diff --git a/include/mbedtls/cmac.h b/include/mbedtls/cmac.h
index 3e02f91..fed337d 100644
--- a/include/mbedtls/cmac.h
+++ b/include/mbedtls/cmac.h
@@ -33,12 +33,12 @@
 #endif
 
 /**
- * \brief          CCM context structure
+ * \brief          CMAC context structure
  */
 typedef struct {
     mbedtls_cipher_context_t cipher_ctx;    /*!< cipher context used */
-    unsigned char* K1;
-    unsigned char* K2;
+    unsigned char* K1; /*!< CMAC Subkey 1 */
+    unsigned char* K2; /*!< CMAC Subkey 2 */
 }
 mbedtls_cmac_context;
 
@@ -52,12 +52,12 @@
 void mbedtls_cmac_init( mbedtls_cmac_context *ctx );
 
 /**
- * \brief           CMAC initialization
+ * \brief           Initialize the CMAC context
  *
  * \param ctx       CMAC context to be initialized
- * \param cipher    cipher to use (a 128-bit block cipher)
+ * \param cipher    cipher to use
  * \param key       encryption key
- * \param keybits   key size in bits (must be acceptable by the cipher)
+ * \param keybits   encryption key size in bits (must be acceptable by the cipher)
  *
  * \return          0 if successful, or a cipher specific error code
  */
@@ -68,20 +68,22 @@
 
 /**
  * \brief           Free a CMAC context and underlying cipher sub-context
+ *                  Securely wipes sub keys and other sensitive data.
  *
  * \param ctx       CMAC context to free
  */
 void mbedtls_cmac_free( mbedtls_cmac_context *ctx );
 
 /**
- * \brief           CMAC generate
+ * \brief           Generate a CMAC tag.
  *
  * \param ctx       CMAC context
  * \param input     buffer holding the input data
  * \param in_len    length of the input data in bytes
  * \param tag       buffer for holding the generated tag
  * \param tag_len   length of the tag to generate in bytes
- *                  must be between 4, 6, 8, 10, 14 or 16
+ *                  Must be 4, 6, 8 if cipher block size is 64
+ *                  Must be 4, 6, 8 0, 14 or 16 if cipher block size is 128
  *
  * \return          0 if successful
  */
@@ -90,47 +92,48 @@
                            unsigned char *tag, size_t tag_len );
 
 /**
- * \brief           CMAC verify
+ * \brief           Verify a CMAC tag.
  *
  * \param ctx       CMAC context
  * \param input     buffer holding the input data
  * \param in_len    length of the input data in bytes
  * \param tag       buffer holding the tag to verify
  * \param tag_len   length of the tag to verify in bytes
- *                  must be 4, 6, 8, 10, 14 or 16
- *
- * \return          0 if successful and authenticated,
+ *                  Must be 4, 6, 8 if cipher block size is 64
+ *                  Must be 4, 6, 8 0, 14 or 16 if cipher block size is 128
+ * \return          0 if successful and authenticated
  *                  MBEDTLS_ERR_CMAC_VERIFY_FAILED if tag does not match
  */
 int mbedtls_cmac_verify( mbedtls_cmac_context *ctx,
                          const unsigned char *input, size_t in_len,
                          const unsigned char *tag, size_t tag_len );
 
+#ifdef MBEDTLS_AES_C
 /**
  * \brief           AES-CMAC-128-PRF
- *  See RFC
+ *                  See RFC 4615 for details
  *
  * \param key       PRF key
  * \param key_len   PRF key length
  * \param input     buffer holding the input data
  * \param in_len    length of the input data in bytes
  * \param tag       buffer holding the tag to verify (16 bytes)
- *                  TODO: update description of tag
  *
  * \return          0 if successful
  */
 int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_len,
                               const unsigned char *input, size_t in_len,
-                              unsigned char *tag );
+                              unsigned char tag[16] );
+#endif /* MBEDTLS_AES_C */
 
-#if defined(MBEDTLS_SELF_TEST) && defined(MBEDTLS_AES_C)
+#if defined(MBEDTLS_SELF_TEST) && ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) )
 /**
  * \brief          Checkup routine
  *
  * \return         0 if successful, or 1 if the test failed
  */
 int mbedtls_cmac_self_test( int verbose );
-#endif /* MBEDTLS_SELF_TEST && MBEDTLS_AES_C */
+#endif /* MBEDTLS_SELF_TEST && ( MBEDTLS_AES_C || MBEDTLS_DES_C ) */
 
 #ifdef __cplusplus
 }
diff --git a/library/cmac.c b/library/cmac.c
index 0de85bc..3d22319 100644
--- a/library/cmac.c
+++ b/library/cmac.c
@@ -73,7 +73,7 @@
  */
 static int cmac_multiply_by_u( unsigned char *output,
                                const unsigned char *input,
-							   size_t blocksize)
+							   size_t blocksize )
 {
 
     const unsigned char R_128 = 0x87;
@@ -84,12 +84,12 @@
 
     starting_index = blocksize -1;
 
-    if(blocksize == 16){
+    if( blocksize == 16 ){
         R_n = R_128;
-    } else if(blocksize == 8) {
+    } else if( blocksize == 8 ) {
         R_n = R_64;
     } else {
-        return MBEDTLS_ERR_CMAC_BAD_INPUT;
+        return( MBEDTLS_ERR_CMAC_BAD_INPUT );
     }
 
 
@@ -113,7 +113,7 @@
 #endif
 
     output[starting_index] ^= R_n & mask;
-    return 0;
+    return( 0 );
 }
 
 /*
@@ -128,7 +128,7 @@
     ret = 0;
     block_size = ctx->cipher_ctx.cipher_info->block_size;
 
-    L = mbedtls_calloc(block_size, sizeof(unsigned char));
+    L = mbedtls_calloc( block_size, sizeof( unsigned char ) );
 
     /* Calculate Ek(0) */
     memset( L, 0, block_size );
@@ -141,15 +141,15 @@
     /*
      * Generate K1 and K2
      */
-    if( ( ret = cmac_multiply_by_u( ctx->K1, L , block_size) ) != 0 )
+    if( ( ret = cmac_multiply_by_u( ctx->K1, L , block_size ) ) != 0 )
         goto exit;
-    if( ( cmac_multiply_by_u( ctx->K2, ctx->K1 , block_size) ) != 0 )
+    if( ( cmac_multiply_by_u( ctx->K2, ctx->K1 , block_size ) ) != 0 )
         goto exit;
 
     exit:
         mbedtls_zeroize( L, sizeof( L ) );
-		free(L);
-        return ret;
+		free( L );
+        return( ret );
 }
 
 /*
@@ -195,8 +195,8 @@
 
     mbedtls_cipher_free( &ctx->cipher_ctx );
 
-    mbedtls_zeroize(ctx->K1, block_size * sizeof( unsigned char ) );
-    mbedtls_zeroize(ctx->K2, block_size * sizeof( unsigned char ) );
+    mbedtls_zeroize( ctx->K1, block_size * sizeof( unsigned char ) );
+    mbedtls_zeroize( ctx->K2, block_size * sizeof( unsigned char ) );
     mbedtls_free( ctx->K1 );
     mbedtls_free( ctx->K2 );
 }
@@ -263,8 +263,8 @@
     ret = 0;
     block_size = ctx->cipher_ctx.cipher_info->block_size;
 
-    state = mbedtls_calloc(block_size,  sizeof(unsigned char) );
-    M_last = mbedtls_calloc(block_size, sizeof(unsigned char) );
+    state = mbedtls_calloc( block_size,  sizeof( unsigned char ) );
+    M_last = mbedtls_calloc( block_size, sizeof( unsigned char ) );
 
     /*
      * Check in_len requirements: SP800-38B A
@@ -302,8 +302,8 @@
     memcpy( tag, state, tag_len );
 
     exit:
-        free(state);
-        free(M_last);
+        free( state );
+        free( M_last );
         return( ret );
 }
 
@@ -322,8 +322,8 @@
     unsigned char i;
     int diff;
 
-    check_tag = mbedtls_calloc(ctx->cipher_ctx.cipher_info->block_size,
-                                sizeof(unsigned char) );
+    check_tag = mbedtls_calloc( ctx->cipher_ctx.cipher_info->block_size,
+                                sizeof( unsigned char ) );
 
     if( ( ret = mbedtls_cmac_generate( ctx, input, in_len,
                                        check_tag, tag_len ) ) != 0 )
@@ -340,24 +340,25 @@
         goto exit;
 
     exit:
-	    free(check_tag);
-        return ret;
+	    free( check_tag );
+        return( ret );
 }
 
+#ifdef MBEDTLS_AES_C
 /*
  * PRF based on CMAC with AES-128
  * See RFC 4615
  */
 int mbedtls_aes_cmac_prf_128( const unsigned char *key, size_t key_length,
                               const unsigned char *input, size_t in_len,
-                              unsigned char *tag )
+                              unsigned char tag[16] )
 {
     int ret;
     mbedtls_cmac_context ctx;
     unsigned char zero_key[16];
     unsigned char int_key[16];
 
-    mbedtls_cmac_init(&ctx);
+    mbedtls_cmac_init(&ctx );
 
     if( key_length == 16 )
     {
@@ -368,7 +369,7 @@
     {
         mbedtls_cmac_context zero_ctx;
 
-        /* Key is AES_CMAC(0, key) */
+        /* Key is AES_CMAC( 0, key ) */
         mbedtls_cmac_init( &zero_ctx );
         memset( zero_key, 0, 16 );
         ret = mbedtls_cmac_setkey( &zero_ctx, MBEDTLS_CIPHER_ID_AES,
@@ -391,11 +392,10 @@
     ret =  mbedtls_cmac_generate( &ctx, input, in_len, tag, 16 );
 
     exit:
-	     mbedtls_cmac_free(&ctx);
+	     mbedtls_cmac_free( &ctx );
 	     return( ret );
-
-
 }
+#endif /* MBEDTLS_AES_C */
 
 #ifdef MBEDTLS_SELF_TEST
 /*
@@ -647,7 +647,7 @@
 };
 #endif /* MBEDTLS_AES_C */
 
-int test_cmac_with_cipher(int verbose,
+int test_cmac_with_cipher( int verbose,
 		                  const unsigned char* testname,
 		                  const unsigned char* key,
 		                  int keybits,
@@ -656,7 +656,7 @@
 						  const unsigned char* subkeys,
 						  const unsigned char* expected_result,
 						  mbedtls_cipher_id_t cipher_id,
-						  int block_size)
+						  int block_size )
 {
 	const int num_tests = 4;
 	mbedtls_cmac_context ctx;
@@ -743,7 +743,7 @@
     int ret;
     
 #ifdef MBEDTLS_AES_C
-    test_cmac_with_cipher(verbose,
+    test_cmac_with_cipher( verbose,
                              "AES 128",
                               aes_128_key,
                               128,
@@ -754,7 +754,7 @@
                               MBEDTLS_CIPHER_ID_AES,
                               AES_BLOCK_SIZE );
 
-    test_cmac_with_cipher(verbose,
+    test_cmac_with_cipher( verbose,
                              "AES 192",
                               aes_192_key,
                               192,
@@ -765,7 +765,7 @@
                               MBEDTLS_CIPHER_ID_AES,
                               AES_BLOCK_SIZE );
 
-    test_cmac_with_cipher(verbose,
+    test_cmac_with_cipher ( verbose,
                              "AES 256",
                               aes_256_key,
                               256,
@@ -778,7 +778,7 @@
 #endif /* MBEDTLS_AES_C */
 
 #ifdef MBEDTLS_DES_C
-    test_cmac_with_cipher(verbose,
+    test_cmac_with_cipher( verbose,
                              "3DES 2 key",
                               des3_2key_key,
                               192,
@@ -789,7 +789,7 @@
                               MBEDTLS_CIPHER_ID_3DES,
                               DES3_BLOCK_SIZE );
 
-    test_cmac_with_cipher(verbose,
+    test_cmac_with_cipher( verbose,
                              "3DES 3 key",
                               des3_3key_key,
                               192,