diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java
index b706d5ed..3fb36539 100644
--- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java
+++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMConfigurations.java
@@ -23,4 +23,5 @@ public class KMConfigurations {
   // If the size of the attestation ids is known and lesser than 64
   // then reduce the size here. It reduces the heap memory usage.
   public static final byte MAX_ATTESTATION_IDS_SIZE = 64;
+  public static final short MAX_SUBJECT_DER_LEN = 1095;
 }
diff --git a/Applet/src/com/android/javacard/keymaster/KMOperationState.java b/Applet/src/com/android/javacard/keymaster/KMOperationState.java
index 8c9bb545..9ad4f5e0 100644
--- a/Applet/src/com/android/javacard/keymaster/KMOperationState.java
+++ b/Applet/src/com/android/javacard/keymaster/KMOperationState.java
@@ -311,8 +311,9 @@ public byte getBufferingMode() {
     short padding = getPadding();
     short blockMode = getBlockMode();
 
-    if (alg == KMType.RSA && digest == KMType.DIGEST_NONE && purpose == KMType.SIGN) {
-      return KMType.BUF_RSA_NO_DIGEST;
+    if (alg == KMType.RSA && ((digest == KMType.DIGEST_NONE && purpose == KMType.SIGN) ||
+    				purpose == KMType.DECRYPT)) {
+      return KMType.BUF_RSA_DECRYPT_OR_NO_DIGEST;
     }
 
     if (alg == KMType.EC && digest == KMType.DIGEST_NONE && purpose == KMType.SIGN) {
diff --git a/Applet/src/com/android/javacard/keymaster/KMType.java b/Applet/src/com/android/javacard/keymaster/KMType.java
index ccb9e37d..2bee7326 100644
--- a/Applet/src/com/android/javacard/keymaster/KMType.java
+++ b/Applet/src/com/android/javacard/keymaster/KMType.java
@@ -346,7 +346,7 @@ public abstract class KMType {
   public static final byte FAKE_CERT = 3;
   // Buffering Mode
   public static final byte BUF_NONE = 0;
-  public static final byte BUF_RSA_NO_DIGEST = 1;
+  public static final byte BUF_RSA_DECRYPT_OR_NO_DIGEST = 1;
   public static final byte BUF_EC_NO_DIGEST = 2;
   public static final byte BUF_AES_ENCRYPT_PKCS7_BLOCK_ALIGN = 3;
   public static final byte BUF_AES_DECRYPT_PKCS7_BLOCK_ALIGN = 4;
diff --git a/HAL/JavacardKeyMintOperation.cpp b/HAL/JavacardKeyMintOperation.cpp
index 4d97c6d4..2dc0c71c 100644
--- a/HAL/JavacardKeyMintOperation.cpp
+++ b/HAL/JavacardKeyMintOperation.cpp
@@ -62,7 +62,7 @@ ScopedAStatus JavacardKeyMintOperation::update(const vector<uint8_t>& input,
         return km_utils::kmError2ScopedAStatus(err);
     }
     if (!(bufferingMode_ == BufferingMode::EC_NO_DIGEST ||
-          bufferingMode_ == BufferingMode::RSA_NO_DIGEST)) {
+          bufferingMode_ == BufferingMode::RSA_DECRYPT_OR_NO_DIGEST)) {
         if (view.length > MAX_CHUNK_SIZE) {
             err = updateInChunks(view, aToken, tToken, output);
             if (err != KM_ERROR_OK) {
@@ -86,7 +86,7 @@ ScopedAStatus JavacardKeyMintOperation::finish(
     DataView view = {.buffer = {}, .data = inData, .start = 0, .length = inData.size()};
     const vector<uint8_t> sign = signature.value_or(vector<uint8_t>());
     if (!(bufferingMode_ == BufferingMode::EC_NO_DIGEST ||
-          bufferingMode_ == BufferingMode::RSA_NO_DIGEST)) {
+          bufferingMode_ == BufferingMode::RSA_DECRYPT_OR_NO_DIGEST)) {
         appendBufferedData(view);  
         if (view.length > MAX_CHUNK_SIZE) {
             auto err = updateInChunks(view, aToken, tToken, output);
@@ -166,7 +166,7 @@ uint16_t JavacardKeyMintOperation::getDataViewOffset(DataView& view, uint16_t bl
 keymaster_error_t JavacardKeyMintOperation::bufferData(DataView& view) {
     if (view.data.empty()) return KM_ERROR_OK;  // nothing to buffer
     switch (bufferingMode_) {
-    case BufferingMode::RSA_NO_DIGEST:
+    case BufferingMode::RSA_DECRYPT_OR_NO_DIGEST:
         buffer_.insert(buffer_.end(), view.data.begin(), view.data.end());
         if (buffer_.size() > RSA_BUFFER_SIZE) {
             abort();
diff --git a/HAL/JavacardKeyMintOperation.h b/HAL/JavacardKeyMintOperation.h
index 2f9815e2..0bfeaa86 100644
--- a/HAL/JavacardKeyMintOperation.h
+++ b/HAL/JavacardKeyMintOperation.h
@@ -41,11 +41,11 @@ using std::vector;
 
 // Bufferig modes for update
 enum class BufferingMode : int32_t {
-    NONE = 0,           // Send everything to javacard - most of the assymteric operations
-    RSA_NO_DIGEST = 1,  // Buffer everything in update upto 256 bytes and send in finish. If
-                        // input data is greater then 256 bytes then it is an error. Javacard
-                        // will further check according to exact key size and crypto provider.
-    EC_NO_DIGEST = 2,   // Buffer upto 65 bytes and then truncate. Javacard will further truncate
+    NONE = 0,                     // Send everything to javacard - most of the assymteric operations
+    RSA_DECRYPT_OR_NO_DIGEST = 1, // Buffer everything in update upto 256 bytes and send in finish. If
+                                  // input data is greater then 256 bytes then it is an error. Javacard
+                                  // will further check according to exact key size and crypto provider.
+    EC_NO_DIGEST = 2,             // Buffer upto 65 bytes and then truncate. Javacard will further truncate
                         // upto exact keysize.
     BUF_AES_ENCRYPT_PKCS7_BLOCK_ALIGNED = 3, // Buffer 16 bytes.
     BUF_AES_DECRYPT_PKCS7_BLOCK_ALIGNED = 4, // Buffer 16 bytes.