Is this really the lowest version with CMAC in? You should also check that `|| !defined(OPENSSL_NO_CMAC)` in case a platform turns it off. (I think that is the right macro...)