( psk ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     conf->psk_opaque = psk;
 
     /* Check and set PSK Identity */
@@ -3801,7 +3801,7 @@
     if( ret != 0 )
         ssl_conf_remove_psk( conf );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
@@ -3809,11 +3809,11 @@
 {
     if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
         ( ssl->handshake == NULL ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl_remove_psk( ssl );
     ssl->handshake->psk_opaque = psk;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
@@ -3839,10 +3839,10 @@
     {
         mbedtls_mpi_free( &conf->dhm_P );
         mbedtls_mpi_free( &conf->dhm_G );
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
@@ -3856,10 +3856,10 @@
     {
         mbedtls_mpi_free( &conf->dhm_P );
         mbedtls_mpi_free( &conf->dhm_G );
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
 
@@ -3909,7 +3909,7 @@
         hostname_len = strlen( hostname );
 
         if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     /* Now it's clear that we will overwrite the old hostname,
@@ -3931,14 +3931,14 @@
     {
         ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
         if( ssl->hostname == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
         memcpy( ssl->hostname, hostname, hostname_len );
 
         ssl->hostname[hostname_len] = '\0';
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_X509_CRT_PARSE_C */
 
@@ -3973,17 +3973,17 @@
         if( ( cur_len == 0 ) ||
             ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
             ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     conf->alpn_list = protos;
 
-    return( 0 );
+    return 0 ;
 }
 
 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
 {
-    return( ssl->alpn_chosen );
+    return ssl->alpn_chosen ;
 }
 #endif /* MBEDTLS_SSL_ALPN */
 
@@ -4000,17 +4000,17 @@
 {
     if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
     {
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
     }
 
     memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
     ssl->dtls_srtp_info.mki_len = mki_len;
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
@@ -4040,13 +4040,13 @@
     {
                 conf->dtls_srtp_profile_list = NULL;
                 conf->dtls_srtp_profile_list_len = 0;
-                return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+                return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     conf->dtls_srtp_profile_list = profiles;
     conf->dtls_srtp_profile_list_len = list_size;
 
-    return( 0 );
+    return 0 ;
 }
 
 void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
@@ -4107,12 +4107,12 @@
     if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
         ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     conf->mfl_code = mfl_code;
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
@@ -4188,15 +4188,15 @@
 
 void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
 {
-    return( conf->p_async_config_data );
+    return conf->p_async_config_data ;
 }
 
 void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
 {
     if( ssl->handshake == NULL )
-        return( NULL );
+        return NULL ;
     else
-        return( ssl->handshake->user_async_ctx );
+        return ssl->handshake->user_async_ctx ;
 }
 
 void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
@@ -4213,18 +4213,18 @@
 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
 {
     if( ssl->session != NULL )
-        return( ssl->session->verify_result );
+        return ssl->session->verify_result ;
 
     if( ssl->session_negotiate != NULL )
-        return( ssl->session_negotiate->verify_result );
+        return ssl->session_negotiate->verify_result ;
 
-    return( 0xFFFFFFFF );
+    return 0xFFFFFFFF ;
 }
 
 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
 {
     if( ssl == NULL || ssl->session == NULL )
-        return( NULL );
+        return NULL ;
 
     return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
 }
@@ -4237,10 +4237,10 @@
         switch( ssl->minor_ver )
         {
             case MBEDTLS_SSL_MINOR_VERSION_3:
-                return( "DTLSv1.2" );
+                return "DTLSv1.2" ;
 
             default:
-                return( "unknown (DTLS)" );
+                return "unknown (DTLS)" ;
         }
     }
 #endif
@@ -4248,10 +4248,10 @@
     switch( ssl->minor_ver )
     {
         case MBEDTLS_SSL_MINOR_VERSION_3:
-            return( "TLSv1.2" );
+            return "TLSv1.2" ;
 
         default:
-            return( "unknown" );
+            return "unknown" ;
     }
 }
 
@@ -4288,7 +4288,7 @@
         }
     }
 
-    return( max_len );
+    return max_len ;
 }
 
 size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
@@ -4314,7 +4314,7 @@
         max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
     }
 
-    return( max_len );
+    return max_len ;
 }
 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
 
@@ -4325,13 +4325,13 @@
     if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
         ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
           ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
-        return ( 0 );
+        return 0 ;
 
     if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
-        return( ssl->mtu );
+        return ssl->mtu ;
 
     if( ssl->mtu == 0 )
-        return( ssl->handshake->mtu );
+        return ssl->handshake->mtu ;
 
     return( ssl->mtu < ssl->handshake->mtu ?
             ssl->mtu : ssl->handshake->mtu );
@@ -4362,12 +4362,12 @@
         const size_t overhead = (size_t) ret;
 
         if( ret < 0 )
-            return( ret );
+            return ret ;
 
         if( mtu <= overhead )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
-            return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
         }
 
         if( max_len > mtu - overhead )
@@ -4380,7 +4380,7 @@
     ((void) ssl);
 #endif
 
-    return( (int) max_len );
+    return (int) max_len ;
 }
 
 int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
@@ -4398,19 +4398,19 @@
         max_len = mfl;
 #endif
 
-    return( (int) max_len );
+    return (int) max_len ;
 }
 
 #if defined(MBEDTLS_X509_CRT_PARSE_C)
 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
 {
     if( ssl == NULL || ssl->session == NULL )
-        return( NULL );
+        return NULL ;
 
 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
-    return( ssl->session->peer_cert );
+    return ssl->session->peer_cert ;
 #else
-    return( NULL );
+    return NULL ;
 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 }
 #endif /* MBEDTLS_X509_CRT_PARSE_C */
@@ -4426,7 +4426,7 @@
         ssl->session == NULL ||
         ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
@@ -4441,15 +4441,15 @@
      * and fail if so.
      */
     if( ssl->session->exported == 1 )
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
 
     ret = mbedtls_ssl_session_copy( dst, ssl->session );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /* Remember that we've exported the session. */
     ssl->session->exported = 1;
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_CLI_C */
 
@@ -4733,7 +4733,7 @@
         *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF );
 #endif
 
-    return( used );
+    return used ;
 }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
@@ -4784,14 +4784,14 @@
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
     default:
-        return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ;
     }
 
     *olen = used;
     if( used > buf_len )
-        return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -4802,7 +4802,7 @@
                               size_t buf_len,
                               size_t *olen )
 {
-    return( ssl_session_save( session, 0, buf, buf_len, olen ) );
+    return ssl_session_save( session, 0, buf, buf_len, olen ) ;
 }
 
 /*
@@ -4832,7 +4832,7 @@
      */
 #if defined(MBEDTLS_HAVE_TIME)
     if( 8 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     start = ( (uint64_t) p[0] << 56 ) |
             ( (uint64_t) p[1] << 48 ) |
@@ -4851,7 +4851,7 @@
      * Basic mandatory fields
      */
     if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     session->ciphersuite = ( p[0] << 8 ) | p[1];
     p += 2;
@@ -4891,7 +4891,7 @@
 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
     /* Deserialize CRT from the end of the ticket. */
     if( 3 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
     p += 3;
@@ -4901,12 +4901,12 @@
         int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
         if( cert_len > (size_t)( end - p ) )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( session->peer_cert == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
         mbedtls_x509_crt_init( session->peer_cert );
 
@@ -4916,7 +4916,7 @@
             mbedtls_x509_crt_free( session->peer_cert );
             mbedtls_free( session->peer_cert );
             session->peer_cert = NULL;
-            return( ret );
+            return ret ;
         }
 
         p += cert_len;
@@ -4924,7 +4924,7 @@
 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
     /* Deserialize CRT digest from the end of the ticket. */
     if( 2 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
     session->peer_cert_digest_len  = (size_t) *p++;
@@ -4934,17 +4934,17 @@
         const mbedtls_md_info_t *md_info =
             mbedtls_md_info_from_type( session->peer_cert_digest_type );
         if( md_info == NULL )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
         if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         if( session->peer_cert_digest_len > (size_t)( end - p ) )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         session->peer_cert_digest =
             mbedtls_calloc( 1, session->peer_cert_digest_len );
         if( session->peer_cert_digest == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
         memcpy( session->peer_cert_digest, p,
                 session->peer_cert_digest_len );
@@ -4958,7 +4958,7 @@
      */
 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
     if( 3 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
     p += 3;
@@ -4966,18 +4966,18 @@
     if( session->ticket_len != 0 )
     {
         if( session->ticket_len > (size_t)( end - p ) )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         session->ticket = mbedtls_calloc( 1, session->ticket_len );
         if( session->ticket == NULL )
-            return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
+            return MBEDTLS_ERR_SSL_ALLOC_FAILED ;
 
         memcpy( session->ticket, p, session->ticket_len );
         p += session->ticket_len;
     }
 
     if( 4 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
                                ( (uint32_t) p[1] << 16 ) |
@@ -4991,23 +4991,23 @@
      */
 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
     if( 1 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     session->mfl_code = *p++;
 #endif
 
 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
     if( 1 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     session->encrypt_then_mac = *p++;
 #endif
 
     /* Done, should have consumed entire buffer */
     if( p != end )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_session_load( mbedtls_ssl_session *session,
@@ -5025,12 +5025,12 @@
          */
 
         if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         if( memcmp( p, ssl_serialized_session_header,
                     sizeof( ssl_serialized_session_header ) ) != 0 )
         {
-            return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
+            return MBEDTLS_ERR_SSL_VERSION_MISMATCH ;
         }
         p += sizeof( ssl_serialized_session_header );
     }
@@ -5039,7 +5039,7 @@
      * TLS version identifier
      */
     if( 1 > (size_t)( end - p ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     session->minor_ver = *p++;
 
     /* Dispatch according to TLS version. */
@@ -5049,12 +5049,12 @@
     case MBEDTLS_SSL_MINOR_VERSION_3: /* TLS 1.2 */
     {
         size_t remaining_len = ( end - p );
-        return( ssl_session_load_tls12( session, p, remaining_len ) );
+        return ssl_session_load_tls12( session, p, remaining_len ) ;
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
     default:
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 }
 
@@ -5070,7 +5070,7 @@
     if( ret != 0 )
         mbedtls_ssl_session_free( session );
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -5081,7 +5081,7 @@
     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
 
     if( ssl == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_SSL_CLI_C)
     if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
@@ -5092,7 +5092,7 @@
         ret = mbedtls_ssl_handshake_server_step( ssl );
 #endif
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -5105,7 +5105,7 @@
     /* Sanity checks */
 
     if( ssl == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
@@ -5113,7 +5113,7 @@
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
                                      "mbedtls_ssl_set_timer_cb() for DTLS" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
@@ -5130,7 +5130,7 @@
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
 
-    return( ret );
+    return ret ;
 }
 
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
@@ -5151,12 +5151,12 @@
     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_SSL_SRV_C */
 
@@ -5176,7 +5176,7 @@
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
 
     if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
-        return( ret );
+        return ret ;
 
     /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
      * the ServerHello will have message_seq = 1" */
@@ -5197,12 +5197,12 @@
     if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
-        return( ret );
+        return ret ;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -5214,22 +5214,22 @@
     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
 
     if( ssl == NULL || ssl->conf == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_SSL_SRV_C)
     /* On server, just send the request */
     if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
     {
         if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
 
         /* Did we already try/start sending HelloRequest? */
         if( ssl->out_left != 0 )
-            return( mbedtls_ssl_flush_output( ssl ) );
+            return mbedtls_ssl_flush_output( ssl ) ;
 
-        return( ssl_write_hello_request( ssl ) );
+        return ssl_write_hello_request( ssl ) ;
     }
 #endif /* MBEDTLS_SSL_SRV_C */
 
@@ -5241,12 +5241,12 @@
     if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
     {
         if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
-            return( ret );
+            return ret ;
         }
     }
     else
@@ -5254,12 +5254,12 @@
         if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
-            return( ret );
+            return ret ;
         }
     }
 #endif /* MBEDTLS_SSL_CLI_C */
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SSL_RENEGOTIATION */
 
@@ -5517,59 +5517,59 @@
     if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     if( ssl->handshake != NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     /* Double-check that sub-structures are indeed ready */
     if( ssl->transform == NULL || ssl->session == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     /* There must be no pending incoming or outgoing data */
     if( mbedtls_ssl_check_pending( ssl ) != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     if( ssl->out_left != 0 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     /* Protocol must be DLTS, not TLS */
     if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     /* Version must be 1.2 */
     if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     /* We must be using an AEAD ciphersuite */
     if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
     /* Renegotiation must not be enabled */
 #if defined(MBEDTLS_SSL_RENEGOTIATION)
     if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 #endif
 
@@ -5590,7 +5590,7 @@
      */
     ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
     if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
-        return( ret );
+        return ret ;
 
     used += 4 + session_len;
     if( used <= buf_len )
@@ -5603,7 +5603,7 @@
         ret = ssl_session_save( ssl->session, 1,
                                 p, session_len, &session_len );
         if( ret != 0 )
-            return( ret );
+            return ret ;
 
         p += session_len;
     }
@@ -5719,11 +5719,11 @@
     *olen = used;
 
     if( used > buf_len )
-        return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
+        return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ;
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
 
-    return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
+    return mbedtls_ssl_session_reset_int( ssl, 0 ) ;
 }
 
 /*
@@ -5741,11 +5741,11 @@
          mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
 
     if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
-        return( tls_prf_sha384 );
+        return tls_prf_sha384 ;
 #else
     (void) ciphersuite_id;
 #endif
-    return( tls_prf_sha256 );
+    return tls_prf_sha256 ;
 }
 
 /*
@@ -5772,7 +5772,7 @@
     if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
         ssl->session != NULL )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     /*
@@ -5789,7 +5789,7 @@
 #endif
         0 )
     {
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
@@ -5798,12 +5798,12 @@
      * Check version identifier
      */
     if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( memcmp( p, ssl_serialized_context_header,
                 sizeof( ssl_serialized_context_header ) ) != 0 )
     {
-        return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
+        return MBEDTLS_ERR_SSL_VERSION_MISMATCH ;
     }
     p += sizeof( ssl_serialized_context_header );
 
@@ -5811,7 +5811,7 @@
      * Session
      */
     if( (size_t)( end - p ) < 4 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     session_len = ( (size_t) p[0] << 24 ) |
                   ( (size_t) p[1] << 16 ) |
@@ -5827,13 +5827,13 @@
     ssl->session_negotiate = NULL;
 
     if( (size_t)( end - p ) < session_len )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ret = ssl_session_load( ssl->session, 1, p, session_len );
     if( ret != 0 )
     {
         mbedtls_ssl_session_free( ssl->session );
-        return( ret );
+        return ret ;
     }
 
     p += session_len;
@@ -5851,7 +5851,7 @@
 
     /* Read random bytes and populate structure */
     if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ret = ssl_populate_transform( ssl->transform,
                   ssl->session->ciphersuite,
@@ -5867,19 +5867,19 @@
                   ssl->conf->endpoint,
                   ssl );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     p += sizeof( ssl->transform->randbytes );
 
 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
     /* Read connection IDs and store them */
     if( (size_t)( end - p ) < 1 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl->transform->in_cid_len = *p++;
 
     if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
     p += ssl->transform->in_cid_len;
@@ -5887,7 +5887,7 @@
     ssl->transform->out_cid_len = *p++;
 
     if( (size_t)( end - p ) < ssl->transform->out_cid_len )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
     p += ssl->transform->out_cid_len;
@@ -5897,7 +5897,7 @@
      * Saved fields from top-level ssl_context structure
      */
     if( (size_t)( end - p ) < 4 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
                        ( (uint32_t) p[1] << 16 ) |
@@ -5907,7 +5907,7 @@
 
 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
     if( (size_t)( end - p ) < 16 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
                          ( (uint64_t) p[1] << 48 ) |
@@ -5932,20 +5932,20 @@
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( (size_t)( end - p ) < 1 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl->disable_datagram_packing = *p++;
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
 
     if( (size_t)( end - p ) < 8 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     memcpy( ssl->cur_out_ctr, p, 8 );
     p += 8;
 
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( (size_t)( end - p ) < 2 )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl->mtu = ( p[0] << 8 ) | p[1];
     p += 2;
@@ -5957,7 +5957,7 @@
         const char **cur;
 
         if( (size_t)( end - p ) < 1 )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         alpn_len = *p++;
 
@@ -5977,7 +5977,7 @@
 
         /* can only happen on conf mismatch */
         if( alpn_len != 0 && ssl->alpn_chosen == NULL )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+            return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
         p += alpn_len;
     }
@@ -6017,9 +6017,9 @@
      * Done - should have consumed entire buffer
      */
     if( p != end )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -6034,7 +6034,7 @@
     if( ret != 0 )
         mbedtls_ssl_free( context );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
 
@@ -6278,7 +6278,7 @@
                                                dhm_p, sizeof( dhm_p ),
                                                dhm_g, sizeof( dhm_g ) ) ) != 0 )
                 {
-                    return( ret );
+                    return ret ;
                 }
             }
 #endif
@@ -6350,7 +6350,7 @@
 #endif
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -6397,25 +6397,25 @@
 {
 #if defined(MBEDTLS_RSA_C)
     if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
-        return( MBEDTLS_SSL_SIG_RSA );
+        return MBEDTLS_SSL_SIG_RSA ;
 #endif
 #if defined(MBEDTLS_ECDSA_C)
     if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
-        return( MBEDTLS_SSL_SIG_ECDSA );
+        return MBEDTLS_SSL_SIG_ECDSA ;
 #endif
-    return( MBEDTLS_SSL_SIG_ANON );
+    return MBEDTLS_SSL_SIG_ANON ;
 }
 
 unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
 {
     switch( type ) {
         case MBEDTLS_PK_RSA:
-            return( MBEDTLS_SSL_SIG_RSA );
+            return MBEDTLS_SSL_SIG_RSA ;
         case MBEDTLS_PK_ECDSA:
         case MBEDTLS_PK_ECKEY:
-            return( MBEDTLS_SSL_SIG_ECDSA );
+            return MBEDTLS_SSL_SIG_ECDSA ;
         default:
-            return( MBEDTLS_SSL_SIG_ANON );
+            return MBEDTLS_SSL_SIG_ANON ;
     }
 }
 
@@ -6425,14 +6425,14 @@
     {
 #if defined(MBEDTLS_RSA_C)
         case MBEDTLS_SSL_SIG_RSA:
-            return( MBEDTLS_PK_RSA );
+            return MBEDTLS_PK_RSA ;
 #endif
 #if defined(MBEDTLS_ECDSA_C)
         case MBEDTLS_SSL_SIG_ECDSA:
-            return( MBEDTLS_PK_ECDSA );
+            return MBEDTLS_PK_ECDSA ;
 #endif
         default:
-            return( MBEDTLS_PK_NONE );
+            return MBEDTLS_PK_NONE ;
     }
 }
 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
@@ -6447,11 +6447,11 @@
     switch( sig_alg )
     {
         case MBEDTLS_PK_RSA:
-            return( set->rsa );
+            return set->rsa ;
         case MBEDTLS_PK_ECDSA:
-            return( set->ecdsa );
+            return set->ecdsa ;
         default:
-            return( MBEDTLS_MD_NONE );
+            return MBEDTLS_MD_NONE ;
     }
 }
 
@@ -6497,30 +6497,30 @@
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_SSL_HASH_MD5:
-            return( MBEDTLS_MD_MD5 );
+            return MBEDTLS_MD_MD5 ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_SSL_HASH_SHA1:
-            return( MBEDTLS_MD_SHA1 );
+            return MBEDTLS_MD_SHA1 ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_SSL_HASH_SHA224:
-            return( MBEDTLS_MD_SHA224 );
+            return MBEDTLS_MD_SHA224 ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_SSL_HASH_SHA256:
-            return( MBEDTLS_MD_SHA256 );
+            return MBEDTLS_MD_SHA256 ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_SSL_HASH_SHA384:
-            return( MBEDTLS_MD_SHA384 );
+            return MBEDTLS_MD_SHA384 ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_SSL_HASH_SHA512:
-            return( MBEDTLS_MD_SHA512 );
+            return MBEDTLS_MD_SHA512 ;
 #endif
         default:
-            return( MBEDTLS_MD_NONE );
+            return MBEDTLS_MD_NONE ;
     }
 }
 
@@ -6533,30 +6533,30 @@
     {
 #if defined(MBEDTLS_MD5_C)
         case MBEDTLS_MD_MD5:
-            return( MBEDTLS_SSL_HASH_MD5 );
+            return MBEDTLS_SSL_HASH_MD5 ;
 #endif
 #if defined(MBEDTLS_SHA1_C)
         case MBEDTLS_MD_SHA1:
-            return( MBEDTLS_SSL_HASH_SHA1 );
+            return MBEDTLS_SSL_HASH_SHA1 ;
 #endif
 #if defined(MBEDTLS_SHA224_C)
         case MBEDTLS_MD_SHA224:
-            return( MBEDTLS_SSL_HASH_SHA224 );
+            return MBEDTLS_SSL_HASH_SHA224 ;
 #endif
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_MD_SHA256:
-            return( MBEDTLS_SSL_HASH_SHA256 );
+            return MBEDTLS_SSL_HASH_SHA256 ;
 #endif
 #if defined(MBEDTLS_SHA384_C)
         case MBEDTLS_MD_SHA384:
-            return( MBEDTLS_SSL_HASH_SHA384 );
+            return MBEDTLS_SSL_HASH_SHA384 ;
 #endif
 #if defined(MBEDTLS_SHA512_C)
         case MBEDTLS_MD_SHA512:
-            return( MBEDTLS_SSL_HASH_SHA512 );
+            return MBEDTLS_SSL_HASH_SHA512 ;
 #endif
         default:
-            return( MBEDTLS_SSL_HASH_NONE );
+            return MBEDTLS_SSL_HASH_NONE ;
     }
 }
 
@@ -6570,13 +6570,13 @@
     const mbedtls_ecp_group_id *gid;
 
     if( ssl->conf->curve_list == NULL )
-        return( -1 );
+        return -1 ;
 
     for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
         if( *gid == grp_id )
-            return( 0 );
+            return 0 ;
 
-    return( -1 );
+    return -1 ;
 }
 #endif /* MBEDTLS_ECP_C */
 
@@ -6591,13 +6591,13 @@
     const int *cur;
 
     if( ssl->conf->sig_hashes == NULL )
-        return( -1 );
+        return -1 ;
 
     for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
         if( *cur == (int) md )
-            return( 0 );
+            return 0 ;
 
-    return( -1 );
+    return -1 ;
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
 
@@ -6671,7 +6671,7 @@
         ret = -1;
     }
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_X509_CRT_PARSE_C */
 
@@ -6679,7 +6679,7 @@
 {
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
     if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
-        return( -1 );
+        return -1 ;
 
     switch( md )
     {
@@ -6694,7 +6694,7 @@
             break;
 #endif
         default:
-            return( -1 );
+            return -1 ;
     }
 
     return 0;
@@ -6702,7 +6702,7 @@
     (void) ssl;
     (void) md;
 
-    return( -1 );
+    return -1 ;
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 }
 
@@ -6756,17 +6756,17 @@
         switch( status )
         {
             case PSA_ERROR_NOT_SUPPORTED:
-                return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
+                return MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE ;
             case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
             case PSA_ERROR_BUFFER_TOO_SMALL:
-                return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
+                return MBEDTLS_ERR_MD_BAD_INPUT_DATA ;
             case PSA_ERROR_INSUFFICIENT_MEMORY:
-                return( MBEDTLS_ERR_MD_ALLOC_FAILED );
+                return MBEDTLS_ERR_MD_ALLOC_FAILED ;
             default:
-                return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
+                return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED ;
         }
     }
-    return( 0 );
+    return 0 ;
 }
 
 #else
@@ -6825,7 +6825,7 @@
         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                         MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index f1c8a12..cd7c2c0 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -147,24 +147,24 @@
         /* Should never happen since this is an internal
          * function, and we know statically which labels
          * are allowed. */
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     if( clen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN )
     {
         /* Should not happen, as above. */
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     if( blen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN )
     {
         /* Should not happen, as above. */
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
     }
 
     md = mbedtls_md_info_from_type( hash_alg );
     if( md == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     ssl_tls1_3_hkdf_encode_label( blen,
                                   label, llen,
@@ -209,7 +209,7 @@
                     NULL, 0,
                     keys->client_write_key, key_len );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_ssl_tls1_3_hkdf_expand_label( hash_alg,
                     server_secret, slen,
@@ -217,7 +217,7 @@
                     NULL, 0,
                     keys->server_write_key, key_len );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_ssl_tls1_3_hkdf_expand_label( hash_alg,
                     client_secret, slen,
@@ -225,7 +225,7 @@
                     NULL, 0,
                     keys->client_write_iv, iv_len );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_ssl_tls1_3_hkdf_expand_label( hash_alg,
                     server_secret, slen,
@@ -233,12 +233,12 @@
                     NULL, 0,
                     keys->server_write_iv, iv_len );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     keys->key_len = key_len;
     keys->iv_len = iv_len;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_tls1_3_derive_secret(
@@ -255,13 +255,13 @@
     const mbedtls_md_info_t *md;
     md = mbedtls_md_info_from_type( hash_alg );
     if( md == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED )
     {
         ret = mbedtls_md( md, ctx, clen, hashed_context );
         if( ret != 0 )
-            return( ret );
+            return ret ;
         clen = mbedtls_md_get_size( md );
     }
     else
@@ -272,7 +272,7 @@
              * and the code sets `ctx_hashed` correctly.
              * Let's double-check nonetheless to not run at the risk
              * of getting a stack overflow. */
-            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+            return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
         }
 
         memcpy( hashed_context, ctx, clen );
@@ -299,7 +299,7 @@
     const mbedtls_md_info_t *md;
     md = mbedtls_md_info_from_type( hash_alg );
     if( md == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA ;
 
     hlen = mbedtls_md_get_size( md );
 
@@ -344,7 +344,7 @@
 
     mbedtls_platform_zeroize( tmp_secret, sizeof(tmp_secret) );
     mbedtls_platform_zeroize( tmp_input,  sizeof(tmp_input)  );
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ssl_tls1_3_derive_early_secrets(
@@ -360,7 +360,7 @@
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
     if( md_info == 0 )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 
     /*
      *            0
@@ -385,7 +385,7 @@
                          derived->client_early_traffic_secret,
                          md_size );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /* Create early exporter */
     ret = mbedtls_ssl_tls1_3_derive_secret( md_type,
@@ -396,9 +396,9 @@
                          derived->early_exporter_master_secret,
                          md_size );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_tls1_3_derive_handshake_secrets(
@@ -414,7 +414,7 @@
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
     if( md_info == 0 )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 
     /*
      *
@@ -443,7 +443,7 @@
              derived->client_handshake_traffic_secret,
              md_size );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     /*
      * Compute server_handshake_traffic_secret with
@@ -458,9 +458,9 @@
              derived->server_handshake_traffic_secret,
              md_size );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_ssl_tls1_3_derive_application_secrets(
@@ -476,7 +476,7 @@
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
     if( md_info == 0 )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 
     /* Generate {client,server}_application_traffic_secret_0
      *
@@ -504,7 +504,7 @@
               derived->client_application_traffic_secret_N,
               md_size );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_ssl_tls1_3_derive_secret( md_type,
               application_secret, md_size,
@@ -514,7 +514,7 @@
               derived->server_application_traffic_secret_N,
               md_size );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_ssl_tls1_3_derive_secret( md_type,
               application_secret, md_size,
@@ -524,9 +524,9 @@
               derived->exporter_master_secret,
               md_size );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Generate resumption_master_secret for use with the ticket exchange.
@@ -546,7 +546,7 @@
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
     if( md_info == 0 )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 
     ret = mbedtls_ssl_tls1_3_derive_secret( md_type,
               application_secret, md_size,
@@ -557,9 +557,9 @@
               md_size );
 
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int ssl_tls1_3_calc_finished_core( mbedtls_md_type_t md_type,
@@ -575,7 +575,7 @@
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
     if( md_info == 0 )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 
     /* TLS 1.3 Finished message
      *
@@ -609,7 +609,7 @@
 exit:
 
     mbedtls_platform_zeroize( finished_key, sizeof( finished_key ) );
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_ssl_tls1_3_create_psk_binder( mbedtls_ssl_context *ssl,
@@ -633,7 +633,7 @@
     /* We should never call this function with an unknown hash,
      * but add an assertion anyway. */
     if( md_info == 0 )
-        return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        return MBEDTLS_ERR_SSL_INTERNAL_ERROR ;
 
     /*
      *            0
@@ -696,7 +696,7 @@
 
     mbedtls_platform_zeroize( early_secret, sizeof( early_secret ) );
     mbedtls_platform_zeroize( binder_key,   sizeof( binder_key ) );
-    return( ret );
+    return ret ;
 }
 
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
diff --git a/library/threading.c b/library/threading.c
index bae6644..cf01c0a 100644
--- a/library/threading.c
+++ b/library/threading.c
@@ -88,23 +88,23 @@
 static int threading_mutex_lock_pthread( mbedtls_threading_mutex_t *mutex )
 {
     if( mutex == NULL || ! mutex->is_valid )
-        return( MBEDTLS_ERR_THREADING_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_THREADING_BAD_INPUT_DATA ;
 
     if( pthread_mutex_lock( &mutex->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int threading_mutex_unlock_pthread( mbedtls_threading_mutex_t *mutex )
 {
     if( mutex == NULL || ! mutex->is_valid )
-        return( MBEDTLS_ERR_THREADING_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_THREADING_BAD_INPUT_DATA ;
 
     if( pthread_mutex_unlock( &mutex->mutex ) != 0 )
-        return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
+        return MBEDTLS_ERR_THREADING_MUTEX_ERROR ;
 
-    return( 0 );
+    return 0 ;
 }
 
 void (*mbedtls_mutex_init)( mbedtls_threading_mutex_t * ) = threading_mutex_init_pthread;
@@ -123,7 +123,7 @@
 static int threading_mutex_fail( mbedtls_threading_mutex_t *mutex )
 {
     ((void) mutex );
-    return( MBEDTLS_ERR_THREADING_BAD_INPUT_DATA );
+    return MBEDTLS_ERR_THREADING_BAD_INPUT_DATA ;
 }
 static void threading_mutex_dummy( mbedtls_threading_mutex_t *mutex )
 {
diff --git a/library/timing.c b/library/timing.c
index 8a02c00..0acec5b 100644
--- a/library/timing.c
+++ b/library/timing.c
@@ -84,7 +84,7 @@
     if( reset )
     {
         QueryPerformanceCounter( &t->start );
-        return( 0 );
+        return 0 ;
     }
     else
     {
@@ -94,7 +94,7 @@
         QueryPerformanceFrequency( &hfreq );
         delta = (unsigned long)( ( now.QuadPart - t->start.QuadPart ) * 1000ul
                                  / hfreq.QuadPart );
-        return( delta );
+        return delta ;
     }
 }
 
@@ -107,7 +107,7 @@
     if( reset )
     {
         gettimeofday( &t->start, NULL );
-        return( 0 );
+        return 0 ;
     }
     else
     {
@@ -116,7 +116,7 @@
         gettimeofday( &now, NULL );
         delta = ( now.tv_sec  - t->start.tv_sec  ) * 1000ul
               + ( now.tv_usec - t->start.tv_usec ) / 1000;
-        return( delta );
+        return delta ;
     }
 }
 
@@ -145,17 +145,17 @@
     unsigned long elapsed_ms;
 
     if( ctx->fin_ms == 0 )
-        return( -1 );
+        return -1 ;
 
     elapsed_ms = mbedtls_timing_get_timer( &ctx->timer, 0 );
 
     if( elapsed_ms >= ctx->fin_ms )
-        return( 2 );
+        return 2 ;
 
     if( elapsed_ms >= ctx->int_ms )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 #endif /* !MBEDTLS_TIMING_ALT */
diff --git a/library/version.c b/library/version.c
index 32a0d7d..d80de43 100644
--- a/library/version.c
+++ b/library/version.c
@@ -26,7 +26,7 @@
 
 unsigned int mbedtls_version_get_number( void )
 {
-    return( MBEDTLS_VERSION_NUMBER );
+    return MBEDTLS_VERSION_NUMBER ;
 }
 
 void mbedtls_version_get_string( char *string )
diff --git a/library/x509.c b/library/x509.c
index 2e11c7f..0f14aad 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -62,13 +62,13 @@
 #include <time.h>
 #endif
 
-#define CHECK(code) if( ( ret = ( code ) ) != 0 ){ return( ret ); }
+#define CHECK(code) if( ( ret = ( code ) ) != 0 ){ return ret ; }
 #define CHECK_RANGE(min, max, val)                      \
     do                                                  \
     {                                                   \
         if( ( val ) < ( min ) || ( val ) > ( max ) )    \
         {                                               \
-            return( ret );                              \
+            return ret ;                              \
         }                                               \
     } while( 0 )
 
@@ -92,12 +92,12 @@
     serial->tag = *(*p)++;
 
     if( ( ret = mbedtls_asn1_get_len( p, end, &serial->len ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_SERIAL, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_SERIAL, ret ) ;
 
     serial->p = *p;
     *p += serial->len;
 
-    return( 0 );
+    return 0 ;
 }
 
 /* Get an algorithm identifier without parameters (eg for signatures)
@@ -112,9 +112,9 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ( ret = mbedtls_asn1_get_alg_null( p, end, alg ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -126,9 +126,9 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ( ret = mbedtls_asn1_get_alg( p, end, alg, params ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
@@ -165,27 +165,27 @@
     md_oid.tag = *p;
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &md_oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
     md_oid.p = p;
     p += md_oid.len;
 
     /* Get md_alg from md_oid */
     if( ( ret = mbedtls_oid_get_md_alg( &md_oid, md_alg ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
     /* Make sure params is absent of NULL */
     if( p == end )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_NULL ) ) != 0 || len != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
     if( p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -224,7 +224,7 @@
     end = p + params->len;
 
     if( p == end )
-        return( 0 );
+        return 0 ;
 
     /*
      * HashAlgorithm
@@ -236,20 +236,20 @@
 
         /* HashAlgorithm ::= AlgorithmIdentifier (without parameters) */
         if( ( ret = mbedtls_x509_get_alg_null( &p, end2, &alg_id ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( ( ret = mbedtls_oid_get_md_alg( &alg_id, md_alg ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
         if( p != end2 )
             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG,
                     MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
     }
     else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
     if( p == end )
-        return( 0 );
+        return 0 ;
 
     /*
      * MaskGenAlgorithm
@@ -261,7 +261,7 @@
 
         /* MaskGenAlgorithm ::= AlgorithmIdentifier (params = HashAlgorithm) */
         if( ( ret = mbedtls_x509_get_alg( &p, end2, &alg_id, &alg_params ) ) != 0 )
-            return( ret );
+            return ret ;
 
         /* Only MFG1 is recognised for now */
         if( MBEDTLS_OID_CMP( MBEDTLS_OID_MGF1, &alg_id ) != 0 )
@@ -270,17 +270,17 @@
 
         /* Parse HashAlgorithm */
         if( ( ret = x509_get_hash_alg( &alg_params, mgf_md ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( p != end2 )
             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG,
                     MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
     }
     else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
     if( p == end )
-        return( 0 );
+        return 0 ;
 
     /*
      * salt_len
@@ -291,17 +291,17 @@
         end2 = p + len;
 
         if( ( ret = mbedtls_asn1_get_int( &p, end2, salt_len ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
         if( p != end2 )
             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG,
                     MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
     }
     else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
     if( p == end )
-        return( 0 );
+        return 0 ;
 
     /*
      * trailer_field (if present, must be 1)
@@ -314,23 +314,23 @@
         end2 = p + len;
 
         if( ( ret = mbedtls_asn1_get_int( &p, end2, &trailer_field ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
         if( p != end2 )
             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG,
                     MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
         if( trailer_field != 1 )
-            return( MBEDTLS_ERR_X509_INVALID_ALG );
+            return MBEDTLS_ERR_X509_INVALID_ALG ;
     }
     else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG, ret ) ;
 
     if( p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_ALG,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
 
@@ -354,7 +354,7 @@
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) ;
 
     end = *p + len;
 
@@ -366,7 +366,7 @@
     oid->tag = **p;
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &oid->len, MBEDTLS_ASN1_OID ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) ;
 
     oid->p = *p;
     *p += oid->len;
@@ -386,7 +386,7 @@
     val->tag = *(*p)++;
 
     if( ( ret = mbedtls_asn1_get_len( p, end, &val->len ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) ;
 
     val->p = *p;
     *p += val->len;
@@ -399,7 +399,7 @@
 
     cur->next = NULL;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -440,14 +440,14 @@
          */
         if( ( ret = mbedtls_asn1_get_tag( p, end, &set_len,
                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_NAME, ret ) ;
 
         end_set  = *p + set_len;
 
         while( 1 )
         {
             if( ( ret = x509_get_attr_type_value( p, end_set, cur ) ) != 0 )
-                return( ret );
+                return ret ;
 
             if( *p == end_set )
                 break;
@@ -458,7 +458,7 @@
             cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
             if( cur->next == NULL )
-                return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+                return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
             cur = cur->next;
         }
@@ -467,12 +467,12 @@
          * continue until end of SEQUENCE is reached
          */
         if( *p == end )
-            return( 0 );
+            return 0 ;
 
         cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
         if( cur->next == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
         cur = cur->next;
     }
@@ -485,13 +485,13 @@
     for( ; n > 0; --n )
     {
         if( ( **p < '0') || ( **p > '9' ) )
-            return ( MBEDTLS_ERR_X509_INVALID_DATE );
+            return MBEDTLS_ERR_X509_INVALID_DATE ;
 
         *res *= 10;
         *res += ( *(*p)++ - '0' );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 static int x509_date_is_valid(const mbedtls_x509_time *t )
@@ -520,11 +520,11 @@
                 month_len = 28;
             break;
         default:
-            return( ret );
+            return ret ;
     }
     CHECK_RANGE( 1, month_len, t->day );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -540,7 +540,7 @@
      * Minimum length is 10 or 12 depending on yearlen
      */
     if ( len < yearlen + 8 )
-        return ( MBEDTLS_ERR_X509_INVALID_DATE );
+        return MBEDTLS_ERR_X509_INVALID_DATE ;
     len -= yearlen + 8;
 
     /*
@@ -569,7 +569,7 @@
         len -= 2;
     }
     else
-        return ( MBEDTLS_ERR_X509_INVALID_DATE );
+        return MBEDTLS_ERR_X509_INVALID_DATE ;
 
     /*
      * Parse trailing 'Z' if present
@@ -584,11 +584,11 @@
      * We should have parsed all characters at this point
      */
     if ( 0 != len )
-        return ( MBEDTLS_ERR_X509_INVALID_DATE );
+        return MBEDTLS_ERR_X509_INVALID_DATE ;
 
     CHECK( x509_date_is_valid( tm ) );
 
-    return ( 0 );
+    return 0 ;
 }
 
 /*
@@ -621,7 +621,7 @@
     ret = mbedtls_asn1_get_len( p, end, &len );
 
     if( ret != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_DATE, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_DATE, ret ) ;
 
     return x509_parse_time( p, len, year_len, tm );
 }
@@ -639,7 +639,7 @@
     tag_type = **p;
 
     if( ( ret = mbedtls_asn1_get_bitstring_null( p, end, &len ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_SIGNATURE, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_SIGNATURE, ret ) ;
 
     sig->tag = tag_type;
     sig->len = len;
@@ -647,7 +647,7 @@
 
     *p += len;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -660,10 +660,10 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( *sig_opts != NULL )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     if( ( ret = mbedtls_oid_get_sig_alg( sig_oid, md_alg, pk_alg ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG, ret ) ;
 
 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
     if( *pk_alg == MBEDTLS_PK_RSASSA_PSS )
@@ -672,7 +672,7 @@
 
         pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
         if( pss_opts == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
         ret = mbedtls_x509_get_rsassa_pss_params( sig_params,
                                           md_alg,
@@ -681,7 +681,7 @@
         if( ret != 0 )
         {
             mbedtls_free( pss_opts );
-            return( ret );
+            return ret ;
         }
 
         *sig_opts = (void *) pss_opts;
@@ -692,10 +692,10 @@
         /* Make sure parameters are absent or NULL */
         if( ( sig_params->tag != MBEDTLS_ASN1_NULL && sig_params->tag != 0 ) ||
               sig_params->len != 0 )
-        return( MBEDTLS_ERR_X509_INVALID_ALG );
+        return MBEDTLS_ERR_X509_INVALID_ALG ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -714,7 +714,7 @@
     ret = mbedtls_asn1_get_tag( p, end, &ext->len,
               MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | tag );
     if( ret != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     ext->tag = MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | tag;
     ext->p   = *p;
@@ -725,13 +725,13 @@
      */
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( end != *p + len )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -890,7 +890,7 @@
     ret = mbedtls_snprintf( p, n, "%s key size", name );
     MBEDTLS_X509_SAFE_SNPRINTF;
 
-    return( 0 );
+    return 0 ;
 }
 
 #if defined(MBEDTLS_HAVE_TIME_DATE)
@@ -919,7 +919,7 @@
         now->sec  = lt->tm_sec;
     }
 
-    return( ret );
+    return ret ;
 }
 
 /*
@@ -928,29 +928,29 @@
 static int x509_check_time( const mbedtls_x509_time *before, const mbedtls_x509_time *after )
 {
     if( before->year  > after->year )
-        return( 1 );
+        return 1 ;
 
     if( before->year == after->year &&
         before->mon   > after->mon )
-        return( 1 );
+        return 1 ;
 
     if( before->year == after->year &&
         before->mon  == after->mon  &&
         before->day   > after->day )
-        return( 1 );
+        return 1 ;
 
     if( before->year == after->year &&
         before->mon  == after->mon  &&
         before->day  == after->day  &&
         before->hour  > after->hour )
-        return( 1 );
+        return 1 ;
 
     if( before->year == after->year &&
         before->mon  == after->mon  &&
         before->day  == after->day  &&
         before->hour == after->hour &&
         before->min   > after->min  )
-        return( 1 );
+        return 1 ;
 
     if( before->year == after->year &&
         before->mon  == after->mon  &&
@@ -958,9 +958,9 @@
         before->hour == after->hour &&
         before->min  == after->min  &&
         before->sec   > after->sec  )
-        return( 1 );
+        return 1 ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509_time_is_past( const mbedtls_x509_time *to )
@@ -968,9 +968,9 @@
     mbedtls_x509_time now;
 
     if( x509_get_current_time( &now ) != 0 )
-        return( 1 );
+        return 1 ;
 
-    return( x509_check_time( &now, to ) );
+    return x509_check_time( &now, to ) ;
 }
 
 int mbedtls_x509_time_is_future( const mbedtls_x509_time *from )
@@ -978,9 +978,9 @@
     mbedtls_x509_time now;
 
     if( x509_get_current_time( &now ) != 0 )
-        return( 1 );
+        return 1 ;
 
-    return( x509_check_time( from, &now ) );
+    return x509_check_time( from, &now ) ;
 }
 
 #else  /* MBEDTLS_HAVE_TIME_DATE */
@@ -988,13 +988,13 @@
 int mbedtls_x509_time_is_past( const mbedtls_x509_time *to )
 {
     ((void) to);
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509_time_is_future( const mbedtls_x509_time *from )
 {
     ((void) from);
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_HAVE_TIME_DATE */
 #endif /* MBEDTLS_X509_USE_C */
diff --git a/library/x509_create.c b/library/x509_create.c
index 056bbaa..af157e8 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -115,9 +115,9 @@
             break;
 
     if ( cur->name == NULL )
-        return( NULL );
+        return NULL ;
 
-    return( cur );
+    return cur ;
 }
 
 int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name )
@@ -170,7 +170,7 @@
 
             if(cur == NULL )
             {
-                return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+                return MBEDTLS_ERR_X509_ALLOC_FAILED ;
             }
 
             // set tagType
@@ -199,7 +199,7 @@
 
 exit:
 
-    return( ret );
+    return ret ;
 }
 
 /* The first byte of the value in the mbedtls_asn1_named_data structure is reserved
@@ -213,13 +213,13 @@
     if( ( cur = mbedtls_asn1_store_named_data( head, oid, oid_len,
                                        NULL, val_len + 1 ) ) == NULL )
     {
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return MBEDTLS_ERR_X509_ALLOC_FAILED ;
     }
 
     cur->val.p[0] = critical;
     memcpy( cur->val.p + 1, val, val_len );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -263,7 +263,7 @@
                                                  MBEDTLS_ASN1_CONSTRUCTED |
                                                  MBEDTLS_ASN1_SET ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_x509_write_names( unsigned char **p, unsigned char *start,
@@ -283,7 +283,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_CONSTRUCTED |
                                                  MBEDTLS_ASN1_SEQUENCE ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start,
@@ -294,14 +294,14 @@
     size_t len = 0;
 
     if( *p < start || (size_t)( *p - start ) < size )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     len = size;
     (*p) -= len;
     memcpy( *p, sig, len );
 
     if( *p - start < 1 )
-        return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
+        return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL ;
 
     *--(*p) = 0;
     len += 1;
@@ -314,7 +314,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_algorithm_identifier( p, start, oid,
                                                         oid_len, 0 ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 static int x509_write_extension( unsigned char **p, unsigned char *start,
@@ -342,7 +342,7 @@
     MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start, MBEDTLS_ASN1_CONSTRUCTED |
                                                  MBEDTLS_ASN1_SEQUENCE ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 /*
@@ -368,7 +368,7 @@
         cur_ext = cur_ext->next;
     }
 
-    return( (int) len );
+    return (int) len ;
 }
 
 #endif /* MBEDTLS_X509_CREATE_C */
diff --git a/library/x509_crl.c b/library/x509_crl.c
index e6efdca..de8bcbc 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -76,13 +76,13 @@
         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
         {
             *ver = 0;
-            return( 0 );
+            return 0 ;
         }
 
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION, ret ) ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -99,14 +99,14 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( *p == end )
-        return( 0 );
+        return 0 ;
 
     /*
      * crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
      *                              -- if present, version MUST be v2
      */
     if( ( ret = mbedtls_x509_get_ext( p, end, ext, 0 ) ) != 0 )
-        return( ret );
+        return ret ;
 
     end = ext->p + ext->len;
 
@@ -125,7 +125,7 @@
         /* Get enclosing sequence tag */
         if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         end_ext_data = *p + len;
 
@@ -133,7 +133,7 @@
         if( ( ret = mbedtls_asn1_get_tag( p, end_ext_data, &len,
                                           MBEDTLS_ASN1_OID ) ) != 0 )
         {
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
         }
         *p += len;
 
@@ -142,13 +142,13 @@
                                            &is_critical ) ) != 0 &&
             ( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) )
         {
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
         }
 
         /* Data should be octet string type */
         if( ( ret = mbedtls_asn1_get_tag( p, end_ext_data, &len,
                 MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         /* Ignore data so far and just check its length */
         *p += len;
@@ -166,7 +166,7 @@
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -181,7 +181,7 @@
 
     /* OPTIONAL */
     if( end <= *p )
-        return( 0 );
+        return 0 ;
 
     ext->tag = **p;
     ext->p = *p;
@@ -196,9 +196,9 @@
         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
         {
             ext->p = NULL;
-            return( 0 );
+            return 0 ;
         }
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
     }
 
     end = *p + ext->len;
@@ -211,7 +211,7 @@
     {
         if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         *p += len;
     }
@@ -220,7 +220,7 @@
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -235,15 +235,15 @@
     mbedtls_x509_crl_entry *cur_entry = entry;
 
     if( *p == end )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &entry_len,
             MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED ) ) != 0 )
     {
         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
-            return( 0 );
+            return 0 ;
 
-        return( ret );
+        return ret ;
     }
 
     end = *p + entry_len;
@@ -257,7 +257,7 @@
         if( ( ret = mbedtls_asn1_get_tag( p, end, &len2,
                 MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED ) ) != 0 )
         {
-            return( ret );
+            return ret ;
         }
 
         cur_entry->raw.p = *p;
@@ -265,28 +265,28 @@
         end2 = *p + len2;
 
         if( ( ret = mbedtls_x509_get_serial( p, end2, &cur_entry->serial ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( ( ret = mbedtls_x509_get_time( p, end2,
                                    &cur_entry->revocation_date ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( ( ret = x509_get_crl_entry_ext( p, end2,
                                             &cur_entry->entry_ext ) ) != 0 )
-            return( ret );
+            return ret ;
 
         if( *p < end )
         {
             cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
 
             if( cur_entry->next == NULL )
-                return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+                return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
             cur_entry = cur_entry->next;
         }
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -305,7 +305,7 @@
      * Check for valid input
      */
     if( crl == NULL || buf == NULL )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     memset( &sig_params1, 0, sizeof( mbedtls_x509_buf ) );
     memset( &sig_params2, 0, sizeof( mbedtls_x509_buf ) );
@@ -324,7 +324,7 @@
         if( crl->next == NULL )
         {
             mbedtls_x509_crl_free( crl );
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return MBEDTLS_ERR_X509_ALLOC_FAILED ;
         }
 
         mbedtls_x509_crl_init( crl->next );
@@ -335,11 +335,11 @@
      * Copy raw DER-encoded CRL
      */
     if( buflen == 0 )
-        return( MBEDTLS_ERR_X509_INVALID_FORMAT );
+        return MBEDTLS_ERR_X509_INVALID_FORMAT ;
 
     p = mbedtls_calloc( 1, buflen );
     if( p == NULL )
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
     memcpy( p, buf, buflen );
 
@@ -358,7 +358,7 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( MBEDTLS_ERR_X509_INVALID_FORMAT );
+        return MBEDTLS_ERR_X509_INVALID_FORMAT ;
     }
 
     if( len != (size_t) ( end - p ) )
@@ -377,7 +377,7 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     end = p + len;
@@ -393,13 +393,13 @@
         ( ret = mbedtls_x509_get_alg( &p, end, &crl->sig_oid, &sig_params1 ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( ret );
+        return ret ;
     }
 
     if( crl->version < 0 || crl->version > 1 )
     {
         mbedtls_x509_crl_free( crl );
-        return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
+        return MBEDTLS_ERR_X509_UNKNOWN_VERSION ;
     }
 
     crl->version++;
@@ -409,7 +409,7 @@
                                   &crl->sig_opts ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG );
+        return MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG ;
     }
 
     /*
@@ -421,13 +421,13 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     if( ( ret = mbedtls_x509_get_name( &p, p + len, &crl->issuer ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( ret );
+        return ret ;
     }
 
     crl->issuer_raw.len = p - crl->issuer_raw.p;
@@ -439,7 +439,7 @@
     if( ( ret = mbedtls_x509_get_time( &p, end, &crl->this_update ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = mbedtls_x509_get_time( &p, end, &crl->next_update ) ) != 0 )
@@ -450,7 +450,7 @@
                         MBEDTLS_ERR_ASN1_OUT_OF_DATA ) ) )
         {
             mbedtls_x509_crl_free( crl );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -465,7 +465,7 @@
     if( ( ret = x509_get_entries( &p, end, &crl->entry ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( ret );
+        return ret ;
     }
 
     /*
@@ -479,7 +479,7 @@
         if( ret != 0 )
         {
             mbedtls_x509_crl_free( crl );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -499,7 +499,7 @@
     if( ( ret = mbedtls_x509_get_alg( &p, end, &sig_oid2, &sig_params2 ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( ret );
+        return ret ;
     }
 
     if( crl->sig_oid.len != sig_oid2.len ||
@@ -509,13 +509,13 @@
           memcmp( sig_params1.p, sig_params2.p, sig_params1.len ) != 0 ) )
     {
         mbedtls_x509_crl_free( crl );
-        return( MBEDTLS_ERR_X509_SIG_MISMATCH );
+        return MBEDTLS_ERR_X509_SIG_MISMATCH ;
     }
 
     if( ( ret = mbedtls_x509_get_sig( &p, end, &crl->sig ) ) != 0 )
     {
         mbedtls_x509_crl_free( crl );
-        return( ret );
+        return ret ;
     }
 
     if( p != end )
@@ -525,7 +525,7 @@
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -540,7 +540,7 @@
     int is_pem = 0;
 
     if( chain == NULL || buf == NULL )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     do
     {
@@ -570,13 +570,13 @@
                                             pem.buf, pem.buflen ) ) != 0 )
             {
                 mbedtls_pem_free( &pem );
-                return( ret );
+                return ret ;
             }
         }
         else if( is_pem )
         {
             mbedtls_pem_free( &pem );
-            return( ret );
+            return ret ;
         }
 
         mbedtls_pem_free( &pem );
@@ -586,10 +586,10 @@
     while( is_pem && buflen > 1 );
 
     if( is_pem )
-        return( 0 );
+        return 0 ;
     else
 #endif /* MBEDTLS_PEM_PARSE_C */
-        return( mbedtls_x509_crl_parse_der( chain, buf, buflen ) );
+        return mbedtls_x509_crl_parse_der( chain, buf, buflen ) ;
 }
 
 #if defined(MBEDTLS_FS_IO)
@@ -603,14 +603,14 @@
     unsigned char *buf;
 
     if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_x509_crl_parse( chain, buf, n );
 
     mbedtls_platform_zeroize( buf, n );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_FS_IO */
 
diff --git a/library/x509_crt.c b/library/x509_crt.c
index c865444..cf3f91a 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -185,12 +185,12 @@
                                       mbedtls_md_type_t md_alg )
 {
     if( md_alg == MBEDTLS_MD_NONE )
-        return( -1 );
+        return -1 ;
 
     if( ( profile->allowed_mds & MBEDTLS_X509_ID_FLAG( md_alg ) ) != 0 )
-        return( 0 );
+        return 0 ;
 
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -201,12 +201,12 @@
                                       mbedtls_pk_type_t pk_alg )
 {
     if( pk_alg == MBEDTLS_PK_NONE )
-        return( -1 );
+        return -1 ;
 
     if( ( profile->allowed_pks & MBEDTLS_X509_ID_FLAG( pk_alg ) ) != 0 )
-        return( 0 );
+        return 0 ;
 
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -222,9 +222,9 @@
     if( pk_alg == MBEDTLS_PK_RSA || pk_alg == MBEDTLS_PK_RSASSA_PSS )
     {
         if( mbedtls_pk_get_bitlen( pk ) >= profile->rsa_min_bitlen )
-            return( 0 );
+            return 0 ;
 
-        return( -1 );
+        return -1 ;
     }
 #endif
 
@@ -236,16 +236,16 @@
         const mbedtls_ecp_group_id gid = mbedtls_pk_ec( *pk )->grp.id;
 
         if( gid == MBEDTLS_ECP_DP_NONE )
-            return( -1 );
+            return -1 ;
 
         if( ( profile->allowed_curves & MBEDTLS_X509_ID_FLAG( gid ) ) != 0 )
-            return( 0 );
+            return 0 ;
 
-        return( -1 );
+        return -1 ;
     }
 #endif
 
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -271,10 +271,10 @@
             continue;
         }
 
-        return( -1 );
+        return -1 ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -287,7 +287,7 @@
 
     /* We can't have a match if there is no wildcard to match */
     if( name->len < 3 || name->p[0] != '*' || name->p[1] != '.' )
-        return( -1 );
+        return -1 ;
 
     for( i = 0; i < cn_len; ++i )
     {
@@ -299,15 +299,15 @@
     }
 
     if( cn_idx == 0 )
-        return( -1 );
+        return -1 ;
 
     if( cn_len - cn_idx == name->len - 1 &&
         x509_memcasecmp( name->p + 1, cn + cn_idx, name->len - 1 ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -322,7 +322,7 @@
         a->len == b->len &&
         memcmp( a->p, b->p, b->len ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
     if( ( a->tag == MBEDTLS_ASN1_UTF8_STRING || a->tag == MBEDTLS_ASN1_PRINTABLE_STRING ) &&
@@ -330,10 +330,10 @@
         a->len == b->len &&
         x509_memcasecmp( a->p, b->p, b->len ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -352,30 +352,30 @@
     while( a != NULL || b != NULL )
     {
         if( a == NULL || b == NULL )
-            return( -1 );
+            return -1 ;
 
         /* type */
         if( a->oid.tag != b->oid.tag ||
             a->oid.len != b->oid.len ||
             memcmp( a->oid.p, b->oid.p, b->oid.len ) != 0 )
         {
-            return( -1 );
+            return -1 ;
         }
 
         /* value */
         if( x509_string_cmp( &a->val, &b->val ) != 0 )
-            return( -1 );
+            return -1 ;
 
         /* structure of the list of sets */
         if( a->next_merged != b->next_merged )
-            return( -1 );
+            return -1 ;
 
         a = a->next;
         b = b->next;
     }
 
     /* a == NULL == b */
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -415,22 +415,22 @@
         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
         {
             *ver = 0;
-            return( 0 );
+            return 0 ;
         }
 
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     end = *p + len;
 
     if( ( ret = mbedtls_asn1_get_int( p, end, ver ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION, ret ) ;
 
     if( *p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -448,21 +448,21 @@
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_DATE, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_DATE, ret ) ;
 
     end = *p + len;
 
     if( ( ret = mbedtls_x509_get_time( p, end, from ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( ( ret = mbedtls_x509_get_time( p, end, to ) ) != 0 )
-        return( ret );
+        return ret ;
 
     if( *p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_DATE,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -475,7 +475,7 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( *p == end )
-        return( 0 );
+        return 0 ;
 
     uid->tag = **p;
 
@@ -483,15 +483,15 @@
             MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | n ) ) != 0 )
     {
         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
-            return( 0 );
+            return 0 ;
 
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     uid->p = *p;
     *p += uid->len;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int x509_get_basic_constraints( unsigned char **p,
@@ -512,10 +512,10 @@
 
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( *p == end )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_asn1_get_bool( p, end, ca_istrue ) ) != 0 )
     {
@@ -523,17 +523,17 @@
             ret = mbedtls_asn1_get_int( p, end, ca_istrue );
 
         if( ret != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         if( *ca_istrue != 0 )
             *ca_istrue = 1;
     }
 
     if( *p == end )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_asn1_get_int( p, end, max_pathlen ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( *p != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
@@ -547,7 +547,7 @@
 
     (*max_pathlen)++;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int x509_get_ns_cert_type( unsigned char **p,
@@ -558,7 +558,7 @@
     mbedtls_x509_bitstring bs = { 0, 0, NULL };
 
     if( ( ret = mbedtls_asn1_get_bitstring( p, end, &bs ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( bs.len != 1 )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
@@ -566,7 +566,7 @@
 
     /* Get actual bitstring */
     *ns_cert_type = *bs.p;
-    return( 0 );
+    return 0 ;
 }
 
 static int x509_get_key_usage( unsigned char **p,
@@ -578,7 +578,7 @@
     mbedtls_x509_bitstring bs = { 0, 0, NULL };
 
     if( ( ret = mbedtls_asn1_get_bitstring( p, end, &bs ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( bs.len < 1 )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
@@ -591,7 +591,7 @@
         *key_usage |= (unsigned int) bs.p[i] << (8*i);
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -606,14 +606,14 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ( ret = mbedtls_asn1_get_sequence_of( p, end, ext_key_usage, MBEDTLS_ASN1_OID ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     /* Sequence length must be >= 1 */
     if( ext_key_usage->buf.p == NULL )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_INVALID_LENGTH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -656,7 +656,7 @@
     /* Get main sequence tag */
     if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( *p + len != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
@@ -670,7 +670,7 @@
         tag = **p;
         (*p)++;
         if( ( ret = mbedtls_asn1_get_len( p, end, &tag_len ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         if( ( tag & MBEDTLS_ASN1_TAG_CLASS_MASK ) !=
                 MBEDTLS_ASN1_CONTEXT_SPECIFIC )
@@ -700,14 +700,14 @@
                 mbedtls_free( seq_prv );
             }
             subject_alt_name->next = NULL;
-            return( ret );
+            return ret ;
         }
 
         /* Allocate and assign next pointer */
         if( cur->buf.p != NULL )
         {
             if( cur->next != NULL )
-                return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS );
+                return MBEDTLS_ERR_X509_INVALID_EXTENSIONS ;
 
             cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
@@ -732,7 +732,7 @@
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -797,7 +797,7 @@
     ret = mbedtls_asn1_get_tag( p, end, &len,
                              MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE );
     if( ret != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( *p + len != end )
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
@@ -820,13 +820,13 @@
          */
         if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         policy_end = *p + len;
 
         if( ( ret = mbedtls_asn1_get_tag( p, policy_end, &len,
                                           MBEDTLS_ASN1_OID ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         policy_oid.tag = MBEDTLS_ASN1_OID;
         policy_oid.len = len;
@@ -848,7 +848,7 @@
         if( cur->buf.p != NULL )
         {
             if( cur->next != NULL )
-                return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS );
+                return MBEDTLS_ERR_X509_INVALID_EXTENSIONS ;
 
             cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
@@ -874,7 +874,7 @@
         {
             if( ( ret = mbedtls_asn1_get_tag( p, policy_end, &len,
                      MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-                return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+                return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
             /*
              * Skip the optional policy qualifiers.
              */
@@ -893,7 +893,7 @@
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( parse_ret );
+    return parse_ret ;
 }
 
 /*
@@ -911,10 +911,10 @@
     unsigned char *end_ext_data, *start_ext_octet, *end_ext_octet;
 
     if( *p == end )
-        return( 0 );
+        return 0 ;
 
     if( ( ret = mbedtls_x509_get_ext( p, end, &crt->v3_ext, 3 ) ) != 0 )
-        return( ret );
+        return ret ;
 
     end = crt->v3_ext.p + crt->v3_ext.len;
     while( *p < end )
@@ -931,14 +931,14 @@
 
         if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         end_ext_data = *p + len;
 
         /* Get extension ID */
         if( ( ret = mbedtls_asn1_get_tag( p, end_ext_data, &extn_oid.len,
                                           MBEDTLS_ASN1_OID ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         extn_oid.tag = MBEDTLS_ASN1_OID;
         extn_oid.p = *p;
@@ -947,12 +947,12 @@
         /* Get optional critical */
         if( ( ret = mbedtls_asn1_get_bool( p, end_ext_data, &is_critical ) ) != 0 &&
             ( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         /* Data should be octet string type */
         if( ( ret = mbedtls_asn1_get_tag( p, end_ext_data, &len,
                 MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-            return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+            return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
         start_ext_octet = *p;
         end_ext_octet = *p + len;
@@ -973,7 +973,7 @@
             {
                 ret = cb( p_ctx, crt, &extn_oid, is_critical, *p, end_ext_octet );
                 if( ret != 0 && is_critical )
-                    return( ret );
+                    return ret ;
                 *p = end_ext_octet;
                 continue;
             }
@@ -992,7 +992,7 @@
 
         /* Forbid repeated extensions */
         if( ( crt->ext_types & ext_type ) != 0 )
-            return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS );
+            return MBEDTLS_ERR_X509_INVALID_EXTENSIONS ;
 
         crt->ext_types |= ext_type;
 
@@ -1002,35 +1002,35 @@
             /* Parse basic constraints */
             if( ( ret = x509_get_basic_constraints( p, end_ext_octet,
                     &crt->ca_istrue, &crt->max_pathlen ) ) != 0 )
-                return( ret );
+                return ret ;
             break;
 
         case MBEDTLS_X509_EXT_KEY_USAGE:
             /* Parse key usage */
             if( ( ret = x509_get_key_usage( p, end_ext_octet,
                     &crt->key_usage ) ) != 0 )
-                return( ret );
+                return ret ;
             break;
 
         case MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE:
             /* Parse extended key usage */
             if( ( ret = x509_get_ext_key_usage( p, end_ext_octet,
                     &crt->ext_key_usage ) ) != 0 )
-                return( ret );
+                return ret ;
             break;
 
         case MBEDTLS_X509_EXT_SUBJECT_ALT_NAME:
             /* Parse subject alt name */
             if( ( ret = x509_get_subject_alt_name( p, end_ext_octet,
                     &crt->subject_alt_names ) ) != 0 )
-                return( ret );
+                return ret ;
             break;
 
         case MBEDTLS_X509_EXT_NS_CERT_TYPE:
             /* Parse netscape certificate type */
             if( ( ret = x509_get_ns_cert_type( p, end_ext_octet,
                     &crt->ns_cert_type ) ) != 0 )
-                return( ret );
+                return ret ;
             break;
 
         case MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES:
@@ -1046,7 +1046,7 @@
                     break;
 
                 if( is_critical )
-                    return( ret );
+                    return ret ;
                 else
                 /*
                  * If MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE is returned, then we
@@ -1055,7 +1055,7 @@
                  * unless the extension is critical.
                  */
                 if( ret != MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE )
-                    return( ret );
+                    return ret ;
             }
             break;
 
@@ -1066,7 +1066,7 @@
              * skip the extension.
              */
             if( is_critical )
-                return( MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE );
+                return MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE ;
             else
                 *p = end_ext_octet;
         }
@@ -1076,7 +1076,7 @@
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1102,7 +1102,7 @@
      * Check for valid input
      */
     if( crt == NULL || buf == NULL )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     /* Use the original buffer until we figure out actual length. */
     p = (unsigned char*) buf;
@@ -1119,7 +1119,7 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( MBEDTLS_ERR_X509_INVALID_FORMAT );
+        return MBEDTLS_ERR_X509_INVALID_FORMAT ;
     }
 
     end = crt_end = p + len;
@@ -1129,7 +1129,7 @@
         /* Create and populate a new buffer for the raw field. */
         crt->raw.p = p = mbedtls_calloc( 1, crt->raw.len );
         if( crt->raw.p == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
         memcpy( crt->raw.p, buf, crt->raw.len );
         crt->own_buffer = 1;
@@ -1152,7 +1152,7 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     end = p + len;
@@ -1171,13 +1171,13 @@
                                             &sig_params1 ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
 
     if( crt->version < 0 || crt->version > 2 )
     {
         mbedtls_x509_crt_free( crt );
-        return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
+        return MBEDTLS_ERR_X509_UNKNOWN_VERSION ;
     }
 
     crt->version++;
@@ -1187,7 +1187,7 @@
                                   &crt->sig_opts ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
 
     /*
@@ -1199,13 +1199,13 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     if( ( ret = mbedtls_x509_get_name( &p, p + len, &crt->issuer ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
 
     crt->issuer_raw.len = p - crt->issuer_raw.p;
@@ -1220,7 +1220,7 @@
                                          &crt->valid_to ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
 
     /*
@@ -1232,13 +1232,13 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     if( len && ( ret = mbedtls_x509_get_name( &p, p + len, &crt->subject ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
 
     crt->subject_raw.len = p - crt->subject_raw.p;
@@ -1250,7 +1250,7 @@
     if( ( ret = mbedtls_pk_parse_subpubkey( &p, end, &crt->pk ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
     crt->pk_raw.len = p - crt->pk_raw.p;
 
@@ -1268,7 +1268,7 @@
         if( ret != 0 )
         {
             mbedtls_x509_crt_free( crt );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -1278,7 +1278,7 @@
         if( ret != 0 )
         {
             mbedtls_x509_crt_free( crt );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -1288,7 +1288,7 @@
         if( ret != 0 )
         {
             mbedtls_x509_crt_free( crt );
-            return( ret );
+            return ret ;
         }
     }
 
@@ -1311,7 +1311,7 @@
     if( ( ret = mbedtls_x509_get_alg( &p, end, &sig_oid2, &sig_params2 ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
 
     if( crt->sig_oid.len != sig_oid2.len ||
@@ -1322,13 +1322,13 @@
           memcmp( sig_params1.p, sig_params2.p, sig_params1.len ) != 0 ) )
     {
         mbedtls_x509_crt_free( crt );
-        return( MBEDTLS_ERR_X509_SIG_MISMATCH );
+        return MBEDTLS_ERR_X509_SIG_MISMATCH ;
     }
 
     if( ( ret = mbedtls_x509_get_sig( &p, end, &crt->sig ) ) != 0 )
     {
         mbedtls_x509_crt_free( crt );
-        return( ret );
+        return ret ;
     }
 
     if( p != end )
@@ -1338,7 +1338,7 @@
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -1359,7 +1359,7 @@
      * Check for valid input
      */
     if( crt == NULL || buf == NULL )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     while( crt->version != 0 && crt->next != NULL )
     {
@@ -1375,7 +1375,7 @@
         crt->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( crt->next == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
         prev = crt;
         mbedtls_x509_crt_init( crt->next );
@@ -1391,17 +1391,17 @@
         if( crt != chain )
             mbedtls_free( crt );
 
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509_crt_parse_der_nocopy( mbedtls_x509_crt *chain,
                                        const unsigned char *buf,
                                        size_t buflen )
 {
-    return( mbedtls_x509_crt_parse_der_internal( chain, buf, buflen, 0, NULL, NULL ) );
+    return mbedtls_x509_crt_parse_der_internal( chain, buf, buflen, 0, NULL, NULL ) ;
 }
 
 int mbedtls_x509_crt_parse_der_with_ext_cb( mbedtls_x509_crt *chain,
@@ -1411,14 +1411,14 @@
                                             mbedtls_x509_crt_ext_cb_t cb,
                                             void *p_ctx )
 {
-    return( mbedtls_x509_crt_parse_der_internal( chain, buf, buflen, make_copy, cb, p_ctx ) );
+    return mbedtls_x509_crt_parse_der_internal( chain, buf, buflen, make_copy, cb, p_ctx ) ;
 }
 
 int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain,
                                 const unsigned char *buf,
                                 size_t buflen )
 {
-    return( mbedtls_x509_crt_parse_der_internal( chain, buf, buflen, 1, NULL, NULL ) );
+    return mbedtls_x509_crt_parse_der_internal( chain, buf, buflen, 1, NULL, NULL ) ;
 }
 
 /*
@@ -1438,7 +1438,7 @@
      * Check for valid input
      */
     if( chain == NULL || buf == NULL )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     /*
      * Determine buffer content. Buffer contains either one DER certificate or
@@ -1485,7 +1485,7 @@
             }
             else if( ret == MBEDTLS_ERR_PEM_BAD_INPUT_DATA )
             {
-                return( ret );
+                return ret ;
             }
             else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
             {
@@ -1516,7 +1516,7 @@
                  * Quit parsing on a memory error
                  */
                 if( ret == MBEDTLS_ERR_X509_ALLOC_FAILED )
-                    return( ret );
+                    return ret ;
 
                 if( first_error == 0 )
                     first_error = ret;
@@ -1530,11 +1530,11 @@
     }
 
     if( success )
-        return( total_failed );
+        return total_failed ;
     else if( first_error )
-        return( first_error );
+        return first_error ;
     else
-        return( MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT );
+        return MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT ;
 #endif /* MBEDTLS_PEM_PARSE_C */
 }
 
@@ -1549,14 +1549,14 @@
     unsigned char *buf;
 
     if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_x509_crt_parse( chain, buf, n );
 
     mbedtls_platform_zeroize( buf, n );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 
 int mbedtls_x509_crt_parse_path( mbedtls_x509_crt *chain, const char *path )
@@ -1573,7 +1573,7 @@
     HANDLE hFind;
 
     if( len > MAX_PATH - 3 )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     memset( szDir, 0, sizeof(szDir) );
     memset( filename, 0, MAX_PATH );
@@ -1585,11 +1585,11 @@
     w_ret = MultiByteToWideChar( CP_ACP, 0, filename, (int)len, szDir,
                                  MAX_PATH - 3 );
     if( w_ret == 0 )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     hFind = FindFirstFileW( szDir, &file_data );
     if( hFind == INVALID_HANDLE_VALUE )
-        return( MBEDTLS_ERR_X509_FILE_IO_ERROR );
+        return MBEDTLS_ERR_X509_FILE_IO_ERROR ;
 
     len = MAX_PATH - len;
     do
@@ -1631,13 +1631,13 @@
     DIR *dir = opendir( path );
 
     if( dir == NULL )
-        return( MBEDTLS_ERR_X509_FILE_IO_ERROR );
+        return MBEDTLS_ERR_X509_FILE_IO_ERROR ;
 
 #if defined(MBEDTLS_THREADING_C)
     if( ( ret = mbedtls_mutex_lock( &mbedtls_threading_readdir_mutex ) ) != 0 )
     {
         closedir( dir );
-        return( ret );
+        return ret ;
     }
 #endif /* MBEDTLS_THREADING_C */
 
@@ -1645,10 +1645,10 @@
 
     while( ( entry = readdir( dir ) ) != NULL )
     {
-        snp_ret = mbedtls_snprintf( entry_name, sizeof entry_name,
+        snp_ret = mbedtls_snprintf( entry_name, sizeof(entry_name),
                                     "%s/%s", path, entry->d_name );
 
-        if( snp_ret < 0 || (size_t)snp_ret >= sizeof entry_name )
+        if( snp_ret < 0 || (size_t)snp_ret >= sizeof(entry_name) )
         {
             ret = MBEDTLS_ERR_X509_BUFFER_TOO_SMALL;
             goto cleanup;
@@ -1681,7 +1681,7 @@
 
 #endif /* _WIN32 */
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -1713,12 +1713,12 @@
         /*
          * The given subject alternative name is not of type "othername".
          */
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
     }
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
                                       MBEDTLS_ASN1_OID ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     cur_oid.tag = MBEDTLS_ASN1_OID;
     cur_oid.p = p;
@@ -1729,7 +1729,7 @@
      */
     if( MBEDTLS_OID_CMP( MBEDTLS_OID_ON_HW_MODULE_NAME, &cur_oid ) != 0 )
     {
-        return( MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE ;
     }
 
     if( p + len >= end )
@@ -1741,14 +1741,14 @@
     p += len;
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
                      MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
-       return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+       return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_OID ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     other_name->value.hardware_module_name.oid.tag = MBEDTLS_ASN1_OID;
     other_name->value.hardware_module_name.oid.p = p;
@@ -1763,7 +1763,7 @@
     p += len;
     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
                                       MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) ;
 
     other_name->value.hardware_module_name.val.tag = MBEDTLS_ASN1_OCTET_STRING;
     other_name->value.hardware_module_name.val.p = p;
@@ -1776,7 +1776,7 @@
         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
     }
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509_parse_subject_alt_name( const mbedtls_x509_buf *san_buf,
@@ -1796,7 +1796,7 @@
 
             ret = x509_get_other_name( san_buf, &other_name );
             if( ret != 0 )
-                return( ret );
+                return ret ;
 
             memset( san, 0, sizeof( mbedtls_x509_subject_alternative_name ) );
             san->type = MBEDTLS_X509_SAN_OTHER_NAME;
@@ -1824,9 +1824,9 @@
          * Type not supported
          */
         default:
-            return( MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE );
+            return MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE ;
     }
-    return( 0 );
+    return 0 ;
 }
 
 #if !defined(MBEDTLS_X509_REMOVE_INFO)
@@ -1891,7 +1891,7 @@
                     if( other_name->value.hardware_module_name.val.len >= n )
                     {
                         *p = '\0';
-                        return( MBEDTLS_ERR_X509_BUFFER_TOO_SMALL );
+                        return MBEDTLS_ERR_X509_BUFFER_TOO_SMALL ;
                     }
 
                     memcpy( p, other_name->value.hardware_module_name.val.p,
@@ -1914,7 +1914,7 @@
                 if( san.san.unstructured_name.len >= n )
                 {
                     *p = '\0';
-                    return( MBEDTLS_ERR_X509_BUFFER_TOO_SMALL );
+                    return MBEDTLS_ERR_X509_BUFFER_TOO_SMALL ;
                 }
 
                 memcpy( p, san.san.unstructured_name.p, san.san.unstructured_name.len );
@@ -1940,7 +1940,7 @@
     *size = n;
     *buf = p;
 
-    return( 0 );
+    return 0 ;
 }
 
 #define PRINT_ITEM(i)                           \
@@ -1974,7 +1974,7 @@
     *size = n;
     *buf = p;
 
-    return( 0 );
+    return 0 ;
 }
 
 #define KEY_USAGE(code,name)    \
@@ -2002,7 +2002,7 @@
     *size = n;
     *buf = p;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int x509_info_ext_key_usage( char **buf, size_t *size,
@@ -2031,7 +2031,7 @@
     *size = n;
     *buf = p;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int x509_info_cert_policies( char **buf, size_t *size,
@@ -2060,7 +2060,7 @@
     *size = n;
     *buf = p;
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2132,7 +2132,7 @@
     if( ( ret = mbedtls_x509_key_size_helper( key_size_str, BEFORE_COLON,
                                       mbedtls_pk_get_name( &crt->pk ) ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     ret = mbedtls_snprintf( p, n, "\n%s%-" BC "s: %d bits", prefix, key_size_str,
@@ -2164,7 +2164,7 @@
         if( ( ret = x509_info_subject_alt_name( &p, &n,
                                                 &crt->subject_alt_names,
                                                 prefix ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 
     if( crt->ext_types & MBEDTLS_X509_EXT_NS_CERT_TYPE )
@@ -2173,7 +2173,7 @@
         MBEDTLS_X509_SAFE_SNPRINTF;
 
         if( ( ret = x509_info_cert_type( &p, &n, crt->ns_cert_type ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 
     if( crt->ext_types & MBEDTLS_X509_EXT_KEY_USAGE )
@@ -2182,7 +2182,7 @@
         MBEDTLS_X509_SAFE_SNPRINTF;
 
         if( ( ret = x509_info_key_usage( &p, &n, crt->key_usage ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 
     if( crt->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE )
@@ -2192,7 +2192,7 @@
 
         if( ( ret = x509_info_ext_key_usage( &p, &n,
                                              &crt->ext_key_usage ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 
     if( crt->ext_types & MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES )
@@ -2202,7 +2202,7 @@
 
         if( ( ret = x509_info_cert_policies( &p, &n,
                                              &crt->certificate_policies ) ) != 0 )
-            return( ret );
+            return ret ;
     }
 
     ret = mbedtls_snprintf( p, n, "\n" );
@@ -2260,19 +2260,19 @@
                           | MBEDTLS_X509_KU_DECIPHER_ONLY;
 
     if( ( crt->ext_types & MBEDTLS_X509_EXT_KEY_USAGE ) == 0 )
-        return( 0 );
+        return 0 ;
 
     usage_must = usage & ~may_mask;
 
     if( ( ( crt->key_usage & ~may_mask ) & usage_must ) != usage_must )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     usage_may = usage & may_mask;
 
     if( ( ( crt->key_usage & may_mask ) | usage_may ) != usage_may )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509_crt_check_extended_key_usage( const mbedtls_x509_crt *crt,
@@ -2283,7 +2283,7 @@
 
     /* Extension is not mandatory, absent means no restriction */
     if( ( crt->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE ) == 0 )
-        return( 0 );
+        return 0 ;
 
     /*
      * Look for the requested usage (or wildcard ANY) in our list
@@ -2295,14 +2295,14 @@
         if( cur_oid->len == usage_len &&
             memcmp( cur_oid->p, usage_oid, usage_len ) == 0 )
         {
-            return( 0 );
+            return 0 ;
         }
 
         if( MBEDTLS_OID_CMP( MBEDTLS_OID_ANY_EXTENDED_KEY_USAGE, cur_oid ) == 0 )
-            return( 0 );
+            return 0 ;
     }
 
-    return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+    return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 }
 
 #if defined(MBEDTLS_X509_CRL_PARSE_C)
@@ -2318,13 +2318,13 @@
         if( crt->serial.len == cur->serial.len &&
             memcmp( crt->serial.p, cur->serial.p, crt->serial.len ) == 0 )
         {
-            return( 1 );
+            return 1 ;
         }
 
         cur = cur->next;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2340,7 +2340,7 @@
     const mbedtls_md_info_t *md_info;
 
     if( ca == NULL )
-        return( flags );
+        return flags ;
 
     while( crl_list != NULL )
     {
@@ -2410,7 +2410,7 @@
         crl_list = crl_list->next;
     }
 
-    return( flags );
+    return flags ;
 }
 #endif /* MBEDTLS_X509_CRL_PARSE_C */
 
@@ -2430,29 +2430,29 @@
 
     /* Note: hash errors can happen only after an internal error */
     if( mbedtls_md( md_info, child->tbs.p, child->tbs.len, hash ) != 0 )
-        return( -1 );
+        return -1 ;
 #else
     psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
     psa_algorithm_t hash_alg = mbedtls_psa_translate_md( child->sig_md );
 
     if( psa_hash_setup( &hash_operation, hash_alg ) != PSA_SUCCESS )
-        return( -1 );
+        return -1 ;
 
     if( psa_hash_update( &hash_operation, child->tbs.p, child->tbs.len )
         != PSA_SUCCESS )
     {
-        return( -1 );
+        return -1 ;
     }
 
     if( psa_hash_finish( &hash_operation, hash, sizeof( hash ), &hash_len )
         != PSA_SUCCESS )
     {
-        return( -1 );
+        return -1 ;
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
     /* Skip expensive computation on obvious mismatch */
     if( ! mbedtls_pk_can_do( &parent->pk, child->sig_pk ) )
-        return( -1 );
+        return -1 ;
 
 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
     if( rs_ctx != NULL && child->sig_pk == MBEDTLS_PK_ECDSA )
@@ -2484,7 +2484,7 @@
 
     /* Parent must be the issuer */
     if( x509_name_cmp( &child->issuer, &parent->subject ) != 0 )
-        return( -1 );
+        return -1 ;
 
     /* Parent must have the basicConstraints CA bit set as a general rule */
     need_ca_bit = 1;
@@ -2494,15 +2494,15 @@
         need_ca_bit = 0;
 
     if( need_ca_bit && ! parent->ca_istrue )
-        return( -1 );
+        return -1 ;
 
     if( need_ca_bit &&
         mbedtls_x509_crt_check_key_usage( parent, MBEDTLS_X509_KU_KEY_CERT_SIGN ) != 0 )
     {
-        return( -1 );
+        return -1 ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2611,7 +2611,7 @@
             rs_ctx->fallback_parent = fallback_parent;
             rs_ctx->fallback_signature_is_good = fallback_signature_is_good;
 
-            return( ret );
+            return ret ;
         }
 #else
         (void) ret;
@@ -2646,7 +2646,7 @@
         *r_signature_is_good = fallback_signature_is_good;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2708,7 +2708,7 @@
         {
             /* save state */
             rs_ctx->parent_is_trusted = *parent_is_trusted;
-            return( ret );
+            return ret ;
         }
 #else
         (void) ret;
@@ -2729,7 +2729,7 @@
         *signature_is_good = 0;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -2746,7 +2746,7 @@
 
     /* must be self-issued */
     if( x509_name_cmp( &crt->issuer, &crt->subject ) != 0 )
-        return( -1 );
+        return -1 ;
 
     /* look for an exact match with trusted cert */
     for( cur = trust_ca; cur != NULL; cur = cur->next )
@@ -2754,12 +2754,12 @@
         if( crt->raw.len == cur->raw.len &&
             memcmp( crt->raw.p, cur->raw.p, crt->raw.len ) == 0 )
         {
-            return( 0 );
+            return 0 ;
         }
     }
 
     /* too bad */
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -2864,7 +2864,7 @@
 
         /* Stop here for trusted roots (but not for trusted EE certs) */
         if( child_is_trusted )
-            return( 0 );
+            return 0 ;
 
         /* Check signature algorithm: MD & PK algs */
         if( x509_profile_check_md_alg( profile, child->sig_md ) != 0 )
@@ -2877,7 +2877,7 @@
         if( ver_chain->len == 1 &&
             x509_crt_check_ee_locally_trusted( child, trust_ca ) == 0 )
         {
-            return( 0 );
+            return 0 ;
         }
 
 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
@@ -2895,7 +2895,7 @@
 
             ret = f_ca_cb( p_ca_cb, child, &ver_chain->trust_ca_cb_result );
             if( ret != 0 )
-                return( MBEDTLS_ERR_X509_FATAL_ERROR );
+                return MBEDTLS_ERR_X509_FATAL_ERROR ;
 
             cur_trust_ca = ver_chain->trust_ca_cb_result;
         }
@@ -2920,7 +2920,7 @@
             rs_ctx->self_cnt = self_cnt;
             rs_ctx->ver_chain = *ver_chain; /* struct copy */
 
-            return( ret );
+            return ret ;
         }
 #else
         (void) ret;
@@ -2930,7 +2930,7 @@
         if( parent == NULL )
         {
             *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
-            return( 0 );
+            return 0 ;
         }
 
         /* Count intermediate self-issued (not necessarily self-signed) certs.
@@ -2948,7 +2948,7 @@
             ver_chain->len > MBEDTLS_X509_MAX_INTERMEDIATE_CA )
         {
             /* return immediately to avoid overflow the chain array */
-            return( MBEDTLS_ERR_X509_FATAL_ERROR );
+            return MBEDTLS_ERR_X509_FATAL_ERROR ;
         }
 
         /* signature was checked while searching parent */
@@ -2984,16 +2984,16 @@
     if( name->len == cn_len &&
         x509_memcasecmp( cn, name->p, cn_len ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
     /* try wildcard match */
     if( x509_check_wildcard( cn, name ) == 0 )
     {
-        return( 0 );
+        return 0 ;
     }
 
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -3007,12 +3007,12 @@
 
     /* dNSName */
     if( san_type == MBEDTLS_X509_SAN_DNS_NAME )
-        return( x509_crt_check_cn( name, cn, cn_len ) );
+        return x509_crt_check_cn( name, cn, cn_len ) ;
 
     /* (We may handle other types here later.) */
 
     /* Unrecognized type */
-    return( -1 );
+    return -1 ;
 }
 
 /*
@@ -3074,12 +3074,12 @@
 
         if( NULL != f_vrfy )
             if( ( ret = f_vrfy( p_vrfy, cur->crt, (int) i-1, &cur_flags ) ) != 0 )
-                return( ret );
+                return ret ;
 
         *flags |= cur_flags;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -3174,13 +3174,13 @@
     if( ret != 0 )
     {
         *flags = (uint32_t) -1;
-        return( ret );
+        return ret ;
     }
 
     if( *flags != 0 )
-        return( MBEDTLS_ERR_X509_CERT_VERIFY_FAILED );
+        return MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ;
 
-    return( 0 );
+    return 0 ;
 }
 
 
diff --git a/library/x509_csr.c b/library/x509_csr.c
index 25069b2..bdcc200 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -70,13 +70,13 @@
         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
         {
             *ver = 0;
-            return( 0 );
+            return 0 ;
         }
 
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION, ret ) ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -96,7 +96,7 @@
      * Check for valid input
      */
     if( csr == NULL || buf == NULL || buflen == 0 )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     mbedtls_x509_csr_init( csr );
 
@@ -106,7 +106,7 @@
     p = mbedtls_calloc( 1, len = buflen );
 
     if( p == NULL )
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return MBEDTLS_ERR_X509_ALLOC_FAILED ;
 
     memcpy( p, buf, buflen );
 
@@ -125,7 +125,7 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( MBEDTLS_ERR_X509_INVALID_FORMAT );
+        return MBEDTLS_ERR_X509_INVALID_FORMAT ;
     }
 
     if( len != (size_t) ( end - p ) )
@@ -144,7 +144,7 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     end = p + len;
@@ -156,13 +156,13 @@
     if( ( ret = x509_csr_get_version( &p, end, &csr->version ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( ret );
+        return ret ;
     }
 
     if( csr->version != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
+        return MBEDTLS_ERR_X509_UNKNOWN_VERSION ;
     }
 
     csr->version++;
@@ -176,13 +176,13 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     if( ( ret = mbedtls_x509_get_name( &p, p + len, &csr->subject ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( ret );
+        return ret ;
     }
 
     csr->subject_raw.len = p - csr->subject_raw.p;
@@ -193,7 +193,7 @@
     if( ( ret = mbedtls_pk_parse_subpubkey( &p, end, &csr->pk ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( ret );
+        return ret ;
     }
 
     /*
@@ -210,7 +210,7 @@
             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
+        return MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) ;
     }
 
     p += len;
@@ -224,7 +224,7 @@
     if( ( ret = mbedtls_x509_get_alg( &p, end, &csr->sig_oid, &sig_params ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = mbedtls_x509_get_sig_alg( &csr->sig_oid, &sig_params,
@@ -232,13 +232,13 @@
                                   &csr->sig_opts ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG );
+        return MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG ;
     }
 
     if( ( ret = mbedtls_x509_get_sig( &p, end, &csr->sig ) ) != 0 )
     {
         mbedtls_x509_csr_free( csr );
-        return( ret );
+        return ret ;
     }
 
     if( p != end )
@@ -248,7 +248,7 @@
                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
     }
 
-    return( 0 );
+    return 0 ;
 }
 
 /*
@@ -266,7 +266,7 @@
      * Check for valid input
      */
     if( csr == NULL || buf == NULL || buflen == 0 )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
 #if defined(MBEDTLS_PEM_PARSE_C)
     /* Avoid calling mbedtls_pem_read_buffer() on non-null-terminated string */
@@ -295,10 +295,10 @@
 
         mbedtls_pem_free( &pem );
         if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
-            return( ret );
+            return ret ;
     }
 #endif /* MBEDTLS_PEM_PARSE_C */
-    return( mbedtls_x509_csr_parse_der( csr, buf, buflen ) );
+    return mbedtls_x509_csr_parse_der( csr, buf, buflen ) ;
 }
 
 #if defined(MBEDTLS_FS_IO)
@@ -312,14 +312,14 @@
     unsigned char *buf;
 
     if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_x509_csr_parse( csr, buf, n );
 
     mbedtls_platform_zeroize( buf, n );
     mbedtls_free( buf );
 
-    return( ret );
+    return ret ;
 }
 #endif /* MBEDTLS_FS_IO */
 
@@ -359,7 +359,7 @@
     if( ( ret = mbedtls_x509_key_size_helper( key_size_str, BEFORE_COLON,
                                       mbedtls_pk_get_name( &csr->pk ) ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     ret = mbedtls_snprintf( p, n, "\n%s%-" BC "s: %d bits\n", prefix, key_size_str,
diff --git a/library/x509write_crt.c b/library/x509write_crt.c
index c8169f1..d0514a9 100644
--- a/library/x509write_crt.c
+++ b/library/x509write_crt.c
@@ -101,9 +101,9 @@
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
     if( ( ret = mbedtls_mpi_copy( &ctx->serial, serial ) ) != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509write_crt_set_validity( mbedtls_x509write_cert *ctx,
@@ -113,14 +113,14 @@
     if( strlen( not_before ) != MBEDTLS_X509_RFC5280_UTC_TIME_LEN - 1 ||
         strlen( not_after )  != MBEDTLS_X509_RFC5280_UTC_TIME_LEN - 1 )
     {
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
     }
     strncpy( ctx->not_before, not_before, MBEDTLS_X509_RFC5280_UTC_TIME_LEN );
     strncpy( ctx->not_after , not_after , MBEDTLS_X509_RFC5280_UTC_TIME_LEN );
     ctx->not_before[MBEDTLS_X509_RFC5280_UTC_TIME_LEN - 1] = 'Z';
     ctx->not_after[MBEDTLS_X509_RFC5280_UTC_TIME_LEN - 1] = 'Z';
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509write_crt_set_extension( mbedtls_x509write_cert *ctx,
@@ -143,7 +143,7 @@
     memset( buf, 0, sizeof(buf) );
 
     if( is_ca && max_pathlen > 127 )
-        return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA ;
 
     if( is_ca )
     {
@@ -181,7 +181,7 @@
     ret = mbedtls_sha1( buf + sizeof( buf ) - len, len,
                             buf + sizeof( buf ) - 20 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
     c = buf + sizeof( buf ) - 20;
     len = 20;
 
@@ -209,7 +209,7 @@
     ret = mbedtls_sha1( buf + sizeof( buf ) - len, len,
                             buf + sizeof( buf ) - 20 );
     if( ret != 0 )
-        return( ret );
+        return ret ;
     c = buf + sizeof( buf ) - 20;
     len = 20;
 
@@ -248,7 +248,7 @@
 
     /* Check that nothing other than the allowed flags is set */
     if( ( key_usage & ~allowed_bits ) != 0 )
-        return( MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE );
+        return MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE ;
 
     c = buf + 5;
     ku[0] = (unsigned char)( key_usage      );
@@ -256,17 +256,17 @@
     ret = mbedtls_asn1_write_named_bitstring( &c, buf, ku, 9 );
 
     if( ret < 0 )
-        return( ret );
+        return ret ;
     else if( ret < 3 || ret > 5 )
-        return( MBEDTLS_ERR_X509_INVALID_FORMAT );
+        return MBEDTLS_ERR_X509_INVALID_FORMAT ;
 
     ret = mbedtls_x509write_crt_set_extension( ctx, MBEDTLS_OID_KEY_USAGE,
                                    MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ),
                                    1, c, (size_t)ret );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509write_crt_set_ns_cert_type( mbedtls_x509write_cert *ctx,
@@ -280,15 +280,15 @@
 
     ret = mbedtls_asn1_write_named_bitstring( &c, buf, &ns_cert_type, 8 );
     if( ret < 3 || ret > 4 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_x509write_crt_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE,
                                    MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ),
                                    0, c, (size_t)ret );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int x509_write_time( unsigned char **p, unsigned char *start,
@@ -319,7 +319,7 @@
                                              MBEDTLS_ASN1_GENERALIZED_TIME ) );
     }
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_x509write_crt_der( mbedtls_x509write_cert *ctx,
@@ -351,12 +351,12 @@
     else if( mbedtls_pk_can_do( ctx->issuer_key, MBEDTLS_PK_ECDSA ) )
         pk_alg = MBEDTLS_PK_ECDSA;
     else
-        return( MBEDTLS_ERR_X509_INVALID_ALG );
+        return MBEDTLS_ERR_X509_INVALID_ALG ;
 
     if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
                                           &sig_oid, &sig_oid_len ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /*
@@ -470,14 +470,14 @@
     if( ( ret = mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c,
                             len, hash ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = mbedtls_pk_sign( ctx->issuer_key, ctx->md_alg,
                                  hash, 0, sig, sizeof( sig ), &sig_len,
                                  f_rng, p_rng ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /* Move CRT to the front of the buffer to have space
@@ -509,7 +509,7 @@
                                                  MBEDTLS_ASN1_CONSTRUCTED |
                                                  MBEDTLS_ASN1_SEQUENCE ) );
 
-    return( (int) len );
+    return (int) len ;
 }
 
 #define PEM_BEGIN_CRT           "-----BEGIN CERTIFICATE-----\n"
@@ -527,17 +527,17 @@
     if( ( ret = mbedtls_x509write_crt_der( crt, buf, size,
                                    f_rng, p_rng ) ) < 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CRT, PEM_END_CRT,
                                           buf + size - ret, ret,
                                           buf, size, &olen ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PEM_WRITE_C */
 
diff --git a/library/x509write_csr.c b/library/x509write_csr.c
index 555f296..0e18dae 100644
--- a/library/x509write_csr.c
+++ b/library/x509write_csr.c
@@ -100,15 +100,15 @@
 
     ret = mbedtls_asn1_write_named_bitstring( &c, buf, &key_usage, 8 );
     if( ret < 3 || ret > 4 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_KEY_USAGE,
                                        MBEDTLS_OID_SIZE( MBEDTLS_OID_KEY_USAGE ),
                                        0, c, (size_t)ret );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 int mbedtls_x509write_csr_set_ns_cert_type( mbedtls_x509write_csr *ctx,
@@ -122,15 +122,15 @@
 
     ret = mbedtls_asn1_write_named_bitstring( &c, buf, &ns_cert_type, 8 );
     if( ret < 3 || ret > 4 )
-        return( ret );
+        return ret ;
 
     ret = mbedtls_x509write_csr_set_extension( ctx, MBEDTLS_OID_NS_CERT_TYPE,
                                        MBEDTLS_OID_SIZE( MBEDTLS_OID_NS_CERT_TYPE ),
                                        0, c, (size_t)ret );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 
-    return( 0 );
+    return 0 ;
 }
 
 static int x509write_csr_der_internal( mbedtls_x509write_csr *ctx,
@@ -220,26 +220,26 @@
      */
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( psa_hash_setup( &hash_operation, hash_alg ) != PSA_SUCCESS )
-        return( MBEDTLS_ERR_X509_FATAL_ERROR );
+        return MBEDTLS_ERR_X509_FATAL_ERROR ;
 
     if( psa_hash_update( &hash_operation, c, len ) != PSA_SUCCESS )
-        return( MBEDTLS_ERR_X509_FATAL_ERROR );
+        return MBEDTLS_ERR_X509_FATAL_ERROR ;
 
     if( psa_hash_finish( &hash_operation, hash, sizeof( hash ), &hash_len )
         != PSA_SUCCESS )
     {
-        return( MBEDTLS_ERR_X509_FATAL_ERROR );
+        return MBEDTLS_ERR_X509_FATAL_ERROR ;
     }
 #else /* MBEDTLS_USE_PSA_CRYPTO */
     ret = mbedtls_md( mbedtls_md_info_from_type( ctx->md_alg ), c, len, hash );
     if( ret != 0 )
-        return( ret );
+        return ret ;
 #endif
     if( ( ret = mbedtls_pk_sign( ctx->key, ctx->md_alg, hash, 0,
                                  sig, sig_size, &sig_len,
                                  f_rng, p_rng ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_RSA ) )
@@ -247,12 +247,12 @@
     else if( mbedtls_pk_can_do( ctx->key, MBEDTLS_PK_ECDSA ) )
         pk_alg = MBEDTLS_PK_ECDSA;
     else
-        return( MBEDTLS_ERR_X509_INVALID_ALG );
+        return MBEDTLS_ERR_X509_INVALID_ALG ;
 
     if( ( ret = mbedtls_oid_get_oid_by_sig_alg( pk_alg, ctx->md_alg,
                                               &sig_oid, &sig_oid_len ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     /*
@@ -289,7 +289,7 @@
     /* Zero the unused bytes at the start of buf */
     memset( buf, 0, c2 - buf);
 
-    return( (int) len );
+    return (int) len ;
 }
 
 int mbedtls_x509write_csr_der( mbedtls_x509write_csr *ctx, unsigned char *buf,
@@ -302,7 +302,7 @@
 
     if( ( sig = mbedtls_calloc( 1, MBEDTLS_PK_SIGNATURE_MAX_SIZE ) ) == NULL )
     {
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return MBEDTLS_ERR_X509_ALLOC_FAILED ;
     }
 
     ret = x509write_csr_der_internal( ctx, buf, size,
@@ -311,7 +311,7 @@
 
     mbedtls_free( sig );
 
-    return( ret );
+    return ret ;
 }
 
 #define PEM_BEGIN_CSR           "-----BEGIN CERTIFICATE REQUEST-----\n"
@@ -328,17 +328,17 @@
     if( ( ret = mbedtls_x509write_csr_der( ctx, buf, size,
                                    f_rng, p_rng ) ) < 0 )
     {
-        return( ret );
+        return ret ;
     }
 
     if( ( ret = mbedtls_pem_write_buffer( PEM_BEGIN_CSR, PEM_END_CSR,
                                   buf + size - ret,
                                   ret, buf, size, &olen ) ) != 0 )
     {
-        return( ret );
+        return ret ;
     }
 
-    return( 0 );
+    return 0 ;
 }
 #endif /* MBEDTLS_PEM_WRITE_C */