anchor.diff:  %% for groups not listed in the client's "supported_groups" extension.
   %% Servers MAY check for violations of these rules and abort the
   %% handshake with an "illegal_parameter" alert if one is violated.
  -validate_key_share(_ ,[]) ->
  +validate_client_key_share(_ ,[]) ->
       ok;
  -validate_key_share([], _) ->
  +validate_client_key_share([], _) ->
       {error, illegal_parameter};
  -validate_key_share([G|ClientGroups], [{_, G, _}|ClientShares]) ->
  -    validate_key_share(ClientGroups, ClientShares);
  -validate_key_share([_|ClientGroups], [_|_] = ClientShares) ->
  -    validate_key_share(ClientGroups, ClientShares).
  +validate_client_key_share([G|ClientGroups], [{_, G, _}|ClientShares]) ->
  +    validate_client_key_share(ClientGroups, ClientShares);
  +validate_client_key_share([_|ClientGroups], [_|_] = ClientShares) ->
  +    validate_client_key_share(ClientGroups, ClientShares).
  +
  +
  +%% Verify that selected group is offered by the client.
  +validate_server_key_share([G|_ClientGroups], {_, G, _}) ->
  +    ok;
  +validate_server_key_share([_|ClientGroups], {_, _, _} = ServerKeyShare) ->
  +    validate_server_key_share(ClientGroups, ServerKeyShare).
   
   
   get_client_public_key([Group|_] = Groups, ClientShares) ->
  
positive.code:         %% Go to state 'start' if server replies with 'HelloRetryRequest'.
          Maybe(maybe_hello_retry_request(ServerHello, State0)),
  
          %% TODO: implement validation
          %% Maybe(validate_cipher_suite(SelectedCipherSuite, ClientCiphers)),
          %% Maybe(validate_key_share(ServerKeyShare, ClientGroups)),
  
          %% Get server public key
          {SelectedGroup, ServerPublicKey} = get_server_public_key(ServerKeyShare),
  
negative.code:         %% the client.
          Cipher = Maybe(select_cipher_suite(ClientCiphers, ServerCiphers)),
          Groups = Maybe(select_common_groups(ServerGroups, ClientGroups)),
          Maybe(validate_client_key_share(ClientGroups, ClientShares)),
  
          {PublicKeyAlgo, SignAlgo, SignHash} = get_certificate_params(Cert),
  
  