diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 083814c..7f233cd 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -47,6 +47,8 @@
 #include "mbedtls/platform_util.h"
 #include "mbedtls/version.h"
 
+#include "ssl_invasive.h"
+
 #include <string.h>
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
@@ -1064,6 +1066,32 @@
     return( 0 );
 }
 
+#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \
+    ( defined(MBEDTLS_SSL_PROTO_TLS1) ||        \
+      defined(MBEDTLS_SSL_PROTO_TLS1_1) ||      \
+      defined(MBEDTLS_SSL_PROTO_TLS1_2) )
+/*
+ * Compute HMAC of variable-length data with constant flow.
+ */
+int mbedtls_ssl_cf_hmac(
+        mbedtls_md_context_t *ctx,
+        const unsigned char *add_data, size_t add_data_len,
+        const unsigned char *data, size_t data_len_secret,
+        size_t min_data_len, size_t max_data_len,
+        unsigned char *output )
+{
+    /* WORK IN PROGRESS - THIS IS NOT CONSTANT FLOW AT ALL */
+    (void) min_data_len;
+    (void) max_data_len;
+    mbedtls_md_hmac_update( ctx, add_data, add_data_len );
+    mbedtls_md_hmac_update( ctx, data, data_len_secret );
+    mbedtls_md_hmac_finish( ctx, output );
+    mbedtls_md_hmac_reset( ctx );
+
+    return( 0 );
+}
+#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC && TLS 1.0-1.2 */
+
 int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
                              mbedtls_ssl_transform *transform,
                              mbedtls_record *rec )