diff --git a/Applet/AndroidSEApplet/src/com/android/javacard/kmapplet/KMKeymintDataStore.java b/Applet/AndroidSEApplet/src/com/android/javacard/kmapplet/KMKeymintDataStore.java
index 109ee1f4..f01199bf 100644
--- a/Applet/AndroidSEApplet/src/com/android/javacard/kmapplet/KMKeymintDataStore.java
+++ b/Applet/AndroidSEApplet/src/com/android/javacard/kmapplet/KMKeymintDataStore.java
@@ -433,7 +433,7 @@ public boolean storeAuthTag(byte[] data, short offset, short length, byte[] scra
     while (index < MAX_BLOB_STORAGE) {
       if ((dataLength((short) (index + AUTH_TAG_1)) == 0)
           || isAuthTagSlotAvailable((short) (index + AUTH_TAG_1), scratchPad, scratchPadOff)) {
-
+        Util.arrayFillNonAtomic(scratchPad, scratchPadOff, AUTH_TAG_ENTRY_SIZE, (byte)0);
         // prepare auth tag buffer
         writeAuthTagState(scratchPad, scratchPadOff, (byte) 1);
         Util.arrayCopyNonAtomic(data, offset, scratchPad, (short) (scratchPadOff + 1), AUTH_TAG_LENGTH);
@@ -897,4 +897,4 @@ public short getBootPatchLevel(byte[] buffer, short start) {
     return (short) bootPatchLevel.length;
   }
 
-}
\ No newline at end of file
+}
diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/seprovider/KMKeymintProvision.java b/Applet/AndroidSEProvider/src/com/android/javacard/seprovider/KMKeymintProvision.java
index a74e08e3..234fb20a 100644
--- a/Applet/AndroidSEProvider/src/com/android/javacard/seprovider/KMKeymintProvision.java
+++ b/Applet/AndroidSEProvider/src/com/android/javacard/seprovider/KMKeymintProvision.java
@@ -18,6 +18,7 @@
 import com.android.javacard.kmdevice.KMRkpDataStore;
 import com.android.javacard.kmdevice.KMSEProvider;
 import com.android.javacard.kmdevice.KMTextString;
+import com.android.javacard.kmdevice.RemotelyProvisionedComponentDevice;
 
 import javacard.framework.APDU;
 import javacard.framework.Util;
@@ -61,7 +62,7 @@ public void processProvisionDeviceUniqueKey(APDU apdu) {
         pubKeyLen, privKeyLen);
     short bcc = ((KMKeymintDevice) kmDeviceInst).generateBcc(false, scratchPad);
     short len = kmDeviceInst.encodeToApduBuffer(bcc, scratchPad, (short) 0,
-    		KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+    		RemotelyProvisionedComponentDevice.MAX_COSE_BUF_SIZE);
     rkpDataStore.storeData(KMDataStoreConstants.BOOT_CERT_CHAIN, scratchPad, (short) 0, len);
     writeProvisionStatus(PROVISION_STATUS_DEVICE_UNIQUE_KEY);
     kmDeviceInst.sendError(apdu, KMError.OK);
diff --git a/Applet/src/com/android/javacard/kmdevice/KMArray.java b/Applet/src/com/android/javacard/kmdevice/KMArray.java
index 4c6b0c98..a8936d93 100644
--- a/Applet/src/com/android/javacard/kmdevice/KMArray.java
+++ b/Applet/src/com/android/javacard/kmdevice/KMArray.java
@@ -137,6 +137,10 @@ private short length() {
     return Util.getShort(heap, (short) (KMType.instanceTable[KM_ARRAY_OFFSET] + TLV_HEADER_SIZE + 2));
   }
 
+  private short setLength(short len) {
+	return Util.setShort(heap, (short) (KMType.instanceTable[KM_ARRAY_OFFSET] + TLV_HEADER_SIZE + 2), len);
+  }
+  
   private byte[] getBuffer() {
     return heap;
   }
@@ -170,7 +174,11 @@ public static short getStartOff(short bPtr) {
   public static short length(short bPtr) {
 	return KMArray.cast(bPtr).length();
   }
-
+ 
+  public static short setLength(short bPtr, short len) {
+	return KMArray.cast(bPtr).setLength(len);
+  }
+  
   public static byte[] getBuffer(short bPtr) {
 	return KMArray.cast(bPtr).getBuffer();
   }
diff --git a/Applet/src/com/android/javacard/kmdevice/KMDecoder.java b/Applet/src/com/android/javacard/kmdevice/KMDecoder.java
index b37740e7..eaee683a 100644
--- a/Applet/src/com/android/javacard/kmdevice/KMDecoder.java
+++ b/Applet/src/com/android/javacard/kmdevice/KMDecoder.java
@@ -344,6 +344,7 @@ private short decodeKeyParam(short exp) {
     short tagClass;
     short allowedType;
     short obj;
+    short arrPos =0;
     // For each tag in payload ...
     while (index < payloadLength) {
       tagFound = false;
@@ -359,13 +360,14 @@ private short decodeKeyParam(short exp) {
           try {
             tagFound = true;
             obj = decode(tagClass);
-            KMArray.add(vals, index, obj);
+            KMArray.add(vals, arrPos++, obj);
             break;
           }catch(KMException e){
             if(KMException.reason() == KMError.INVALID_TAG &&
             !ignoreInvalidTags){
               KMException.throwIt(KMError.INVALID_TAG);
             }
+            break;
           }
         }
         tagInd++;
@@ -376,6 +378,7 @@ private short decodeKeyParam(short exp) {
         index++;
       }
     }
+    KMArray.setLength(vals, arrPos);
     return KMKeyParameters.instance(vals);
   }
 
diff --git a/Applet/src/com/android/javacard/kmdevice/KMKeymasterDevice.java b/Applet/src/com/android/javacard/kmdevice/KMKeymasterDevice.java
index 191aad04..1a8fb68b 100644
--- a/Applet/src/com/android/javacard/kmdevice/KMKeymasterDevice.java
+++ b/Applet/src/com/android/javacard/kmdevice/KMKeymasterDevice.java
@@ -60,7 +60,7 @@ public class KMKeymasterDevice {
   public static byte[] confirmationToken;
   // Subject is a fixed field with only CN= Android Keystore Key - same for all the keys
   private static byte[] defaultSubject;
-  public static final short MAX_COSE_BUF_SIZE = (short) 1024;
+  
   // Top 32 commands are reserved for provisioning.
   private static final byte KEYMINT_CMD_APDU_START = 0x20;
 
@@ -89,7 +89,7 @@ public class KMKeymasterDevice {
   private static final byte INS_ABORT_OPERATION_CMD = KEYMINT_CMD_APDU_START + 19; //0x33
   private static final byte INS_DEVICE_LOCKED_CMD = KEYMINT_CMD_APDU_START + 20;//0x34
   private static final byte INS_EARLY_BOOT_ENDED_CMD = KEYMINT_CMD_APDU_START + 21; //0x35
-  protected static final byte INS_GET_CERT_CHAIN_CMD = KEYMINT_CMD_APDU_START + 22; //0x36
+  private static final byte INS_GET_CERT_CHAIN_CMD = KEYMINT_CMD_APDU_START + 22; //0x36
   private static final byte INS_UPDATE_AAD_OPERATION_CMD = KEYMINT_CMD_APDU_START + 23; //0x37
   private static final byte INS_BEGIN_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 24; //0x38
   private static final byte INS_FINISH_IMPORT_WRAPPED_KEY_CMD = KEYMINT_CMD_APDU_START + 25; //0x39
@@ -108,49 +108,49 @@ public class KMKeymasterDevice {
   private static final byte INS_END_KM_CMD = 0x7F;
 
   // Data Dictionary items
-  public static final byte DATA_ARRAY_SIZE = 40;
-  public static final byte TMP_VARIABLE_ARRAY_SIZE = 5;
-
-  public static final byte KEY_PARAMETERS = 0;
-  public static final byte KEY_CHARACTERISTICS = 1;
-  public static final byte HIDDEN_PARAMETERS = 2;
-  public static final byte HW_PARAMETERS = 3;
-  public static final byte SW_PARAMETERS = 4;
-  public static final byte AUTH_DATA = 5;
-  public static final byte AUTH_TAG = 6;
-  public static final byte NONCE = 7;
-  public static final byte KEY_BLOB = 8;
-  public static final byte AUTH_DATA_LENGTH = 9;
-  public static final byte SECRET = 10;
-  public static final byte ROT = 11;
-  public static final byte DERIVED_KEY = 12;
-  public static final byte RSA_PUB_EXPONENT = 13;
-  public static final byte APP_ID = 14;
-  public static final byte APP_DATA = 15;
-  public static final byte PUB_KEY = 16;
-  public static final byte IMPORTED_KEY_BLOB = 17;
-  public static final byte ORIGIN = 18;
-  public static final byte NOT_USED = 19;
-  public static final byte MASKING_KEY = 20;
-  public static final byte HMAC_SHARING_PARAMS = 21;
-  public static final byte OP_HANDLE = 22;
-  public static final byte IV = 23;
-  public static final byte INPUT_DATA = 24;
-  public static final byte OUTPUT_DATA = 25;
-  public static final byte HW_TOKEN = 26;
-  public static final byte VERIFICATION_TOKEN = 27;
-  public static final byte SIGNATURE = 28;
-  public static final byte ATTEST_KEY_BLOB = 29;
-  public static final byte ATTEST_KEY_PARAMS = 30;
-  public static final byte ATTEST_KEY_ISSUER = 31;
-  public static final byte CERTIFICATE = 32;
-  public static final byte PLAIN_SECRET = 33;
-  public static final byte TEE_PARAMETERS = 34;
-  public static final byte SB_PARAMETERS = 35;
-  public static final byte CONFIRMATION_TOKEN = 36;
+  private static final byte DATA_ARRAY_SIZE = 40;
+  private static final byte TMP_VARIABLE_ARRAY_SIZE = 5;
+
+  protected static final byte KEY_PARAMETERS = 0;
+  private static final byte KEY_CHARACTERISTICS = 1;
+  private static final byte HIDDEN_PARAMETERS = 2;
+  protected static final byte HW_PARAMETERS = 3;
+  private static final byte SW_PARAMETERS = 4;
+  private static final byte AUTH_DATA = 5;
+  private static final byte AUTH_TAG = 6;
+  private static final byte NONCE = 7;
+  private static final byte KEY_BLOB = 8;
+  private static final byte AUTH_DATA_LENGTH = 9;
+  protected static final byte SECRET = 10;
+  private static final byte ROT = 11;
+  private static final byte DERIVED_KEY = 12;
+  private static final byte RSA_PUB_EXPONENT = 13;
+  private static final byte APP_ID = 14;
+  private static final byte APP_DATA = 15;
+  private static final byte PUB_KEY = 16;
+  private static final byte IMPORTED_KEY_BLOB = 17;
+  private static final byte ORIGIN = 18;
+  private static final byte NOT_USED = 19;
+  private static final byte MASKING_KEY = 20;
+  private static final byte HMAC_SHARING_PARAMS = 21;
+  private static final byte OP_HANDLE = 22;
+  private static final byte IV = 23;
+  protected static final byte INPUT_DATA = 24;
+  protected static final byte OUTPUT_DATA = 25;
+  private static final byte HW_TOKEN = 26;
+  private static final byte VERIFICATION_TOKEN = 27;
+  private static final byte SIGNATURE = 28;
+  private static final byte ATTEST_KEY_BLOB = 29;
+  private static final byte ATTEST_KEY_PARAMS = 30;
+  private static final byte ATTEST_KEY_ISSUER = 31;
+  private static final byte CERTIFICATE = 32;
+  private static final byte PLAIN_SECRET = 33;
+  private static final byte TEE_PARAMETERS = 34;
+  private static final byte SB_PARAMETERS = 35;
+  private static final byte CONFIRMATION_TOKEN = 36;
 
   // AddRngEntropy
-  protected static final short MAX_SEED_SIZE = 2048;
+  private static final short MAX_SEED_SIZE = 2048;
 
   // Keyblob constants
   public static final byte KEY_BLOB_SECRET = 0;
@@ -3601,7 +3601,7 @@ private short generateAttestKeyCmd(APDU apdu) {
 	return receiveIncoming(apdu, generateAttestKeyExp());
   }
 
-  private void processGetCertChainCmd(APDU apdu) {
+  protected void processGetCertChainCmd(APDU apdu) {
     // Make the response
     short certChainLen = storeDataInst.getCertificateDataLength(KMDataStoreConstants.CERTIFICATE_CHAIN);
     short int32Ptr = KMInteger.uint_16(KMError.OK);
diff --git a/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java b/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java
index be11a5d3..99337fde 100644
--- a/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java
+++ b/Applet/src/com/android/javacard/kmdevice/KMKeymintDevice.java
@@ -389,10 +389,6 @@ public short validateApduHeader(APDU apdu) {
     byte[] apduBuffer = apdu.getBuffer();
     short P1P2 = Util.getShort(apduBuffer, ISO7816.OFFSET_P1);
     byte ins = apduBuffer[ISO7816.OFFSET_INS];
-    switch (ins) {
-    case INS_GET_CERT_CHAIN_CMD:
-      return KMError.UNSUPPORTED_INSTRUCTION;
-    }
     if (P1P2 != KEYMINT_HAL_VERSION) {
       return KMError.INVALID_P1P2;
     }
@@ -423,7 +419,7 @@ public short generateBcc(boolean testMode, byte[] scratchPad) {
     short coseKey = kmCoseInst.constructCoseKey(KMInteger.uint_8(KMCose.COSE_KEY_TYPE_EC2), KMType.INVALID_VALUE,
         KMNInteger.uint_8(KMCose.COSE_ALG_ES256), KMInteger.uint_8(KMCose.COSE_KEY_OP_VERIFY),
         KMInteger.uint_8(KMCose.COSE_ECCURVE_256), scratchPad, (short) 0, temp, KMType.INVALID_VALUE, false);
-    temp = encodeToApduBuffer(coseKey, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+    temp = encodeToApduBuffer(coseKey, scratchPad, (short) 0, RemotelyProvisionedComponentDevice.MAX_COSE_BUF_SIZE);
     // Construct payload.
     short payload = kmCoseInst.constructCoseCertPayload(
         KMCosePairTextStringTag.instance(KMInteger.uint_8(KMCose.ISSUER),
@@ -435,7 +431,7 @@ public short generateBcc(boolean testMode, byte[] scratchPad) {
         KMCosePairByteBlobTag.instance(KMNInteger.uint_32(KMCose.KEY_USAGE, (short) 0),
             KMByteBlob.instance(KMCose.KEY_USAGE_SIGN, (short) 0, (short) KMCose.KEY_USAGE_SIGN.length)));
     // temp temporarily holds the length of encoded cert payload.
-    temp = encodeToApduBuffer(payload, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+    temp = encodeToApduBuffer(payload, scratchPad, (short) 0, RemotelyProvisionedComponentDevice.MAX_COSE_BUF_SIZE);
     payload = KMByteBlob.instance(scratchPad, (short) 0, temp);
 
     // protected header
@@ -443,7 +439,7 @@ public short generateBcc(boolean testMode, byte[] scratchPad) {
         KMType.INVALID_VALUE, KMType.INVALID_VALUE);
     // temp temporarily holds the length of encoded headers.
     temp = encodeToApduBuffer(protectedHeader, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        RemotelyProvisionedComponentDevice.MAX_COSE_BUF_SIZE);
     protectedHeader = KMByteBlob.instance(scratchPad, (short) 0, temp);
 
     // unprotected headers.
@@ -455,7 +451,7 @@ public short generateBcc(boolean testMode, byte[] scratchPad) {
         payload);
     // temp temporarily holds the length of encoded sign structure.
     // Encode cose Sign_Structure.
-    temp = encodeToApduBuffer(coseSignStructure, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+    temp = encodeToApduBuffer(coseSignStructure, scratchPad, (short) 0, RemotelyProvisionedComponentDevice.MAX_COSE_BUF_SIZE);
     // do sign
     short len = seProvider.ecSign256(deviceUniqueKey, scratchPad, (short) 0, temp, scratchPad, temp);
     coseSignStructure = KMByteBlob.instance(scratchPad, temp, len);
@@ -536,7 +532,7 @@ public short validateCertChain(boolean validateEekRoot, byte expCertAlg,
               KMByteBlob.instance((short) 0),
               KMArray.get(ptr1, KMCose.COSE_SIGN1_PAYLOAD_OFFSET));
       encodedLen = encodeToApduBuffer(signStructure, scratchPad,
-          keySize, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+          keySize, RemotelyProvisionedComponentDevice.MAX_COSE_BUF_SIZE);
 
       if (!seProvider.ecVerify256(scratchPad, (short) 0, keySize, scratchPad, keySize, encodedLen,
           KMByteBlob.getBuffer(KMArray.get(ptr1, KMCose.COSE_SIGN1_SIGNATURE_OFFSET)),
@@ -548,5 +544,10 @@ public short validateCertChain(boolean validateEekRoot, byte expCertAlg,
     }
     return prevCoseKey;
   }
+  
+  @Override
+  protected void processGetCertChainCmd(APDU apdu) {
+	KMException.throwIt(KMError.ATTESTATION_KEYS_NOT_PROVISIONED);
+  }
 
 }
diff --git a/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java b/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java
index 9ca642e7..04192f54 100644
--- a/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java
+++ b/Applet/src/com/android/javacard/kmdevice/RemotelyProvisionedComponentDevice.java
@@ -41,6 +41,7 @@ public class RemotelyProvisionedComponentDevice {
   private static final byte SYSTEM_PATCH_LEVEL_ID = 0x01;
   private static final byte BOOT_PATCH_LEVEL_ID = 0x02;
   private static final byte VENDOR_PATCH_LEVEL_ID = 0x03;
+  public static final short MAX_COSE_BUF_SIZE = (short) 1024;
   // Device Info labels
   public static byte[] BRAND;
   public static byte[] MANUFACTURER;
@@ -117,16 +118,18 @@ public class RemotelyProvisionedComponentDevice {
   private KMSEProvider seProvider;
   private Object[] operation;
   private short[] dataIndex;
-  public static Object[] authorizedEekRoots;
+  private  Object[] authorizedEekRoots;
   private KMKeymintDevice KMAppletInst;
-  protected static KMDataStore storeDataInst;
-  protected static KMRkpDataStore rkpStoreDataInst;
-  protected static KMBootDataStore bootParamsProv;
+  private KMDataStore storeDataInst;
+  private KMRkpDataStore rkpStoreDataInst;
+  private KMBootDataStore bootParamsProv;
   private KMCose kmCoseInst;
+  private short[] deviceIds; 
 
   public RemotelyProvisionedComponentDevice(KMKeymintDevice KMApplet, KMEncoder encoder, KMDecoder decoder,
       KMRepository repository, KMSEProvider seProvider, KMDataStore storeData, KMRkpDataStore rkpStore,
       KMBootDataStore bootParamsProvider) {
+	initStatics();  
     this.encoder = encoder;
     this.decoder = decoder;
     this.repository = repository;
@@ -135,6 +138,7 @@ public RemotelyProvisionedComponentDevice(KMKeymintDevice KMApplet, KMEncoder en
     storeDataInst = storeData;
     rkpStoreDataInst = rkpStore;
     bootParamsProv = bootParamsProvider; 
+    deviceIds = JCSystem.makeTransientShortArray((short) 30, JCSystem.CLEAR_ON_RESET);
     data = JCSystem.makeTransientByteArray(DATA_SIZE, JCSystem.CLEAR_ON_RESET);
     operation = JCSystem.makeTransientObjectArray((short) 1, JCSystem.CLEAR_ON_RESET);
     dataIndex = JCSystem.makeTransientShortArray((short) 1, JCSystem.CLEAR_ON_RESET);
@@ -354,7 +358,7 @@ public void processUpdateKey(APDU apdu) throws Exception {
       short coseKey = validateAndExtractPublicKey(arrInst, scratchPad);
       // Encode CoseKey
       short length = KMAppletInst.encodeToApduBuffer(coseKey, scratchPad, (short) 0,
-          KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+         MAX_COSE_BUF_SIZE);
       // Do Hmac update with input as encoded CoseKey.
       ((KMOperation) operation[0]).update(scratchPad, (short) 0, length);
       // Increment the count each time this function gets executed.
@@ -481,7 +485,7 @@ public void processFinishSendData(APDU apdu) throws Exception {
       short coseEncryptProtectedHeader = getCoseEncryptProtectedHeader(scratchPad);
       short coseEncryptUnProtectedHeader = getCoseEncryptUnprotectedHeader(scratchPad, nonce);
       len = KMAppletInst.encodeToApduBuffer(deviceInfo, scratchPad,
-              (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+              (short) 0,MAX_COSE_BUF_SIZE);
       short encodedDeviceInfo =  KMByteBlob.instance(scratchPad, (short) 0, len);
       updateState(FINISH);
       short arr = KMArray.instance((short) 7);
@@ -680,7 +684,7 @@ private short validateAndExtractPublicKey(short coseMacPtr, byte[] scratchPad) {
             KMByteBlob.instance((short) 0),
             KMArray.get(coseMacPtr, KMCose.COSE_MAC0_PAYLOAD_OFFSET));
     short encodedLen = KMAppletInst.encodeToApduBuffer(macStructure, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        MAX_COSE_BUF_SIZE);
 
     short hmacLen = seProvider.hmacSign(KMByteBlob.getBuffer(macKey),
         KMByteBlob.getStartOff(macKey),
@@ -769,7 +773,7 @@ private void constructPartialPubKeysToSignMac(byte[] scratchPad, short arrayLeng
         KMType.INVALID_VALUE);
     // Encode the protected header as byte blob.
     len = KMAppletInst.encodeToApduBuffer(headerPtr, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        MAX_COSE_BUF_SIZE);
     short protectedHeader = KMByteBlob.instance(scratchPad, (short) 0, len);
     // create MAC_Structure
     ptr =
@@ -777,7 +781,7 @@ private void constructPartialPubKeysToSignMac(byte[] scratchPad, short arrayLeng
             KMByteBlob.instance((short) 0), KMType.INVALID_VALUE);
     // Encode the Mac_structure and do HMAC_Sign to produce the tag for COSE_MAC0
     len = KMAppletInst.encodeToApduBuffer(ptr, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        MAX_COSE_BUF_SIZE);
     // Construct partial payload - Bstr Header + Array Header
     // The maximum combined length of bstr header and array header length is 6 bytes.
     // The lengths will never exceed Max SHORT value.
@@ -814,7 +818,7 @@ private short createSignedMac(KMDeviceUniqueKey deviceUniqueKey, byte[] scratchP
     KMArray.add(aad, (short) 1, deviceMapPtr);
     KMArray.add(aad, (short) 2, pubKeysToSign);
     aad = KMAppletInst.encodeToApduBuffer(aad, scratchPad,
-        (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        (short) 0, MAX_COSE_BUF_SIZE);
     aad = KMByteBlob.instance(scratchPad, (short) 0, aad);
 
     /* construct protected header */
@@ -824,14 +828,14 @@ private short createSignedMac(KMDeviceUniqueKey deviceUniqueKey, byte[] scratchP
         KMType.INVALID_VALUE,
         KMType.INVALID_VALUE);
     protectedHeaders = KMAppletInst.encodeToApduBuffer(protectedHeaders, scratchPad,
-        (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        (short) 0, MAX_COSE_BUF_SIZE);
     protectedHeaders = KMByteBlob.instance(scratchPad, (short) 0, protectedHeaders);
 
     /* construct cose sign structure */
     short signStructure =
         kmCoseInst.constructCoseSignStructure(protectedHeaders, aad, ephmeralMacKey);
     signStructure = KMAppletInst.encodeToApduBuffer(signStructure, scratchPad,
-        (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        (short) 0, MAX_COSE_BUF_SIZE);
     short len =
         seProvider.ecSign256(
             deviceUniqueKey,
@@ -899,23 +903,9 @@ private KMDeviceUniqueKey createDeviceUniqueKey(boolean testMode, byte[] scratch
    */
   private short createDeviceInfo(byte[] scratchpad) {
     // Device Info Key Value pairs.
-    short[] deviceIds = {
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-        KMType.INVALID_VALUE, KMType.INVALID_VALUE,
-    };
+    for(short i = 0; i < 30; i++) {
+      deviceIds[i] =  KMType.INVALID_VALUE;
+    }
     short[] out = {0/* index */, 0 /* length */};
     updateItem(deviceIds, out, BRAND, getAttestationId(KMType.ATTESTATION_ID_BRAND, scratchpad));
     updateItem(deviceIds, out, MANUFACTURER,
@@ -1102,7 +1092,7 @@ private short ecdhHkdfDeriveKey(byte[] privKeyA, short privKeyAOff, short privKe
         kmCoseInst.constructKdfContext(pubKeyA, pubKeyAOff, pubKeyALen, pubKeyB, pubKeyBOff, pubKeyBLen,
             true);
     kdfContext = KMAppletInst
-        .encodeToApduBuffer(kdfContext, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        .encodeToApduBuffer(kdfContext, scratchPad, (short) 0, MAX_COSE_BUF_SIZE);
     kdfContext = KMByteBlob.instance(scratchPad, (short) 0, kdfContext);
 
     Util.arrayFillNonAtomic(scratchPad, (short) 0, (short) 32, (byte) 0);
@@ -1225,7 +1215,7 @@ private short processRecipientStructure(byte[] scratchPad) {
     // Encode the protected header as byte blob.
     protectedHeaderRecipient = KMAppletInst
         .encodeToApduBuffer(protectedHeaderRecipient, scratchPad, (short) 0,
-            KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+            MAX_COSE_BUF_SIZE);
     protectedHeaderRecipient = KMByteBlob.instance(scratchPad, (short) 0, protectedHeaderRecipient);
 
     /* Construct unprotected headers */
@@ -1301,7 +1291,7 @@ private short processBcc(byte[] scratchPad) {
     if (testMode) {
       short bcc = KMAppletInst.generateBcc(true, scratchPad);
       len = KMAppletInst
-          .encodeToApduBuffer(bcc, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+          .encodeToApduBuffer(bcc, scratchPad, (short) 0, MAX_COSE_BUF_SIZE);
     } else {
       byte[] bcc = rkpStoreDataInst.getData(KMDataStoreConstants.BOOT_CERT_CHAIN);
       len = Util.getShort(bcc, (short) 0);
@@ -1328,12 +1318,12 @@ private void processAesGcmUpdateAad(byte[] scratchPad) {
         KMType.INVALID_VALUE);
     // Encode the protected header as byte blob.
     protectedHeader = KMAppletInst.encodeToApduBuffer(protectedHeader, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        MAX_COSE_BUF_SIZE);
     protectedHeader = KMByteBlob.instance(scratchPad, (short) 0, protectedHeader);
     short coseEncryptStr =
         kmCoseInst.constructCoseEncryptStructure(protectedHeader, KMByteBlob.instance((short) 0));
     coseEncryptStr = KMAppletInst.encodeToApduBuffer(coseEncryptStr, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        MAX_COSE_BUF_SIZE);
     ((KMOperation) operation[0]).updateAAD(scratchPad, (short) 0, coseEncryptStr);
   }
 
@@ -1352,7 +1342,7 @@ private short processSignedMac(byte[] scratchPad, short pubKeysToSignMac, short
       KMArray.add(arr, (short) 2, KMType.INVALID_VALUE);
     }
     short len = KMAppletInst
-        .encodeToApduBuffer(arr, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        .encodeToApduBuffer(arr, scratchPad, (short) 0, MAX_COSE_BUF_SIZE);
     short cipherTextLen = ((KMOperation) operation[0])
         .update(scratchPad, (short) 0, len, scratchPad, len);
     Util.arrayCopyNonAtomic(
@@ -1374,7 +1364,7 @@ private short getCoseEncryptProtectedHeader(byte[] scratchPad) {
         KMType.INVALID_VALUE);
     // Encode the protected header as byte blob.
     protectedHeader = KMAppletInst.encodeToApduBuffer(protectedHeader, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        MAX_COSE_BUF_SIZE);
     return KMByteBlob.instance(scratchPad, (short) 0, protectedHeader);
   }
 
@@ -1400,7 +1390,7 @@ private short constructCoseMacForRkpKey(boolean testMode, byte[] scratchPad, sho
             testMode);
     // Encode the cose key and make it as payload.
     short len = KMAppletInst
-        .encodeToApduBuffer(coseKey, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        .encodeToApduBuffer(coseKey, scratchPad, (short) 0, MAX_COSE_BUF_SIZE);
     short payload = KMByteBlob.instance(scratchPad, (short) 0, len);
     // Get the mackey.
     short macKey = getHmacKey(testMode, scratchPad);
@@ -1412,14 +1402,14 @@ private short constructCoseMacForRkpKey(boolean testMode, byte[] scratchPad, sho
         KMType.INVALID_VALUE);
     // Encode the protected header as byte blob.
     len = KMAppletInst
-        .encodeToApduBuffer(headerPtr, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        .encodeToApduBuffer(headerPtr, scratchPad, (short) 0, MAX_COSE_BUF_SIZE);
     short protectedHeader = KMByteBlob.instance(scratchPad, (short) 0, len);
     // create MAC_Structure
     short macStructure =
         kmCoseInst.constructCoseMacStructure(protectedHeader, KMByteBlob.instance((short) 0), payload);
     // Encode the Mac_structure and do HMAC_Sign to produce the tag for COSE_MAC0
     len = KMAppletInst.encodeToApduBuffer(macStructure, scratchPad, (short) 0,
-        KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        MAX_COSE_BUF_SIZE);
     // HMAC Sign.
     short hmacLen = seProvider
         .hmacSign(KMByteBlob.getBuffer(macKey), KMByteBlob.getStartOff(macKey),
@@ -1431,7 +1421,7 @@ private short constructCoseMacForRkpKey(boolean testMode, byte[] scratchPad, sho
                 payload,
                 KMByteBlob.instance(scratchPad, len, hmacLen));
     len = KMAppletInst
-        .encodeToApduBuffer(coseMac0, scratchPad, (short) 0, KMKeymasterDevice.MAX_COSE_BUF_SIZE);
+        .encodeToApduBuffer(coseMac0, scratchPad, (short) 0, MAX_COSE_BUF_SIZE);
     return KMByteBlob.instance(scratchPad, (short) 0, len);
   }