diff --git a/crypto/tests/test_check.c b/crypto/tests/test_check.c
index 58e959d1b1..e6fcb42117 100644
--- a/crypto/tests/test_check.c
+++ b/crypto/tests/test_check.c
@@ -41,6 +41,7 @@
 
 #include "address.h"
 #include "aes/aes.h"
+#include "aes/aesccm.h"
 #include "base32.h"
 #include "base58.h"
 #include "bignum.h"
@@ -4108,6 +4109,299 @@ START_TEST(test_aes) {
 }
 END_TEST
 
+// test vectors from
+// https://datatracker.ietf.org/doc/html/rfc3610
+// https://doi.org/10.6028/NIST.SP.800-38C
+START_TEST(test_aesccm) {
+  struct {
+    char *key;
+    char *nonce;
+    char *aad;
+    char *plaintext;
+    int mac_len;
+    char *ciphertext;
+  } vectors[] = {
+      {
+          // RFC 3610 Packet Vector #1
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "00000003020100A0A1A2A3A4A5",
+          "0001020304050607",
+          "08090A0B0C0D0E0F101112131415161718191A1B1C1D1E",
+          8,
+          "588C979A61C663D2F066D0C2C0F989806D5F6B61DAC38417E8D12CFDF926E0",
+      },
+      {
+          // RFC 3610 Packet Vector #2
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "00000004030201A0A1A2A3A4A5",
+          "0001020304050607",
+          "08090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F",
+          8,
+          "72C91A36E135F8CF291CA894085C87E3CC15C439C9E43A3BA091D56E10400916",
+      },
+      {
+          // RFC 3610 Packet Vector #3
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "00000005040302A0A1A2A3A4A5",
+          "0001020304050607",
+          "08090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20",
+          8,
+          "51B1E5F44A197D1DA46B0F8E2D282AE871E838BB64DA8596574ADAA76FBD9FB0C5",
+      },
+      {
+          // RFC 3610 Packet Vector #4
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "00000006050403A0A1A2A3A4A5",
+          "000102030405060708090A0B",
+          "0C0D0E0F101112131415161718191A1B1C1D1E",
+          8,
+          "A28C6865939A9A79FAAA5C4C2A9D4A91CDAC8C96C861B9C9E61EF1",
+      },
+      {
+          // RFC 3610 Packet Vector #5
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "00000007060504A0A1A2A3A4A5",
+          "000102030405060708090A0B",
+          "0C0D0E0F101112131415161718191A1B1C1D1E1F",
+          8,
+          "DCF1FB7B5D9E23FB9D4E131253658AD86EBDCA3E51E83F077D9C2D93",
+      },
+      {
+          // RFC 3610 Packet Vector #6
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "00000008070605A0A1A2A3A4A5",
+          "000102030405060708090A0B",
+          "0C0D0E0F101112131415161718191A1B1C1D1E1F20",
+          8,
+          "6FC1B011F006568B5171A42D953D469B2570A4BD87405A0443AC91CB94",
+      },
+      {
+          // RFC 3610 Packet Vector #7
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "00000009080706A0A1A2A3A4A5",
+          "0001020304050607",
+          "08090A0B0C0D0E0F101112131415161718191A1B1C1D1E",
+          10,
+          "0135D1B2C95F41D5D1D4FEC185D166B8094E999DFED96C048C56602C97ACBB7490",
+      },
+      {
+          // RFC 3610 Packet Vector #8
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "0000000A090807A0A1A2A3A4A5",
+          "0001020304050607",
+          "08090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F",
+          10,
+          "7B75399AC0831DD2F0BBD75879A2FD8F6CAE6B6CD9B7DB24C17B4433F434963F34B"
+          "4",
+      },
+      {
+          // RFC 3610 Packet Vector #9
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "0000000B0A0908A0A1A2A3A4A5",
+          "0001020304050607",
+          "08090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20",
+          10,
+          "82531A60CC24945A4B8279181AB5C84DF21CE7F9B73F42E197EA9C07E56B5EB17E5F"
+          "4E",
+      },
+      {
+          // RFC 3610 Packet Vector #10
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "0000000C0B0A09A0A1A2A3A4A5",
+          "000102030405060708090A0B",
+          "0C0D0E0F101112131415161718191A1B1C1D1E",
+          10,
+          "07342594157785152B074098330ABB141B947B566AA9406B4D999988DD",
+      },
+      {
+          // RFC 3610 Packet Vector #11
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "0000000D0C0B0AA0A1A2A3A4A5",
+          "000102030405060708090A0B",
+          "0C0D0E0F101112131415161718191A1B1C1D1E1F",
+          10,
+          "676BB20380B0E301E8AB79590A396DA78B834934F53AA2E9107A8B6C022C",
+      },
+      {
+          // RFC 3610 Packet Vector #12
+          "C0C1C2C3C4C5C6C7C8C9CACBCCCDCECF",
+          "0000000E0D0C0BA0A1A2A3A4A5",
+          "000102030405060708090A0B",
+          "0C0D0E0F101112131415161718191A1B1C1D1E1F20",
+          10,
+          "C0FFA0D6F05BDB67F24D43A4338D2AA4BED7B20E43CD1AA31662E7AD65D6DB",
+      },
+      {
+          // RFC 3610 Packet Vector #13
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "00412B4EA9CDBE3C9696766CFA",
+          "0BE1A88BACE018B1",
+          "08E8CF97D820EA258460E96AD9CF5289054D895CEAC47C",
+          8,
+          "4CB97F86A2A4689A877947AB8091EF5386A6FFBDD080F8E78CF7CB0CDDD7B3",
+      },
+      {
+          // RFC 3610 Packet Vector #14
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "0033568EF7B2633C9696766CFA",
+          "63018F76DC8A1BCB",
+          "9020EA6F91BDD85AFA0039BA4BAFF9BFB79C7028949CD0EC",
+          8,
+          "4CCB1E7CA981BEFAA0726C55D378061298C85C92814ABC33C52EE81D7D77C08A",
+      },
+      {
+          // RFC 3610 Packet Vector #15
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "00103FE41336713C9696766CFA",
+          "AA6CFA36CAE86B40",
+          "B916E0EACC1C00D7DCEC68EC0B3BBB1A02DE8A2D1AA346132E",
+          8,
+          "B1D23A2220DDC0AC900D9AA03C61FCF4A559A4417767089708A776796EDB723506",
+      },
+      {
+          // RFC 3610 Packet Vector #16
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "00764C63B8058E3C9696766CFA",
+          "D0D0735C531E1BECF049C244",
+          "12DAAC5630EFA5396F770CE1A66B21F7B2101C",
+          8,
+          "14D253C3967B70609B7CBB7C499160283245269A6F49975BCADEAF",
+      },
+      {
+          // RFC 3610 Packet Vector #17
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "00F8B678094E3B3C9696766CFA",
+          "77B60F011C03E1525899BCAE",
+          "E88B6A46C78D63E52EB8C546EFB5DE6F75E9CC0D",
+          8,
+          "5545FF1A085EE2EFBF52B2E04BEE1E2336C73E3F762C0C7744FE7E3C",
+      },
+      {
+          // RFC 3610 Packet Vector #18
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "00D560912D3F703C9696766CFA",
+          "CD9044D2B71FDB8120EA60C0",
+          "6435ACBAFB11A82E2F071D7CA4A5EBD93A803BA87F",
+          8,
+          "009769ECABDF48625594C59251E6035722675E04C847099E5AE0704551",
+      },
+      {
+          // RFC 3610 Packet Vector #19
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "0042FFF8F1951C3C9696766CFA",
+          "D85BC7E69F944FB8",
+          "8A19B950BCF71A018E5E6701C91787659809D67DBEDD18",
+          10,
+          "BC218DAA947427B6DB386A99AC1AEF23ADE0B52939CB6A637CF9BEC2408897C6BA",
+      },
+      {
+          // RFC 3610 Packet Vector #20
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "00920F40E56CDC3C9696766CFA",
+          "74A0EBC9069F5B37",
+          "1761433C37C5A35FC1F39F406302EB907C6163BE38C98437",
+          10,
+          "5810E6FD25874022E80361A478E3E9CF484AB04F447EFFF6F0A477CC2FC9BF54894"
+          "4",
+      },
+      {
+          // RFC 3610 Packet Vector #21
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "0027CA0C7120BC3C9696766CFA",
+          "44A3AA3AAE6475CA",
+          "A434A8E58500C6E41530538862D686EA9E81301B5AE4226BFA",
+          10,
+          "F2BEED7BC5098E83FEB5B31608F8E29C38819A89C8E776F1544D4151A4ED3A8B87B9"
+          "CE",
+      },
+      {
+          // RFC 3610 Packet Vector #22
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "005B8CCBCD9AF83C9696766CFA",
+          "EC46BB63B02520C33C49FD70",
+          "B96B49E21D621741632875DB7F6C9243D2D7C2",
+          10,
+          "31D750A09DA3ED7FDDD49A2032AABF17EC8EBF7D22C8088C666BE5C197",
+      },
+      {
+          // RFC 3610 Packet Vector #23
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "003EBE94044B9A3C9696766CFA",
+          "47A65AC78B3D594227E85E71",
+          "E2FCFBB880442C731BF95167C8FFD7895E337076",
+          10,
+          "E882F1DBD38CE3EDA7C23F04DD65071EB41342ACDF7E00DCCEC7AE52987D",
+      },
+      {
+          // RFC 3610 Packet Vector #24
+          "D7828D13B2B0BDC325A76236DF93CC6B",
+          "008D493B30AE8B3C9696766CFA",
+          "6E37A6EF546D955D34AB6059",
+          "ABF21C0B02FEB88F856DF4A37381BCE3CC128517D4",
+          10,
+          "F32905B88A641B04B9C9FFB58CC390900F3DA12AB16DCE9E82EFA16DA62059",
+      },
+      {
+          // NIST.SP.800-38C Example 1
+          "404142434445464748494a4b4c4d4e4f",
+          "10111213141516",
+          "0001020304050607",
+          "20212223",
+          4,
+          "7162015b4dac255d",
+      },
+      {
+          // NIST.SP.800-38C Example 2
+          "404142434445464748494a4b4c4d4e4f",
+          "1011121314151617",
+          "000102030405060708090a0b0c0d0e0f",
+          "202122232425262728292a2b2c2d2e2f",
+          6,
+          "d2a1f0e051ea5f62081a7792073d593d1fc64fbfaccd",
+      },
+      {
+          // NIST.SP.800-38C Example 3
+          "404142434445464748494a4b4c4d4e4f",
+          "101112131415161718191a1b",
+          "000102030405060708090a0b0c0d0e0f10111213",
+          "202122232425262728292a2b2c2d2e2f3031323334353637",
+          8,
+          "e3b201a9f5b71a7a9b1ceaeccd97e70b6176aad9a4428aa5484392fbc1b09951",
+      }};
+
+  uint8_t nonce[13] = {0};
+  uint8_t aad[20] = {0};
+  uint8_t plaintext[30] = {0};
+  uint8_t ciphertext[40] = {0};
+  for (size_t i = 0; i < sizeof(vectors) / sizeof(vectors[0]); ++i) {
+    aes_encrypt_ctx ctx;
+    aes_encrypt_key128(fromhex(vectors[i].key), &ctx);
+    size_t nonce_len = strlen(vectors[i].nonce) / 2;
+    memcpy(nonce, fromhex(vectors[i].nonce), nonce_len);
+    size_t aad_len = strlen(vectors[i].aad) / 2;
+    memcpy(aad, fromhex(vectors[i].aad), aad_len);
+    size_t plaintext_len = strlen(vectors[i].plaintext) / 2;
+    memcpy(plaintext, fromhex(vectors[i].plaintext), plaintext_len);
+    size_t ciphertext_len = strlen(vectors[i].ciphertext) / 2;
+
+    // Test encryption.
+    AES_RETURN ret =
+        aes_ccm_encrypt(&ctx, nonce, nonce_len, aad, aad_len, plaintext,
+                        plaintext_len, vectors[i].mac_len, ciphertext);
+    ck_assert_int_eq(ret, EXIT_SUCCESS);
+    ck_assert_mem_eq(ciphertext, fromhex(vectors[i].ciphertext),
+                     ciphertext_len);
+
+    // Test decryption.
+    aes_encrypt_key128(fromhex(vectors[i].key), &ctx);
+    ret = aes_ccm_decrypt(&ctx, nonce, nonce_len, aad, aad_len, ciphertext,
+                          ciphertext_len, vectors[i].mac_len, plaintext);
+    ck_assert_int_eq(ret, EXIT_SUCCESS);
+    ck_assert_mem_eq(plaintext, fromhex(vectors[i].plaintext), plaintext_len);
+  }
+}
+END_TEST
+
 #define TEST1 "abc"
 #define TEST2_1 "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
 #define TEST2_2a "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"
@@ -9572,6 +9866,10 @@ Suite *test_suite(void) {
   tcase_add_test(tc, test_aes);
   suite_add_tcase(s, tc);
 
+  tc = tcase_create("aes_ccm");
+  tcase_add_test(tc, test_aesccm);
+  suite_add_tcase(s, tc);
+
   tc = tcase_create("sha2");
   tcase_add_test(tc, test_sha1);
   tcase_add_test(tc, test_sha256);