diff --git a/aes_operation.cpp b/aes_operation.cpp
index 73549a8..7c62d74 100644
--- a/aes_operation.cpp
+++ b/aes_operation.cpp
@@ -30,6 +30,10 @@
 
 namespace keymaster {
 
+static const size_t GCM_NONCE_SIZE = 12;
+static const size_t GCM_MAX_TAG_LENGTH = 16;
+static const size_t GCM_MIN_TAG_LENGTH = 12;
+
 Operation* AesOperationFactory::CreateOperation(const Key& key,
                                                 const AuthorizationSet& begin_params,
                                                 keymaster_error_t* error) {
@@ -50,30 +54,38 @@
     if (!begin_params.GetTagValue(TAG_BLOCK_MODE, &block_mode)) {
         LOG_E("%d block modes specified in begin params", begin_params.GetTagCount(TAG_BLOCK_MODE));
         *error = KM_ERROR_UNSUPPORTED_BLOCK_MODE;
-        return nullptr;
     } else if (!supported(block_mode)) {
         LOG_E("Block mode %d not supported", block_mode);
         *error = KM_ERROR_UNSUPPORTED_BLOCK_MODE;
-        return nullptr;
     } else if (!key.authorizations().Contains(TAG_BLOCK_MODE, block_mode)) {
         LOG_E("Block mode %d was specified, but not authorized by key", block_mode);
         *error = KM_ERROR_INCOMPATIBLE_BLOCK_MODE;
-        return nullptr;
+    }
+
+    size_t tag_length = 0;
+    if (block_mode == KM_MODE_GCM && purpose() == KM_PURPOSE_ENCRYPT) {
+        uint32_t tag_length_bits;
+        if (!begin_params.GetTagValue(TAG_MAC_LENGTH, &tag_length_bits))
+            *error = KM_ERROR_MISSING_MAC_LENGTH;
+        tag_length = tag_length_bits / 8;
+        if (tag_length_bits % 8 != 0 || tag_length > GCM_MAX_TAG_LENGTH ||
+            tag_length < GCM_MIN_TAG_LENGTH)
+            *error = KM_ERROR_UNSUPPORTED_MAC_LENGTH;
     }
 
     keymaster_padding_t padding;
     if (!begin_params.GetTagValue(TAG_PADDING, &padding)) {
         LOG_E("%d padding modes specified in begin params", begin_params.GetTagCount(TAG_PADDING));
         *error = KM_ERROR_UNSUPPORTED_PADDING_MODE;
-        return nullptr;
     } else if (!supported(padding)) {
         LOG_E("Padding mode %d not supported", padding);
         *error = KM_ERROR_UNSUPPORTED_PADDING_MODE;
-        return nullptr;
+    } else if (block_mode == KM_MODE_CTR && padding != KM_PAD_NONE) {
+        LOG_E("CTR mode does not support padding", 0);
+        *error = KM_ERROR_INCOMPATIBLE_PADDING_MODE;
     } else if (!key.authorizations().Contains(TAG_PADDING, padding)) {
         LOG_E("Padding mode %d was specified, but not authorized by key", padding);
         *error = KM_ERROR_INCOMPATIBLE_PADDING_MODE;
-        return nullptr;
     }
 
     bool caller_nonce = key.authorizations().GetTagValue(TAG_CALLER_NONCE);
@@ -81,30 +93,17 @@
     if (*error != KM_ERROR_OK)
         return nullptr;
 
-    switch (block_mode) {
-    case KM_MODE_ECB:
-    case KM_MODE_CBC:
-        return CreateEvpOperation(*symmetric_key, block_mode, padding, caller_nonce, error);
-    case KM_MODE_CTR:
-        if (padding != KM_PAD_NONE) {
-            *error = KM_ERROR_INCOMPATIBLE_PADDING_MODE;
-            return nullptr;
-        }
-        return CreateEvpOperation(*symmetric_key, block_mode, padding, caller_nonce, error);
-    default:
-        *error = KM_ERROR_UNSUPPORTED_BLOCK_MODE;
-        return nullptr;
-    }
+    return CreateEvpOperation(*symmetric_key, block_mode, padding, caller_nonce, tag_length, error);
 }
 
 Operation* AesOperationFactory::CreateEvpOperation(const SymmetricKey& key,
                                                    keymaster_block_mode_t block_mode,
                                                    keymaster_padding_t padding, bool caller_iv,
-                                                   keymaster_error_t* error) {
+                                                   size_t tag_length, keymaster_error_t* error) {
     Operation* op = NULL;
     switch (purpose()) {
     case KM_PURPOSE_ENCRYPT:
-        op = new AesEvpEncryptOperation(block_mode, padding, caller_iv, key.key_data(),
+        op = new AesEvpEncryptOperation(block_mode, padding, caller_iv, tag_length, key.key_data(),
                                         key.key_data_size());
         break;
     case KM_PURPOSE_DECRYPT:
@@ -121,7 +120,7 @@
 }
 
 static const keymaster_block_mode_t supported_block_modes[] = {KM_MODE_ECB, KM_MODE_CBC,
-                                                               KM_MODE_CTR};
+                                                               KM_MODE_CTR, KM_MODE_GCM};
 
 const keymaster_block_mode_t*
 AesOperationFactory::SupportedBlockModes(size_t* block_mode_count) const {
@@ -139,8 +138,8 @@
 AesEvpOperation::AesEvpOperation(keymaster_purpose_t purpose, keymaster_block_mode_t block_mode,
                                  keymaster_padding_t padding, bool caller_iv, const uint8_t* key,
                                  size_t key_size)
-    : Operation(purpose), key_size_(key_size), block_mode_(block_mode), padding_(padding),
-      caller_iv_(caller_iv) {
+    : Operation(purpose), block_mode_(block_mode), caller_iv_(caller_iv), aad_provided_(false),
+      key_size_(key_size), padding_(padding) {
     memcpy(key_, key, key_size_);
     EVP_CIPHER_CTX_init(&ctx_);
 }
@@ -197,14 +196,26 @@
             return KM_ERROR_UNSUPPORTED_KEY_SIZE;
         }
         break;
+    case KM_MODE_GCM:
+        switch (key_size_) {
+        case 16:
+            cipher = EVP_aes_128_gcm();
+            break;
+        case 24:
+            cipher = EVP_aes_192_gcm();
+            break;
+        case 32:
+            cipher = EVP_aes_256_gcm();
+            break;
+        default:
+            return KM_ERROR_UNSUPPORTED_KEY_SIZE;
+        }
+        break;
     default:
         return KM_ERROR_UNSUPPORTED_BLOCK_MODE;
     }
 
-    int init_result =
-        EVP_CipherInit_ex(&ctx_, cipher, NULL /* engine */, key_, iv_.get(), evp_encrypt_mode());
-
-    if (!init_result)
+    if (!EVP_CipherInit_ex(&ctx_, cipher, NULL /* engine */, key_, iv_.get(), evp_encrypt_mode()))
         return TranslateLastOpenSslError();
 
     switch (padding_) {
@@ -225,6 +236,7 @@
     switch (block_mode_) {
     case KM_MODE_CBC:
     case KM_MODE_CTR:
+    case KM_MODE_GCM:
         return true;
     case KM_MODE_ECB:
         return false;
@@ -235,38 +247,41 @@
     }
 }
 
-keymaster_error_t AesEvpOperation::Begin(const AuthorizationSet& input_params,
-                                         AuthorizationSet* output_params) {
+keymaster_error_t AesEvpDecryptOperation::Begin(const AuthorizationSet& input_params,
+                                                AuthorizationSet* output_params) {
     if (!output_params)
         return KM_ERROR_OUTPUT_PARAMETER_NULL;
 
-    keymaster_error_t error = KM_ERROR_OK;
     if (need_iv()) {
-        switch (purpose()) {
-        case KM_PURPOSE_ENCRYPT:
-            if (input_params.find(TAG_NONCE) == -1)
-                error = GenerateIv();
-            else if (caller_iv_)
-                error = GetIv(input_params);
-            else
-                error = KM_ERROR_CALLER_NONCE_PROHIBITED;
-
-            if (error == KM_ERROR_OK)
-                output_params->push_back(TAG_NONCE, iv_.get(), AES_BLOCK_SIZE);
-            break;
-
-        case KM_PURPOSE_DECRYPT:
-            error = GetIv(input_params);
-            break;
-        default:
-            return KM_ERROR_UNSUPPORTED_PURPOSE;
-        }
+        keymaster_error_t error = GetIv(input_params);
+        if (error != KM_ERROR_OK)
+            return error;
     }
 
-    if (error == KM_ERROR_OK)
-        error = InitializeCipher();
+    return InitializeCipher();
+}
 
-    return error;
+keymaster_error_t AesEvpEncryptOperation::Begin(const AuthorizationSet& input_params,
+                                                AuthorizationSet* output_params) {
+    if (!output_params)
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+
+    if (need_iv()) {
+        keymaster_error_t error = KM_ERROR_OK;
+        if (input_params.find(TAG_NONCE) == -1)
+            error = GenerateIv();
+        else if (caller_iv_)
+            error = GetIv(input_params);
+        else
+            error = KM_ERROR_CALLER_NONCE_PROHIBITED;
+
+        if (error == KM_ERROR_OK)
+            output_params->push_back(TAG_NONCE, iv_.get(), iv_length_);
+        else
+            return error;
+    }
+
+    return InitializeCipher();
 }
 
 keymaster_error_t AesEvpOperation::GetIv(const AuthorizationSet& input_params) {
@@ -275,7 +290,13 @@
         LOG_E("No IV provided", 0);
         return KM_ERROR_INVALID_ARGUMENT;
     }
-    if (iv_blob.data_length != AES_BLOCK_SIZE) {
+    if (block_mode_ == KM_MODE_GCM) {
+        if (iv_blob.data_length != GCM_NONCE_SIZE) {
+            LOG_E("Expected %d-byte nonce for AES-GCM operation, but got %d bytes", GCM_NONCE_SIZE,
+                  iv_blob.data_length);
+            return KM_ERROR_INVALID_NONCE;
+        }
+    } else if (iv_blob.data_length != AES_BLOCK_SIZE) {
         LOG_E("Expected %d-byte IV for AES operation, but got %d bytes", AES_BLOCK_SIZE,
               iv_blob.data_length);
         return KM_ERROR_INVALID_NONCE;
@@ -283,14 +304,16 @@
     iv_.reset(dup_array(iv_blob.data, iv_blob.data_length));
     if (!iv_.get())
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+    iv_length_ = iv_blob.data_length;
     return KM_ERROR_OK;
 }
 
-keymaster_error_t AesEvpOperation::GenerateIv() {
-    iv_.reset(new uint8_t[AES_BLOCK_SIZE]);
+keymaster_error_t AesEvpEncryptOperation::GenerateIv() {
+    iv_length_ = (block_mode_ == KM_MODE_GCM) ? GCM_NONCE_SIZE : AES_BLOCK_SIZE;
+    iv_.reset(new uint8_t[iv_length_]);
     if (!iv_.get())
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
-    if (RAND_bytes(iv_.get(), AES_BLOCK_SIZE) != 1)
+    if (RAND_bytes(iv_.get(), iv_length_) != 1)
         return TranslateLastOpenSslError();
     return KM_ERROR_OK;
 }
@@ -301,10 +324,22 @@
     return b;
 }
 
-keymaster_error_t AesEvpOperation::Update(const AuthorizationSet& /* additional_params */,
+keymaster_error_t AesEvpOperation::Update(const AuthorizationSet& additional_params,
                                           const Buffer& input,
                                           AuthorizationSet* /* output_params */, Buffer* output,
                                           size_t* input_consumed) {
+    if (!aad_provided_ && block_mode_ == KM_MODE_GCM) {
+        keymaster_blob_t aad;
+        if (additional_params.GetTagValue(TAG_ASSOCIATED_DATA, &aad)) {
+            // Incantation to add AAD is to call update with null output.  Ugly.
+            int output_written;
+            if (!EVP_CipherUpdate(&ctx_, nullptr /* out */, &output_written, aad.data,
+                                  aad.data_length))
+                return TranslateLastOpenSslError();
+        }
+        aad_provided_ = true;
+    }
+
     output->reserve(input.available_read() + AES_BLOCK_SIZE);
 
     const uint8_t* input_pos = input.peek_read();
@@ -322,6 +357,33 @@
     return KM_ERROR_OK;
 }
 
+keymaster_error_t AesEvpDecryptOperation::Update(const AuthorizationSet& additional_params,
+                                                 const Buffer& input,
+                                                 AuthorizationSet* output_params, Buffer* output,
+                                                 size_t* input_consumed) {
+    if (!tag_provided_ && block_mode_ == KM_MODE_GCM && purpose() == KM_PURPOSE_DECRYPT) {
+        keymaster_blob_t tag;
+        if (additional_params.GetTagValue(TAG_AEAD_TAG, &tag)) {
+            if (tag.data_length < GCM_MIN_TAG_LENGTH || tag.data_length > GCM_MAX_TAG_LENGTH)
+                return KM_ERROR_UNSUPPORTED_MAC_LENGTH;
+
+            if (!EVP_CIPHER_CTX_ctrl(&ctx_, EVP_CTRL_GCM_SET_TAG, tag.data_length,
+                                     const_cast<uint8_t*>(tag.data)))
+                return TranslateLastOpenSslError();
+            tag_provided_ = true;
+        }
+        if (!tag_provided_)
+            return KM_ERROR_INVALID_TAG;
+    }
+
+    return AesEvpOperation::Update(additional_params, input, output_params, output, input_consumed);
+}
+
+inline bool is_bad_decrypt(unsigned long error) {
+    return (ERR_GET_LIB(error) == ERR_LIB_CIPHER &&  //
+            ERR_GET_REASON(error) == CIPHER_R_BAD_DECRYPT);
+}
+
 keymaster_error_t AesEvpOperation::Finish(const AuthorizationSet& /* additional_params */,
                                           const Buffer& /* signature */,
                                           AuthorizationSet* /* output_params */, Buffer* output) {
@@ -329,6 +391,8 @@
 
     int output_written = -1;
     if (!EVP_CipherFinal_ex(&ctx_, output->peek_write(), &output_written)) {
+        if (block_mode_ == KM_MODE_GCM && is_bad_decrypt(ERR_peek_last_error()))
+            return KM_ERROR_VERIFICATION_FAILED;
         LOG_E("Error encrypting final block: %s", ERR_error_string(ERR_peek_last_error(), NULL));
         return TranslateLastOpenSslError();
     }
@@ -338,6 +402,23 @@
     return KM_ERROR_OK;
 }
 
+keymaster_error_t AesEvpEncryptOperation::Finish(const AuthorizationSet& additional_params,
+                                                 const Buffer& signature,
+                                                 AuthorizationSet* output_params, Buffer* output) {
+    keymaster_error_t error =
+        AesEvpOperation::Finish(additional_params, signature, output_params, output);
+    if (error != KM_ERROR_OK)
+        return error;
+
+    if (block_mode_ == KM_MODE_GCM && purpose() == KM_PURPOSE_ENCRYPT) {
+        uint8_t tag[tag_length_];
+        if (!EVP_CIPHER_CTX_ctrl(&ctx_, EVP_CTRL_GCM_GET_TAG, tag_length_, tag))
+            return TranslateLastOpenSslError();
+        output_params->push_back(TAG_AEAD_TAG, tag, tag_length_);
+    }
+
+    return KM_ERROR_OK;
+}
 keymaster_error_t AesEvpOperation::Abort() {
     return KM_ERROR_OK;
 }
diff --git a/aes_operation.h b/aes_operation.h
index 726a599..dc902a7 100644
--- a/aes_operation.h
+++ b/aes_operation.h
@@ -34,39 +34,51 @@
                     size_t key_size);
     ~AesEvpOperation();
 
-    virtual keymaster_error_t Begin(const AuthorizationSet& input_params,
-                                    AuthorizationSet* output_params);
-    virtual keymaster_error_t Update(const AuthorizationSet& additional_params, const Buffer& input,
-                                     AuthorizationSet* output_params, Buffer* output,
-                                     size_t* input_consumed);
-    virtual keymaster_error_t Finish(const AuthorizationSet& additional_params,
-                                     const Buffer& signature, AuthorizationSet* output_params,
-                                     Buffer* output);
-    virtual keymaster_error_t Abort();
+    keymaster_error_t Update(const AuthorizationSet& additional_params, const Buffer& input,
+                             AuthorizationSet* output_params, Buffer* output,
+                             size_t* input_consumed) override;
+    keymaster_error_t Finish(const AuthorizationSet& additional_params, const Buffer& signature,
+                             AuthorizationSet* output_params, Buffer* output) override;
+    keymaster_error_t Abort() override;
 
     virtual int evp_encrypt_mode() = 0;
 
-  private:
+  protected:
+    bool need_iv() const;
     keymaster_error_t InitializeCipher();
     keymaster_error_t GetIv(const AuthorizationSet& input_params);
-    keymaster_error_t GenerateIv();
-    bool need_iv() const;
 
-    EVP_CIPHER_CTX ctx_;
-    const size_t key_size_;
     const keymaster_block_mode_t block_mode_;
-    const keymaster_padding_t padding_;
-    const bool caller_iv_;
+    EVP_CIPHER_CTX ctx_;
     UniquePtr<uint8_t[]> iv_;
+    size_t iv_length_;
+    const bool caller_iv_;
+
+  private:
+    bool aad_provided_;
+    const size_t key_size_;
+    const keymaster_padding_t padding_;
     uint8_t key_[MAX_EVP_KEY_SIZE];
 };
 
 class AesEvpEncryptOperation : public AesEvpOperation {
   public:
     AesEvpEncryptOperation(keymaster_block_mode_t block_mode, keymaster_padding_t padding,
-                           bool caller_iv, const uint8_t* key, size_t key_size)
-        : AesEvpOperation(KM_PURPOSE_ENCRYPT, block_mode, padding, caller_iv, key, key_size) {}
-    int evp_encrypt_mode() { return 1; }
+                           bool caller_iv, size_t tag_length, const uint8_t* key, size_t key_size)
+        : AesEvpOperation(KM_PURPOSE_ENCRYPT, block_mode, padding, caller_iv, key, key_size),
+          tag_length_(tag_length) {}
+
+    keymaster_error_t Begin(const AuthorizationSet& input_params,
+                            AuthorizationSet* output_params) override;
+    keymaster_error_t Finish(const AuthorizationSet& additional_params, const Buffer& signature,
+                             AuthorizationSet* output_params, Buffer* output) override;
+
+    int evp_encrypt_mode() override { return 1; }
+
+  private:
+    keymaster_error_t GenerateIv();
+
+    size_t tag_length_;
 };
 
 class AesEvpDecryptOperation : public AesEvpOperation {
@@ -74,9 +86,19 @@
     AesEvpDecryptOperation(keymaster_block_mode_t block_mode, keymaster_padding_t padding,
                            const uint8_t* key, size_t key_size)
         : AesEvpOperation(KM_PURPOSE_DECRYPT, block_mode, padding,
-                          false /* caller_iv -- don't care */, key, key_size) {}
+                          false /* caller_iv -- don't care */, key, key_size),
+          tag_provided_(false) {}
 
-    int evp_encrypt_mode() { return 0; }
+    keymaster_error_t Begin(const AuthorizationSet& input_params,
+                            AuthorizationSet* output_params) override;
+    keymaster_error_t Update(const AuthorizationSet& additional_params, const Buffer& input,
+                             AuthorizationSet* output_params, Buffer* output,
+                             size_t* input_consumed) override;
+
+    int evp_encrypt_mode() override { return 0; }
+
+  private:
+    bool tag_provided_;
 };
 
 /**
@@ -98,7 +120,7 @@
     virtual Operation* CreateEvpOperation(const SymmetricKey& key,
                                           keymaster_block_mode_t block_mode,
                                           keymaster_padding_t padding, bool caller_iv,
-                                          keymaster_error_t* error);
+                                          size_t tag_length, keymaster_error_t* error);
 };
 
 /**
diff --git a/android_keymaster_test.cpp b/android_keymaster_test.cpp
index 123f24f..4b86a2d 100644
--- a/android_keymaster_test.cpp
+++ b/android_keymaster_test.cpp
@@ -138,7 +138,7 @@
 
     ASSERT_EQ(KM_ERROR_OK, device()->get_supported_block_modes(device(), KM_ALGORITHM_AES,
                                                                KM_PURPOSE_ENCRYPT, &modes, &len));
-    EXPECT_TRUE(ResponseContains({KM_MODE_ECB, KM_MODE_CBC, KM_MODE_CTR}, modes, len));
+    EXPECT_TRUE(ResponseContains({KM_MODE_ECB, KM_MODE_CBC, KM_MODE_CTR, KM_MODE_GCM}, modes, len));
     free(modes);
 
     EXPECT_EQ(0, GetParam()->keymaster0_calls());
@@ -2203,6 +2203,268 @@
     EXPECT_EQ(0, GetParam()->keymaster0_calls());
 }
 
+TEST_P(EncryptionOperationsTest, AesGcmRoundTripSuccess) {
+    ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
+                                           .AesEncryptionKey(128)
+                                           .Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
+                                           .Authorization(TAG_PADDING, KM_PAD_NONE)));
+    string aad = "foobar";
+    string message = "123456789012345678901234567890123456";
+    AuthorizationSet begin_params(client_params());
+    begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
+    begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
+    begin_params.push_back(TAG_MAC_LENGTH, 128);
+    AuthorizationSet begin_out_params;
+
+    AuthorizationSet update_params;
+    update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
+    AuthorizationSet update_out_params;
+
+    AuthorizationSet finish_params;
+    AuthorizationSet finish_out_params;
+
+    string ciphertext;
+    string discard;
+    string plaintext;
+
+    size_t input_consumed;
+
+    // Encrypt
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
+                                           &input_consumed));
+    EXPECT_EQ(message.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_OK, FinishOperation(finish_params, "", &finish_out_params, &discard));
+
+    // Grab nonce & tag.
+    EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
+    EXPECT_NE(-1, finish_out_params.find(TAG_AEAD_TAG));
+    begin_params.push_back(begin_out_params);
+    update_params.push_back(finish_out_params);
+
+    // Decrypt.
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
+                                           &plaintext, &input_consumed));
+    EXPECT_EQ(ciphertext.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_OK, FinishOperation(&discard));
+
+    EXPECT_EQ(message, plaintext);
+    EXPECT_EQ(0, GetParam()->keymaster0_calls());
+}
+
+TEST_P(EncryptionOperationsTest, AesGcmBadAad) {
+    ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
+                                           .AesEncryptionKey(128)
+                                           .Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
+                                           .Authorization(TAG_PADDING, KM_PAD_NONE)));
+    string aad = "foobar";
+    string message = "12345678901234567890123456789012";
+    AuthorizationSet begin_params(client_params());
+    begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
+    begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
+    begin_params.push_back(TAG_MAC_LENGTH, 128);
+    AuthorizationSet begin_out_params;
+
+    AuthorizationSet update_params;
+    update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
+    AuthorizationSet update_out_params;
+
+    AuthorizationSet finish_params;
+    AuthorizationSet finish_out_params;
+
+    string ciphertext;
+    string discard;
+    string plaintext;
+
+    size_t input_consumed;
+
+    // Encrypt
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
+                                           &input_consumed));
+    EXPECT_EQ(message.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_OK, FinishOperation(finish_params, "", &finish_out_params, &discard));
+
+    // Grab nonce & tag.
+    EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
+    EXPECT_NE(-1, finish_out_params.find(TAG_AEAD_TAG));
+    begin_params.push_back(begin_out_params);
+    update_params.Clear();
+    update_params.push_back(TAG_ASSOCIATED_DATA, "barfoo" /* Wrong AAD */, 6);
+    update_params.push_back(finish_out_params);
+
+    // Decrypt.
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
+                                           &plaintext, &input_consumed));
+    EXPECT_EQ(ciphertext.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(&discard));
+
+    EXPECT_EQ(message, plaintext);
+    EXPECT_EQ(0, GetParam()->keymaster0_calls());
+}
+
+TEST_P(EncryptionOperationsTest, AesGcmWrongNonce) {
+    ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
+                                           .AesEncryptionKey(128)
+                                           .Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
+                                           .Authorization(TAG_PADDING, KM_PAD_NONE)));
+    string aad = "foobar";
+    string message = "12345678901234567890123456789012";
+    AuthorizationSet begin_params(client_params());
+    begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
+    begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
+    begin_params.push_back(TAG_MAC_LENGTH, 128);
+    AuthorizationSet begin_out_params;
+
+    AuthorizationSet update_params;
+    update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
+    AuthorizationSet update_out_params;
+
+    AuthorizationSet finish_params;
+    AuthorizationSet finish_out_params;
+
+    string ciphertext;
+    string discard;
+    string plaintext;
+
+    size_t input_consumed;
+
+    // Encrypt
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
+                                           &input_consumed));
+    EXPECT_EQ(message.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_OK, FinishOperation(finish_params, "", &finish_out_params, &discard));
+
+    // Try with wrong-length nonce.  Should fail immediately.
+    AuthorizationSet long_nonce(begin_params);
+    long_nonce.push_back(TAG_NONCE, "1234567890123", 13);
+    EXPECT_EQ(KM_ERROR_INVALID_NONCE,
+              BeginOperation(KM_PURPOSE_DECRYPT, long_nonce, &begin_out_params));
+    AuthorizationSet short_nonce(begin_params);
+    short_nonce.push_back(TAG_NONCE, "12345678901", 11);
+    EXPECT_EQ(KM_ERROR_INVALID_NONCE,
+              BeginOperation(KM_PURPOSE_DECRYPT, short_nonce, &begin_out_params));
+
+    // Now with correct length, but incorrect content.
+    EXPECT_NE(-1, finish_out_params.find(TAG_AEAD_TAG));
+    update_params.push_back(finish_out_params);
+    begin_params.push_back(TAG_NONCE, "123456789012", 12);
+
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
+                                           &plaintext, &input_consumed));
+    EXPECT_EQ(ciphertext.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(&discard));
+
+    // With wrong nonce, should have gotten garbage plaintext.
+    EXPECT_NE(message, plaintext);
+    EXPECT_EQ(0, GetParam()->keymaster0_calls());
+}
+
+TEST_P(EncryptionOperationsTest, AesGcmCorruptTag) {
+    ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
+                                           .AesEncryptionKey(128)
+                                           .Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
+                                           .Authorization(TAG_PADDING, KM_PAD_NONE)));
+    string aad = "foobar";
+    string message = "123456789012345678901234567890123456";
+    AuthorizationSet begin_params(client_params());
+    begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
+    begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
+    begin_params.push_back(TAG_MAC_LENGTH, 128);
+    AuthorizationSet begin_out_params;
+
+    AuthorizationSet update_params;
+    update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
+    AuthorizationSet update_out_params;
+
+    AuthorizationSet finish_params;
+    AuthorizationSet finish_out_params;
+
+    string ciphertext;
+    string discard;
+    string plaintext;
+
+    size_t input_consumed;
+
+    // Encrypt
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
+                                           &input_consumed));
+    EXPECT_EQ(message.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_OK, FinishOperation(finish_params, "", &finish_out_params, &discard));
+
+    // Grab nonce & tag; corrupt tag.
+    EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
+    begin_params.push_back(begin_out_params);
+    keymaster_blob_t tag;
+    EXPECT_TRUE(finish_out_params.GetTagValue(TAG_AEAD_TAG, &tag));
+    const_cast<uint8_t*>(tag.data)[tag.data_length / 2]++;
+    update_params.push_back(TAG_AEAD_TAG, tag);
+
+    // Decrypt.
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
+                                           &plaintext, &input_consumed));
+    EXPECT_EQ(ciphertext.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(&discard));
+
+    EXPECT_EQ(message, plaintext);
+    EXPECT_EQ(0, GetParam()->keymaster0_calls());
+}
+
+TEST_P(EncryptionOperationsTest, AesGcmShortTag) {
+    ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
+                                           .AesEncryptionKey(128)
+                                           .Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
+                                           .Authorization(TAG_PADDING, KM_PAD_NONE)));
+    string aad = "foobar";
+    string message = "123456789012345678901234567890123456";
+    AuthorizationSet begin_params(client_params());
+    begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
+    begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
+    begin_params.push_back(TAG_MAC_LENGTH, 128);
+    AuthorizationSet begin_out_params;
+
+    AuthorizationSet update_params;
+    update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
+    AuthorizationSet update_out_params;
+
+    AuthorizationSet finish_params;
+    AuthorizationSet finish_out_params;
+
+    string ciphertext;
+    string discard;
+    string plaintext;
+
+    size_t input_consumed;
+
+    // Encrypt
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
+                                           &input_consumed));
+    EXPECT_EQ(message.size(), input_consumed);
+    EXPECT_EQ(KM_ERROR_OK, FinishOperation(finish_params, "", &finish_out_params, &discard));
+
+    EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
+    begin_params.push_back(begin_out_params);
+    keymaster_blob_t tag;
+    EXPECT_TRUE(finish_out_params.GetTagValue(TAG_AEAD_TAG, &tag));
+    tag.data_length = 11;
+    update_params.push_back(TAG_AEAD_TAG, tag);
+
+    // Decrypt.
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
+    EXPECT_EQ(KM_ERROR_UNSUPPORTED_MAC_LENGTH,
+              UpdateOperation(update_params, ciphertext, &update_out_params, &plaintext,
+                              &input_consumed));
+
+    EXPECT_EQ(0, GetParam()->keymaster0_calls());
+}
+
 typedef Keymaster1Test AddEntropyTest;
 INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, AddEntropyTest, test_params);
 
diff --git a/android_keymaster_test_utils.cpp b/android_keymaster_test_utils.cpp
index 80f6822..69ca470 100644
--- a/android_keymaster_test_utils.cpp
+++ b/android_keymaster_test_utils.cpp
@@ -249,7 +249,8 @@
 }
 
 keymaster_error_t Keymaster1Test::UpdateOperation(const AuthorizationSet& additional_params,
-                                                  const string& message, string* output,
+                                                  const string& message,
+                                                  AuthorizationSet* output_params, string* output,
                                                   size_t* input_consumed) {
     EXPECT_NE(op_handle_, OP_HANDLE_SENTINEL);
     keymaster_blob_t input = {reinterpret_cast<const uint8_t*>(message.c_str()), message.length()};
@@ -260,6 +261,9 @@
     if (error == KM_ERROR_OK && out_tmp.data)
         output->append(reinterpret_cast<const char*>(out_tmp.data), out_tmp.data_length);
     free((void*)out_tmp.data);
+    if (output_params)
+        output_params->Reinitialize(out_params);
+    keymaster_free_param_set(&out_params);
     return error;
 }
 
@@ -269,11 +273,13 @@
 
 keymaster_error_t Keymaster1Test::FinishOperation(const string& signature, string* output) {
     AuthorizationSet additional_params;
-    return FinishOperation(additional_params, signature, output);
+    AuthorizationSet output_params;
+    return FinishOperation(additional_params, signature, &output_params, output);
 }
 
 keymaster_error_t Keymaster1Test::FinishOperation(const AuthorizationSet& additional_params,
-                                                  const string& signature, string* output) {
+                                                  const string& signature,
+                                                  AuthorizationSet* output_params, string* output) {
     keymaster_blob_t sig = {reinterpret_cast<const uint8_t*>(signature.c_str()),
                             signature.length()};
     keymaster_blob_t out_tmp;
@@ -289,6 +295,9 @@
     if (out_tmp.data)
         output->append(reinterpret_cast<const char*>(out_tmp.data), out_tmp.data_length);
     free((void*)out_tmp.data);
+    if (output_params)
+        output_params->Reinitialize(out_params);
+    keymaster_free_param_set(&out_params);
     return error;
 }
 
@@ -310,12 +319,13 @@
 string Keymaster1Test::ProcessMessage(keymaster_purpose_t purpose, const string& message,
                                       const AuthorizationSet& begin_params,
                                       const AuthorizationSet& update_params,
-                                      AuthorizationSet* output_params) {
-    EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, begin_params, output_params));
+                                      AuthorizationSet* begin_out_params) {
+    EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, begin_params, begin_out_params));
 
     string result;
     size_t input_consumed;
-    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &result, &input_consumed));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, nullptr /* output_params */,
+                                           &result, &input_consumed));
     EXPECT_EQ(message.size(), input_consumed);
     EXPECT_EQ(KM_ERROR_OK, FinishOperation(update_params, "", &result));
     return result;
@@ -329,7 +339,8 @@
 
     string result;
     size_t input_consumed;
-    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &result, &input_consumed));
+    EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, nullptr /* output_params */,
+                                           &result, &input_consumed));
     EXPECT_EQ(message.size(), input_consumed);
     EXPECT_EQ(KM_ERROR_OK, FinishOperation(update_params, signature, &result));
     return result;
diff --git a/android_keymaster_test_utils.h b/android_keymaster_test_utils.h
index ede14f5..cefd3d3 100644
--- a/android_keymaster_test_utils.h
+++ b/android_keymaster_test_utils.h
@@ -188,13 +188,18 @@
     keymaster_error_t UpdateOperation(const std::string& message, std::string* output,
                                       size_t* input_consumed);
     keymaster_error_t UpdateOperation(const AuthorizationSet& additional_params,
-                                      const std::string& message, std::string* output,
-                                      size_t* input_consumed);
+                                      const std::string& message, AuthorizationSet* output_params,
+                                      std::string* output, size_t* input_consumed);
 
     keymaster_error_t FinishOperation(std::string* output);
     keymaster_error_t FinishOperation(const std::string& signature, std::string* output);
     keymaster_error_t FinishOperation(const AuthorizationSet& additional_params,
-                                      const std::string& signature, std::string* output);
+                                      const std::string& signature, std::string* output) {
+        return FinishOperation(additional_params, signature, nullptr /* output_params */, output);
+    }
+    keymaster_error_t FinishOperation(const AuthorizationSet& additional_params,
+                                      const std::string& signature, AuthorizationSet* output_params,
+                                      std::string* output);
 
     keymaster_error_t AbortOperation();