diff --git a/include/polarssl/des.h b/include/polarssl/des.h
index b0fe69e..1a09ad1 100644
--- a/include/polarssl/des.h
+++ b/include/polarssl/des.h
@@ -56,7 +56,7 @@
  * \param ctx      DES context to be initialized
  * \param key      8-byte secret key
  */
-void des_setkey_enc( des_context *ctx, unsigned char key[8] );
+void des_setkey_enc( des_context *ctx, const unsigned char key[8] );
 
 /**
  * \brief          DES key schedule (56-bit, decryption)
@@ -64,7 +64,7 @@
  * \param ctx      DES context to be initialized
  * \param key      8-byte secret key
  */
-void des_setkey_dec( des_context *ctx, unsigned char key[8] );
+void des_setkey_dec( des_context *ctx, const unsigned char key[8] );
 
 /**
  * \brief          Triple-DES key schedule (112-bit, encryption)
@@ -72,7 +72,7 @@
  * \param ctx      3DES context to be initialized
  * \param key      16-byte secret key
  */
-void des3_set2key_enc( des3_context *ctx, unsigned char key[16] );
+void des3_set2key_enc( des3_context *ctx, const unsigned char key[16] );
 
 /**
  * \brief          Triple-DES key schedule (112-bit, decryption)
@@ -80,7 +80,7 @@
  * \param ctx      3DES context to be initialized
  * \param key      16-byte secret key
  */
-void des3_set2key_dec( des3_context *ctx, unsigned char key[16] );
+void des3_set2key_dec( des3_context *ctx, const unsigned char key[16] );
 
 /**
  * \brief          Triple-DES key schedule (168-bit, encryption)
@@ -88,7 +88,7 @@
  * \param ctx      3DES context to be initialized
  * \param key      24-byte secret key
  */
-void des3_set3key_enc( des3_context *ctx, unsigned char key[24] );
+void des3_set3key_enc( des3_context *ctx, const unsigned char key[24] );
 
 /**
  * \brief          Triple-DES key schedule (168-bit, decryption)
@@ -96,7 +96,7 @@
  * \param ctx      3DES context to be initialized
  * \param key      24-byte secret key
  */
-void des3_set3key_dec( des3_context *ctx, unsigned char key[24] );
+void des3_set3key_dec( des3_context *ctx, const unsigned char key[24] );
 
 /**
  * \brief          DES-ECB block encryption/decryption
@@ -106,7 +106,7 @@
  * \param output   64-bit output block
  */
 void des_crypt_ecb( des_context *ctx,
-                    unsigned char input[8],
+                    const unsigned char input[8],
                     unsigned char output[8] );
 
 /**
@@ -123,7 +123,7 @@
                     int mode,
                     int length,
                     unsigned char iv[8],
-                    unsigned char *input,
+                    const unsigned char *input,
                     unsigned char *output );
 
 /**
@@ -134,7 +134,7 @@
  * \param output   64-bit output block
  */
 void des3_crypt_ecb( des3_context *ctx,
-                     unsigned char input[8],
+                     const unsigned char input[8],
                      unsigned char output[8] );
 
 /**
@@ -151,7 +151,7 @@
                      int mode,
                      int length,
                      unsigned char iv[8],
-                     unsigned char *input,
+                     const unsigned char *input,
                      unsigned char *output );
 
 /*