diff --git a/library/cipher.c b/library/cipher.c
index a5f6e11..f8e2841 100644
--- a/library/cipher.c
+++ b/library/cipher.c
@@ -415,14 +415,32 @@
     return 0;
 }
 
-int cipher_reset( cipher_context_t *ctx,
-                  const unsigned char *ad, size_t ad_len )
+int cipher_reset( cipher_context_t *ctx )
 {
+    if( NULL == ctx || NULL == ctx->cipher_info )
+        return POLARSSL_ERR_CIPHER_BAD_INPUT_DATA;
+
     ctx->unprocessed_len = 0;
 
+    return 0;
+}
+
+int cipher_update_ad( cipher_context_t *ctx,
+                      const unsigned char *ad, size_t ad_len )
+{
+    if( NULL == ctx || NULL == ctx->cipher_info )
+        return POLARSSL_ERR_CIPHER_BAD_INPUT_DATA;
+
 #if defined(POLARSSL_GCM_C)
     if( POLARSSL_MODE_GCM == ctx->cipher_info->mode )
     {
+        /* Make sure we're called right after cipher_reset() */
+        if( ((gcm_context *) ctx->cipher_ctx)->len != 0 ||
+            ((gcm_context *) ctx->cipher_ctx)->add_len != 0 )
+        {
+            return POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE;
+        }
+
         return gcm_starts( ctx->cipher_ctx, ctx->operation,
                            ctx->iv, ctx->iv_size, ad, ad_len );
     }
diff --git a/library/pkcs12.c b/library/pkcs12.c
index cc59d68..98ebd88 100644
--- a/library/pkcs12.c
+++ b/library/pkcs12.c
@@ -187,7 +187,7 @@
     if( ( ret = cipher_set_iv( &cipher_ctx, iv, cipher_info->iv_size ) ) != 0 )
         goto exit;
 
-    if( ( ret = cipher_reset( &cipher_ctx, NULL, 0 ) ) != 0 )
+    if( ( ret = cipher_reset( &cipher_ctx ) ) != 0 )
         goto exit;
 
     if( ( ret = cipher_update( &cipher_ctx, data, len,
diff --git a/library/pkcs5.c b/library/pkcs5.c
index 10adbb4..a27d4fb 100644
--- a/library/pkcs5.c
+++ b/library/pkcs5.c
@@ -190,7 +190,7 @@
     if( ( ret = cipher_set_iv( &cipher_ctx, iv, enc_scheme_params.len ) ) != 0 )
         goto exit;
 
-    if( ( ret = cipher_reset( &cipher_ctx, NULL, 0 ) ) != 0 )
+    if( ( ret = cipher_reset( &cipher_ctx ) ) != 0 )
         goto exit;
 
     if( ( ret = cipher_update( &cipher_ctx, data, datalen,