<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
Nevermind: I figured out what I failed to understand.<br>
<br>
The handlers that use CMAC and are size locked are on the client to
server path. The server to client path *does* allow for additional
data.<br>
<br>
Nothing to see here, move along.<br>
<br>
<div class="moz-signature">-- <br>
<i>"In the end; what separates a Man, from a Slave? Money? Power?
No. A Man Chooses, a Slave Obeys."</i> -- Andrew Ryan
<p>
<i>"Utopia cannot precede the Utopian.
It will exist the moment we are fit to occupy it."</i> --
Sophia Lamb
</p>
</div>
</body>
</html>