diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 45b991b4ca..072ebbe460 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -191,7 +191,6 @@
 
 /* Elliptic Curve Groups (ECDHE) */
 #define MBEDTLS_SSL_IANA_TLS_GROUP_NONE               0
-#define MBEDTLS_SSL_IANA_TLS_GROUP_SECT163K1     0x0001 /* RFC 4492 */
 #define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1     0x0012
 #define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1     0x0013
 #define MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1     0x0014
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index f854ef1dfc..eb828a942b 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -1489,6 +1489,7 @@ static inline int mbedtls_ssl_conf_is_tls13_only( const mbedtls_ssl_config *conf
     }
     return( 0 );
 }
+
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
@@ -1503,8 +1504,43 @@ static inline int mbedtls_ssl_conf_is_tls12_only( const mbedtls_ssl_config *conf
     }
     return( 0 );
 }
+
 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
 
+static inline int mbedtls_ssl_conf_is_tls13_enabled( const mbedtls_ssl_config *conf )
+{
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+    if( conf->min_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
+        conf->max_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
+        conf->min_minor_ver <= MBEDTLS_SSL_MINOR_VERSION_4 &&
+        conf->max_minor_ver >= MBEDTLS_SSL_MINOR_VERSION_4 )
+    {
+        return( 1 );
+    }
+    return( 0 );
+#else
+    ((void) conf);
+    return( 0 );
+#endif
+}
+
+static inline int mbedtls_ssl_conf_is_tls12_enabled( const mbedtls_ssl_config *conf )
+{
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+    if( conf->min_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
+        conf->max_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
+        conf->min_minor_ver <= MBEDTLS_SSL_MINOR_VERSION_3 &&
+        conf->max_minor_ver >= MBEDTLS_SSL_MINOR_VERSION_3 )
+    {
+        return( 1 );
+    }
+    return( 0 );
+#else
+    ((void) conf);
+    return( 0 );
+#endif
+}
+
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
 static inline int mbedtls_ssl_conf_is_hybrid_tls12_tls13( const mbedtls_ssl_config *conf )
 {
@@ -1729,13 +1765,24 @@ static inline const void *mbedtls_ssl_get_groups( const mbedtls_ssl_context *ssl
 /*
  * Helper functions for NamedGroup.
  */
-static inline int mbedtls_ssl_named_group_is_ecdhe( uint16_t named_group )
+static inline int mbedtls_ssl_tls12_named_group_is_ecdhe( uint16_t named_group )
 {
     /*
-     * RFC 4492 section 5.1.1
+     * RFC 8422 section 5.1.1
      */
-    return( named_group >= MBEDTLS_SSL_IANA_TLS_GROUP_SECT163K1 &&
-            named_group < MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048 );
+    return( named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1 ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1   ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1   ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1   ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X25519    ||
+            named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X448 );
 }
 
 static inline int mbedtls_ssl_tls13_named_group_is_ecdhe( uint16_t named_group )
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 69fa39b466..844d5c3d9b 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -7221,10 +7221,7 @@ int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
  *      NamedCurve named_curve_list<2..2^16-1>
  *  } NamedCurveList;
  *
- * RFC8422 and RFC8446 share simillar structure and same extension id. The function
- * only check if the curve/group is supported by library. It does not need check
- * the IANA values. ECP module should check if the group/curve is deprecated or
- * supported.
+ * RFC8422 and RFC8446 share simillar structure and same extension id.
  *
  * DHE groups hasn't been supported yet.
  */
@@ -7260,16 +7257,22 @@ int mbedtls_ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl,
         MBEDTLS_SSL_DEBUG_MSG( 1, ("got supported group(%04x)",*group_list));
 
 #if defined(MBEDTLS_ECP_C)
-        const mbedtls_ecp_curve_info *curve_info;
-        curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
-        if( curve_info != NULL )
+        if( ( mbedtls_ssl_conf_is_tls13_enabled(ssl->conf) &&
+              mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) ||
+            ( mbedtls_ssl_conf_is_tls12_enabled(ssl->conf) &&
+              mbedtls_ssl_tls12_named_group_is_ecdhe( *group_list ) ) )
         {
-            MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
-            MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
-            p += 2;
-            MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
-                                   curve_info->name, *group_list ) );
-            continue;
+            const mbedtls_ecp_curve_info *curve_info;
+            curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
+            if( curve_info != NULL )
+            {
+                MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
+                MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
+                p += 2;
+                MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
+                                    curve_info->name, *group_list ) );
+                continue;
+            }
         }
 #endif /* MBEDTLS_ECP_C */
         /* Add DHE groups here */