Thanks. It's working now. Timings soon. The first paragraph in the man page for EVP_DigestSign and friends says: The EVP signature routines are a high level interface to digital signatures. Input data is digested first before the signing takes place. Down at the bottom, under CMAC, it says: Will ignore any digest provided. So I assume the first paragraph doesn't apply for CMAC. -- These are my opinions. I hate spam.