anchor.diff:      L.
   
   
  -verify_signature_algorithm(#state{session = #session{sign_alg = SignatureScheme}} = State,
  -                           #certificate_verify_1_3{algorithm = SignatureScheme2}) ->
  -    %% TODO
  -    ok.
  +%% If sent by a client, the signature algorithm used in the signature
  +%% MUST be one of those present in the supported_signature_algorithms
  +%% field of the "signature_algorithms" extension in the
  +%% CertificateRequest message.
  +verify_signature_algorithm(#state{ssl_options =
  +                                      #ssl_options{
  +                                         signature_algs = ServerSignAlgs}} = State0,
  +                           #certificate_verify_1_3{algorithm = ClientSignAlg}) ->
  +    case lists:member(ClientSignAlg, ServerSignAlgs) of
  +        true ->
  +            ok;
  +        false ->
  +            State1 = calculate_traffic_secrets(State0),
  +            State = ssl_record:step_encryption_state(State1),
  +            {error, {{handshake_failure,
  +                      "CertificateVerify has a not supported signature algorithm"}, State}}
  +    end.
   
   
   verify_certificate_verify(#state{connection_states = ConnectionStates,
  -                          handshake_env =
  -                              #handshake_env{
  -                                 public_key_info = PublicKeyInfo,
  -                                 tls_handshake_history = HHistory}} = State0,
  -                   #certificate_verify_1_3{
  -                      algorithm = SignatureScheme,
  -                      signature = Signature}) ->
  +                                 handshake_env =
  +                                     #handshake_env{
  +                                        public_key_info = PublicKeyInfo,
  +                                        tls_handshake_history = HHistory}} = State0,
  +                          #certificate_verify_1_3{
  +                             algorithm = SignatureScheme,
  +                             signature = Signature}) ->
       #{security_parameters := SecParamsR} =
           ssl_record:pending_connection_state(ConnectionStates, write),
       #security_parameters{prf_algorithm = HKDFAlgo} = SecParamsR,
  
positive.code:                                      SslOptions#ssl_options.crl_check, CRLDbHandle, CertPath),
          Options = [{max_path_length, SslOptions#ssl_options.depth},
                     {verify_fun, ValidationFunAndState}],
  	case public_key:pkix_path_validation(TrustedCert, CertPath, Options) of
  	    {ok, {PublicKeyInfo,_}} ->
  		{ok, {PeerCert, PublicKeyInfo}};
  	    {error, Reason} ->
  		ssl_handshake:handle_path_validation_error(Reason, PeerCert, ChainCerts,
                                                             SslOptions, Options,
                                                             CertDbHandle, CertDbRef)
  	end
      catch
  	error:{badmatch,{asn1, Asn1Reason}} ->
  	    %% ASN-1 decode of certificate somehow failed
              {error, {certificate_unknown, {failed_to_decode_certificate, Asn1Reason}}};
          error:OtherReason ->
              {error, {internal_error, {unexpected_error, OtherReason}}}
  
negative.code:             State1 = calculate_traffic_secrets(State0),
              State = ssl_record:step_encryption_state(State1),
              {error, {Reason, State}};
          #alert{} = Alert ->
              State1 = calculate_traffic_secrets(State0),
              State = ssl_record:step_encryption_state(State1),
  