function runMacTests(options) {
    setup({explicit_done: true});

    var subtle = self.crypto.subtle; // Change to test prefixed implementations

    // When are all these tests really done? When all the promises they use have resolved.
    var all_promises = [];

    // The algorithm-specific vector source provides getTestVectors().
    var testVectors = getTestVectors();

    function operationAlgorithm(vector, nameGetter) {
        var algorithm = options.operationAlgorithm(vector);
        if (nameGetter !== undefined) {
            Object.defineProperty(algorithm, "name", {
                enumerable: true,
                get: nameGetter
            });
        }
        return algorithm;
    }

    // Test verification first, because signing tests rely on that working
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, vector.plaintext)
                .then(function(is_verified) {
                    assert_true(is_verified, "Signature verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " verification");

        }, function(err) {
            // We need a failed test if the importVectorKey operation fails, so
            // we know we never tested verification.
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification");
        });

        all_promises.push(promise);
    });

    // Test verification with an altered buffer during call
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var signature = copyBuffer(vector.signature);
                signature[0] = 255 - signature[0];
                var operation = subtle.verify(operationAlgorithm(vector, function() {
                        signature[0] = vector.signature[0];
                        return options.operationAlgorithm(vector).name;
                    }), vector.key, signature, vector.plaintext)
                .then(function(is_verified) {
                    assert_true(is_verified, "Signature is not verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " verification with altered signature during call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification with altered signature during call");
        });

        all_promises.push(promise);
    });

    // Test verification with an altered buffer after call
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var signature = copyBuffer(vector.signature);
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
                .then(function(is_verified) {
                    assert_true(is_verified, "Signature is not verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                signature[0] = 255 - signature[0];
                return operation;
            }, vector.name + " verification with altered signature after call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification with altered signature after call");
        });

        all_promises.push(promise);
    });

    // Test verification with a transferred buffer during call
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var signature = copyBuffer(vector.signature);
                var operation = subtle.verify(operationAlgorithm(vector, function() {
                        signature.buffer.transfer();
                        return options.operationAlgorithm(vector).name;
                    }), vector.key, signature, vector.plaintext)
                .then(function(is_verified) {
                    assert_false(is_verified, "Signature is NOT verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " verification with transferred signature during call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification with transferred signature during call");
        });

        all_promises.push(promise);
    });

    // Test verification with a transferred buffer after call
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var signature = copyBuffer(vector.signature);
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
                .then(function(is_verified) {
                    assert_true(is_verified, "Signature is not verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                signature.buffer.transfer();
                return operation;
            }, vector.name + " verification with transferred signature after call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification with transferred signature after call");
        });

        all_promises.push(promise);
    });

    // Check for successful verification even if plaintext is altered during call.
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var plaintext = copyBuffer(vector.plaintext);
                plaintext[0] = 255 - plaintext[0];
                var operation = subtle.verify(operationAlgorithm(vector, function() {
                        plaintext[0] = vector.plaintext[0];
                        return options.operationAlgorithm(vector).name;
                    }), vector.key, vector.signature, plaintext)
                .then(function(is_verified) {
                    assert_true(is_verified, "Signature verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " with altered plaintext during call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " with altered plaintext during call");
        });

        all_promises.push(promise);
    });

    // Check for successful verification even if plaintext is altered after call.
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var plaintext = copyBuffer(vector.plaintext);
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, plaintext)
                .then(function(is_verified) {
                    assert_true(is_verified, "Signature verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                plaintext[0] = 255 - plaintext[0];
                return operation;
            }, vector.name + " with altered plaintext after call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " with altered plaintext after call");
        });

        all_promises.push(promise);
    });

    // Check for failed verification if plaintext is transferred during call.
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var plaintext = copyBuffer(vector.plaintext);
                var operation = subtle.verify(operationAlgorithm(vector, function() {
                        plaintext.buffer.transfer();
                        return options.operationAlgorithm(vector).name;
                    }), vector.key, vector.signature, plaintext)
                .then(function(is_verified) {
                    assert_false(is_verified, "Signature is NOT verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " with transferred plaintext during call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " with transferred plaintext during call");
        });

        all_promises.push(promise);
    });

    // Check for successful verification even if plaintext is transferred after call.
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            promise_test(function(test) {
                var plaintext = copyBuffer(vector.plaintext);
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, plaintext)
                .then(function(is_verified) {
                    assert_true(is_verified, "Signature verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                plaintext.buffer.transfer();
                return operation;
            }, vector.name + " with transferred plaintext after call");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " with transferred plaintext after call");
        });

        all_promises.push(promise);
    });

    // Check for failures due to no "verify" usage.
    testVectors.forEach(function(originalVector) {
        var vector = Object.assign({}, originalVector);

        var promise = importVectorKeys(vector, ["sign"])
        .then(function(vector) {
            promise_test(function(test) {
                return subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, vector.plaintext)
                .then(function(plaintext) {
                    assert_unreached("Should have thrown error for no verify usage in " + vector.name + ": '" + err.message + "'");
                }, function(err) {
                    assert_equals(err.name, "InvalidAccessError", "Should throw InvalidAccessError instead of '" + err.message + "'");
                });
            }, vector.name + " no verify usage");
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " no verify usage");
        });

        all_promises.push(promise);
    });

    // Check for successful signing and verification.
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vectors) {
            promise_test(function(test) {
                return subtle.sign(operationAlgorithm(vector), vector.key, vector.plaintext)
                .then(function(signature) {
                    assert_true(equalBuffers(signature, vector.signature), "Signing did not give the expected output");
                    // Can we get the verify the new signature?
                    return subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
                    .then(function(is_verified) {
                        assert_true(is_verified, "Round trip verifies");
                        return signature;
                    }, function(err) {
                        assert_unreached("verify error for test " + vector.name + ": '" + err.message + "'");
                    });
                });
            }, vector.name + " round trip");

        }, function(err) {
            // We need a failed test if the importVectorKey operation fails, so
            // we know we never tested signing or verifying
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " round trip");
        });

        all_promises.push(promise);
    });

    // Test signing with the wrong algorithm
    testVectors.forEach(function(vector) {
        // Want to get the key for the wrong algorithm
        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
        .then(function(wrongKey) {
            return importVectorKeys(vector, ["verify", "sign"])
            .then(function(vectors) {
                promise_test(function(test) {
                    var operation = subtle.sign(operationAlgorithm(vector), wrongKey.privateKey, vector.plaintext)
                    .then(function(signature) {
                        assert_unreached("Signing should not have succeeded for " + vector.name);
                    }, function(err) {
                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
                    });

                    return operation;
                }, vector.name + " signing with wrong algorithm name");

            }, function(err) {
                // We need a failed test if the importVectorKey operation fails, so
                // we know we never tested verification.
                promise_test(function(test) {
                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
                }, "importVectorKeys step: " + vector.name + " signing with wrong algorithm name");
            });
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
            }, "generate wrong key step: " + vector.name + " signing with wrong algorithm name");
        });

        all_promises.push(promise);
    });

    // Test verification with the wrong algorithm
    testVectors.forEach(function(vector) {
        // Want to get the key for the wrong algorithm
        var promise = subtle.generateKey({name: "ECDSA", namedCurve: "P-256", hash: "SHA-256"}, false, ["sign", "verify"])
        .then(function(wrongKey) {
            return importVectorKeys(vector, ["verify", "sign"])
            .then(function(vector) {
                promise_test(function(test) {
                    var operation = subtle.verify(operationAlgorithm(vector), wrongKey.publicKey, vector.signature, vector.plaintext)
                    .then(function(signature) {
                        assert_unreached("Verifying should not have succeeded for " + vector.name);
                    }, function(err) {
                        assert_equals(err.name, "InvalidAccessError", "Should have thrown InvalidAccessError instead of '" + err.message + "'");
                    });

                    return operation;
                }, vector.name + " verifying with wrong algorithm name");

            }, function(err) {
                // We need a failed test if the importVectorKey operation fails, so
                // we know we never tested verification.
                promise_test(function(test) {
                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
                }, "importVectorKeys step: " + vector.name + " verifying with wrong algorithm name");
            });
        }, function(err) {
            promise_test(function(test) {
                assert_unreached("Generate wrong key for test " + vector.name + " failed: '" + err.message + "'");
            }, "generate wrong key step: " + vector.name + " verifying with wrong algorithm name");
        });

        all_promises.push(promise);
    });

    // Verification should fail if the plaintext is changed
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            var plaintext = copyBuffer(vector.plaintext);
            plaintext[0] = 255 - plaintext[0];
            promise_test(function(test) {
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, vector.signature, plaintext)
                .then(function(is_verified) {
                    assert_false(is_verified, "Signature is NOT verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " verification failure due to wrong plaintext");

        }, function(err) {
            // We need a failed test if the importVectorKey operation fails, so
            // we know we never tested verification.
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong plaintext");
        });

        all_promises.push(promise);
    });

    // Verification should fail if the signature is changed
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            var signature = copyBuffer(vector.signature);
            signature[0] = 255 - signature[0];
            promise_test(function(test) {
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
                .then(function(is_verified) {
                    assert_false(is_verified, "Signature is NOT verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " verification failure due to wrong signature");

        }, function(err) {
            // We need a failed test if the importVectorKey operation fails, so
            // we know we never tested verification.
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification failure due to wrong signature");
        });

        all_promises.push(promise);
    });

    // Verification should fail if the signature is wrong length
    testVectors.forEach(function(vector) {
        var promise = importVectorKeys(vector, ["verify", "sign"])
        .then(function(vector) {
            var signature = vector.signature.slice(1); // Drop first byte
            promise_test(function(test) {
                var operation = subtle.verify(operationAlgorithm(vector), vector.key, signature, vector.plaintext)
                .then(function(is_verified) {
                    assert_false(is_verified, "Signature is NOT verified");
                }, function(err) {
                    assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                });

                return operation;
            }, vector.name + " verification failure due to short signature");

        }, function(err) {
            // We need a failed test if the importVectorKey operation fails, so
            // we know we never tested verification.
            promise_test(function(test) {
                assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
            }, "importVectorKeys step: " + vector.name + " verification failure due to short signature");
        });

        all_promises.push(promise);
    });

    if (options.wrongVerificationAlgorithm !== undefined) {
        // Test verification failure due to algorithm-specific parameters.
        testVectors.forEach(function(vector) {
            var promise = importVectorKeys(vector, ["verify", "sign"])
            .then(function(vector) {
                promise_test(function(test) {
                    var operation = subtle.verify(options.wrongVerificationAlgorithm(vector), vector.key, vector.signature, vector.plaintext)
                    .then(function(is_verified) {
                        assert_false(is_verified, "Signature is NOT verified with wrong length");
                    }, function(err) {
                        assert_unreached("Verification should not throw error " + vector.name + ": '" + err.message + "'");
                    });

                    return operation;
                }, vector.name + " verification failure due to wrong length parameter");

            }, function(err) {
                promise_test(function(test) {
                    assert_unreached("importVectorKeys failed for " + vector.name + ". Message: ''" + err.message + "''");
                }, "importVectorKeys step: " + vector.name + " verification failure due to wrong length parameter");
            });

            all_promises.push(promise);
        });
    }



    promise_test(function() {
        return Promise.all(all_promises).finally(done);
    }, "setup");

    // A test vector has all needed fields for signing and verifying, EXCEPT that the
    // key field may be null. This function replaces that null with the Correct
    // CryptoKey object.
    //
    // Returns a Promise that yields an updated vector on success.
    function importVectorKeys(vector, keyUsages) {
        if (vector.key !== null) {
            return Promise.resolve(vector);
        } else {
            return subtle.importKey(options.importFormat, vector.keyBuffer, options.importAlgorithm(vector), false, keyUsages)
            .then(function(key) {
                vector.key = key;
                return vector;
            });
        }
    }

    return;
}