cipher: Use const for *_spec_t, if possible.

* cipher/blake2.c: Use const.
* cipher/camellia-glue.c, cipher/cipher.c, cipher/crc.c: Likewise.
* cipher/des.c, cipher/gost28147.c, cipher/gostr3411-94.c: Likewise.
* cipher/keccak.c, cipher/mac-cmac.c, cipher/mac-gmac.c: Likewise.
* cipher/mac-hmac.c, cipher/mac-internal.h: Likewise.
* cipher/mac-poly1305.c, cipher/mac.c, cipher/md.c: Likewise.
* cipher/md.c, cipher/md2.c, cipher/md4.c, cipher/md5.c: Likewise.
* cipher/pubkey.c, cipher/rfc2268.c, cipher/rijndael.c: Likewise.
* cipher/rmd160.c, cipher/seed.c, cipher/serpent.c: Likewise.
* cipher/sha1.c, cipher/sha256.c, cipher/sha512.c: Likewise.
* cipher/sm3.c, cipher/sm4.c, cipher/stribog.c: Likewise.
* cipher/pubkey.c, cipher/rfc2268.c, cipher/rijndael.c: Likewise.
* src/cipher-proto.h, src/cipher.h: Likewise.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>

34 files changed, 303 insertions, 291 deletions

diff --git a/cipher/blake2.c b/cipher/blake2.c
index 750c00c3..642c5bfd 100644
--- a/cipher/blake2.c
+++ b/cipher/blake2.c
@@ -958,13 +958,13 @@ gcry_err_code_t _gcry_blake2_init_with_key(void *ctx, unsigned int flags,
     blake2##bs##_final (&hd); \
     memcpy (outbuf, blake2##bs##_read (&hd), dbits / 8); \
   } \
-  static byte blake2##bs##_##dbits##_asn[] = { 0x30 }; \
-  static gcry_md_oid_spec_t oid_spec_blake2##bs##_##dbits[] = \
+  static const byte blake2##bs##_##dbits##_asn[] = { 0x30 }; \
+  static const gcry_md_oid_spec_t oid_spec_blake2##bs##_##dbits[] = \
     { \
       { " 1.3.6.1.4.1.1722.12.2." oid_branch }, \
       { NULL } \
     }; \
-  gcry_md_spec_t _gcry_digest_spec_blake2##bs##_##dbits = \
+  const gcry_md_spec_t _gcry_digest_spec_blake2##bs##_##dbits = \
     { \
       GCRY_MD_BLAKE2##BS##_##dbits, {0, 0}, \
       "BLAKE2" #BS "_" #dbits, blake2##bs##_##dbits##_asn, \
diff --git a/cipher/camellia-glue.c b/cipher/camellia-glue.c
index 23cbec81..72c02d77 100644
--- a/cipher/camellia-glue.c
+++ b/cipher/camellia-glue.c
@@ -1146,7 +1146,7 @@ selftest(void)
    <http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications_oid.html>,
    retrieved May 1, 2007. */
 
-static gcry_cipher_oid_spec_t camellia128_oids[] =
+static const gcry_cipher_oid_spec_t camellia128_oids[] =
   {
     {"1.2.392.200011.61.1.1.1.2", GCRY_CIPHER_MODE_CBC},
     {"0.3.4401.5.3.1.9.1", GCRY_CIPHER_MODE_ECB},
@@ -1155,7 +1155,7 @@ static gcry_cipher_oid_spec_t camellia128_oids[] =
     { NULL }
   };
 
-static gcry_cipher_oid_spec_t camellia192_oids[] =
+static const gcry_cipher_oid_spec_t camellia192_oids[] =
   {
     {"1.2.392.200011.61.1.1.1.3", GCRY_CIPHER_MODE_CBC},
     {"0.3.4401.5.3.1.9.21", GCRY_CIPHER_MODE_ECB},
@@ -1164,7 +1164,7 @@ static gcry_cipher_oid_spec_t camellia192_oids[] =
     { NULL }
   };
 
-static gcry_cipher_oid_spec_t camellia256_oids[] =
+static const gcry_cipher_oid_spec_t camellia256_oids[] =
   {
     {"1.2.392.200011.61.1.1.1.4", GCRY_CIPHER_MODE_CBC},
     {"0.3.4401.5.3.1.9.41", GCRY_CIPHER_MODE_ECB},
diff --git a/cipher/cipher.c b/cipher/cipher.c
index 4890777d..3e2b70a5 100644
--- a/cipher/cipher.c
+++ b/cipher/cipher.c
@@ -274,7 +274,7 @@ static gcry_cipher_spec_t *
 spec_from_oid (const char *oid)
 {
   gcry_cipher_spec_t *spec;
-  gcry_cipher_oid_spec_t *oid_specs;
+  const gcry_cipher_oid_spec_t *oid_specs;
   int idx, j;
 
   for (idx=0; (spec = cipher_list[idx]); idx++)
diff --git a/cipher/crc.c b/cipher/crc.c
index db8d8dc9..b38869ec 100644
--- a/cipher/crc.c
+++ b/cipher/crc.c
@@ -927,7 +927,7 @@ crc24rfc2440_final (void *context)
 /* We allow the CRC algorithms even in FIPS mode because they are
    actually no cryptographic primitives.  */
 
-gcry_md_spec_t _gcry_digest_spec_crc32 =
+const gcry_md_spec_t _gcry_digest_spec_crc32 =
   {
     GCRY_MD_CRC32, {0, 1},
     "CRC32", NULL, 0, NULL, 4,
@@ -936,7 +936,7 @@ gcry_md_spec_t _gcry_digest_spec_crc32 =
     sizeof (CRC_CONTEXT)
   };
 
-gcry_md_spec_t _gcry_digest_spec_crc32_rfc1510 =
+const gcry_md_spec_t _gcry_digest_spec_crc32_rfc1510 =
   {
     GCRY_MD_CRC32_RFC1510, {0, 1},
     "CRC32RFC1510", NULL, 0, NULL, 4,
@@ -945,7 +945,7 @@ gcry_md_spec_t _gcry_digest_spec_crc32_rfc1510 =
     sizeof (CRC_CONTEXT)
   };
 
-gcry_md_spec_t _gcry_digest_spec_crc24_rfc2440 =
+const gcry_md_spec_t _gcry_digest_spec_crc24_rfc2440 =
   {
     GCRY_MD_CRC24_RFC2440, {0, 1},
     "CRC24RFC2440", NULL, 0, NULL, 3,
diff --git a/cipher/des.c b/cipher/des.c
index ddab0e45..51116fcf 100644
--- a/cipher/des.c
+++ b/cipher/des.c
@@ -1486,7 +1486,7 @@ gcry_cipher_spec_t _gcry_cipher_spec_des =
     do_des_setkey, do_des_encrypt, do_des_decrypt
   };
 
-static gcry_cipher_oid_spec_t oids_tripledes[] =
+static const gcry_cipher_oid_spec_t oids_tripledes[] =
   {
     { "1.2.840.113549.3.7", GCRY_CIPHER_MODE_CBC },
     /* Teletrust specific OID for 3DES. */
diff --git a/cipher/gost28147.c b/cipher/gost28147.c
index 9445b378..f094d5ba 100644
--- a/cipher/gost28147.c
+++ b/cipher/gost28147.c
@@ -277,7 +277,7 @@ gost_encrypt_block_mesh (void *c, byte *outbuf, const byte *inbuf)
   return /* burn_stack */ burn + 6*sizeof(void*) /* func call */;
 }
 
-static gcry_cipher_oid_spec_t oids_gost28147_mesh[] =
+static const gcry_cipher_oid_spec_t oids_gost28147_mesh[] =
   {
     { "1.2.643.2.2.21", GCRY_CIPHER_MODE_CFB },
     /* { "1.2.643.2.2.31.0", GCRY_CIPHER_MODE_CNTGOST }, */
@@ -546,7 +546,7 @@ static gcry_mac_spec_ops_t gost_imit_ops = {
   NULL
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_gost28147_imit =
+const gcry_mac_spec_t _gcry_mac_type_spec_gost28147_imit =
   {
     GCRY_MAC_GOST28147_IMIT, {0, 0}, "GOST28147_IMIT",
     &gost_imit_ops
diff --git a/cipher/gostr3411-94.c b/cipher/gostr3411-94.c
index 588d5dc1..93de83b4 100644
--- a/cipher/gostr3411-94.c
+++ b/cipher/gostr3411-94.c
@@ -353,10 +353,10 @@ gost3411_read (void *context)
   return hd->result;
 }
 
-static unsigned char asn[6] = /* Object ID is 1.2.643.2.2.3 */
+static const unsigned char asn[6] = /* Object ID is 1.2.643.2.2.3 */
   { 0x2a, 0x85, 0x03, 0x02, 0x02, 0x03 };
 
-static gcry_md_oid_spec_t oid_spec_gostr3411[] =
+static const gcry_md_oid_spec_t oid_spec_gostr3411[] =
   {
     /* iso.member-body.ru.rans.cryptopro.3 (gostR3411-94-with-gostR3410-2001) */
     { "1.2.643.2.2.3" },
@@ -365,7 +365,7 @@ static gcry_md_oid_spec_t oid_spec_gostr3411[] =
     {NULL},
   };
 
-gcry_md_spec_t _gcry_digest_spec_gost3411_94 =
+const gcry_md_spec_t _gcry_digest_spec_gost3411_94 =
   {
     GCRY_MD_GOSTR3411_94, {0, 0},
     "GOSTR3411_94", NULL, 0, NULL, 32,
@@ -373,7 +373,7 @@ gcry_md_spec_t _gcry_digest_spec_gost3411_94 =
     NULL,
     sizeof (GOSTR3411_CONTEXT)
   };
-gcry_md_spec_t _gcry_digest_spec_gost3411_cp =
+const gcry_md_spec_t _gcry_digest_spec_gost3411_cp =
   {
     GCRY_MD_GOSTR3411_CP, {0, 0},
     "GOSTR3411_CP", asn, DIM (asn), oid_spec_gostr3411, 32,
diff --git a/cipher/keccak.c b/cipher/keccak.c
index c03a1fac..f3502022 100644
--- a/cipher/keccak.c
+++ b/cipher/keccak.c
@@ -1456,48 +1456,48 @@ run_selftests (int algo, int extended, selftest_report_func_t report)
 
 
 
-static byte sha3_224_asn[] = { 0x30 };
-static gcry_md_oid_spec_t oid_spec_sha3_224[] =
+static const byte sha3_224_asn[] = { 0x30 };
+static const gcry_md_oid_spec_t oid_spec_sha3_224[] =
   {
     { "2.16.840.1.101.3.4.2.7" },
     /* PKCS#1 sha3_224WithRSAEncryption */
     { "?" },
     { NULL }
   };
-static byte sha3_256_asn[] = { 0x30 };
-static gcry_md_oid_spec_t oid_spec_sha3_256[] =
+static const byte sha3_256_asn[] = { 0x30 };
+static const gcry_md_oid_spec_t oid_spec_sha3_256[] =
   {
     { "2.16.840.1.101.3.4.2.8" },
     /* PKCS#1 sha3_256WithRSAEncryption */
     { "?" },
     { NULL }
   };
-static byte sha3_384_asn[] = { 0x30 };
-static gcry_md_oid_spec_t oid_spec_sha3_384[] =
+static const byte sha3_384_asn[] = { 0x30 };
+static const gcry_md_oid_spec_t oid_spec_sha3_384[] =
   {
     { "2.16.840.1.101.3.4.2.9" },
     /* PKCS#1 sha3_384WithRSAEncryption */
     { "?" },
     { NULL }
   };
-static byte sha3_512_asn[] = { 0x30 };
-static gcry_md_oid_spec_t oid_spec_sha3_512[] =
+static const byte sha3_512_asn[] = { 0x30 };
+static const gcry_md_oid_spec_t oid_spec_sha3_512[] =
   {
     { "2.16.840.1.101.3.4.2.10" },
     /* PKCS#1 sha3_512WithRSAEncryption */
     { "?" },
     { NULL }
   };
-static byte shake128_asn[] = { 0x30 };
-static gcry_md_oid_spec_t oid_spec_shake128[] =
+static const byte shake128_asn[] = { 0x30 };
+static const gcry_md_oid_spec_t oid_spec_shake128[] =
   {
     { "2.16.840.1.101.3.4.2.11" },
     /* PKCS#1 shake128WithRSAEncryption */
     { "?" },
     { NULL }
   };
-static byte shake256_asn[] = { 0x30 };
-static gcry_md_oid_spec_t oid_spec_shake256[] =
+static const byte shake256_asn[] = { 0x30 };
+static const gcry_md_oid_spec_t oid_spec_shake256[] =
   {
     { "2.16.840.1.101.3.4.2.12" },
     /* PKCS#1 shake256WithRSAEncryption */
@@ -1505,7 +1505,7 @@ static gcry_md_oid_spec_t oid_spec_shake256[] =
     { NULL }
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha3_224 =
+const gcry_md_spec_t _gcry_digest_spec_sha3_224 =
   {
     GCRY_MD_SHA3_224, {0, 1},
     "SHA3-224", sha3_224_asn, DIM (sha3_224_asn), oid_spec_sha3_224, 28,
@@ -1514,7 +1514,7 @@ gcry_md_spec_t _gcry_digest_spec_sha3_224 =
     sizeof (KECCAK_CONTEXT),
     run_selftests
   };
-gcry_md_spec_t _gcry_digest_spec_sha3_256 =
+const gcry_md_spec_t _gcry_digest_spec_sha3_256 =
   {
     GCRY_MD_SHA3_256, {0, 1},
     "SHA3-256", sha3_256_asn, DIM (sha3_256_asn), oid_spec_sha3_256, 32,
@@ -1523,7 +1523,7 @@ gcry_md_spec_t _gcry_digest_spec_sha3_256 =
     sizeof (KECCAK_CONTEXT),
     run_selftests
   };
-gcry_md_spec_t _gcry_digest_spec_sha3_384 =
+const gcry_md_spec_t _gcry_digest_spec_sha3_384 =
   {
     GCRY_MD_SHA3_384, {0, 1},
     "SHA3-384", sha3_384_asn, DIM (sha3_384_asn), oid_spec_sha3_384, 48,
@@ -1532,7 +1532,7 @@ gcry_md_spec_t _gcry_digest_spec_sha3_384 =
     sizeof (KECCAK_CONTEXT),
     run_selftests
   };
-gcry_md_spec_t _gcry_digest_spec_sha3_512 =
+const gcry_md_spec_t _gcry_digest_spec_sha3_512 =
   {
     GCRY_MD_SHA3_512, {0, 1},
     "SHA3-512", sha3_512_asn, DIM (sha3_512_asn), oid_spec_sha3_512, 64,
@@ -1541,7 +1541,7 @@ gcry_md_spec_t _gcry_digest_spec_sha3_512 =
     sizeof (KECCAK_CONTEXT),
     run_selftests
   };
-gcry_md_spec_t _gcry_digest_spec_shake128 =
+const gcry_md_spec_t _gcry_digest_spec_shake128 =
   {
     GCRY_MD_SHAKE128, {0, 1},
     "SHAKE128", shake128_asn, DIM (shake128_asn), oid_spec_shake128, 0,
@@ -1550,7 +1550,7 @@ gcry_md_spec_t _gcry_digest_spec_shake128 =
     sizeof (KECCAK_CONTEXT),
     run_selftests
   };
-gcry_md_spec_t _gcry_digest_spec_shake256 =
+const gcry_md_spec_t _gcry_digest_spec_shake256 =
   {
     GCRY_MD_SHAKE256, {0, 1},
     "SHAKE256", shake256_asn, DIM (shake256_asn), oid_spec_shake256, 0,
diff --git a/cipher/mac-cmac.c b/cipher/mac-cmac.c
index 0538de37..b80c3406 100644
--- a/cipher/mac-cmac.c
+++ b/cipher/mac-cmac.c
@@ -451,73 +451,73 @@ static gcry_mac_spec_ops_t cmac_ops = {
 
 
 #if USE_BLOWFISH
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_blowfish = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_blowfish = {
   GCRY_MAC_CMAC_BLOWFISH, {0, 0}, "CMAC_BLOWFISH",
   &cmac_ops
 };
 #endif
 #if USE_DES
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_tripledes = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_tripledes = {
   GCRY_MAC_CMAC_3DES, {0, 0}, "CMAC_3DES",
   &cmac_ops
 };
 #endif
 #if USE_CAST5
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_cast5 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_cast5 = {
   GCRY_MAC_CMAC_CAST5, {0, 0}, "CMAC_CAST5",
   &cmac_ops
 };
 #endif
 #if USE_AES
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_aes = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_aes = {
   GCRY_MAC_CMAC_AES, {0, 1}, "CMAC_AES",
   &cmac_ops
 };
 #endif
 #if USE_TWOFISH
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_twofish = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_twofish = {
   GCRY_MAC_CMAC_TWOFISH, {0, 0}, "CMAC_TWOFISH",
   &cmac_ops
 };
 #endif
 #if USE_SERPENT
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_serpent = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_serpent = {
   GCRY_MAC_CMAC_SERPENT, {0, 0}, "CMAC_SERPENT",
   &cmac_ops
 };
 #endif
 #if USE_RFC2268
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_rfc2268 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_rfc2268 = {
   GCRY_MAC_CMAC_RFC2268, {0, 0}, "CMAC_RFC2268",
   &cmac_ops
 };
 #endif
 #if USE_SEED
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_seed = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_seed = {
   GCRY_MAC_CMAC_SEED, {0, 0}, "CMAC_SEED",
   &cmac_ops
 };
 #endif
 #if USE_CAMELLIA
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_camellia = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_camellia = {
   GCRY_MAC_CMAC_CAMELLIA, {0, 0}, "CMAC_CAMELLIA",
   &cmac_ops
 };
 #endif
 #if USE_IDEA
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_idea = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_idea = {
   GCRY_MAC_CMAC_IDEA, {0, 0}, "CMAC_IDEA",
   &cmac_ops
 };
 #endif
 #if USE_GOST28147
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_gost28147 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_gost28147 = {
   GCRY_MAC_CMAC_GOST28147, {0, 0}, "CMAC_GOST28147",
   &cmac_ops
 };
 #endif
 #if USE_SM4
-gcry_mac_spec_t _gcry_mac_type_spec_cmac_sm4 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_cmac_sm4 = {
   GCRY_MAC_CMAC_SM4, {0, 0}, "CMAC_SM4",
   &cmac_ops
 };
diff --git a/cipher/mac-gmac.c b/cipher/mac-gmac.c
index 1d59d085..12f515eb 100644
--- a/cipher/mac-gmac.c
+++ b/cipher/mac-gmac.c
@@ -156,31 +156,31 @@ static gcry_mac_spec_ops_t gmac_ops = {
 
 
 #if USE_AES
-gcry_mac_spec_t _gcry_mac_type_spec_gmac_aes = {
+const gcry_mac_spec_t _gcry_mac_type_spec_gmac_aes = {
   GCRY_MAC_GMAC_AES, {0, 0}, "GMAC_AES",
   &gmac_ops
 };
 #endif
 #if USE_TWOFISH
-gcry_mac_spec_t _gcry_mac_type_spec_gmac_twofish = {
+const gcry_mac_spec_t _gcry_mac_type_spec_gmac_twofish = {
   GCRY_MAC_GMAC_TWOFISH, {0, 0}, "GMAC_TWOFISH",
   &gmac_ops
 };
 #endif
 #if USE_SERPENT
-gcry_mac_spec_t _gcry_mac_type_spec_gmac_serpent = {
+const gcry_mac_spec_t _gcry_mac_type_spec_gmac_serpent = {
   GCRY_MAC_GMAC_SERPENT, {0, 0}, "GMAC_SERPENT",
   &gmac_ops
 };
 #endif
 #if USE_SEED
-gcry_mac_spec_t _gcry_mac_type_spec_gmac_seed = {
+const gcry_mac_spec_t _gcry_mac_type_spec_gmac_seed = {
   GCRY_MAC_GMAC_SEED, {0, 0}, "GMAC_SEED",
   &gmac_ops
 };
 #endif
 #if USE_CAMELLIA
-gcry_mac_spec_t _gcry_mac_type_spec_gmac_camellia = {
+const gcry_mac_spec_t _gcry_mac_type_spec_gmac_camellia = {
   GCRY_MAC_GMAC_CAMELLIA, {0, 0}, "GMAC_CAMELLIA",
   &gmac_ops
 };
diff --git a/cipher/mac-hmac.c b/cipher/mac-hmac.c
index 38746241..108a4408 100644
--- a/cipher/mac-hmac.c
+++ b/cipher/mac-hmac.c
@@ -1308,158 +1308,158 @@ static const gcry_mac_spec_ops_t hmac_ops = {
 
 
 #if USE_SHA1
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha1 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha1 = {
   GCRY_MAC_HMAC_SHA1, {0, 1}, "HMAC_SHA1",
   &hmac_ops
 };
 #endif
 #if USE_SHA256
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha256 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha256 = {
   GCRY_MAC_HMAC_SHA256, {0, 1}, "HMAC_SHA256",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha224 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha224 = {
   GCRY_MAC_HMAC_SHA224, {0, 1}, "HMAC_SHA224",
   &hmac_ops
 };
 #endif
 #if USE_SHA512
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512 = {
   GCRY_MAC_HMAC_SHA512, {0, 1}, "HMAC_SHA512",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha384 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha384 = {
   GCRY_MAC_HMAC_SHA384, {0, 1}, "HMAC_SHA384",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_256 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_256 = {
   GCRY_MAC_HMAC_SHA512_256, {0, 1}, "HMAC_SHA512_256",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_224 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_224 = {
   GCRY_MAC_HMAC_SHA512_224, {0, 1}, "HMAC_SHA512_224",
   &hmac_ops
 };
 
 #endif
 #if USE_SHA3
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_224 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_224 = {
   GCRY_MAC_HMAC_SHA3_224, {0, 1}, "HMAC_SHA3_224",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_256 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_256 = {
   GCRY_MAC_HMAC_SHA3_256, {0, 1}, "HMAC_SHA3_256",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_384 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_384 = {
   GCRY_MAC_HMAC_SHA3_384, {0, 1}, "HMAC_SHA3_384",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_512 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_512 = {
   GCRY_MAC_HMAC_SHA3_512, {0, 1}, "HMAC_SHA3_512",
   &hmac_ops
 };
 #endif
 #if USE_GOST_R_3411_94
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_94 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_94 = {
   GCRY_MAC_HMAC_GOSTR3411_94, {0, 0}, "HMAC_GOSTR3411_94",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_cp = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_cp = {
   GCRY_MAC_HMAC_GOSTR3411_CP, {0, 0}, "HMAC_GOSTR3411_CP",
   &hmac_ops
 };
 #endif
 #if USE_GOST_R_3411_12
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog256 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog256 = {
   GCRY_MAC_HMAC_STRIBOG256, {0, 0}, "HMAC_STRIBOG256",
   &hmac_ops
 };
 
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog512 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog512 = {
   GCRY_MAC_HMAC_STRIBOG512, {0, 0}, "HMAC_STRIBOG512",
   &hmac_ops
 };
 #endif
 #if USE_WHIRLPOOL
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_whirlpool = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_whirlpool = {
   GCRY_MAC_HMAC_WHIRLPOOL, {0, 0}, "HMAC_WHIRLPOOL",
   &hmac_ops
 };
 #endif
 #if USE_RMD160
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_rmd160 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_rmd160 = {
   GCRY_MAC_HMAC_RMD160, {0, 0}, "HMAC_RIPEMD160",
   &hmac_ops
 };
 #endif
 #if USE_TIGER
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_tiger1 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_tiger1 = {
   GCRY_MAC_HMAC_TIGER1, {0, 0}, "HMAC_TIGER",
   &hmac_ops
 };
 #endif
 #if USE_MD5
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_md5 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_md5 = {
   GCRY_MAC_HMAC_MD5, {0, 0}, "HMAC_MD5",
   &hmac_ops
 };
 #endif
 #if USE_MD4
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_md4 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_md4 = {
   GCRY_MAC_HMAC_MD4, {0, 0}, "HMAC_MD4",
   &hmac_ops
 };
 #endif
 #if USE_MD2
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_md2 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_md2 = {
   GCRY_MAC_HMAC_MD2, {0, 0}, "HMAC_MD2",
   &hmac_ops
 };
 #endif
 #if USE_BLAKE2
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_512 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_512 = {
   GCRY_MAC_HMAC_BLAKE2B_512, {0, 0}, "HMAC_BLAKE2B_512",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_384 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_384 = {
   GCRY_MAC_HMAC_BLAKE2B_384, {0, 0}, "HMAC_BLAKE2B_384",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_256 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_256 = {
   GCRY_MAC_HMAC_BLAKE2B_256, {0, 0}, "HMAC_BLAKE2B_256",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_160 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_160 = {
   GCRY_MAC_HMAC_BLAKE2B_160, {0, 0}, "HMAC_BLAKE2B_160",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_256 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_256 = {
   GCRY_MAC_HMAC_BLAKE2S_256, {0, 0}, "HMAC_BLAKE2S_256",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_224 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_224 = {
   GCRY_MAC_HMAC_BLAKE2S_224, {0, 0}, "HMAC_BLAKE2S_224",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_160 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_160 = {
   GCRY_MAC_HMAC_BLAKE2S_160, {0, 0}, "HMAC_BLAKE2S_160",
   &hmac_ops
 };
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_128 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_128 = {
   GCRY_MAC_HMAC_BLAKE2S_128, {0, 0}, "HMAC_BLAKE2S_128",
   &hmac_ops
 };
 #endif
 #if USE_SM3
-gcry_mac_spec_t _gcry_mac_type_spec_hmac_sm3 = {
+const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sm3 = {
   GCRY_MAC_HMAC_SM3, {0, 0}, "HMAC_SM3",
   &hmac_ops
 };
diff --git a/cipher/mac-internal.h b/cipher/mac-internal.h
index bb5c8b74..01998152 100644
--- a/cipher/mac-internal.h
+++ b/cipher/mac-internal.h
@@ -137,139 +137,139 @@ struct gcry_mac_handle
  * The HMAC algorithm specifications (mac-hmac.c).
  */
 #if USE_SHA1
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha1;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha1;
 #endif
 #if USE_SHA256
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha256;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha224;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha256;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha224;
 #endif
 #if USE_SHA512
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha384;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_224;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_256;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha384;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_224;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha512_256;
 #endif
 #if USE_SHA3
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_224;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_256;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_384;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_512;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_224;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_256;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_384;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sha3_512;
 #endif
 #if USE_GOST_R_3411_94
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_94;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_cp;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_94;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_gost3411_cp;
 #endif
 #if USE_GOST_R_3411_12
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog256;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog512;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog256;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_stribog512;
 #endif
 #if USE_WHIRLPOOL
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_whirlpool;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_whirlpool;
 #endif
 #if USE_RMD160
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_rmd160;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_rmd160;
 #endif
 #if USE_TIGER
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_tiger1;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_tiger1;
 #endif
 #if USE_MD5
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_md5;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_md5;
 #endif
 #if USE_MD4
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_md4;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_md4;
 #endif
 #if USE_BLAKE2
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_512;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_384;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_256;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_160;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_256;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_224;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_160;
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_128;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_512;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_384;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_256;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2b_160;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_256;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_224;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_160;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_blake2s_128;
 #endif
 #if USE_SM3
-extern gcry_mac_spec_t _gcry_mac_type_spec_hmac_sm3;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_hmac_sm3;
 #endif
 
 /*
  * The CMAC algorithm specifications (mac-cmac.c).
  */
 #if USE_BLOWFISH
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_blowfish;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_blowfish;
 #endif
 #if USE_DES
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_tripledes;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_tripledes;
 #endif
 #if USE_CAST5
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_cast5;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_cast5;
 #endif
 #if USE_AES
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_aes;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_aes;
 #endif
 #if USE_TWOFISH
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_twofish;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_twofish;
 #endif
 #if USE_SERPENT
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_serpent;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_serpent;
 #endif
 #if USE_RFC2268
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_rfc2268;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_rfc2268;
 #endif
 #if USE_SEED
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_seed;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_seed;
 #endif
 #if USE_CAMELLIA
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_camellia;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_camellia;
 #endif
 #if USE_IDEA
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_idea;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_idea;
 #endif
 #if USE_GOST28147
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_gost28147;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_gost28147;
 #endif
 #if USE_GOST28147
-extern gcry_mac_spec_t _gcry_mac_type_spec_gost28147_imit;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_gost28147_imit;
 #endif
 #if USE_SM4
-extern gcry_mac_spec_t _gcry_mac_type_spec_cmac_sm4;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_cmac_sm4;
 #endif
 
 /*
  * The GMAC algorithm specifications (mac-gmac.c).
  */
 #if USE_AES
-extern gcry_mac_spec_t _gcry_mac_type_spec_gmac_aes;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_gmac_aes;
 #endif
 #if USE_TWOFISH
-extern gcry_mac_spec_t _gcry_mac_type_spec_gmac_twofish;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_gmac_twofish;
 #endif
 #if USE_SERPENT
-extern gcry_mac_spec_t _gcry_mac_type_spec_gmac_serpent;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_gmac_serpent;
 #endif
 #if USE_SEED
-extern gcry_mac_spec_t _gcry_mac_type_spec_gmac_seed;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_gmac_seed;
 #endif
 #if USE_CAMELLIA
-extern gcry_mac_spec_t _gcry_mac_type_spec_gmac_camellia;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_gmac_camellia;
 #endif
 
 /*
  * The Poly1305 MAC algorithm specifications (mac-poly1305.c).
  */
-extern gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac;
 #if USE_AES
-extern gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_aes;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_aes;
 #endif
 #if USE_CAMELLIA
-extern gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_camellia;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_camellia;
 #endif
 #if USE_TWOFISH
-extern gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_twofish;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_twofish;
 #endif
 #if USE_SERPENT
-extern gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_serpent;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_serpent;
 #endif
 #if USE_SEED
-extern gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_seed;
+extern const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_seed;
 #endif
diff --git a/cipher/mac-poly1305.c b/cipher/mac-poly1305.c
index 46ea735f..3abc7774 100644
--- a/cipher/mac-poly1305.c
+++ b/cipher/mac-poly1305.c
@@ -328,36 +328,36 @@ static gcry_mac_spec_ops_t poly1305mac_ops = {
 };
 
 
-gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac = {
+const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac = {
   GCRY_MAC_POLY1305, {0, 0}, "POLY1305",
   &poly1305mac_ops
 };
 #if USE_AES
-gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_aes = {
+const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_aes = {
   GCRY_MAC_POLY1305_AES, {0, 0}, "POLY1305_AES",
   &poly1305mac_ops
 };
 #endif
 #if USE_CAMELLIA
-gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_camellia = {
+const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_camellia = {
   GCRY_MAC_POLY1305_CAMELLIA, {0, 0}, "POLY1305_CAMELLIA",
   &poly1305mac_ops
 };
 #endif
 #if USE_TWOFISH
-gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_twofish = {
+const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_twofish = {
   GCRY_MAC_POLY1305_TWOFISH, {0, 0}, "POLY1305_TWOFISH",
   &poly1305mac_ops
 };
 #endif
 #if USE_SERPENT
-gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_serpent = {
+const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_serpent = {
   GCRY_MAC_POLY1305_SERPENT, {0, 0}, "POLY1305_SERPENT",
   &poly1305mac_ops
 };
 #endif
 #if USE_SEED
-gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_seed = {
+const gcry_mac_spec_t _gcry_mac_type_spec_poly1305mac_seed = {
   GCRY_MAC_POLY1305_SEED, {0, 0}, "POLY1305_SEED",
   &poly1305mac_ops
 };
diff --git a/cipher/mac.c b/cipher/mac.c
index 9851b81c..ba1eb300 100644
--- a/cipher/mac.c
+++ b/cipher/mac.c
@@ -29,7 +29,7 @@
 
 /* This is the list of the digest implementations included in
    libgcrypt.  */
-static gcry_mac_spec_t * const mac_list[] = {
+static const gcry_mac_spec_t * const mac_list[] = {
 #if USE_SHA1
   &_gcry_mac_type_spec_hmac_sha1,
 #endif
@@ -137,7 +137,7 @@ static gcry_mac_spec_t * const mac_list[] = {
 };
 
 /* HMAC implementations start with index 101 (enum gcry_mac_algos) */
-static gcry_mac_spec_t * const mac_list_algo101[] =
+static const gcry_mac_spec_t * const mac_list_algo101[] =
   {
 #if USE_SHA256
     &_gcry_mac_type_spec_hmac_sha256,
@@ -250,7 +250,7 @@ static gcry_mac_spec_t * const mac_list_algo101[] =
   };
 
 /* CMAC implementations start with index 201 (enum gcry_mac_algos) */
-static gcry_mac_spec_t * const mac_list_algo201[] =
+static const gcry_mac_spec_t * const mac_list_algo201[] =
   {
 #if USE_AES
     &_gcry_mac_type_spec_cmac_aes,
@@ -315,7 +315,7 @@ static gcry_mac_spec_t * const mac_list_algo201[] =
   };
 
 /* GMAC implementations start with index 401 (enum gcry_mac_algos) */
-static gcry_mac_spec_t * const mac_list_algo401[] =
+static const gcry_mac_spec_t * const mac_list_algo401[] =
   {
 #if USE_AES
     &_gcry_mac_type_spec_gmac_aes,
@@ -345,7 +345,7 @@ static gcry_mac_spec_t * const mac_list_algo401[] =
   };
 
 /* Poly1305-MAC implementations start with index 501 (enum gcry_mac_algos) */
-static gcry_mac_spec_t * const mac_list_algo501[] =
+static const gcry_mac_spec_t * const mac_list_algo501[] =
   {
     &_gcry_mac_type_spec_poly1305mac,
 #if USE_AES
@@ -414,10 +414,10 @@ spec_from_algo (int algo)
 
 
 /* Lookup a mac's spec by its name.  */
-static gcry_mac_spec_t *
+static const gcry_mac_spec_t *
 spec_from_name (const char *name)
 {
-  gcry_mac_spec_t *spec;
+  const gcry_mac_spec_t *spec;
   int idx;
 
   for (idx = 0; (spec = mac_list[idx]); idx++)
@@ -434,7 +434,7 @@ spec_from_name (const char *name)
 int
 _gcry_mac_map_name (const char *string)
 {
-  gcry_mac_spec_t *spec;
+  const gcry_mac_spec_t *spec;
 
   if (!string)
     return 0;
@@ -457,7 +457,7 @@ _gcry_mac_map_name (const char *string)
 const char *
 _gcry_mac_algo_name (int algorithm)
 {
-  gcry_mac_spec_t *spec;
+  const gcry_mac_spec_t *spec;
 
   spec = spec_from_algo (algorithm);
   return spec ? spec->name : "?";
@@ -483,7 +483,7 @@ check_mac_algo (int algorithm)
 static gcry_err_code_t
 mac_open (gcry_mac_hd_t * hd, int algo, int secure, gcry_ctx_t ctx)
 {
-  gcry_mac_spec_t *spec;
+  const gcry_mac_spec_t *spec;
   gcry_err_code_t err;
   gcry_mac_hd_t h;
 
@@ -674,7 +674,7 @@ _gcry_mac_get_algo (gcry_mac_hd_t hd)
 unsigned int
 _gcry_mac_get_algo_maclen (int algo)
 {
-  gcry_mac_spec_t *spec;
+  const gcry_mac_spec_t *spec;
 
   spec = spec_from_algo (algo);
   if (!spec || !spec->ops || !spec->ops->get_maclen)
@@ -687,7 +687,7 @@ _gcry_mac_get_algo_maclen (int algo)
 unsigned int
 _gcry_mac_get_algo_keylen (int algo)
 {
-  gcry_mac_spec_t *spec;
+  const gcry_mac_spec_t *spec;
 
   spec = spec_from_algo (algo);
   if (!spec || !spec->ops || !spec->ops->get_keylen)
diff --git a/cipher/md.c b/cipher/md.c
index 68f5ffdf..34336b5c 100644
--- a/cipher/md.c
+++ b/cipher/md.c
@@ -31,7 +31,7 @@
 
 /* This is the list of the digest implementations included in
    libgcrypt.  */
-static gcry_md_spec_t * const digest_list[] =
+static const gcry_md_spec_t * const digest_list[] =
   {
 #if USE_CRC
      &_gcry_digest_spec_crc32,
@@ -104,7 +104,7 @@ static gcry_md_spec_t * const digest_list[] =
   };
 
 /* Digest implementations starting with index 0 (enum gcry_md_algos) */
-static gcry_md_spec_t * const digest_list_algo0[] =
+static const gcry_md_spec_t * const digest_list_algo0[] =
   {
     NULL, /* GCRY_MD_NONE */
 #if USE_MD5
@@ -154,7 +154,7 @@ static gcry_md_spec_t * const digest_list_algo0[] =
   };
 
 /* Digest implementations starting with index 301 (enum gcry_md_algos) */
-static gcry_md_spec_t * const digest_list_algo301[] =
+static const gcry_md_spec_t * const digest_list_algo301[] =
   {
 #if USE_MD4
     &_gcry_digest_spec_md4,
@@ -250,7 +250,7 @@ static gcry_md_spec_t * const digest_list_algo301[] =
 
 typedef struct gcry_md_list
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
   struct gcry_md_list *next;
   size_t actual_struct_size;     /* Allocated size of this structure. */
   PROPERLY_ALIGNED_TYPE context[1];
@@ -296,10 +296,10 @@ map_algo (int algo)
 
 /* Return the spec structure for the hash algorithm ALGO.  For an
    unknown algorithm NULL is returned.  */
-static gcry_md_spec_t *
+static const gcry_md_spec_t *
 spec_from_algo (int algo)
 {
-  gcry_md_spec_t *spec = NULL;
+  const gcry_md_spec_t *spec = NULL;
 
   algo = map_algo (algo);
 
@@ -316,10 +316,10 @@ spec_from_algo (int algo)
 
 
 /* Lookup a hash's spec by its name.  */
-static gcry_md_spec_t *
+static const gcry_md_spec_t *
 spec_from_name (const char *name)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
   int idx;
 
   for (idx=0; (spec = digest_list[idx]); idx++)
@@ -333,11 +333,11 @@ spec_from_name (const char *name)
 
 
 /* Lookup a hash's spec by its OID.  */
-static gcry_md_spec_t *
+static const gcry_md_spec_t *
 spec_from_oid (const char *oid)
 {
-  gcry_md_spec_t *spec;
-  gcry_md_oid_spec_t *oid_specs;
+  const gcry_md_spec_t *spec;
+  const gcry_md_oid_spec_t *oid_specs;
   int idx, j;
 
   for (idx=0; (spec = digest_list[idx]); idx++)
@@ -355,10 +355,10 @@ spec_from_oid (const char *oid)
 }
 
 
-static gcry_md_spec_t *
+static const gcry_md_spec_t *
 search_oid (const char *oid, gcry_md_oid_spec_t *oid_spec)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
   int i;
 
   if (!oid)
@@ -389,7 +389,7 @@ search_oid (const char *oid, gcry_md_oid_spec_t *oid_spec)
 int
 _gcry_md_map_name (const char *string)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
 
   if (!string)
     return 0;
@@ -419,7 +419,7 @@ _gcry_md_map_name (const char *string)
 const char *
 _gcry_md_algo_name (int algorithm)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
 
   spec = spec_from_algo (algorithm);
   return spec ? spec->name : "?";
@@ -548,7 +548,7 @@ static gcry_err_code_t
 md_enable (gcry_md_hd_t hd, int algorithm)
 {
   struct gcry_md_context *h = hd->ctx;
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
   GcryDigestEntry *entry;
   gcry_err_code_t err = 0;
 
@@ -1182,7 +1182,7 @@ void
 _gcry_md_hash_buffer (int algo, void *digest,
                       const void *buffer, size_t length)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
 
   spec = spec_from_algo (algo);
   if (!spec)
@@ -1247,7 +1247,7 @@ _gcry_md_hash_buffers_extract (int algo, unsigned int flags, void *digest,
 			       int digestlen, const gcry_buffer_t *iov,
 			       int iovcnt)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
   int hmac;
 
   if (!iov || iovcnt < 0)
@@ -1364,7 +1364,7 @@ _gcry_md_get_algo (gcry_md_hd_t hd)
 static int
 md_digest_length (int algorithm)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
 
   spec = spec_from_algo (algorithm);
   return spec? spec->mdlen : 0;
@@ -1387,7 +1387,7 @@ _gcry_md_get_algo_dlen (int algorithm)
 static const byte *
 md_asn_oid (int algorithm, size_t *asnlen, size_t *mdlen)
 {
-  gcry_md_spec_t *spec;
+  const gcry_md_spec_t *spec;
   const byte *asnoid = NULL;
 
   spec = spec_from_algo (algorithm);
diff --git a/cipher/md2.c b/cipher/md2.c
index 8fc5a6da..9af9d697 100644
--- a/cipher/md2.c
+++ b/cipher/md2.c
@@ -160,18 +160,18 @@ md2_read (void *context)
   return hd->X;
 }
 
-static byte asn[18] = /* Object ID is 1.2.840.113549.2.2 */
+static const byte asn[18] = /* Object ID is 1.2.840.113549.2.2 */
   { 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86,0x48,
     0x86, 0xf7, 0x0d, 0x02, 0x02, 0x05, 0x00, 0x04, 0x10 };
 
-static gcry_md_oid_spec_t oid_spec_md2[] =
+static const gcry_md_oid_spec_t oid_spec_md2[] =
   {
     /* iso.member-body.us.rsadsi.digestAlgorithm.md2 */
     { "1.2.840.113549.2.2" },
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_md2 =
+const gcry_md_spec_t _gcry_digest_spec_md2 =
   {
     GCRY_MD_MD2, {0, 0},
     "MD2", asn, DIM (asn), oid_spec_md2, 16,
diff --git a/cipher/md4.c b/cipher/md4.c
index 46aa8681..49b2af2a 100644
--- a/cipher/md4.c
+++ b/cipher/md4.c
@@ -275,18 +275,18 @@ md4_read (void *context)
   return hd->bctx.buf;
 }
 
-static byte asn[18] = /* Object ID is 1.2.840.113549.2.4 */
+static const byte asn[18] = /* Object ID is 1.2.840.113549.2.4 */
   { 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86,0x48,
     0x86, 0xf7, 0x0d, 0x02, 0x04, 0x05, 0x00, 0x04, 0x10 };
 
-static gcry_md_oid_spec_t oid_spec_md4[] =
+static const gcry_md_oid_spec_t oid_spec_md4[] =
   {
     /* iso.member-body.us.rsadsi.digestAlgorithm.md4 */
     { "1.2.840.113549.2.4" },
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_md4 =
+const gcry_md_spec_t _gcry_digest_spec_md4 =
   {
     GCRY_MD_MD4, {0, 0},
     "MD4", asn, DIM (asn), oid_spec_md4,16,
diff --git a/cipher/md5.c b/cipher/md5.c
index e98aea52..5457fc38 100644
--- a/cipher/md5.c
+++ b/cipher/md5.c
@@ -299,11 +299,11 @@ md5_read( void *context )
   return hd->bctx.buf;
 }
 
-static byte asn[18] = /* Object ID is 1.2.840.113549.2.5 */
+static const byte asn[18] = /* Object ID is 1.2.840.113549.2.5 */
   { 0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86,0x48,
     0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10 };
 
-static gcry_md_oid_spec_t oid_spec_md5[] =
+static const gcry_md_oid_spec_t oid_spec_md5[] =
   {
     /* iso.member-body.us.rsadsi.pkcs.pkcs-1.4 (md5WithRSAEncryption) */
     { "1.2.840.113549.1.1.4" },
@@ -312,7 +312,7 @@ static gcry_md_oid_spec_t oid_spec_md5[] =
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_md5 =
+const gcry_md_spec_t _gcry_digest_spec_md5 =
   {
     GCRY_MD_MD5, {0, 0},
     "MD5", asn, DIM (asn), oid_spec_md5, 16,
diff --git a/cipher/pubkey.c b/cipher/pubkey.c
index 2d80ee08..7fdb7771 100644
--- a/cipher/pubkey.c
+++ b/cipher/pubkey.c
@@ -195,6 +195,8 @@ _gcry_pk_map_name (const char *string)
     return 0;
   if (spec->flags.disabled)
     return 0;
+  if (!spec->flags.fips && fips_mode ())
+    return 0;
   return spec->algo;
 }
 
@@ -224,7 +226,7 @@ check_pubkey_algo (int algo, unsigned use)
   gcry_pk_spec_t *spec;
 
   spec = spec_from_algo (algo);
-  if (spec && !spec->flags.disabled)
+  if (spec && !spec->flags.disabled && (spec->flags.fips || !fips_mode ()))
     {
       if (((use & GCRY_PK_USAGE_SIGN)
 	   && (! (spec->use & GCRY_PK_USAGE_SIGN)))
@@ -323,7 +325,9 @@ _gcry_pk_encrypt (gcry_sexp_t *r_ciph, gcry_sexp_t s_data, gcry_sexp_t s_pkey)
     goto leave;
 
   if (spec->flags.disabled)
-    rc = GPG_ERR_CIPHER_ALGO;
+    rc = GPG_ERR_PUBKEY_ALGO;
+  else if (!spec->flags.fips && fips_mode ())
+    rc = GPG_ERR_PUBKEY_ALGO;
   else if (spec->encrypt)
     rc = spec->encrypt (r_ciph, s_data, keyparms);
   else
@@ -377,7 +381,9 @@ _gcry_pk_decrypt (gcry_sexp_t *r_plain, gcry_sexp_t s_data, gcry_sexp_t s_skey)
     goto leave;
 
   if (spec->flags.disabled)
-    rc = GPG_ERR_CIPHER_ALGO;
+    rc = GPG_ERR_PUBKEY_ALGO;
+  else if (!spec->flags.fips && fips_mode ())
+    rc = GPG_ERR_PUBKEY_ALGO;
   else if (spec->decrypt)
     rc = spec->decrypt (r_plain, s_data, keyparms);
   else
@@ -432,7 +438,9 @@ _gcry_pk_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_hash, gcry_sexp_t s_skey)
     goto leave;
 
   if (spec->flags.disabled)
-    rc = GPG_ERR_CIPHER_ALGO;
+    rc = GPG_ERR_PUBKEY_ALGO;
+  else if (!spec->flags.fips && fips_mode ())
+    rc = GPG_ERR_PUBKEY_ALGO;
   else if (spec->sign)
     rc = spec->sign (r_sig, s_hash, keyparms);
   else
@@ -567,7 +575,9 @@ _gcry_pk_sign_md (gcry_sexp_t *r_sig, const char *tmpl, gcry_md_hd_t hd_orig,
     goto leave;
 
   if (spec->flags.disabled)
-    rc = GPG_ERR_CIPHER_ALGO;
+    rc = GPG_ERR_PUBKEY_ALGO;
+  else if (!spec->flags.fips && fips_mode ())
+    rc = GPG_ERR_PUBKEY_ALGO;
   else if (spec->sign)
     rc = spec->sign (r_sig, s_hash, keyparms);
   else
@@ -599,7 +609,9 @@ _gcry_pk_verify (gcry_sexp_t s_sig, gcry_sexp_t s_hash, gcry_sexp_t s_pkey)
     goto leave;
 
   if (spec->flags.disabled)
-    rc = GPG_ERR_CIPHER_ALGO;
+    rc = GPG_ERR_PUBKEY_ALGO;
+  else if (!spec->flags.fips && fips_mode ())
+    rc = GPG_ERR_PUBKEY_ALGO;
   else if (spec->verify)
     rc = spec->verify (s_sig, s_hash, keyparms);
   else
@@ -673,7 +685,9 @@ _gcry_pk_verify_md (gcry_sexp_t s_sig, const char *tmpl, gcry_md_hd_t hd_orig,
     goto leave;
 
   if (spec->flags.disabled)
-    rc = GPG_ERR_CIPHER_ALGO;
+    rc = GPG_ERR_PUBKEY_ALGO;
+  else if (!spec->flags.fips && fips_mode ())
+    rc = GPG_ERR_PUBKEY_ALGO;
   else if (spec->verify)
     rc = spec->verify (s_sig, s_hash, keyparms);
   else
@@ -707,7 +721,9 @@ _gcry_pk_testkey (gcry_sexp_t s_key)
     goto leave;
 
   if (spec->flags.disabled)
-    rc = GPG_ERR_CIPHER_ALGO;
+    rc = GPG_ERR_PUBKEY_ALGO;
+  else if (!spec->flags.fips && fips_mode ())
+    rc = GPG_ERR_PUBKEY_ALGO;
   else if (spec->check_secret_key)
     rc = spec->check_secret_key (keyparms);
   else
@@ -790,7 +806,7 @@ _gcry_pk_genkey (gcry_sexp_t *r_key, gcry_sexp_t s_parms)
   spec = spec_from_name (name);
   xfree (name);
   name = NULL;
-  if (!spec || spec->flags.disabled)
+  if (!spec || spec->flags.disabled || (!spec->flags.fips && fips_mode ()))
     {
       rc = GPG_ERR_PUBKEY_ALGO; /* Unknown algorithm.  */
       goto leave;
@@ -832,6 +848,8 @@ _gcry_pk_get_nbits (gcry_sexp_t key)
     return 0; /* Error - 0 is a suitable indication for that.  */
   if (spec->flags.disabled)
     return 0;
+  if (!spec->flags.fips && fips_mode ())
+    return 0;
 
   nbits = spec->get_nbits (parms);
   sexp_release (parms);
@@ -967,6 +985,8 @@ _gcry_pk_get_curve (gcry_sexp_t key, int iterator, unsigned int *r_nbits)
 
   if (spec->flags.disabled)
     return NULL;
+  if (!spec->flags.fips && fips_mode ())
+    return NULL;
   if (spec->get_curve)
     result = spec->get_curve (keyparms, iterator, r_nbits);
 
@@ -1152,17 +1172,6 @@ _gcry_pubkey_get_sexp (gcry_sexp_t *r_sexp, int mode, gcry_ctx_t ctx)
 gcry_err_code_t
 _gcry_pk_init (void)
 {
-  if (fips_mode())
-    {
-      /* disable algorithms that are disallowed in fips */
-      int idx;
-      gcry_pk_spec_t *spec;
-
-      for (idx = 0; (spec = pubkey_list[idx]); idx++)
-        if (!spec->flags.fips)
-          spec->flags.disabled = 1;
-    }
-
   return 0;
 }
 
@@ -1177,7 +1186,9 @@ _gcry_pk_selftest (int algo, int extended, selftest_report_func_t report)
 
   algo = map_algo (algo);
   spec = spec_from_algo (algo);
-  if (spec && !spec->flags.disabled && spec->selftest)
+  if (spec && !spec->flags.disabled
+      && (spec->flags.fips || !fips_mode ())
+      && spec->selftest)
     ec = spec->selftest (algo, extended, report);
   else
     {
@@ -1186,7 +1197,8 @@ _gcry_pk_selftest (int algo, int extended, selftest_report_func_t report)
          of an encryption mode (e.g. pkcs1, ecdsa, or ecdh).  */
       if (report)
         report ("pubkey", algo, "module",
-                spec && !spec->flags.disabled?
+                spec && !spec->flags.disabled
+                && (spec->flags.fips || !fips_mode ())?
                 "no selftest available" :
                 spec? "algorithm disabled" :
                 "algorithm not found");
diff --git a/cipher/rfc2268.c b/cipher/rfc2268.c
index b093f022..c270ce9b 100644
--- a/cipher/rfc2268.c
+++ b/cipher/rfc2268.c
@@ -349,7 +349,7 @@ selftest (void)
 
 
 
-static gcry_cipher_oid_spec_t oids_rfc2268_40[] =
+static const gcry_cipher_oid_spec_t oids_rfc2268_40[] =
   {
     /*{ "1.2.840.113549.3.2", GCRY_CIPHER_MODE_CBC },*/
     /* pbeWithSHAAnd40BitRC2_CBC */
@@ -357,7 +357,7 @@ static gcry_cipher_oid_spec_t oids_rfc2268_40[] =
     { NULL }
   };
 
-static gcry_cipher_oid_spec_t oids_rfc2268_128[] =
+static const gcry_cipher_oid_spec_t oids_rfc2268_128[] =
   {
     /* pbeWithSHAAnd128BitRC2_CBC */
     { "1.2.840.113549.1.12.1.5", GCRY_CIPHER_MODE_CBC },
diff --git a/cipher/rijndael.c b/cipher/rijndael.c
index 23c4efe3..9b96b616 100644
--- a/cipher/rijndael.c
+++ b/cipher/rijndael.c
@@ -2022,7 +2022,7 @@ static const char *rijndael_names[] =
     NULL
   };
 
-static gcry_cipher_oid_spec_t rijndael_oids[] =
+static const gcry_cipher_oid_spec_t rijndael_oids[] =
   {
     { "2.16.840.1.101.3.4.1.1", GCRY_CIPHER_MODE_ECB },
     { "2.16.840.1.101.3.4.1.2", GCRY_CIPHER_MODE_CBC },
@@ -2051,7 +2051,7 @@ static const char *rijndael192_names[] =
     NULL
   };
 
-static gcry_cipher_oid_spec_t rijndael192_oids[] =
+static const gcry_cipher_oid_spec_t rijndael192_oids[] =
   {
     { "2.16.840.1.101.3.4.1.21", GCRY_CIPHER_MODE_ECB },
     { "2.16.840.1.101.3.4.1.22", GCRY_CIPHER_MODE_CBC },
@@ -2080,7 +2080,7 @@ static const char *rijndael256_names[] =
     NULL
   };
 
-static gcry_cipher_oid_spec_t rijndael256_oids[] =
+static const gcry_cipher_oid_spec_t rijndael256_oids[] =
   {
     { "2.16.840.1.101.3.4.1.41", GCRY_CIPHER_MODE_ECB },
     { "2.16.840.1.101.3.4.1.42", GCRY_CIPHER_MODE_CBC },
diff --git a/cipher/rmd160.c b/cipher/rmd160.c
index 1861205e..5c54fdff 100644
--- a/cipher/rmd160.c
+++ b/cipher/rmd160.c
@@ -497,11 +497,11 @@ _gcry_rmd160_hash_buffers (void *outbuf, size_t nbytes,
 }
 
 
-static byte asn[15] = /* Object ID is 1.3.36.3.2.1 */
+static const byte asn[15] = /* Object ID is 1.3.36.3.2.1 */
   { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
     0x02, 0x01, 0x05, 0x00, 0x04, 0x14 };
 
-static gcry_md_oid_spec_t oid_spec_rmd160[] =
+static const gcry_md_oid_spec_t oid_spec_rmd160[] =
   {
     /* rsaSignatureWithripemd160 */
     { "1.3.36.3.3.1.2" },
@@ -510,7 +510,7 @@ static gcry_md_oid_spec_t oid_spec_rmd160[] =
     { NULL }
   };
 
-gcry_md_spec_t _gcry_digest_spec_rmd160 =
+const gcry_md_spec_t _gcry_digest_spec_rmd160 =
   {
     GCRY_MD_RMD160, {0, 0},
     "RIPEMD160", asn, DIM (asn), oid_spec_rmd160, 20,
diff --git a/cipher/seed.c b/cipher/seed.c
index 2c8958fa..4fd93d75 100644
--- a/cipher/seed.c
+++ b/cipher/seed.c
@@ -461,7 +461,7 @@ selftest (void)
 
 
 
-static gcry_cipher_oid_spec_t seed_oids[] =
+static const gcry_cipher_oid_spec_t seed_oids[] =
   {
     { "1.2.410.200004.1.3", GCRY_CIPHER_MODE_ECB },
     { "1.2.410.200004.1.4", GCRY_CIPHER_MODE_CBC },
diff --git a/cipher/serpent.c b/cipher/serpent.c
index d2f7f16e..159d889f 100644
--- a/cipher/serpent.c
+++ b/cipher/serpent.c
@@ -1742,7 +1742,7 @@ serpent_test (void)
 }
 
 
-static gcry_cipher_oid_spec_t serpent128_oids[] =
+static const gcry_cipher_oid_spec_t serpent128_oids[] =
   {
     {"1.3.6.1.4.1.11591.13.2.1", GCRY_CIPHER_MODE_ECB },
     {"1.3.6.1.4.1.11591.13.2.2", GCRY_CIPHER_MODE_CBC },
@@ -1751,7 +1751,7 @@ static gcry_cipher_oid_spec_t serpent128_oids[] =
     { NULL }
   };
 
-static gcry_cipher_oid_spec_t serpent192_oids[] =
+static const gcry_cipher_oid_spec_t serpent192_oids[] =
   {
     {"1.3.6.1.4.1.11591.13.2.21", GCRY_CIPHER_MODE_ECB },
     {"1.3.6.1.4.1.11591.13.2.22", GCRY_CIPHER_MODE_CBC },
@@ -1760,7 +1760,7 @@ static gcry_cipher_oid_spec_t serpent192_oids[] =
     { NULL }
   };
 
-static gcry_cipher_oid_spec_t serpent256_oids[] =
+static const gcry_cipher_oid_spec_t serpent256_oids[] =
   {
     {"1.3.6.1.4.1.11591.13.2.41", GCRY_CIPHER_MODE_ECB },
     {"1.3.6.1.4.1.11591.13.2.42", GCRY_CIPHER_MODE_CBC },
diff --git a/cipher/sha1.c b/cipher/sha1.c
index 3bb24c7e..b83b9de0 100644
--- a/cipher/sha1.c
+++ b/cipher/sha1.c
@@ -738,11 +738,11 @@ run_selftests (int algo, int extended, selftest_report_func_t report)
 
 
 
-static unsigned char asn[15] = /* Object ID is 1.3.14.3.2.26 */
+static const unsigned char asn[15] = /* Object ID is 1.3.14.3.2.26 */
   { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
     0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
 
-static gcry_md_oid_spec_t oid_spec_sha1[] =
+static const gcry_md_oid_spec_t oid_spec_sha1[] =
   {
     /* iso.member-body.us.rsadsi.pkcs.pkcs-1.5 (sha1WithRSAEncryption) */
     { "1.2.840.113549.1.1.5" },
@@ -757,7 +757,7 @@ static gcry_md_oid_spec_t oid_spec_sha1[] =
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha1 =
+const gcry_md_spec_t _gcry_digest_spec_sha1 =
   {
     GCRY_MD_SHA1, {0, 1},
     "SHA1", asn, DIM (asn), oid_spec_sha1, 20,
diff --git a/cipher/sha256.c b/cipher/sha256.c
index 74f7fdf0..642711af 100644
--- a/cipher/sha256.c
+++ b/cipher/sha256.c
@@ -788,25 +788,25 @@ run_selftests (int algo, int extended, selftest_report_func_t report)
 
 
 
-static byte asn224[19] = /* Object ID is 2.16.840.1.101.3.4.2.4 */
+static const byte asn224[19] = /* Object ID is 2.16.840.1.101.3.4.2.4 */
   { 0x30, 0x2D, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
     0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
     0x1C
   };
 
-static gcry_md_oid_spec_t oid_spec_sha224[] =
+static const gcry_md_oid_spec_t oid_spec_sha224[] =
   {
     /* From RFC3874, Section 4 */
     { "2.16.840.1.101.3.4.2.4" },
     { NULL },
   };
 
-static byte asn256[19] = /* Object ID is  2.16.840.1.101.3.4.2.1 */
+static const byte asn256[19] = /* Object ID is  2.16.840.1.101.3.4.2.1 */
   { 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
     0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05,
     0x00, 0x04, 0x20 };
 
-static gcry_md_oid_spec_t oid_spec_sha256[] =
+static const gcry_md_oid_spec_t oid_spec_sha256[] =
   {
     /* According to the OpenPGP draft rfc2440-bis06 */
     { "2.16.840.1.101.3.4.2.1" },
@@ -816,7 +816,7 @@ static gcry_md_oid_spec_t oid_spec_sha256[] =
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha224 =
+const gcry_md_spec_t _gcry_digest_spec_sha224 =
   {
     GCRY_MD_SHA224, {0, 1},
     "SHA224", asn224, DIM (asn224), oid_spec_sha224, 28,
@@ -826,7 +826,7 @@ gcry_md_spec_t _gcry_digest_spec_sha224 =
     run_selftests
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha256 =
+const gcry_md_spec_t _gcry_digest_spec_sha256 =
   {
     GCRY_MD_SHA256, {0, 1},
     "SHA256", asn256, DIM (asn256), oid_spec_sha256, 32,
diff --git a/cipher/sha512.c b/cipher/sha512.c
index 2d4f58e0..9cab33d6 100644
--- a/cipher/sha512.c
+++ b/cipher/sha512.c
@@ -1178,14 +1178,14 @@ run_selftests (int algo, int extended, selftest_report_func_t report)
 
 
 
-static byte sha512_asn[] =	/* Object ID is 2.16.840.1.101.3.4.2.3 */
+static const byte sha512_asn[] =	/* Object ID is 2.16.840.1.101.3.4.2.3 */
   {
     0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
     0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05,
     0x00, 0x04, 0x40
   };
 
-static gcry_md_oid_spec_t oid_spec_sha512[] =
+static const gcry_md_oid_spec_t oid_spec_sha512[] =
   {
     { "2.16.840.1.101.3.4.2.3" },
 
@@ -1195,7 +1195,7 @@ static gcry_md_oid_spec_t oid_spec_sha512[] =
     { NULL }
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha512 =
+const gcry_md_spec_t _gcry_digest_spec_sha512 =
   {
     GCRY_MD_SHA512, {0, 1},
     "SHA512", sha512_asn, DIM (sha512_asn), oid_spec_sha512, 64,
@@ -1205,14 +1205,14 @@ gcry_md_spec_t _gcry_digest_spec_sha512 =
     run_selftests
   };
 
-static byte sha384_asn[] =	/* Object ID is 2.16.840.1.101.3.4.2.2 */
+static const byte sha384_asn[] =	/* Object ID is 2.16.840.1.101.3.4.2.2 */
   {
     0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
     0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05,
     0x00, 0x04, 0x30
   };
 
-static gcry_md_oid_spec_t oid_spec_sha384[] =
+static const gcry_md_oid_spec_t oid_spec_sha384[] =
   {
     { "2.16.840.1.101.3.4.2.2" },
 
@@ -1225,7 +1225,7 @@ static gcry_md_oid_spec_t oid_spec_sha384[] =
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha384 =
+const gcry_md_spec_t _gcry_digest_spec_sha384 =
   {
     GCRY_MD_SHA384, {0, 1},
     "SHA384", sha384_asn, DIM (sha384_asn), oid_spec_sha384, 48,
@@ -1235,21 +1235,21 @@ gcry_md_spec_t _gcry_digest_spec_sha384 =
     run_selftests
   };
 
-static byte sha512_256_asn[] =
+static const byte sha512_256_asn[] =
   {
     0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
     0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x06, 0x05,
     0x00, 0x04, 0x20
   };
 
-static gcry_md_oid_spec_t oid_spec_sha512_256[] =
+static const gcry_md_oid_spec_t oid_spec_sha512_256[] =
   {
     { "2.16.840.1.101.3.4.2.6" },
 
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha512_256 =
+const gcry_md_spec_t _gcry_digest_spec_sha512_256 =
   {
     GCRY_MD_SHA512_256, {0, 1},
     "SHA512_256", sha512_256_asn, DIM (sha512_256_asn), oid_spec_sha512_256, 32,
@@ -1259,21 +1259,21 @@ gcry_md_spec_t _gcry_digest_spec_sha512_256 =
     run_selftests
   };
 
-static byte sha512_224_asn[] =
+static const byte sha512_224_asn[] =
   {
     0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
     0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x05, 0x05,
     0x00, 0x04, 0x1c
   };
 
-static gcry_md_oid_spec_t oid_spec_sha512_224[] =
+static const gcry_md_oid_spec_t oid_spec_sha512_224[] =
   {
     { "2.16.840.1.101.3.4.2.5" },
 
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_sha512_224 =
+const gcry_md_spec_t _gcry_digest_spec_sha512_224 =
   {
     GCRY_MD_SHA512_224, {0, 1},
     "SHA512_224", sha512_224_asn, DIM (sha512_224_asn), oid_spec_sha512_224, 28,
diff --git a/cipher/sm3.c b/cipher/sm3.c
index 05b7b259..c4897687 100644
--- a/cipher/sm3.c
+++ b/cipher/sm3.c
@@ -486,12 +486,12 @@ run_selftests (int algo, int extended, selftest_report_func_t report)
   return ec;
 }
 
-static byte asn_sm3[] = /* Object ID is 1.2.156.10197.401 */
+static const byte asn_sm3[] = /* Object ID is 1.2.156.10197.401 */
   { 0x30, 0x2F, 0x30, 0x0B, 0x06, 0x07, 0x2A, 0x81,
     0x1C, 0xCF, 0x55, 0x83, 0x11, 0x05, 0x00, 0x04,
     0x20 };
 
-static gcry_md_oid_spec_t oid_spec_sm3[] =
+static const gcry_md_oid_spec_t oid_spec_sm3[] =
   {
     /* China Electronics Standardization Instutute,
        OID White paper (2015), Table 6 */
@@ -499,7 +499,7 @@ static gcry_md_oid_spec_t oid_spec_sm3[] =
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_sm3 =
+const gcry_md_spec_t _gcry_digest_spec_sm3 =
   {
     GCRY_MD_SM3, {0, 0},
     "SM3", asn_sm3, DIM (asn_sm3), oid_spec_sm3, 32,
diff --git a/cipher/sm4.c b/cipher/sm4.c
index c8dd0406..81662988 100644
--- a/cipher/sm4.c
+++ b/cipher/sm4.c
@@ -1230,7 +1230,7 @@ run_selftests (int algo, int extended, selftest_report_func_t report)
 }
 
 
-static gcry_cipher_oid_spec_t sm4_oids[] =
+static const gcry_cipher_oid_spec_t sm4_oids[] =
   {
     { "1.2.156.10197.1.104.1", GCRY_CIPHER_MODE_ECB },
     { "1.2.156.10197.1.104.2", GCRY_CIPHER_MODE_CBC },
diff --git a/cipher/stribog.c b/cipher/stribog.c
index e0ee1515..21e385ae 100644
--- a/cipher/stribog.c
+++ b/cipher/stribog.c
@@ -1325,7 +1325,7 @@ stribog_read_256 (void *context)
   return hd->result + 32;
 }
 
-static gcry_md_oid_spec_t oid_spec_stribog256[] =
+static const gcry_md_oid_spec_t oid_spec_stribog256[] =
   {
     /* id-tc26-signwithdigest-gost3410-12-256 */
     { "1.2.643.7.1.1.3.2" },
@@ -1334,7 +1334,7 @@ static gcry_md_oid_spec_t oid_spec_stribog256[] =
     { NULL },
   };
 
-static gcry_md_oid_spec_t oid_spec_stribog512[] =
+static const gcry_md_oid_spec_t oid_spec_stribog512[] =
   {
     /* id-tc26-signwithdigest-gost3410-12-512 */
     { "1.2.643.7.1.1.3.3" },
@@ -1343,7 +1343,7 @@ static gcry_md_oid_spec_t oid_spec_stribog512[] =
     { NULL },
   };
 
-gcry_md_spec_t _gcry_digest_spec_stribog_256 =
+const gcry_md_spec_t _gcry_digest_spec_stribog_256 =
   {
     GCRY_MD_STRIBOG256, {0, 0},
     "STRIBOG256", NULL, 0, oid_spec_stribog256, 32,
@@ -1352,7 +1352,7 @@ gcry_md_spec_t _gcry_digest_spec_stribog_256 =
     sizeof (STRIBOG_CONTEXT)
   };
 
-gcry_md_spec_t _gcry_digest_spec_stribog_512 =
+const gcry_md_spec_t _gcry_digest_spec_stribog_512 =
   {
     GCRY_MD_STRIBOG512, {0, 0},
     "STRIBOG512", NULL, 0, oid_spec_stribog512, 64,
diff --git a/cipher/tiger.c b/cipher/tiger.c
index f8208ac8..ae55359c 100644
--- a/cipher/tiger.c
+++ b/cipher/tiger.c
@@ -814,7 +814,7 @@ tiger_read( void *context )
 /* This is the old TIGER variant based on the unfixed reference
    implementation.  IT was used in GnupG up to 1.3.2.  We don't provide
    an OID anymore because that would not be correct.  */
-gcry_md_spec_t _gcry_digest_spec_tiger =
+const gcry_md_spec_t _gcry_digest_spec_tiger =
   {
     GCRY_MD_TIGER, {0, 0},
     "TIGER192", NULL, 0, NULL, 24,
@@ -826,19 +826,19 @@ gcry_md_spec_t _gcry_digest_spec_tiger =
 
 
 /* This is the fixed TIGER implementation.  */
-static byte asn1[19] = /* Object ID is 1.3.6.1.4.1.11591.12.2 */
+static const byte asn1[19] = /* Object ID is 1.3.6.1.4.1.11591.12.2 */
   { 0x30, 0x29, 0x30, 0x0d, 0x06, 0x09, 0x2b, 0x06,
     0x01, 0x04, 0x01, 0xda, 0x47, 0x0c, 0x02,
     0x05, 0x00, 0x04, 0x18 };
 
-static gcry_md_oid_spec_t oid_spec_tiger1[] =
+static const gcry_md_oid_spec_t oid_spec_tiger1[] =
   {
     /* GNU.digestAlgorithm TIGER */
     { "1.3.6.1.4.1.11591.12.2" },
     { NULL }
   };
 
-gcry_md_spec_t _gcry_digest_spec_tiger1 =
+const gcry_md_spec_t _gcry_digest_spec_tiger1 =
   {
     GCRY_MD_TIGER1, {0, 0},
     "TIGER", asn1, DIM (asn1), oid_spec_tiger1, 24,
@@ -850,7 +850,7 @@ gcry_md_spec_t _gcry_digest_spec_tiger1 =
 
 
 /* This is TIGER2 which usues a changed padding algorithm.  */
-gcry_md_spec_t _gcry_digest_spec_tiger2 =
+const gcry_md_spec_t _gcry_digest_spec_tiger2 =
   {
     GCRY_MD_TIGER2, {0, 0},
     "TIGER2", NULL, 0, NULL, 24,
diff --git a/cipher/whirlpool.c b/cipher/whirlpool.c
index f6e5a7db..ecb9a416 100644
--- a/cipher/whirlpool.c
+++ b/cipher/whirlpool.c
@@ -1525,7 +1525,7 @@ whirlpool_read (void *ctx)
   return context->bctx.buf;
 }
 
-gcry_md_spec_t _gcry_digest_spec_whirlpool =
+const gcry_md_spec_t _gcry_digest_spec_whirlpool =
   {
     GCRY_MD_WHIRLPOOL, {0, 0},
     "WHIRLPOOL", NULL, 0, NULL, 64,
diff --git a/src/cipher-proto.h b/src/cipher-proto.h
index b730fd06..36729165 100644
--- a/src/cipher-proto.h
+++ b/src/cipher-proto.h
@@ -184,7 +184,7 @@ typedef struct gcry_cipher_spec
   } flags;
   const char *name;
   const char **aliases;
-  gcry_cipher_oid_spec_t *oids;
+  const gcry_cipher_oid_spec_t *oids;
   size_t blocksize;
   size_t keylen;
   size_t contextsize;
@@ -240,9 +240,9 @@ typedef struct gcry_md_spec
     unsigned int fips:1;
   } flags;
   const char *name;
-  unsigned char *asnoid;
+  const unsigned char *asnoid;
   int asnlen;
-  gcry_md_oid_spec_t *oids;
+  const gcry_md_oid_spec_t *oids;
   int mdlen;
   gcry_md_init_t init;
   gcry_md_write_t write;
diff --git a/src/cipher.h b/src/cipher.h
index 2efe00fa..87f8c4d0 100644
--- a/src/cipher.h
+++ b/src/cipher.h
@@ -171,43 +171,43 @@ extern gcry_cipher_spec_t _gcry_cipher_spec_chacha20;
 extern gcry_cipher_spec_t _gcry_cipher_spec_sm4;
 
 /* Declarations for the digest specifications.  */
-extern gcry_md_spec_t _gcry_digest_spec_crc32;
-extern gcry_md_spec_t _gcry_digest_spec_crc32_rfc1510;
-extern gcry_md_spec_t _gcry_digest_spec_crc24_rfc2440;
-extern gcry_md_spec_t _gcry_digest_spec_gost3411_94;
-extern gcry_md_spec_t _gcry_digest_spec_gost3411_cp;
-extern gcry_md_spec_t _gcry_digest_spec_stribog_256;
-extern gcry_md_spec_t _gcry_digest_spec_stribog_512;
-extern gcry_md_spec_t _gcry_digest_spec_md2;
-extern gcry_md_spec_t _gcry_digest_spec_md4;
-extern gcry_md_spec_t _gcry_digest_spec_md5;
-extern gcry_md_spec_t _gcry_digest_spec_rmd160;
-extern gcry_md_spec_t _gcry_digest_spec_sha1;
-extern gcry_md_spec_t _gcry_digest_spec_sha224;
-extern gcry_md_spec_t _gcry_digest_spec_sha256;
-extern gcry_md_spec_t _gcry_digest_spec_sha384;
-extern gcry_md_spec_t _gcry_digest_spec_sha512;
-extern gcry_md_spec_t _gcry_digest_spec_sha512_224;
-extern gcry_md_spec_t _gcry_digest_spec_sha512_256;
-extern gcry_md_spec_t _gcry_digest_spec_sha3_224;
-extern gcry_md_spec_t _gcry_digest_spec_sha3_256;
-extern gcry_md_spec_t _gcry_digest_spec_sha3_512;
-extern gcry_md_spec_t _gcry_digest_spec_sha3_384;
-extern gcry_md_spec_t _gcry_digest_spec_shake128;
-extern gcry_md_spec_t _gcry_digest_spec_shake256;
-extern gcry_md_spec_t _gcry_digest_spec_tiger;
-extern gcry_md_spec_t _gcry_digest_spec_tiger1;
-extern gcry_md_spec_t _gcry_digest_spec_tiger2;
-extern gcry_md_spec_t _gcry_digest_spec_whirlpool;
-extern gcry_md_spec_t _gcry_digest_spec_blake2b_512;
-extern gcry_md_spec_t _gcry_digest_spec_blake2b_384;
-extern gcry_md_spec_t _gcry_digest_spec_blake2b_256;
-extern gcry_md_spec_t _gcry_digest_spec_blake2b_160;
-extern gcry_md_spec_t _gcry_digest_spec_blake2s_256;
-extern gcry_md_spec_t _gcry_digest_spec_blake2s_224;
-extern gcry_md_spec_t _gcry_digest_spec_blake2s_160;
-extern gcry_md_spec_t _gcry_digest_spec_blake2s_128;
-extern gcry_md_spec_t _gcry_digest_spec_sm3;
+extern const gcry_md_spec_t _gcry_digest_spec_crc32;
+extern const gcry_md_spec_t _gcry_digest_spec_crc32_rfc1510;
+extern const gcry_md_spec_t _gcry_digest_spec_crc24_rfc2440;
+extern const gcry_md_spec_t _gcry_digest_spec_gost3411_94;
+extern const gcry_md_spec_t _gcry_digest_spec_gost3411_cp;
+extern const gcry_md_spec_t _gcry_digest_spec_stribog_256;
+extern const gcry_md_spec_t _gcry_digest_spec_stribog_512;
+extern const gcry_md_spec_t _gcry_digest_spec_md2;
+extern const gcry_md_spec_t _gcry_digest_spec_md4;
+extern const gcry_md_spec_t _gcry_digest_spec_md5;
+extern const gcry_md_spec_t _gcry_digest_spec_rmd160;
+extern const gcry_md_spec_t _gcry_digest_spec_sha1;
+extern const gcry_md_spec_t _gcry_digest_spec_sha224;
+extern const gcry_md_spec_t _gcry_digest_spec_sha256;
+extern const gcry_md_spec_t _gcry_digest_spec_sha384;
+extern const gcry_md_spec_t _gcry_digest_spec_sha512;
+extern const gcry_md_spec_t _gcry_digest_spec_sha512_224;
+extern const gcry_md_spec_t _gcry_digest_spec_sha512_256;
+extern const gcry_md_spec_t _gcry_digest_spec_sha3_224;
+extern const gcry_md_spec_t _gcry_digest_spec_sha3_256;
+extern const gcry_md_spec_t _gcry_digest_spec_sha3_512;
+extern const gcry_md_spec_t _gcry_digest_spec_sha3_384;
+extern const gcry_md_spec_t _gcry_digest_spec_shake128;
+extern const gcry_md_spec_t _gcry_digest_spec_shake256;
+extern const gcry_md_spec_t _gcry_digest_spec_tiger;
+extern const gcry_md_spec_t _gcry_digest_spec_tiger1;
+extern const gcry_md_spec_t _gcry_digest_spec_tiger2;
+extern const gcry_md_spec_t _gcry_digest_spec_whirlpool;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2b_512;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2b_384;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2b_256;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2b_160;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2s_256;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2s_224;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2s_160;
+extern const gcry_md_spec_t _gcry_digest_spec_blake2s_128;
+extern const gcry_md_spec_t _gcry_digest_spec_sm3;
 
 /* Declarations for the pubkey cipher specifications.  */
 extern gcry_pk_spec_t _gcry_pubkey_spec_rsa;