diff --git a/crypto/cipher_extra/aead_test.cc b/crypto/cipher_extra/aead_test.cc
index e5e7761..6536e34 100644
--- a/crypto/cipher_extra/aead_test.cc
+++ b/crypto/cipher_extra/aead_test.cc
@@ -240,8 +240,8 @@
       size_t out_tag_len;
       ASSERT_TRUE(EVP_AEAD_CTX_seal_scatter(
           ctx.get(), out.data(), out_tag.data(), &out_tag_len, out_tag.size(),
-          nonce.data(), nonce.size(), in.data(), in.size(), ad.data(),
-          ad.size()));
+          nonce.data(), nonce.size(), in.data(), in.size(), nullptr, 0,
+          ad.data(), ad.size()));
       out_tag.resize(out_tag_len);
 
       ASSERT_EQ(out.size(), ct.size());
diff --git a/crypto/cipher_extra/e_aesctrhmac.c b/crypto/cipher_extra/e_aesctrhmac.c
index dbe9f06..2982d0d 100644
--- a/crypto/cipher_extra/e_aesctrhmac.c
+++ b/crypto/cipher_extra/e_aesctrhmac.c
@@ -178,8 +178,8 @@
 static int aead_aes_ctr_hmac_sha256_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
   const uint64_t in_len_64 = in_len;
 
@@ -242,9 +242,10 @@
 
 static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
     16 /* AES key */ + 32 /* HMAC key */,
-    12,                                       /* nonce length */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* overhead */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* max tag length */
+    12,                                   /* nonce length */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */
+    0,                                    /* seal_scatter_supports_extra_in */
 
     aead_aes_ctr_hmac_sha256_init,
     NULL /* init_with_direction */,
@@ -257,9 +258,10 @@
 
 static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
     32 /* AES key */ + 32 /* HMAC key */,
-    12,                                       /* nonce length */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* overhead */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* max tag length */
+    12,                                   /* nonce length */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */
+    0,                                    /* seal_scatter_supports_extra_in */
 
     aead_aes_ctr_hmac_sha256_init,
     NULL /* init_with_direction */,
diff --git a/crypto/cipher_extra/e_aesgcmsiv.c b/crypto/cipher_extra/e_aesgcmsiv.c
index 3a1ec47..190a1b9 100644
--- a/crypto/cipher_extra/e_aesgcmsiv.c
+++ b/crypto/cipher_extra/e_aesgcmsiv.c
@@ -322,8 +322,8 @@
 static int aead_aes_gcm_siv_asm_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx = ctx->aead_state;
   const uint64_t in_len_64 = in_len;
   const uint64_t ad_len_64 = ad_len;
@@ -505,6 +505,7 @@
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_asm_init,
     NULL /* init_with_direction */,
@@ -520,6 +521,7 @@
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_asm_init,
     NULL /* init_with_direction */,
@@ -698,12 +700,11 @@
                   key_material + 16, gcm_siv_ctx->is_256 ? 32 : 16);
 }
 
-static int aead_aes_gcm_siv_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
-                                         uint8_t *out_tag, size_t *out_tag_len,
-                                         size_t max_out_tag_len,
-                                         const uint8_t *nonce, size_t nonce_len,
-                                         const uint8_t *in, size_t in_len,
-                                         const uint8_t *ad, size_t ad_len) {
+static int aead_aes_gcm_siv_seal_scatter(
+    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
+    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx = ctx->aead_state;
   const uint64_t in_len_64 = in_len;
   const uint64_t ad_len_64 = ad_len;
@@ -788,6 +789,7 @@
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_init,
     NULL /* init_with_direction */,
@@ -803,6 +805,7 @@
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_init,
     NULL /* init_with_direction */,
diff --git a/crypto/cipher_extra/e_chacha20poly1305.c b/crypto/cipher_extra/e_chacha20poly1305.c
index c433053..6cfc856 100644
--- a/crypto/cipher_extra/e_chacha20poly1305.c
+++ b/crypto/cipher_extra/e_chacha20poly1305.c
@@ -157,8 +157,8 @@
 static int aead_chacha20_poly1305_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_chacha20_poly1305_ctx *c20_ctx = ctx->aead_state;
 
   if (nonce_len != 12) {
@@ -249,17 +249,19 @@
 }
 
 static const EVP_AEAD aead_chacha20_poly1305 = {
-    32,                 /* key len */
-    12,                 /* nonce len */
-    POLY1305_TAG_LEN,   /* overhead */
-    POLY1305_TAG_LEN,   /* max tag length */
+    32,               /* key len */
+    12,               /* nonce len */
+    POLY1305_TAG_LEN, /* overhead */
+    POLY1305_TAG_LEN, /* max tag length */
+    0,                /* seal_scatter_supports_extra_in */
+
     aead_chacha20_poly1305_init,
     NULL, /* init_with_direction */
     aead_chacha20_poly1305_cleanup,
     NULL /* open */,
     aead_chacha20_poly1305_seal_scatter,
     aead_chacha20_poly1305_open_gather,
-    NULL,               /* get_iv */
+    NULL, /* get_iv */
 };
 
 const EVP_AEAD *EVP_aead_chacha20_poly1305(void) {
diff --git a/crypto/cipher_extra/e_ssl3.c b/crypto/cipher_extra/e_ssl3.c
index 7af9a58..f2eb357 100644
--- a/crypto/cipher_extra/e_ssl3.c
+++ b/crypto/cipher_extra/e_ssl3.c
@@ -127,7 +127,8 @@
                                   uint8_t *out_tag, size_t *out_tag_len,
                                   size_t max_out_tag_len, const uint8_t *nonce,
                                   size_t nonce_len, const uint8_t *in,
-                                  size_t in_len, const uint8_t *ad,
+                                  size_t in_len, const uint8_t *extra_in,
+                                  size_t extra_in_len, const uint8_t *ad,
                                   size_t ad_len) {
   AEAD_SSL3_CTX *ssl3_ctx = (AEAD_SSL3_CTX *)ctx->aead_state;
 
@@ -362,6 +363,8 @@
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
+    0,                           /* seal_scatter_supports_extra_in */
+
     NULL, /* init */
     aead_aes_128_cbc_sha1_ssl3_init,
     aead_ssl3_cleanup,
@@ -376,6 +379,8 @@
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
+    0,                           /* seal_scatter_supports_extra_in */
+
     NULL, /* init */
     aead_aes_256_cbc_sha1_ssl3_init,
     aead_ssl3_cleanup,
@@ -390,6 +395,8 @@
     0,                          /* nonce len */
     8 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,          /* max tag length */
+    0,                          /* seal_scatter_supports_extra_in */
+
     NULL, /* init */
     aead_des_ede3_cbc_sha1_ssl3_init,
     aead_ssl3_cleanup,
@@ -400,11 +407,13 @@
 };
 
 static const EVP_AEAD aead_null_sha1_ssl3 = {
-    SHA_DIGEST_LENGTH,          /* key len */
-    0,                          /* nonce len */
-    SHA_DIGEST_LENGTH,          /* overhead (SHA1) */
-    SHA_DIGEST_LENGTH,          /* max tag length */
-    NULL,                       /* init */
+    SHA_DIGEST_LENGTH, /* key len */
+    0,                 /* nonce len */
+    SHA_DIGEST_LENGTH, /* overhead (SHA1) */
+    SHA_DIGEST_LENGTH, /* max tag length */
+    0,                 /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_null_sha1_ssl3_init,
     aead_ssl3_cleanup,
     aead_ssl3_open,
diff --git a/crypto/cipher_extra/e_tls.c b/crypto/cipher_extra/e_tls.c
index bf4f2e4..14d5377 100644
--- a/crypto/cipher_extra/e_tls.c
+++ b/crypto/cipher_extra/e_tls.c
@@ -103,7 +103,8 @@
                                  uint8_t *out_tag, size_t *out_tag_len,
                                  size_t max_out_tag_len, const uint8_t *nonce,
                                  size_t nonce_len, const uint8_t *in,
-                                 size_t in_len, const uint8_t *ad,
+                                 size_t in_len, const uint8_t *extra_in,
+                                 size_t extra_in_len, const uint8_t *ad,
                                  size_t ad_len) {
   AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX *)ctx->aead_state;
 
@@ -457,7 +458,9 @@
     16,                     /* nonce len (IV) */
     16 + SHA_DIGEST_LENGTH, /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,      /* max tag length */
-    NULL,                   /* init */
+    0,                      /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_128_cbc_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -471,7 +474,9 @@
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
-    NULL,                        /* init */
+    0,                           /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_128_cbc_sha1_tls_implicit_iv_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -485,7 +490,9 @@
     16,                        /* nonce len (IV) */
     16 + SHA256_DIGEST_LENGTH, /* overhead (padding + SHA256) */
     SHA256_DIGEST_LENGTH,      /* max tag length */
-    NULL,                      /* init */
+    0,                         /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_128_cbc_sha256_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -499,7 +506,9 @@
     16,                     /* nonce len (IV) */
     16 + SHA_DIGEST_LENGTH, /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,      /* max tag length */
-    NULL,                   /* init */
+    0,                      /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -513,7 +522,9 @@
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
-    NULL,                        /* init */
+    0,                           /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha1_tls_implicit_iv_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -527,7 +538,9 @@
     16,                        /* nonce len (IV) */
     16 + SHA256_DIGEST_LENGTH, /* overhead (padding + SHA256) */
     SHA256_DIGEST_LENGTH,      /* max tag length */
-    NULL,                      /* init */
+    0,                         /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha256_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -541,7 +554,9 @@
     16,                        /* nonce len (IV) */
     16 + SHA384_DIGEST_LENGTH, /* overhead (padding + SHA384) */
     SHA384_DIGEST_LENGTH,      /* max tag length */
-    NULL,                      /* init */
+    0,                         /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha384_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -555,7 +570,9 @@
     8,                      /* nonce len (IV) */
     8 + SHA_DIGEST_LENGTH,  /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,      /* max tag length */
-    NULL,                   /* init */
+    0,                      /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_des_ede3_cbc_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -569,7 +586,9 @@
     0,                          /* nonce len */
     8 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,          /* max tag length */
-    NULL,                       /* init */
+    0,                          /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_des_ede3_cbc_sha1_tls_implicit_iv_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -583,7 +602,9 @@
     0,                 /* nonce len */
     SHA_DIGEST_LENGTH, /* overhead (SHA1) */
     SHA_DIGEST_LENGTH, /* max tag length */
-    NULL,              /* init */
+    0,                 /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_null_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
diff --git a/crypto/fipsmodule/cipher/aead.c b/crypto/fipsmodule/cipher/aead.c
index a44889f..79139e6 100644
--- a/crypto/fipsmodule/cipher/aead.c
+++ b/crypto/fipsmodule/cipher/aead.c
@@ -134,7 +134,7 @@
   size_t out_tag_len;
   if (ctx->aead->seal_scatter(ctx, out, out + in_len, &out_tag_len,
                               max_out_len - in_len, nonce, nonce_len, in,
-                              in_len, ad, ad_len)) {
+                              in_len, NULL, 0, ad, ad_len)) {
     *out_len = in_len + out_tag_len;
     return 1;
   }
@@ -148,10 +148,10 @@
 }
 
 int EVP_AEAD_CTX_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag, size_t
+    *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce, size_t
+    nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   // |in| and |out| may alias exactly, |out_tag| may not alias.
   if (!check_alias(in, in_len, out, in_len) ||
       buffers_alias(out, in_len, out_tag, max_out_tag_len) ||
@@ -160,8 +160,14 @@
     goto error;
   }
 
+  if (!ctx->aead->seal_scatter_supports_extra_in && extra_in_len) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_OPERATION);
+    goto error;
+  }
+
   if (ctx->aead->seal_scatter(ctx, out, out_tag, out_tag_len, max_out_tag_len,
-                              nonce, nonce_len, in, in_len, ad, ad_len)) {
+                              nonce, nonce_len, in, in_len, extra_in,
+                              extra_in_len, ad, ad_len)) {
     return 1;
   }
 
diff --git a/crypto/fipsmodule/cipher/e_aes.c b/crypto/fipsmodule/cipher/e_aes.c
index 1505001..31d9877 100644
--- a/crypto/fipsmodule/cipher/e_aes.c
+++ b/crypto/fipsmodule/cipher/e_aes.c
@@ -1207,6 +1207,8 @@
                                      size_t max_out_tag_len,
                                      const uint8_t *nonce, size_t nonce_len,
                                      const uint8_t *in, size_t in_len,
+                                     const uint8_t *extra_in,
+                                     size_t extra_in_len,
                                      const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
   GCM128_CONTEXT gcm;
@@ -1351,8 +1353,8 @@
 static int aead_aes_gcm_tls12_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   struct aead_aes_gcm_tls12_ctx *gcm_ctx = ctx->aead_state;
   if (gcm_ctx->counter == UINT64_MAX) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_NONCE);
@@ -1374,7 +1376,7 @@
 
   return aead_aes_gcm_seal_scatter(ctx, out, out_tag, out_tag_len,
                                    max_out_tag_len, nonce, nonce_len, in,
-                                   in_len, ad, ad_len);
+                                   in_len, extra_in, extra_in_len, ad, ad_len);
 }
 
 DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_tls12) {
diff --git a/crypto/fipsmodule/cipher/internal.h b/crypto/fipsmodule/cipher/internal.h
index c61bff7..ea59723 100644
--- a/crypto/fipsmodule/cipher/internal.h
+++ b/crypto/fipsmodule/cipher/internal.h
@@ -79,6 +79,7 @@
   uint8_t nonce_len;
   uint8_t overhead;
   uint8_t max_tag_len;
+  int seal_scatter_supports_extra_in;
 
   /* init initialises an |EVP_AEAD_CTX|. If this call returns zero then
    * |cleanup| will not be called for that context. */
@@ -96,7 +97,8 @@
   int (*seal_scatter)(const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
                       size_t *out_tag_len, size_t max_out_tag_len,
                       const uint8_t *nonce, size_t nonce_len, const uint8_t *in,
-                      size_t in_len, const uint8_t *ad, size_t ad_len);
+                      size_t in_len, const uint8_t *extra_in,
+                      size_t extra_in_len, const uint8_t *ad, size_t ad_len);
 
   int (*open_gather)(const EVP_AEAD_CTX *ctx, uint8_t *out,
                      const uint8_t *nonce, size_t nonce_len, const uint8_t *in,
diff --git a/include/openssl/aead.h b/include/openssl/aead.h
index e0d6432..f0a67d8 100644
--- a/include/openssl/aead.h
+++ b/include/openssl/aead.h
@@ -267,8 +267,15 @@
  * function on the same |EVP_AEAD_CTX|.
  *
  * Exactly |in_len| bytes are written to |out|, and up to
- * |EVP_AEAD_max_overhead| bytes to |out_tag|. On successful return,
- * |*out_tag_len| is set to the actual number of bytes written to |out_tag|.
+ * |EVP_AEAD_max_overhead+extra_in_len| bytes to |out_tag|. On successful
+ * return, |*out_tag_len| is set to the actual number of bytes written to
+ * |out_tag|.
+ *
+ * |extra_in| may point to an additional plaintext input buffer if the cipher
+ * supports it. If present, |extra_in_len| additional bytes of plaintext are
+ * encrypted and authenticated, and the ciphertext is written (before the tag)
+ * to |out_tag|. |max_out_tag_len| must be sized to allow for the additional
+ * |extra_in_len| bytes.
  *
  * The length of |nonce|, |nonce_len|, must be equal to the result of
  * |EVP_AEAD_nonce_length| for this AEAD.
@@ -281,10 +288,12 @@
  * If |in| and |out| alias then |out| must be == |in|. |out_tag| may not alias
  * any other argument. */
 OPENSSL_EXPORT int EVP_AEAD_CTX_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len);
+    const EVP_AEAD_CTX *ctx, uint8_t *out,
+    uint8_t *out_tag, size_t *out_tag_len, size_t max_out_tag_len,
+    const uint8_t *nonce, size_t nonce_len,
+    const uint8_t *in, size_t in_len,
+    const uint8_t *extra_in, size_t extra_in_len,
+    const uint8_t *ad, size_t ad_len);
 
 /* EVP_AEAD_CTX_open_gather decrypts and authenticates |in_len| bytes from |in|
  * and authenticates |ad_len| bytes from |ad| using |in_tag_len| bytes of