anchor.diff:          %% Go to state 'start' if server replies with 'HelloRetryRequest'.
           Maybe(maybe_hello_retry_request(ServerHello, State0)),
   
  -        %% TODO: implement validation
  -        %% Maybe(validate_cipher_suite(SelectedCipherSuite, ClientCiphers)),
  -        %% Maybe(validate_key_share(ServerKeyShare, ClientGroups)),
  +        Maybe(validate_cipher_suite(SelectedCipherSuite, ClientCiphers)),
  +        Maybe(validate_server_key_share(ClientGroups, ServerKeyShare)),
   
           %% Get server public key
           {SelectedGroup, ServerPublicKey} = get_server_public_key(ServerKeyShare),
  
positive.code:         %% the client.
          Cipher = Maybe(select_cipher_suite(ClientCiphers, ServerCiphers)),
          Groups = Maybe(select_common_groups(ServerGroups, ClientGroups)),
          Maybe(validate_key_share(ClientGroups, ClientShares)),
  
          {PublicKeyAlgo, SignAlgo, SignHash} = get_certificate_params(Cert),
  
  
negative.code:         false ->
              select_cipher_suite(ClientCiphers, ServerCiphers)
      end.
  
  
  %% RFC 8446 4.1.3 ServerHello
  %% A client which receives a cipher suite that was not offered MUST abort the
  %% handshake with an "illegal_parameter" alert.
  validate_cipher_suite(Cipher, ClientCiphers) ->
      case lists:member(Cipher, ClientCiphers) of
          true ->
              ok;
          false ->
              {error, illegal_parameter}
      end.
  
  
  %% RFC 8446 (TLS 1.3)
  %% TLS 1.3 provides two extensions for indicating which signature
  