diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index 051586b..8985e49 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -354,6 +354,21 @@
    compliant and is retained only for compatibility. The default value of this
    flag is ``rsa`` which is the TBBR compliant PKCS#1 RSA 2.1 scheme.
 
+-  ``KEY_SIZE``: This build flag enables the user to select the key size for
+   the algorithm specified by ``KEY_ALG``. The valid values for ``KEY_SIZE``
+   depend on the chosen algorithm and the cryptographic module.
+
+   +-----------+------------------------------------+
+   |  KEY_ALG  |        Possible key sizes          |
+   +===========+====================================+
+   |    rsa    | 1024 , 2048 (default), 3072, 4096* |
+   +-----------+------------------------------------+
+   |   ecdsa   |            unavailable             |
+   +-----------+------------------------------------+
+
+   * Only 2048 bits size is available with CryptoCell 712 SBROM release 1.
+     Only 3072 bits size is available with CryptoCell 712 SBROM release 2.
+
 -  ``HASH_ALG``: This build flag enables the user to select the secure hash
    algorithm. It accepts 3 values: ``sha256``, ``sha384`` and ``sha512``.
    The default value of this flag is ``sha256``.
diff --git a/drivers/auth/cryptocell/712/cryptocell_crypto.c b/drivers/auth/cryptocell/712/cryptocell_crypto.c
index 395c550..25eb6bc 100644
--- a/drivers/auth/cryptocell/712/cryptocell_crypto.c
+++ b/drivers/auth/cryptocell/712/cryptocell_crypto.c
@@ -225,7 +225,7 @@
 	/* Verify the signature */
 	error = CCSbVerifySignature((uintptr_t)PLAT_CRYPTOCELL_BASE,
 			(uint32_t *)data_ptr, &pk, &signature,
-			data_len, RSA_PSS_2048);
+			data_len, RSA_PSS);
 	if (error != CC_OK)
 		return CRYPTO_ERR_SIGNATURE;
 
diff --git a/drivers/auth/cryptocell/cryptocell_crypto.mk b/drivers/auth/cryptocell/cryptocell_crypto.mk
index d42a2e7..2fc4ddb 100644
--- a/drivers/auth/cryptocell/cryptocell_crypto.mk
+++ b/drivers/auth/cryptocell/cryptocell_crypto.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -12,6 +12,8 @@
 # Needs to be set to drive mbed TLS configuration correctly
 $(eval $(call add_define,TF_MBEDTLS_KEY_ALG_ID))
 
+$(eval $(call add_define,KEY_SIZE))
+
 # CCSBROM_LIB_PATH must be set to the Cryptocell SBROM library path
 ifeq (${CCSBROM_LIB_PATH},)
   $(error Error: CCSBROM_LIB_PATH not set)
diff --git a/include/drivers/arm/cryptocell/712/rsa.h b/include/drivers/arm/cryptocell/712/rsa.h
index cd9925b..825214d 100644
--- a/include/drivers/arm/cryptocell/712/rsa.h
+++ b/include/drivers/arm/cryptocell/712/rsa.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -21,19 +21,21 @@
 
 /************************ Defines ******************************/
 
-/* the modulus size ion bits */
+/* the modulus size in bits */
+#if (KEY_SIZE == 2048)
 #define RSA_MOD_SIZE_IN_BITS				2048UL
+#elif (KEY_SIZE == 3072)
+#define RSA_MOD_SIZE_IN_BITS				3072UL
+#else
+#error Unsupported CryptoCell key size requested
+#endif
+
 #define RSA_MOD_SIZE_IN_BYTES				(CALC_FULL_BYTES(RSA_MOD_SIZE_IN_BITS))
 #define RSA_MOD_SIZE_IN_WORDS				(CALC_FULL_32BIT_WORDS(RSA_MOD_SIZE_IN_BITS))
 #define RSA_MOD_SIZE_IN_256BITS				(RSA_MOD_SIZE_IN_WORDS/8)
 #define RSA_EXP_SIZE_IN_BITS				17UL
 #define RSA_EXP_SIZE_IN_BYTES				(CALC_FULL_BYTES(RSA_EXP_SIZE_IN_BITS))
 
-/* size of buffer for Barrett modulus tag NP, used in PKA algorithms */
-#define RSA_HW_PKI_PKA_BARRETT_MOD_TAG_SIZE_IN_BITS	132
-#define RSA_HW_PKI_PKA_BARRETT_MOD_TAG_SIZE_IN_BYTES	(CALC_FULL_BYTES(RSA_HW_PKI_PKA_BARRETT_MOD_TAG_SIZE_IN_BITS))
-#define RSA_HW_PKI_PKA_BARRETT_MOD_TAG_SIZE_IN_WORDS	(CALC_FULL_32BIT_WORDS(RSA_HW_PKI_PKA_BARRETT_MOD_TAG_SIZE_IN_BITS))
-
 /*
  * @brief The RSA_CalcNp calculates Np value and saves it into Np_ptr:
  *
diff --git a/include/drivers/arm/cryptocell/712/secureboot_gen_defs.h b/include/drivers/arm/cryptocell/712/secureboot_gen_defs.h
index 68b9ef8..ed1f283 100644
--- a/include/drivers/arm/cryptocell/712/secureboot_gen_defs.h
+++ b/include/drivers/arm/cryptocell/712/secureboot_gen_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -24,7 +24,14 @@
 /***********************/
 
 /*RSA definitions*/
+#if (KEY_SIZE == 2048)
 #define SB_RSA_MOD_SIZE_IN_WORDS		 64
+#elif (KEY_SIZE == 3072)
+#define SB_RSA_MOD_SIZE_IN_WORDS		96
+#else
+#error Unsupported CryptoCell key size requested
+#endif
+
 #define SB_RSA_HW_PKI_PKA_BARRETT_MOD_TAG_SIZE_IN_WORDS 5
 
 
@@ -43,9 +50,12 @@
 /********* Supported algorithms definitions ***********/
 
 /*! RSA supported algorithms */
+/* Note: this applies to either 2k or 3k based on CryptoCell SBROM library
+ * version - it means 2k in version 1 and 3k in version 2 (yes, really).
+ */
 typedef enum {
-	RSA_PSS_2048           = 0x01,			/*!< RSA PSS 2048 after hash SHA 256 */
-	RSA_PKCS15_2048	       = 0x02,			/*!< RSA PKX15 */
+	RSA_PSS                = 0x01,			/*!< RSA PSS after hash SHA 256 */
+	RSA_PKCS15	       = 0x02,			/*!< RSA PKX15 */
 	RSA_Last               = 0x7FFFFFFF
 } CCSbRsaAlg_t;
 
diff --git a/plat/rockchip/rk3399/drivers/dp/cdn_dp.c b/plat/rockchip/rk3399/drivers/dp/cdn_dp.c
index aa71fde..a8773f4 100644
--- a/plat/rockchip/rk3399/drivers/dp/cdn_dp.c
+++ b/plat/rockchip/rk3399/drivers/dp/cdn_dp.c
@@ -18,7 +18,7 @@
 	".global hdcp_handler\n"
 	".balign 4\n"
 	"hdcp_handler:\n"
-	".incbin \"" __XSTRING(HDCPFW) "\"\n"
+	".incbin \"" HDCPFW "\"\n"
 	".type hdcp_handler, %function\n"
 	".size hdcp_handler, .- hdcp_handler\n"
 	".popsection\n"
diff --git a/plat/rockchip/rk3399/drivers/pmu/pmu_fw.c b/plat/rockchip/rk3399/drivers/pmu/pmu_fw.c
index a09ad21..25596b1 100644
--- a/plat/rockchip/rk3399/drivers/pmu/pmu_fw.c
+++ b/plat/rockchip/rk3399/drivers/pmu/pmu_fw.c
@@ -5,20 +5,18 @@
  */
 
 /* convoluted way to make sure that the define is pasted just the right way */
-#define _INCBIN(file, sym, sec) \
+#define INCBIN(file, sym, sec) \
 	__asm__( \
-		".section " #sec "\n" \
-		".global " #sym "\n" \
-		".type " #sym ", %object\n" \
+		".section " sec "\n" \
+		".global " sym "\n" \
+		".type " sym ", %object\n" \
 		".align 4\n" \
-		#sym ":\n" \
-		".incbin \"" #file "\"\n" \
-		".size " #sym ", .-" #sym "\n" \
-		".global " #sym "_end\n" \
-		#sym "_end:\n" \
+		sym ":\n" \
+		".incbin \"" file "\"\n" \
+		".size " sym ", .-" sym "\n" \
+		".global " sym "_end\n" \
+		sym "_end:\n" \
 	)
 
-#define INCBIN(file, sym, sec) _INCBIN(file, sym, sec)
-
-INCBIN(RK3399M0FW, rk3399m0_bin, ".sram.incbin");
-INCBIN(RK3399M0PMUFW, rk3399m0pmu_bin, ".pmusram.incbin");
+INCBIN(RK3399M0FW, "rk3399m0_bin", ".sram.incbin");
+INCBIN(RK3399M0PMUFW, "rk3399m0pmu_bin", ".pmusram.incbin");
diff --git a/plat/rockchip/rk3399/platform.mk b/plat/rockchip/rk3399/platform.mk
index cfc48e8..643c24f 100644
--- a/plat/rockchip/rk3399/platform.mk
+++ b/plat/rockchip/rk3399/platform.mk
@@ -82,13 +82,13 @@
 BUILD_M0		:=	${BUILD_PLAT}/m0
 
 RK3399M0FW=${BUILD_M0}/${PLAT_M0}.bin
-$(eval $(call add_define,RK3399M0FW))
+$(eval $(call add_define_val,RK3399M0FW,\"$(RK3399M0FW)\"))
 
 RK3399M0PMUFW=${BUILD_M0}/${PLAT_M0}pmu.bin
-$(eval $(call add_define,RK3399M0PMUFW))
+$(eval $(call add_define_val,RK3399M0PMUFW,\"$(RK3399M0PMUFW)\"))
 
 HDCPFW=${RK_PLAT_SOC}/drivers/dp/hdcp.bin
-$(eval $(call add_define,HDCPFW))
+$(eval $(call add_define_val,HDCPFW,\"$(HDCPFW)\"))
 
 # CCACHE_EXTRAFILES is needed because ccache doesn't handle .incbin
 export CCACHE_EXTRAFILES