Index: head/sys/crypto/blowfish/bf_skey.c
===================================================================
--- head/sys/crypto/blowfish/bf_skey.c
+++ head/sys/crypto/blowfish/bf_skey.c
@@ -73,11 +73,11 @@
 BF_set_key(key, len, data)
 	BF_KEY *key;
 	int len;
-	unsigned char *data;
+	const unsigned char *data;
 {
 	int i;
 	BF_LONG *p, ri, in[2];
-	unsigned char *d, *end;
+	const unsigned char *d, *end;
 
 	memcpy((char *)key, (const char *)&bf_init, sizeof(BF_KEY));
 	p = key->P;
Index: head/sys/crypto/blowfish/blowfish.h
===================================================================
--- head/sys/crypto/blowfish/blowfish.h
+++ head/sys/crypto/blowfish/blowfish.h
@@ -80,7 +80,7 @@
 	BF_LONG S[4*256];
 } BF_KEY;
 
-void BF_set_key(BF_KEY *, int, unsigned char *);
+void BF_set_key(BF_KEY *, int, const unsigned char *);
 void BF_encrypt(BF_LONG *, BF_KEY *);
 void BF_decrypt(BF_LONG *, BF_KEY *);
 void BF_ecb_encrypt(const unsigned char *, unsigned char *,
Index: head/sys/crypto/chacha20/chacha-sw.c
===================================================================
--- head/sys/crypto/chacha20/chacha-sw.c
+++ head/sys/crypto/chacha20/chacha-sw.c
@@ -7,7 +7,7 @@
 #include <opencrypto/xform_enc.h>
 
 static int
-chacha20_xform_setkey(u_int8_t **sched, u_int8_t *key, int len)
+chacha20_xform_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	struct chacha_ctx *ctx;
 
@@ -24,7 +24,7 @@
 }
 
 static void
-chacha20_xform_reinit(caddr_t key, u_int8_t *iv)
+chacha20_xform_reinit(caddr_t key, const u_int8_t *iv)
 {
 	struct chacha_ctx *ctx;
 
Index: head/sys/crypto/des/des.h
===================================================================
--- head/sys/crypto/des/des.h
+++ head/sys/crypto/des/des.h
@@ -103,12 +103,12 @@
 
 void des_set_odd_parity(des_cblock *);
 void des_fixup_key_parity(des_cblock *); 
-int des_is_weak_key(des_cblock *);
-int des_set_key(des_cblock *, des_key_schedule);
-int des_key_sched(des_cblock *, des_key_schedule);
-int des_set_key_checked(des_cblock *, des_key_schedule);
-void des_set_key_unchecked(des_cblock *, des_key_schedule);
-int des_check_key_parity(des_cblock *);
+int des_is_weak_key(const des_cblock *);
+int des_set_key(const des_cblock *, des_key_schedule);
+int des_key_sched(const des_cblock *, des_key_schedule);
+int des_set_key_checked(const des_cblock *, des_key_schedule);
+void des_set_key_unchecked(const des_cblock *, des_key_schedule);
+int des_check_key_parity(const des_cblock *);
 
 #ifdef  __cplusplus
 }
Index: head/sys/crypto/des/des_setkey.c
===================================================================
--- head/sys/crypto/des/des_setkey.c
+++ head/sys/crypto/des/des_setkey.c
@@ -75,7 +75,7 @@
 		(*key)[i]=odd_parity[(*key)[i]];
 }
 
-int des_check_key_parity(des_cblock *key)
+int des_check_key_parity(const des_cblock *key)
 {
 	int i;
 
@@ -117,7 +117,7 @@
 	{0xE0,0xFE,0xE0,0xFE,0xF1,0xFE,0xF1,0xFE},
 	{0xFE,0xE0,0xFE,0xE0,0xFE,0xF1,0xFE,0xF1}};
 
-int des_is_weak_key(des_cblock *key)
+int des_is_weak_key(const des_cblock *key)
 {
 	int i;
 
@@ -142,7 +142,7 @@
 #define HPERM_OP(a,t,n,m) ((t)=((((a)<<(16-(n)))^(a))&(m)),\
 	(a)=(a)^(t)^(t>>(16-(n))))
 
-int des_set_key(des_cblock *key, des_key_schedule schedule)
+int des_set_key(const des_cblock *key, des_key_schedule schedule)
 {
 	if (des_check_key)
 	{
@@ -159,7 +159,7 @@
  * return -1 if key parity error,
  * return -2 if illegal weak key.
  */
-int des_set_key_checked(des_cblock *key, des_key_schedule schedule)
+int des_set_key_checked(const des_cblock *key, des_key_schedule schedule)
 {
 	if (!des_check_key_parity(key))
 		return(-1);
@@ -169,7 +169,7 @@
 	return 0;
 }
 
-void des_set_key_unchecked(des_cblock *key, des_key_schedule schedule)
+void des_set_key_unchecked(const des_cblock *key, des_key_schedule schedule)
 {
 	static int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
 	DES_LONG c,d,t,s,t2;
@@ -225,7 +225,7 @@
 	}
 }
 
-int des_key_sched(des_cblock *key, des_key_schedule schedule)
+int des_key_sched(const des_cblock *key, des_key_schedule schedule)
 {
 	return(des_set_key(key,schedule));
 }
Index: head/sys/opencrypto/cast.h
===================================================================
--- head/sys/opencrypto/cast.h
+++ head/sys/opencrypto/cast.h
@@ -16,7 +16,7 @@
 	int		rounds;		/* Number of rounds to use, 12 or 16 */
 } cast_key;
 
-void cast_setkey(cast_key * key, u_int8_t * rawkey, int keybytes);
+void cast_setkey(cast_key * key, const u_int8_t * rawkey, int keybytes);
 void cast_encrypt(cast_key * key, u_int8_t * inblock, u_int8_t * outblock);
 void cast_decrypt(cast_key * key, u_int8_t * inblock, u_int8_t * outblock);
 
Index: head/sys/opencrypto/cast.c
===================================================================
--- head/sys/opencrypto/cast.c
+++ head/sys/opencrypto/cast.c
@@ -129,7 +129,7 @@
 
 /***** Key Schedule *****/
 
-void cast_setkey(cast_key* key, u_int8_t* rawkey, int keybytes)
+void cast_setkey(cast_key* key, const u_int8_t* rawkey, int keybytes)
 {
 u_int32_t t[4] = {0, 0, 0, 0}, z[4] = {0, 0, 0, 0}, x[4];
 int i;
Index: head/sys/opencrypto/skipjack.h
===================================================================
--- head/sys/opencrypto/skipjack.h
+++ head/sys/opencrypto/skipjack.h
@@ -19,6 +19,6 @@
 
 extern void skipjack_forwards(u_int8_t *plain, u_int8_t *cipher, u_int8_t **key);
 extern void skipjack_backwards(u_int8_t *cipher, u_int8_t *plain, u_int8_t **key);
-extern void subkey_table_gen(u_int8_t *key, u_int8_t **key_tables);
+extern void subkey_table_gen(const u_int8_t *key, u_int8_t **key_tables);
 
 #endif
Index: head/sys/opencrypto/skipjack.c
===================================================================
--- head/sys/opencrypto/skipjack.c
+++ head/sys/opencrypto/skipjack.c
@@ -65,7 +65,7 @@
  */
 
 void
-subkey_table_gen (u_int8_t *key, u_int8_t **key_tables)
+subkey_table_gen (const u_int8_t *key, u_int8_t **key_tables)
 {
 	int i, k;
 
Index: head/sys/opencrypto/xform_aes_icm.c
===================================================================
--- head/sys/opencrypto/xform_aes_icm.c
+++ head/sys/opencrypto/xform_aes_icm.c
@@ -52,12 +52,12 @@
 
 #include <opencrypto/xform_enc.h>
 
-static	int aes_icm_setkey(u_int8_t **, u_int8_t *, int);
+static	int aes_icm_setkey(u_int8_t **, const u_int8_t *, int);
 static	void aes_icm_crypt(caddr_t, u_int8_t *);
 static	void aes_icm_zerokey(u_int8_t **);
-static	void aes_icm_reinit(caddr_t, u_int8_t *);
-static	void aes_gcm_reinit(caddr_t, u_int8_t *);
-static	void aes_ccm_reinit(caddr_t, u_int8_t *);
+static	void aes_icm_reinit(caddr_t, const u_int8_t *);
+static	void aes_gcm_reinit(caddr_t, const u_int8_t *);
+static	void aes_ccm_reinit(caddr_t, const u_int8_t *);
 
 /* Encryption instances */
 struct enc_xform enc_xform_aes_icm = {
@@ -96,7 +96,7 @@
  * Encryption wrapper routines.
  */
 static void
-aes_icm_reinit(caddr_t key, u_int8_t *iv)
+aes_icm_reinit(caddr_t key, const u_int8_t *iv)
 {
 	struct aes_icm_ctx *ctx;
 
@@ -105,7 +105,7 @@
 }
 
 static void
-aes_gcm_reinit(caddr_t key, u_int8_t *iv)
+aes_gcm_reinit(caddr_t key, const u_int8_t *iv)
 {
 	struct aes_icm_ctx *ctx;
 
@@ -118,7 +118,7 @@
 }
 
 static void
-aes_ccm_reinit(caddr_t key, u_int8_t *iv)
+aes_ccm_reinit(caddr_t key, const u_int8_t *iv)
 {
 	struct aes_icm_ctx *ctx;
 
@@ -153,7 +153,7 @@
 }
 
 static int
-aes_icm_setkey(u_int8_t **sched, u_int8_t *key, int len)
+aes_icm_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	struct aes_icm_ctx *ctx;
 
@@ -166,7 +166,7 @@
 		return ENOMEM;
 
 	ctx = (struct aes_icm_ctx *)*sched;
-	ctx->ac_nr = rijndaelKeySetupEnc(ctx->ac_ek, (u_char *)key, len * 8);
+	ctx->ac_nr = rijndaelKeySetupEnc(ctx->ac_ek, key, len * 8);
 	return 0;
 }
 
Index: head/sys/opencrypto/xform_aes_xts.c
===================================================================
--- head/sys/opencrypto/xform_aes_xts.c
+++ head/sys/opencrypto/xform_aes_xts.c
@@ -52,11 +52,11 @@
 
 #include <opencrypto/xform_enc.h>
 
-static	int aes_xts_setkey(u_int8_t **, u_int8_t *, int);
+static	int aes_xts_setkey(u_int8_t **, const u_int8_t *, int);
 static	void aes_xts_encrypt(caddr_t, u_int8_t *);
 static	void aes_xts_decrypt(caddr_t, u_int8_t *);
 static	void aes_xts_zerokey(u_int8_t **);
-static	void aes_xts_reinit(caddr_t, u_int8_t *);
+static	void aes_xts_reinit(caddr_t, const u_int8_t *);
 
 /* Encryption instances */
 struct enc_xform enc_xform_aes_xts = {
@@ -73,7 +73,7 @@
  * Encryption wrapper routines.
  */
 static void
-aes_xts_reinit(caddr_t key, u_int8_t *iv)
+aes_xts_reinit(caddr_t key, const u_int8_t *iv)
 {
 	struct aes_xts_ctx *ctx = (struct aes_xts_ctx *)key;
 	u_int64_t blocknum;
@@ -136,7 +136,7 @@
 }
 
 static int
-aes_xts_setkey(u_int8_t **sched, u_int8_t *key, int len)
+aes_xts_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	struct aes_xts_ctx *ctx;
 
Index: head/sys/opencrypto/xform_blf.c
===================================================================
--- head/sys/opencrypto/xform_blf.c
+++ head/sys/opencrypto/xform_blf.c
@@ -53,7 +53,7 @@
 #include <crypto/blowfish/blowfish.h>
 #include <opencrypto/xform_enc.h>
 
-static	int blf_setkey(u_int8_t **, u_int8_t *, int);
+static	int blf_setkey(u_int8_t **, const u_int8_t *, int);
 static	void blf_encrypt(caddr_t, u_int8_t *);
 static	void blf_decrypt(caddr_t, u_int8_t *);
 static	void blf_zerokey(u_int8_t **);
@@ -104,7 +104,7 @@
 }
 
 static int
-blf_setkey(u_int8_t **sched, u_int8_t *key, int len)
+blf_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	int err;
 
Index: head/sys/opencrypto/xform_cast5.c
===================================================================
--- head/sys/opencrypto/xform_cast5.c
+++ head/sys/opencrypto/xform_cast5.c
@@ -53,7 +53,7 @@
 #include <opencrypto/cast.h>
 #include <opencrypto/xform_enc.h>
 
-static	int cast5_setkey(u_int8_t **, u_int8_t *, int);
+static	int cast5_setkey(u_int8_t **, const u_int8_t *, int);
 static	void cast5_encrypt(caddr_t, u_int8_t *);
 static	void cast5_decrypt(caddr_t, u_int8_t *);
 static	void cast5_zerokey(u_int8_t **);
@@ -85,7 +85,7 @@
 }
 
 static int
-cast5_setkey(u_int8_t **sched, u_int8_t *key, int len)
+cast5_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	int err;
 
Index: head/sys/opencrypto/xform_cml.c
===================================================================
--- head/sys/opencrypto/xform_cml.c
+++ head/sys/opencrypto/xform_cml.c
@@ -53,7 +53,7 @@
 #include <crypto/camellia/camellia.h>
 #include <opencrypto/xform_enc.h>
 
-static	int cml_setkey(u_int8_t **, u_int8_t *, int);
+static	int cml_setkey(u_int8_t **, const u_int8_t *, int);
 static	void cml_encrypt(caddr_t, u_int8_t *);
 static	void cml_decrypt(caddr_t, u_int8_t *);
 static	void cml_zerokey(u_int8_t **);
@@ -87,7 +87,7 @@
 }
 
 static int
-cml_setkey(u_int8_t **sched, u_int8_t *key, int len)
+cml_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	int err;
 
@@ -96,7 +96,7 @@
 	*sched = KMALLOC(sizeof(camellia_ctx), M_CRYPTO_DATA,
 	    M_NOWAIT|M_ZERO);
 	if (*sched != NULL) {
-		camellia_set_key((camellia_ctx *) *sched, (u_char *) key,
+		camellia_set_key((camellia_ctx *) *sched, key,
 		    len * 8);
 		err = 0;
 	} else
Index: head/sys/opencrypto/xform_des1.c
===================================================================
--- head/sys/opencrypto/xform_des1.c
+++ head/sys/opencrypto/xform_des1.c
@@ -53,7 +53,7 @@
 #include <crypto/des/des.h>
 #include <opencrypto/xform_enc.h>
 
-static	int des1_setkey(u_int8_t **, u_int8_t *, int);
+static	int des1_setkey(u_int8_t **, const u_int8_t *, int);
 static	void des1_encrypt(caddr_t, u_int8_t *);
 static	void des1_decrypt(caddr_t, u_int8_t *);
 static	void des1_zerokey(u_int8_t **);
@@ -91,7 +91,7 @@
 }
 
 static int
-des1_setkey(u_int8_t **sched, u_int8_t *key, int len)
+des1_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	des_key_schedule *p;
 	int err;
@@ -99,7 +99,7 @@
 	p = KMALLOC(sizeof (des_key_schedule),
 		M_CRYPTO_DATA, M_NOWAIT|M_ZERO);
 	if (p != NULL) {
-		des_set_key((des_cblock *) key, p[0]);
+		des_set_key((const des_cblock *) key, p[0]);
 		err = 0;
 	} else
 		err = ENOMEM;
Index: head/sys/opencrypto/xform_des3.c
===================================================================
--- head/sys/opencrypto/xform_des3.c
+++ head/sys/opencrypto/xform_des3.c
@@ -53,7 +53,7 @@
 #include <crypto/des/des.h>
 #include <opencrypto/xform_enc.h>
 
-static	int des3_setkey(u_int8_t **, u_int8_t *, int);
+static	int des3_setkey(u_int8_t **, const u_int8_t *, int);
 static	void des3_encrypt(caddr_t, u_int8_t *);
 static	void des3_decrypt(caddr_t, u_int8_t *);
 static	void des3_zerokey(u_int8_t **);
@@ -92,7 +92,7 @@
 }
 
 static int
-des3_setkey(u_int8_t **sched, u_int8_t *key, int len)
+des3_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	des_key_schedule *p;
 	int err;
@@ -100,9 +100,9 @@
 	p = KMALLOC(3*sizeof (des_key_schedule),
 		M_CRYPTO_DATA, M_NOWAIT|M_ZERO);
 	if (p != NULL) {
-		des_set_key((des_cblock *)(key +  0), p[0]);
-		des_set_key((des_cblock *)(key +  8), p[1]);
-		des_set_key((des_cblock *)(key + 16), p[2]);
+		des_set_key((const des_cblock *)(key +  0), p[0]);
+		des_set_key((const des_cblock *)(key +  8), p[1]);
+		des_set_key((const des_cblock *)(key + 16), p[2]);
 		err = 0;
 	} else
 		err = ENOMEM;
Index: head/sys/opencrypto/xform_enc.h
===================================================================
--- head/sys/opencrypto/xform_enc.h
+++ head/sys/opencrypto/xform_enc.h
@@ -56,9 +56,9 @@
 	u_int16_t minkey, maxkey;
 	void (*encrypt) (caddr_t, u_int8_t *);
 	void (*decrypt) (caddr_t, u_int8_t *);
-	int (*setkey) (u_int8_t **, u_int8_t *, int len);
+	int (*setkey) (u_int8_t **, const u_int8_t *, int len);
 	void (*zerokey) (u_int8_t **);
-	void (*reinit) (caddr_t, u_int8_t *);
+	void (*reinit) (caddr_t, const u_int8_t *);
 	/*
 	 * Encrypt/decrypt 1+ blocks of input -- total size is 'len' bytes.
 	 * Len is guaranteed to be a multiple of the defined 'blocksize'.
Index: head/sys/opencrypto/xform_null.c
===================================================================
--- head/sys/opencrypto/xform_null.c
+++ head/sys/opencrypto/xform_null.c
@@ -53,7 +53,7 @@
 #include <opencrypto/xform_auth.h>
 #include <opencrypto/xform_enc.h>
 
-static	int null_setkey(u_int8_t **, u_int8_t *, int);
+static	int null_setkey(u_int8_t **, const u_int8_t *, int);
 static	void null_encrypt(caddr_t, u_int8_t *);
 static	void null_decrypt(caddr_t, u_int8_t *);
 static	void null_zerokey(u_int8_t **);
@@ -104,7 +104,7 @@
 }
 
 static int
-null_setkey(u_int8_t **sched, u_int8_t *key, int len)
+null_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	*sched = NULL;
 	return 0;
Index: head/sys/opencrypto/xform_rijndael.c
===================================================================
--- head/sys/opencrypto/xform_rijndael.c
+++ head/sys/opencrypto/xform_rijndael.c
@@ -53,7 +53,7 @@
 #include <crypto/rijndael/rijndael.h>
 #include <opencrypto/xform_enc.h>
 
-static	int rijndael128_setkey(u_int8_t **, u_int8_t *, int);
+static	int rijndael128_setkey(u_int8_t **, const u_int8_t *, int);
 static	void rijndael128_encrypt(caddr_t, u_int8_t *);
 static	void rijndael128_decrypt(caddr_t, u_int8_t *);
 static	void rijndael128_zerokey(u_int8_t **);
@@ -87,7 +87,7 @@
 }
 
 static int
-rijndael128_setkey(u_int8_t **sched, u_int8_t *key, int len)
+rijndael128_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	int err;
 
@@ -96,7 +96,7 @@
 	*sched = KMALLOC(sizeof(rijndael_ctx), M_CRYPTO_DATA,
 	    M_NOWAIT|M_ZERO);
 	if (*sched != NULL) {
-		rijndael_set_key((rijndael_ctx *) *sched, (u_char *) key,
+		rijndael_set_key((rijndael_ctx *) *sched, key,
 		    len * 8);
 		err = 0;
 	} else
Index: head/sys/opencrypto/xform_skipjack.c
===================================================================
--- head/sys/opencrypto/xform_skipjack.c
+++ head/sys/opencrypto/xform_skipjack.c
@@ -53,7 +53,7 @@
 #include <opencrypto/skipjack.h>
 #include <opencrypto/xform_enc.h>
 
-static	int skipjack_setkey(u_int8_t **, u_int8_t *, int);
+static	int skipjack_setkey(u_int8_t **, const u_int8_t *, int);
 static	void skipjack_encrypt(caddr_t, u_int8_t *);
 static	void skipjack_decrypt(caddr_t, u_int8_t *);
 static	void skipjack_zerokey(u_int8_t **);
@@ -85,7 +85,7 @@
 }
 
 static int
-skipjack_setkey(u_int8_t **sched, u_int8_t *key, int len)
+skipjack_setkey(u_int8_t **sched, const u_int8_t *key, int len)
 {
 	int err;