diff --git a/include/mbedtls/cmac.h b/include/mbedtls/cmac.h
index ddacb21..ceeb20a 100644
--- a/include/mbedtls/cmac.h
+++ b/include/mbedtls/cmac.h
@@ -1,9 +1,10 @@
 /**
  * \file cmac.h
  *
- * \brief The CMAC Mode for Authentication
+ * \brief Cipher-based Message Authentication Code (CMAC) Mode for
+ *        Authentication
  *
- *  Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
+ *  Copyright (C) 2015-2016, ARM Limited, All Rights Reserved
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -23,110 +24,131 @@
 #ifndef MBEDTLS_CMAC_H
 #define MBEDTLS_CMAC_H
 
-#include "cipher.h"
-
-#define MBEDTLS_ERR_CMAC_BAD_INPUT      -0x0011 /**< Bad input parameters to function. */
-#define MBEDTLS_ERR_CMAC_VERIFY_FAILED  -0x0013 /**< Verification failed. */
-#define MBEDTLS_ERR_CMAC_ALLOC_FAILED   -0x0015 /**< Failed to allocate memory */
-
+#include "mbedtls/cipher.h"
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
+#if defined(MBEDTLS_AES_C)
+#define MBEDTLS_CIPHER_BLKSIZE_MAX_SIZE     16  /* longest known is AES */
+#else
+#define MBEDTLS_CIPHER_BLKSIZE_MAX_SIZE     8   /* longest known is 3DES */
+#endif
+
 /**
  * \brief          CMAC context structure
  */
-typedef struct {
-    mbedtls_cipher_context_t cipher_ctx;    /*!< cipher context used */
-    unsigned char* K1; /*!< CMAC Subkey 1 */
-    unsigned char* K2; /*!< CMAC Subkey 2 */
+typedef struct mbedtls_cmac_context_t {
+
+    /** Internal state of the CMAC algorithm  */
+    unsigned char       state[MBEDTLS_CIPHER_BLKSIZE_MAX_SIZE];
+
+    /** Unprocessed data - either data that was not block aligned and is still 
+     *  pending to be processed, or the final block */
+    unsigned char       unprocessed_block[MBEDTLS_CIPHER_BLKSIZE_MAX_SIZE];
+
+    /** Length of data pending to be processed */
+    size_t              unprocessed_len;
+
+    /** Flag to indicate if the last block needs padding */
+    int                 padding_flag;
 }
-mbedtls_cmac_context;
+mbedtls_cmac_context_t;
 
 /**
- * \brief           Initialize CMAC context (just makes references valid)
- *                  Makes the context ready for mbedtls_cmac_setkey() or
- *                  mbedtls_cmac_free().
+ * \brief               Set the CMAC key and prepare to authenticate the input
+ *                      data.
+ *                      Should be called with an initialised cipher context.
  *
- * \param ctx       CMAC context to initialize
+ * \param ctx           Cipher context
+ * \param key           CMAC key
+ * \param keybits       length of the CMAC key in bits
+ *                      (must be acceptable by the cipher)
+ *
+ * \return              0 if successful, or a cipher specific error code
  */
-void mbedtls_cmac_init( mbedtls_cmac_context *ctx );
+int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx,
+                                const unsigned char *key, size_t keylen );
 
 /**
- * \brief           Initialize the CMAC context
+ * \brief               Generic CMAC process buffer.
+ *                      Called between mbedtls_cipher_cmac_starts() or
+ *                      mbedtls_cipher_cmac_reset() and
+ *                      mbedtls_cipher_cmac_finish().
+ *                      May be called repeatedly.
  *
- * \param ctx       CMAC context to be initialized
- * \param cipher    cipher to use.  
-                    Cipher block size must be 8 bytes or 16 bytes.
- * \param key       encryption key
- * \param keybits   encryption key size in bits (must be acceptable by the cipher)
+ * \param ctx           CMAC context
+ * \param input         buffer holding the  data
+ * \param ilen          length of the input data
  *
- * \return          0 if successful, or a cipher specific error code
+ * \returns             0 on success, MBEDTLS_ERR_MD_BAD_INPUT_DATA if parameter
+ *                      verification fails.
  */
-int mbedtls_cmac_setkey( mbedtls_cmac_context *ctx,
-                         mbedtls_cipher_id_t cipher,
-                         const unsigned char *key,
-                         unsigned int keybits );
+int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx,
+                                const unsigned char *input, size_t ilen );
 
 /**
- * \brief           Free a CMAC context and underlying cipher sub-context
- *                  Securely wipes sub keys and other sensitive data.
+ * \brief               Output CMAC.
+ *                      Called after mbedtls_cipher_cmac_update().
+ *                      Usually followed by mbedtls_cipher_cmac_reset(), then
+ *                      mbedtls_cipher_cmac_starts(), or mbedtls_cipher_free().
  *
- * \param ctx       CMAC context to free
+ * \param ctx           CMAC context
+ * \param output        Generic CMAC checksum result
+ *
+ * \returns             0 on success, MBEDTLS_ERR_MD_BAD_INPUT_DATA if parameter
+ *                      verification fails.
  */
-void mbedtls_cmac_free( mbedtls_cmac_context *ctx );
+int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx,
+                                unsigned char *output );
 
 /**
- * \brief           Generate a CMAC tag.
+ * \brief               Prepare to authenticate a new message with the same key.
+ *                      Called after mbedtls_cipher_cmac_finish() and before
+ *                      mbedtls_cipher_cmac_update().
  *
- * \param ctx       CMAC context
- * \param input     buffer holding the input data
- * \param in_len    length of the input data in bytes
- * \param tag       buffer for holding the generated tag
- * \param tag_len   length of the tag to generate in bytes
- *                  Must be 2, 4, 6, 8 if cipher block size is 8
- *                  Must be 2, 4, 6, 8, 10, 12, 14 or 16 if cipher block size is 16
+ * \param ctx           CMAC context to be reset
  *
- * \return          0 if successful
+ * \returns             0 on success, MBEDTLS_ERR_MD_BAD_INPUT_DATA if parameter
+ *                      verification fails.
  */
-int mbedtls_cmac_generate( mbedtls_cmac_context *ctx,
-                           const unsigned char *input, size_t in_len,
-                           unsigned char *tag, size_t tag_len );
+int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx );
 
 /**
- * \brief           Verify a CMAC tag.
+ * \brief               Output = Generic_CMAC( hmac key, input buffer )
  *
- * \param ctx       CMAC context
- * \param input     buffer holding the input data
- * \param in_len    length of the input data in bytes
- * \param tag       buffer holding the tag to verify
- * \param tag_len   length of the tag to verify in bytes
- *                  Must be 2, 4, 6, 8 if cipher block size is 8
- *                  Must be 2, 4, 6, 8, 10, 12, 14 or 16 if cipher block size is 16
- * \return          0 if successful and authenticated
- *                  MBEDTLS_ERR_CMAC_VERIFY_FAILED if tag does not match
+ * \param cipher_info   message digest info
+ * \param key           CMAC key
+ * \param keylen        length of the CMAC key in bits
+ * \param input         buffer holding the  data
+ * \param ilen          length of the input data
+ * \param output        Generic CMAC-result
+ *
+ * \returns             0 on success, MBEDTLS_ERR_MD_BAD_INPUT_DATA if parameter
+ *                      verification fails.
  */
-int mbedtls_cmac_verify( mbedtls_cmac_context *ctx,
-                         const unsigned char *input, size_t in_len,
-                         const unsigned char *tag, size_t tag_len );
+int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info,
+                         const unsigned char *key, size_t keylen,
+                         const unsigned char *input, size_t ilen,
+                         unsigned char *output );
 
 #ifdef MBEDTLS_AES_C
 /**
  * \brief           AES-CMAC-128-PRF
- *                  See RFC 4615 for details
+ *                  Implementation of (AES-CMAC-PRF-128), as defined in RFC 4615
  *
  * \param key       PRF key
- * \param key_len   PRF key length
+ * \param key_len   PRF key length in bytes
  * \param input     buffer holding the input data
  * \param in_len    length of the input data in bytes
- * \param tag       buffer holding the generated pseudorandom output (16 bytes)
+ * \param output    buffer holding the generated pseudorandom output (16 bytes)
  *
  * \return          0 if successful
  */
 int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_len,
                               const unsigned char *input, size_t in_len,
-                              unsigned char tag[16] );
+                              unsigned char output[16] );
 #endif /* MBEDTLS_AES_C */
 
 #if defined(MBEDTLS_SELF_TEST) && ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) )