diff --git a/include/mbedtls/cmac.h b/include/mbedtls/cmac.h
index c19679353..7f989a0eb 100644
--- a/include/mbedtls/cmac.h
+++ b/include/mbedtls/cmac.h
@@ -77,7 +77,7 @@ struct mbedtls_cmac_context_t
  *                      as one of the following types: MBEDTLS_CIPHER_AES_128_ECB,
  *                      MBEDTLS_CIPHER_AES_192_ECB, MBEDTLS_CIPHER_AES_256_ECB,
  *                      or MBEDTLS_CIPHER_DES_EDE3_ECB.
- * \param key           The CMAC key.
+ * \param key           The CMAC key. This must not be \c NULL.
  * \param keybits       The length of the CMAC key in bits.
  *                      Must be supported by the cipher.
  *
@@ -96,7 +96,8 @@ int mbedtls_cipher_cmac_starts( mbedtls_cipher_context_t *ctx,
  *                      Can be called repeatedly.
  *
  * \param ctx           The cipher context used for the CMAC operation.
- * \param input         The buffer holding the input data.
+ *                      This must be initialized.
+ * \param input         The buffer holding the input data. This must not be \c NULL.
  * \param ilen          The length of the input data.
  *
  * \return             \c 0 on success.
@@ -115,7 +116,9 @@ int mbedtls_cipher_cmac_update( mbedtls_cipher_context_t *ctx,
  *                      mbedtls_cipher_cmac_update(), or mbedtls_cipher_free().
  *
  * \param ctx           The cipher context used for the CMAC operation.
+ *                      This must be initialized.
  * \param output        The output buffer for the CMAC checksum result.
+ *                      This must not be \c NULL.
  *
  * \return              \c 0 on success.
  * \return              #MBEDTLS_ERR_MD_BAD_INPUT_DATA
@@ -133,6 +136,7 @@ int mbedtls_cipher_cmac_finish( mbedtls_cipher_context_t *ctx,
  *                      and before mbedtls_cipher_cmac_update().
  *
  * \param ctx           The cipher context used for the CMAC operation.
+ *                      This must be initialized.
  *
  * \return              \c 0 on success.
  * \return              #MBEDTLS_ERR_MD_BAD_INPUT_DATA
@@ -151,12 +155,12 @@ int mbedtls_cipher_cmac_reset( mbedtls_cipher_context_t *ctx );
  *                      output = generic CMAC(cmac key, input buffer).
  *
  *
- * \param cipher_info   The cipher information.
- * \param key           The CMAC key.
+ * \param cipher_info   The cipher information. This must not be \c NULL.
+ * \param key           The CMAC key. This must not be \c NULL.
  * \param keylen        The length of the CMAC key in bits.
- * \param input         The buffer holding the input data.
+ * \param input         The buffer holding the input data. This must not be \c NULL.
  * \param ilen          The length of the input data.
- * \param output        The buffer for the generic CMAC result.
+ * \param output        The buffer for the generic CMAC result. This must not be \c NULL.
  *
  * \return              \c 0 on success.
  * \return              #MBEDTLS_ERR_MD_BAD_INPUT_DATA
@@ -176,12 +180,12 @@ int mbedtls_cipher_cmac( const mbedtls_cipher_info_t *cipher_info,
  *                  (AES-CMAC-PRF-128) Algorithm for the Internet Key
  *                  Exchange Protocol (IKE).</em>
  *
- * \param key       The key to use.
+ * \param key       The key to use. This must not be \c NULL.
  * \param key_len   The key length in Bytes.
- * \param input     The buffer holding the input data.
+ * \param input     The buffer holding the input data. This must not be \c NULL.
  * \param in_len    The length of the input data in Bytes.
  * \param output    The buffer holding the generated 16 Bytes of
- *                  pseudorandom output.
+ *                  pseudorandom output. This must not be \c NULL.
  *
  * \return          \c 0 on success.
  */