diff --git a/ChangeLog b/ChangeLog
index d5ed6add9..a6b503a14 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,9 @@ Bugfix
    * Fix memory leak in ssl_set_hostname() when called multiple times.
      Found by projectgus and jethrogb, #836.
 
+Features
+   * Allow comments in test data files.
+
 = mbed TLS 1.3.21 branch released 2017-08-10
 
 Security
diff --git a/tests/scripts/generate_code.pl b/tests/scripts/generate_code.pl
index e13a2d0da..750b68b7b 100755
--- a/tests/scripts/generate_code.pl
+++ b/tests/scripts/generate_code.pl
@@ -1,5 +1,26 @@
 #!/usr/bin/env perl
 #
+#       A test data file consists of a sequence of paragraphs separated by
+#       a single empty line. Line breaks may be in Unix (LF) or Windows (CRLF)
+#       format. Lines starting with the character '#' are ignored
+#       (the parser behaves as if they were not present).
+#
+#       Each paragraph describes one test case and must consist of: (1) one
+#       line which is the test case name; (2) an optional line starting with
+#       the 11-character prefix "depends_on:"; (3) a line containing the test
+#       function to execute and its parameters.
+#
+#       A depends_on: line consists of a list of compile-time options
+#       separated by the character ':', with no whitespace. The test case
+#       is executed only if this compilation option is enabled in config.h.
+#
+#       The last line of each paragraph contains a test function name and
+#       a list of parameters separated by the character ':'. Running the
+#       test case calls this function with the specified parameters. Each
+#       parameter may either be an integer written in decimal or hexadecimal,
+#       or a string surrounded by double quotes which may not contain the
+#       ':' character.
+#
 
 use strict;
 
diff --git a/tests/suites/main_test.function b/tests/suites/main_test.function
index d67d875ca..5c0b53997 100644
--- a/tests/suites/main_test.function
+++ b/tests/suites/main_test.function
@@ -132,18 +132,31 @@ DISPATCH_FUNCTION
     return( ret );
 }
 
+/** Retrieve one input line into buf, which must have room for len
+ * bytes. The trailing line break (if any) is stripped from the result.
+ * Lines beginning with the character '#' are skipped. Lines that are
+ * more than len-1 bytes long including the trailing line break are
+ * truncated; note that the following bytes remain in the input stream.
+ *
+ * \return 0 on success, -1 on error or end of file
+ */
 int get_line( FILE *f, char *buf, size_t len )
 {
     char *ret;
 
-    ret = fgets( buf, len, f );
-    if( ret == NULL )
-        return( -1 );
+    do
+    {
+        ret = fgets( buf, len, f );
+        if( ret == NULL )
+            return( -1 );
+    }
+    while( buf[0] == '#' );
 
-    if( strlen( buf ) && buf[strlen(buf) - 1] == '\n' )
-        buf[strlen(buf) - 1] = '\0';
-    if( strlen( buf ) && buf[strlen(buf) - 1] == '\r' )
-        buf[strlen(buf) - 1] = '\0';
+    ret = buf + strlen( buf );
+    if( ret-- > buf && *ret == '\n' )
+        *ret = '\0';
+    if( ret-- > buf && *ret == '\r' )
+        *ret = '\0';
 
     return( 0 );
 }
diff --git a/tests/suites/test_suite_md.data b/tests/suites/test_suite_md.data
index 85be7df0b..b7d2fbd30 100644
--- a/tests/suites/test_suite_md.data
+++ b/tests/suites/test_suite_md.data
@@ -1,3 +1,4 @@
+# Tests of the generic message digest interface
 MD process
 md_process:
 
diff --git a/tests/suites/test_suite_mdx.data b/tests/suites/test_suite_mdx.data
index b815bd610..56a9c80a3 100644
--- a/tests/suites/test_suite_mdx.data
+++ b/tests/suites/test_suite_mdx.data
@@ -1,3 +1,4 @@
+# Test MD2, MD4, MD5 and RIPEMD160
 md2 Test vector RFC1319 #1
 md2_text:"":"8350e5a3e24c153df2275c9f80692773"
 
diff --git a/tests/suites/test_suite_rsa.data b/tests/suites/test_suite_rsa.data
index 57843e3f7..3b9c5b5e5 100644
--- a/tests/suites/test_suite_rsa.data
+++ b/tests/suites/test_suite_rsa.data
@@ -1,5 +1,6 @@
 RSA PKCS1 Verify v1.5 CAVS #1
 depends_on:POLARSSL_SHA1_C:POLARSSL_PKCS1_V15
+# Good padding but wrong hash
 rsa_pkcs1_verify:"d6248c3e96b1a7e5fea978870fcc4c9786b4e5156e16b7faef4557d667f730b8bc4c784ef00c624df5309513c3a5de8ca94c2152e0459618666d3148092562ebc256ffca45b27fd2d63c68bd5e0a0aefbe496e9e63838a361b1db6fc272464f191490bf9c029643c49d2d9cd08833b8a70b4b3431f56fb1eb55ccd39e77a9c92":RSA_PKCS_V15:POLARSSL_MD_SHA1:1024:16:"e28a13548525e5f36dccb24ecb7cc332cc689dfd64012604c9c7816d72a16c3f5fcdc0e86e7c03280b1c69b586ce0cd8aec722cc73a5d3b730310bf7dfebdc77ce5d94bbc369dc18a2f7b07bd505ab0f82224aef09fdc1e5063234255e0b3c40a52e9e8ae60898eb88a766bdd788fe9493d8fd86bcdd2884d5c06216c65469e5":16:"3":"3203b7647fb7e345aa457681e5131777f1adc371f2fba8534928c4e52ef6206a856425d6269352ecbf64db2f6ad82397768cafdd8cd272e512d617ad67992226da6bc291c31404c17fd4b7e2beb20eff284a44f4d7af47fd6629e2c95809fa7f2241a04f70ac70d3271bb13258af1ed5c5988c95df7fa26603515791075feccd":POLARSSL_ERR_RSA_VERIFY_FAILED
 
 RSA PKCS1 Verify v1.5 CAVS #2
@@ -24,6 +25,7 @@ rsa_pkcs1_verify:"44637d3b8de525fd589237bc81229c8966d3af24540850c24036330db8007e
 
 RSA PKCS1 Verify v1.5 CAVS #7
 depends_on:POLARSSL_SHA512_C:POLARSSL_PKCS1_V15
+# Bad padding after performing the public key operation
 rsa_pkcs1_verify:"d03f12276f6ba7545b8fce719471bd253791878809694e8754f3b389f26c9253a758ed28b4c62535a8d5702d7a778731d5759ff2b3b39b192db680e791632918b6093c0e8ca25c2bf756a07fde4144a37f769fe4054455a45cb8cefe4462e7a9a45ce71f2189b4fef01b47aee8585d44dc9d6fa627a3e5f08801871731f234cd":RSA_PKCS_V15:POLARSSL_MD_SHA384:1024:16:"e28a13548525e5f36dccb24ecb7cc332cc689dfd64012604c9c7816d72a16c3f5fcdc0e86e7c03280b1c69b586ce0cd8aec722cc73a5d3b730310bf7dfebdc77ce5d94bbc369dc18a2f7b07bd505ab0f82224aef09fdc1e5063234255e0b3c40a52e9e8ae60898eb88a766bdd788fe9493d8fd86bcdd2884d5c06216c65469e5":16:"3":"d93a878c1ce86571590b0e43794b3edb23552797c4b8c9e3da4fe1cc4ac0566acd3b10541fe9a7a79f5ea4892d3069ca6903efb5c40c47eb8a9c781eb4249281d40c3d96aae16da1bb4daaece6a26eca5f41c062b4124a64fc9d340cba5ab0d1f5affff6515a87f0933774fd4322d2fa497cd6f708a429ca56dcb1fd3db623d0":POLARSSL_ERR_RSA_INVALID_PADDING
 
 RSA PKCS1 Verify v1.5 CAVS #8
@@ -365,6 +367,7 @@ RSA Generate Key - 2048 bit key
 rsa_gen_key:2048:3:0
 
 RSA Generate Key - 1025 bit key
+# rsa_gen_key only supports even-sized keys
 rsa_gen_key:1025:3:POLARSSL_ERR_RSA_BAD_INPUT_DATA
 
 RSA PKCS1 Encrypt Bad RNG
diff --git a/tests/suites/test_suite_shax.data b/tests/suites/test_suite_shax.data
index cb81cd01c..9ec96f446 100644
--- a/tests/suites/test_suite_shax.data
+++ b/tests/suites/test_suite_shax.data
@@ -1,3 +1,4 @@
+# Test the operation of SHA-1 and SHA-2
 SHA-1 Test Vector NIST CAVS #1
 depends_on:POLARSSL_SHA1_C
 sha1:"":"da39a3ee5e6b4b0d3255bfef95601890afd80709"