diff --git a/library/ccm.c b/library/ccm.c
index 78d04b2..01e58b0 100644
--- a/library/ccm.c
+++ b/library/ccm.c
@@ -326,7 +326,7 @@
     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
     CCM_VALIDATE_RET( length == 0 || input != NULL );
     CCM_VALIDATE_RET( length == 0 || output != NULL );
-    CCM_VALIDATE_RET( tag != NULL );
+    CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
     return( ccm_auth_crypt( ctx, CCM_ENCRYPT, length, iv, iv_len,
                             add, add_len, input, output, tag, tag_len ) );
 }
@@ -342,7 +342,7 @@
     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
     CCM_VALIDATE_RET( length == 0 || input != NULL );
     CCM_VALIDATE_RET( length == 0 || output != NULL );
-    CCM_VALIDATE_RET( tag != NULL );
+    CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
     if( tag_len == 0 )
         return( MBEDTLS_ERR_CCM_BAD_INPUT );
 
@@ -369,7 +369,7 @@
     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
     CCM_VALIDATE_RET( length == 0 || input != NULL );
     CCM_VALIDATE_RET( length == 0 || output != NULL );
-    CCM_VALIDATE_RET( tag != NULL );
+    CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
 
     if( ( ret = ccm_auth_crypt( ctx, CCM_DECRYPT, length,
                                 iv, iv_len, add, add_len,
@@ -402,7 +402,7 @@
     CCM_VALIDATE_RET( add_len == 0 || add != NULL );
     CCM_VALIDATE_RET( length == 0 || input != NULL );
     CCM_VALIDATE_RET( length == 0 || output != NULL );
-    CCM_VALIDATE_RET( tag != NULL );
+    CCM_VALIDATE_RET( tag_len == 0 || tag != NULL );
 
     if( tag_len == 0 )
         return( MBEDTLS_ERR_CCM_BAD_INPUT );