diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
index a927e29..833f1d8 100644
--- a/library/cipher_wrap.c
+++ b/library/cipher_wrap.c
@@ -58,13 +58,13 @@
 
 #if defined(POLARSSL_AES_C)
 
-int aes_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
+static int aes_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
         unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
     return aes_crypt_cbc( (aes_context *) ctx, operation, length, iv, input, output );
 }
 
-int aes_crypt_cfb128_wrap( void *ctx, operation_t operation, size_t length,
+static int aes_crypt_cfb128_wrap( void *ctx, operation_t operation, size_t length,
         size_t *iv_off, unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
 #if defined(POLARSSL_CIPHER_MODE_CFB)
@@ -82,7 +82,7 @@
 #endif
 }
 
-int aes_crypt_ctr_wrap( void *ctx, size_t length,
+static int aes_crypt_ctr_wrap( void *ctx, size_t length,
         size_t *nc_off, unsigned char *nonce_counter, unsigned char *stream_block,
         const unsigned char *input, unsigned char *output )
 {
@@ -102,12 +102,12 @@
 #endif
 }
 
-int aes_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int aes_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     return aes_setkey_dec( (aes_context *) ctx, key, key_length );
 }
 
-int aes_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int aes_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     return aes_setkey_enc( (aes_context *) ctx, key, key_length );
 }
@@ -232,13 +232,13 @@
 
 #if defined(POLARSSL_CAMELLIA_C)
 
-int camellia_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
+static int camellia_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
         unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
     return camellia_crypt_cbc( (camellia_context *) ctx, operation, length, iv, input, output );
 }
 
-int camellia_crypt_cfb128_wrap( void *ctx, operation_t operation, size_t length,
+static int camellia_crypt_cfb128_wrap( void *ctx, operation_t operation, size_t length,
         size_t *iv_off, unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
 #if defined(POLARSSL_CIPHER_MODE_CFB)
@@ -256,7 +256,7 @@
 #endif
 }
 
-int camellia_crypt_ctr_wrap( void *ctx, size_t length,
+static int camellia_crypt_ctr_wrap( void *ctx, size_t length,
         size_t *nc_off, unsigned char *nonce_counter, unsigned char *stream_block,
         const unsigned char *input, unsigned char *output )
 {
@@ -276,12 +276,12 @@
 #endif
 }
 
-int camellia_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int camellia_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     return camellia_setkey_dec( (camellia_context *) ctx, key, key_length );
 }
 
-int camellia_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int camellia_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     return camellia_setkey_enc( (camellia_context *) ctx, key, key_length );
 }
@@ -406,19 +406,19 @@
 
 #if defined(POLARSSL_DES_C)
 
-int des_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
+static int des_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
         unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
     return des_crypt_cbc( (des_context *) ctx, operation, length, iv, input, output );
 }
 
-int des3_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
+static int des3_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
         unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
     return des3_crypt_cbc( (des3_context *) ctx, operation, length, iv, input, output );
 }
 
-int des_crypt_cfb128_wrap( void *ctx, operation_t operation, size_t length,
+static int des_crypt_cfb128_wrap( void *ctx, operation_t operation, size_t length,
         size_t *iv_off, unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
     ((void) ctx);
@@ -432,7 +432,7 @@
     return POLARSSL_ERR_CIPHER_FEATURE_UNAVAILABLE;
 }
 
-int des_crypt_ctr_wrap( void *ctx, size_t length,
+static int des_crypt_ctr_wrap( void *ctx, size_t length,
         size_t *nc_off, unsigned char *nonce_counter, unsigned char *stream_block,
         const unsigned char *input, unsigned char *output )
 {
@@ -448,42 +448,42 @@
 }
 
 
-int des_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int des_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     ((void) key_length);
 
     return des_setkey_dec( (des_context *) ctx, key );
 }
 
-int des_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int des_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     ((void) key_length);
 
     return des_setkey_enc( (des_context *) ctx, key );
 }
 
-int des3_set2key_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int des3_set2key_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     ((void) key_length);
 
     return des3_set2key_dec( (des3_context *) ctx, key );
 }
 
-int des3_set2key_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int des3_set2key_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     ((void) key_length);
 
     return des3_set2key_enc( (des3_context *) ctx, key );
 }
 
-int des3_set3key_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int des3_set3key_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     ((void) key_length);
 
     return des3_set3key_dec( (des3_context *) ctx, key );
 }
 
-int des3_set3key_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int des3_set3key_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     ((void) key_length);
 
@@ -578,13 +578,13 @@
 
 #if defined(POLARSSL_BLOWFISH_C)
 
-int blowfish_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
+static int blowfish_crypt_cbc_wrap( void *ctx, operation_t operation, size_t length,
         unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
     return blowfish_crypt_cbc( (blowfish_context *) ctx, operation, length, iv, input, output );
 }
 
-int blowfish_crypt_cfb64_wrap( void *ctx, operation_t operation, size_t length,
+static int blowfish_crypt_cfb64_wrap( void *ctx, operation_t operation, size_t length,
         size_t *iv_off, unsigned char *iv, const unsigned char *input, unsigned char *output )
 {
 #if defined(POLARSSL_CIPHER_MODE_CFB)
@@ -602,7 +602,7 @@
 #endif
 }
 
-int blowfish_crypt_ctr_wrap( void *ctx, size_t length,
+static int blowfish_crypt_ctr_wrap( void *ctx, size_t length,
         size_t *nc_off, unsigned char *nonce_counter, unsigned char *stream_block,
         const unsigned char *input, unsigned char *output )
 {
@@ -622,12 +622,12 @@
 #endif
 }
 
-int blowfish_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int blowfish_setkey_dec_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     return blowfish_setkey( (blowfish_context *) ctx, key, key_length );
 }
 
-int blowfish_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
+static int blowfish_setkey_enc_wrap( void *ctx, const unsigned char *key, unsigned int key_length )
 {
     return blowfish_setkey( (blowfish_context *) ctx, key, key_length );
 }
diff --git a/library/ctr_drbg.c b/library/ctr_drbg.c
index aec29b9..1b46f45 100644
--- a/library/ctr_drbg.c
+++ b/library/ctr_drbg.c
@@ -48,6 +48,14 @@
                    void *p_entropy,
                    const unsigned char *custom,
                    size_t len,
+                   size_t entropy_len );
+
+int ctr_drbg_init_entropy_len(
+                   ctr_drbg_context *ctx,
+                   int (*f_entropy)(void *, unsigned char *, size_t),
+                   void *p_entropy,
+                   const unsigned char *custom,
+                   size_t len,
                    size_t entropy_len )
 {
     int ret;
@@ -98,8 +106,8 @@
     ctx->reseed_interval = interval;
 }
     
-int block_cipher_df( unsigned char *output,
-                     const unsigned char *data, size_t data_len )
+static int block_cipher_df( unsigned char *output,
+                            const unsigned char *data, size_t data_len )
 {
     unsigned char buf[CTR_DRBG_MAX_SEED_INPUT + CTR_DRBG_BLOCKSIZE + 16];
     unsigned char tmp[CTR_DRBG_SEEDLEN];
@@ -180,8 +188,8 @@
     return( 0 );
 }
 
-int ctr_drbg_update_internal( ctr_drbg_context *ctx,
-                              const unsigned char data[CTR_DRBG_SEEDLEN] )
+static int ctr_drbg_update_internal( ctr_drbg_context *ctx,
+                                    const unsigned char data[CTR_DRBG_SEEDLEN] )
 {
     unsigned char tmp[CTR_DRBG_SEEDLEN];
     unsigned char *p = tmp;
@@ -449,7 +457,8 @@
       0x9d, 0x90, 0x3e, 0x07, 0x7c, 0x6f, 0x21, 0x8f };
 
 static size_t test_offset;
-int ctr_drbg_self_test_entropy( void *data, unsigned char *buf, size_t len )
+static int ctr_drbg_self_test_entropy( void *data, unsigned char *buf,
+                                       size_t len )
 {
     unsigned char *p = data;
     memcpy( buf, p + test_offset, len );
diff --git a/library/entropy.c b/library/entropy.c
index 468ef03..9fc11a7 100644
--- a/library/entropy.c
+++ b/library/entropy.c
@@ -85,8 +85,8 @@
 /*
  * Entropy accumulator update
  */
-int entropy_update( entropy_context *ctx, unsigned char source_id,
-                    const unsigned char *data, size_t len )
+static int entropy_update( entropy_context *ctx, unsigned char source_id,
+                           const unsigned char *data, size_t len )
 {
     unsigned char header[2];
     unsigned char tmp[ENTROPY_BLOCK_SIZE];
diff --git a/library/gcm.c b/library/gcm.c
index f1a43af..08435f9 100644
--- a/library/gcm.c
+++ b/library/gcm.c
@@ -129,7 +129,8 @@
     0x9180, 0x8da0, 0xa9c0, 0xb5e0
 };
 
-void gcm_mult( gcm_context *ctx, const unsigned char x[16], unsigned char output[16] )
+static void gcm_mult( gcm_context *ctx, const unsigned char x[16],
+                      unsigned char output[16] )
 {
     int i = 0;
     unsigned char z[16];
diff --git a/library/md_wrap.c b/library/md_wrap.c
index 92d04f9..4ea2e67 100644
--- a/library/md_wrap.c
+++ b/library/md_wrap.c
@@ -81,7 +81,7 @@
     md2_finish( (md2_context *) ctx, output );
 }
 
-int md2_file_wrap( const char *path, unsigned char *output )
+static int md2_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return md2_file( path, output );
@@ -145,22 +145,22 @@
 
 #if defined(POLARSSL_MD4_C)
 
-void md4_starts_wrap( void *ctx )
+static void md4_starts_wrap( void *ctx )
 {
     md4_starts( (md4_context *) ctx );
 }
 
-void md4_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void md4_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     md4_update( (md4_context *) ctx, input, ilen );
 }
 
-void md4_finish_wrap( void *ctx, unsigned char *output )
+static void md4_finish_wrap( void *ctx, unsigned char *output )
 {
     md4_finish( (md4_context *) ctx, output );
 }
 
-int md4_file_wrap( const char *path, unsigned char *output )
+static int md4_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return md4_file( path, output );
@@ -171,32 +171,32 @@
 #endif
 }
 
-void md4_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
+static void md4_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
 {
     md4_hmac_starts( (md4_context *) ctx, key, keylen );
 }
 
-void md4_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void md4_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     md4_hmac_update( (md4_context *) ctx, input, ilen );
 }
 
-void md4_hmac_finish_wrap( void *ctx, unsigned char *output )
+static void md4_hmac_finish_wrap( void *ctx, unsigned char *output )
 {
     md4_hmac_finish( (md4_context *) ctx, output );
 }
 
-void md4_hmac_reset_wrap( void *ctx )
+static void md4_hmac_reset_wrap( void *ctx )
 {
     md4_hmac_reset( (md4_context *) ctx );
 }
 
-void *md4_ctx_alloc( void )
+static void *md4_ctx_alloc( void )
 {
     return malloc( sizeof( md4_context ) );
 }
 
-void md4_ctx_free( void *ctx )
+static void md4_ctx_free( void *ctx )
 {
     polarssl_zeroize( ctx, sizeof( md4_context ) );
     free( ctx );
@@ -239,7 +239,7 @@
     md5_finish( (md5_context *) ctx, output );
 }
 
-int md5_file_wrap( const char *path, unsigned char *output )
+static int md5_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return md5_file( path, output );
@@ -303,22 +303,22 @@
 
 #if defined(POLARSSL_SHA1_C)
 
-void sha1_starts_wrap( void *ctx )
+static void sha1_starts_wrap( void *ctx )
 {
     sha1_starts( (sha1_context *) ctx );
 }
 
-void sha1_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha1_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha1_update( (sha1_context *) ctx, input, ilen );
 }
 
-void sha1_finish_wrap( void *ctx, unsigned char *output )
+static void sha1_finish_wrap( void *ctx, unsigned char *output )
 {
     sha1_finish( (sha1_context *) ctx, output );
 }
 
-int sha1_file_wrap( const char *path, unsigned char *output )
+static int sha1_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return sha1_file( path, output );
@@ -329,32 +329,32 @@
 #endif
 }
 
-void sha1_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
+static void sha1_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
 {
     sha1_hmac_starts( (sha1_context *) ctx, key, keylen );
 }
 
-void sha1_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha1_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha1_hmac_update( (sha1_context *) ctx, input, ilen );
 }
 
-void sha1_hmac_finish_wrap( void *ctx, unsigned char *output )
+static void sha1_hmac_finish_wrap( void *ctx, unsigned char *output )
 {
     sha1_hmac_finish( (sha1_context *) ctx, output );
 }
 
-void sha1_hmac_reset_wrap( void *ctx )
+static void sha1_hmac_reset_wrap( void *ctx )
 {
     sha1_hmac_reset( (sha1_context *) ctx );
 }
 
-void * sha1_ctx_alloc( void )
+static void * sha1_ctx_alloc( void )
 {
     return malloc( sizeof( sha1_context ) );
 }
 
-void sha1_ctx_free( void *ctx )
+static void sha1_ctx_free( void *ctx )
 {
     polarssl_zeroize( ctx, sizeof( sha1_context ) );
     free( ctx );
@@ -385,28 +385,28 @@
  */
 #if defined(POLARSSL_SHA2_C)
 
-void sha224_starts_wrap( void *ctx )
+static void sha224_starts_wrap( void *ctx )
 {
     sha2_starts( (sha2_context *) ctx, 1 );
 }
 
-void sha224_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha224_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha2_update( (sha2_context *) ctx, input, ilen );
 }
 
-void sha224_finish_wrap( void *ctx, unsigned char *output )
+static void sha224_finish_wrap( void *ctx, unsigned char *output )
 {
     sha2_finish( (sha2_context *) ctx, output );
 }
 
-void sha224_wrap( const unsigned char *input, size_t ilen,
+static void sha224_wrap( const unsigned char *input, size_t ilen,
                     unsigned char *output )
 {
     sha2( input, ilen, output, 1 );
 }
 
-int sha224_file_wrap( const char *path, unsigned char *output )
+static int sha224_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return sha2_file( path, output, 1 );
@@ -417,39 +417,39 @@
 #endif
 }
 
-void sha224_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
+static void sha224_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
 {
     sha2_hmac_starts( (sha2_context *) ctx, key, keylen, 1 );
 }
 
-void sha224_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha224_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha2_hmac_update( (sha2_context *) ctx, input, ilen );
 }
 
-void sha224_hmac_finish_wrap( void *ctx, unsigned char *output )
+static void sha224_hmac_finish_wrap( void *ctx, unsigned char *output )
 {
     sha2_hmac_finish( (sha2_context *) ctx, output );
 }
 
-void sha224_hmac_reset_wrap( void *ctx )
+static void sha224_hmac_reset_wrap( void *ctx )
 {
     sha2_hmac_reset( (sha2_context *) ctx );
 }
 
-void sha224_hmac_wrap( const unsigned char *key, size_t keylen,
+static void sha224_hmac_wrap( const unsigned char *key, size_t keylen,
         const unsigned char *input, size_t ilen,
         unsigned char *output )
 {
     sha2_hmac( key, keylen, input, ilen, output, 1 );
 }
 
-void * sha224_ctx_alloc( void )
+static void * sha224_ctx_alloc( void )
 {
     return malloc( sizeof( sha2_context ) );
 }
 
-void sha224_ctx_free( void *ctx )
+static void sha224_ctx_free( void *ctx )
 {
     polarssl_zeroize( ctx, sizeof( sha2_context ) );
     free( ctx );
@@ -473,28 +473,28 @@
     sha224_ctx_free,
 };
 
-void sha256_starts_wrap( void *ctx )
+static void sha256_starts_wrap( void *ctx )
 {
     sha2_starts( (sha2_context *) ctx, 0 );
 }
 
-void sha256_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha256_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha2_update( (sha2_context *) ctx, input, ilen );
 }
 
-void sha256_finish_wrap( void *ctx, unsigned char *output )
+static void sha256_finish_wrap( void *ctx, unsigned char *output )
 {
     sha2_finish( (sha2_context *) ctx, output );
 }
 
-void sha256_wrap( const unsigned char *input, size_t ilen,
+static void sha256_wrap( const unsigned char *input, size_t ilen,
                     unsigned char *output )
 {
     sha2( input, ilen, output, 0 );
 }
 
-int sha256_file_wrap( const char *path, unsigned char *output )
+static int sha256_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return sha2_file( path, output, 0 );
@@ -505,39 +505,39 @@
 #endif
 }
 
-void sha256_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
+static void sha256_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
 {
     sha2_hmac_starts( (sha2_context *) ctx, key, keylen, 0 );
 }
 
-void sha256_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha256_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha2_hmac_update( (sha2_context *) ctx, input, ilen );
 }
 
-void sha256_hmac_finish_wrap( void *ctx, unsigned char *output )
+static void sha256_hmac_finish_wrap( void *ctx, unsigned char *output )
 {
     sha2_hmac_finish( (sha2_context *) ctx, output );
 }
 
-void sha256_hmac_reset_wrap( void *ctx )
+static void sha256_hmac_reset_wrap( void *ctx )
 {
     sha2_hmac_reset( (sha2_context *) ctx );
 }
 
-void sha256_hmac_wrap( const unsigned char *key, size_t keylen,
+static void sha256_hmac_wrap( const unsigned char *key, size_t keylen,
         const unsigned char *input, size_t ilen,
         unsigned char *output )
 {
     sha2_hmac( key, keylen, input, ilen, output, 0 );
 }
 
-void * sha256_ctx_alloc( void )
+static void * sha256_ctx_alloc( void )
 {
     return malloc( sizeof( sha2_context ) );
 }
 
-void sha256_ctx_free( void *ctx )
+static void sha256_ctx_free( void *ctx )
 {
     polarssl_zeroize( ctx, sizeof( sha2_context ) );
     free( ctx );
@@ -565,28 +565,28 @@
 
 #if defined(POLARSSL_SHA4_C)
 
-void sha384_starts_wrap( void *ctx )
+static void sha384_starts_wrap( void *ctx )
 {
     sha4_starts( (sha4_context *) ctx, 1 );
 }
 
-void sha384_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha384_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha4_update( (sha4_context *) ctx, input, ilen );
 }
 
-void sha384_finish_wrap( void *ctx, unsigned char *output )
+static void sha384_finish_wrap( void *ctx, unsigned char *output )
 {
     sha4_finish( (sha4_context *) ctx, output );
 }
 
-void sha384_wrap( const unsigned char *input, size_t ilen,
+static void sha384_wrap( const unsigned char *input, size_t ilen,
                     unsigned char *output )
 {
     sha4( input, ilen, output, 1 );
 }
 
-int sha384_file_wrap( const char *path, unsigned char *output )
+static int sha384_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return sha4_file( path, output, 1 );
@@ -597,39 +597,39 @@
 #endif
 }
 
-void sha384_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
+static void sha384_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
 {
     sha4_hmac_starts( (sha4_context *) ctx, key, keylen, 1 );
 }
 
-void sha384_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha384_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha4_hmac_update( (sha4_context *) ctx, input, ilen );
 }
 
-void sha384_hmac_finish_wrap( void *ctx, unsigned char *output )
+static void sha384_hmac_finish_wrap( void *ctx, unsigned char *output )
 {
     sha4_hmac_finish( (sha4_context *) ctx, output );
 }
 
-void sha384_hmac_reset_wrap( void *ctx )
+static void sha384_hmac_reset_wrap( void *ctx )
 {
     sha4_hmac_reset( (sha4_context *) ctx );
 }
 
-void sha384_hmac_wrap( const unsigned char *key, size_t keylen,
+static void sha384_hmac_wrap( const unsigned char *key, size_t keylen,
         const unsigned char *input, size_t ilen,
         unsigned char *output )
 {
     sha4_hmac( key, keylen, input, ilen, output, 1 );
 }
 
-void * sha384_ctx_alloc( void )
+static void * sha384_ctx_alloc( void )
 {
     return malloc( sizeof( sha4_context ) );
 }
 
-void sha384_ctx_free( void *ctx )
+static void sha384_ctx_free( void *ctx )
 {
     polarssl_zeroize( ctx, sizeof( sha4_context ) );
     free( ctx );
@@ -653,28 +653,28 @@
     sha384_ctx_free,
 };
 
-void sha512_starts_wrap( void *ctx )
+static void sha512_starts_wrap( void *ctx )
 {
     sha4_starts( (sha4_context *) ctx, 0 );
 }
 
-void sha512_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha512_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha4_update( (sha4_context *) ctx, input, ilen );
 }
 
-void sha512_finish_wrap( void *ctx, unsigned char *output )
+static void sha512_finish_wrap( void *ctx, unsigned char *output )
 {
     sha4_finish( (sha4_context *) ctx, output );
 }
 
-void sha512_wrap( const unsigned char *input, size_t ilen,
+static void sha512_wrap( const unsigned char *input, size_t ilen,
                     unsigned char *output )
 {
     sha4( input, ilen, output, 0 );
 }
 
-int sha512_file_wrap( const char *path, unsigned char *output )
+static int sha512_file_wrap( const char *path, unsigned char *output )
 {
 #if defined(POLARSSL_FS_IO)
     return sha4_file( path, output, 0 );
@@ -685,39 +685,39 @@
 #endif
 }
 
-void sha512_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
+static void sha512_hmac_starts_wrap( void *ctx, const unsigned char *key, size_t keylen )
 {
     sha4_hmac_starts( (sha4_context *) ctx, key, keylen, 0 );
 }
 
-void sha512_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
+static void sha512_hmac_update_wrap( void *ctx, const unsigned char *input, size_t ilen )
 {
     sha4_hmac_update( (sha4_context *) ctx, input, ilen );
 }
 
-void sha512_hmac_finish_wrap( void *ctx, unsigned char *output )
+static void sha512_hmac_finish_wrap( void *ctx, unsigned char *output )
 {
     sha4_hmac_finish( (sha4_context *) ctx, output );
 }
 
-void sha512_hmac_reset_wrap( void *ctx )
+static void sha512_hmac_reset_wrap( void *ctx )
 {
     sha4_hmac_reset( (sha4_context *) ctx );
 }
 
-void sha512_hmac_wrap( const unsigned char *key, size_t keylen,
+static void sha512_hmac_wrap( const unsigned char *key, size_t keylen,
         const unsigned char *input, size_t ilen,
         unsigned char *output )
 {
     sha4_hmac( key, keylen, input, ilen, output, 0 );
 }
 
-void * sha512_ctx_alloc( void )
+static void * sha512_ctx_alloc( void )
 {
     return malloc( sizeof( sha4_context ) );
 }
 
-void sha512_ctx_free( void *ctx )
+static void sha512_ctx_free( void *ctx )
 {
     polarssl_zeroize( ctx, sizeof( sha4_context ) );
     free( ctx );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 541e8d4..bda170d 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -359,7 +359,7 @@
                        handshake->pmslen );
 
         handshake->tls_prf( handshake->premaster, handshake->pmslen,
-                            "master secret",
+                            (char *) "master secret",
                             handshake->randbytes, 64, session->master, 48 );
 
         polarssl_zeroize( handshake->premaster, sizeof(handshake->premaster) );
@@ -387,7 +387,7 @@
      *  TLSv1:
      *    key block = PRF( master, "key expansion", randbytes )
      */
-    handshake->tls_prf( session->master, 48, "key expansion",
+    handshake->tls_prf( session->master, 48, (char *) "key expansion",
                         handshake->randbytes, 64, keyblk, 256 );
 
     SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
@@ -2995,7 +2995,7 @@
     return( 0 );
 }
 
-int ssl_handshake_init( ssl_context *ssl )
+static int ssl_handshake_init( ssl_context *ssl )
 {
     if( ssl->transform_negotiate )
         ssl_transform_free( ssl->transform_negotiate );
diff --git a/library/x509parse.c b/library/x509parse.c
index 31699b0..fe13b16 100644
--- a/library/x509parse.c
+++ b/library/x509parse.c
@@ -1135,8 +1135,8 @@
 /*
  * Parse and fill a single X.509 certificate in DER format
  */
-int x509parse_crt_der_core( x509_cert *crt, const unsigned char *buf,
-                            size_t buflen )
+static int x509parse_crt_der_core( x509_cert *crt, const unsigned char *buf,
+                                   size_t buflen )
 {
     int ret;
     size_t len;
@@ -1471,8 +1471,8 @@
             pem_init( &pem );
 
             ret = pem_read_buffer( &pem,
-                           "-----BEGIN CERTIFICATE-----",
-                           "-----END CERTIFICATE-----",
+                           (char *) "-----BEGIN CERTIFICATE-----",
+                           (char *) "-----END CERTIFICATE-----",
                            buf, NULL, 0, &use_len );
 
             if( ret == 0 )
@@ -1582,8 +1582,8 @@
 #if defined(POLARSSL_PEM_C)
     pem_init( &pem );
     ret = pem_read_buffer( &pem,
-                           "-----BEGIN X509 CRL-----",
-                           "-----END X509 CRL-----",
+                           (char *) "-----BEGIN X509 CRL-----",
+                           (char *) "-----END X509 CRL-----",
                            buf, NULL, 0, &use_len );
 
     if( ret == 0 )
@@ -1831,7 +1831,7 @@
 /*
  * Load all data from a file into a given buffer.
  */
-int load_file( const char *path, unsigned char **buf, size_t *n )
+static int load_file( const char *path, unsigned char **buf, size_t *n )
 {
     FILE *f;
     long size;
@@ -1943,7 +1943,6 @@
     if (GetLastError() != ERROR_NO_MORE_FILES) 
         ret = POLARSSL_ERR_X509_FILE_IO_ERROR;
 
-cleanup:
     FindClose( hFind );
 #else
 #if defined(POLARSSL_HAVE_READDIR_R)
@@ -2374,8 +2373,8 @@
 
     pem_init( &pem );
     ret = pem_read_buffer( &pem,
-                           "-----BEGIN RSA PRIVATE KEY-----",
-                           "-----END RSA PRIVATE KEY-----",
+                           (char *) "-----BEGIN RSA PRIVATE KEY-----",
+                           (char *) "-----END RSA PRIVATE KEY-----",
                            key, pwd, pwdlen, &len );
     if( ret == 0 )
     {
@@ -2395,8 +2394,8 @@
         return( ret );
 
     ret = pem_read_buffer( &pem,
-                           "-----BEGIN PRIVATE KEY-----",
-                           "-----END PRIVATE KEY-----",
+                           (char *) "-----BEGIN PRIVATE KEY-----",
+                           (char *) "-----END PRIVATE KEY-----",
                            key, NULL, 0, &len );
     if( ret == 0 )
     {
@@ -2413,8 +2412,8 @@
         return( ret );
 
     ret = pem_read_buffer( &pem,
-                           "-----BEGIN ENCRYPTED PRIVATE KEY-----",
-                           "-----END ENCRYPTED PRIVATE KEY-----",
+                           (char *) "-----BEGIN ENCRYPTED PRIVATE KEY-----",
+                           (char *) "-----END ENCRYPTED PRIVATE KEY-----",
                            key, NULL, 0, &len );
     if( ret == 0 )
     {
@@ -2481,8 +2480,8 @@
 
     pem_init( &pem );
     ret = pem_read_buffer( &pem,
-            "-----BEGIN PUBLIC KEY-----",
-            "-----END PUBLIC KEY-----",
+            (char *) "-----BEGIN PUBLIC KEY-----",
+            (char *) "-----END PUBLIC KEY-----",
             key, NULL, 0, &len );
 
     if( ret == 0 )
@@ -2573,8 +2572,8 @@
     pem_init( &pem );
 
     ret = pem_read_buffer( &pem, 
-                           "-----BEGIN DH PARAMETERS-----",
-                           "-----END DH PARAMETERS-----",
+                           (char *) "-----BEGIN DH PARAMETERS-----",
+                           (char *) "-----END DH PARAMETERS-----",
                            dhmin, NULL, 0, &dhminlen );
 
     if( ret == 0 )
@@ -3319,7 +3318,7 @@
     return( 0 );
 }
 
-int x509_wildcard_verify( const char *cn, x509_buf *name )
+static int x509_wildcard_verify( const char *cn, x509_buf *name )
 {
     size_t i;
     size_t cn_idx = 0;
diff --git a/library/x509write.c b/library/x509write.c
index 9f5a910..c3b1800 100644
--- a/library/x509write.c
+++ b/library/x509write.c
@@ -59,7 +59,7 @@
     ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) );
     ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_BIT_STRING ) );
 
-    ASN1_CHK_ADD( len, asn1_write_algorithm_identifier( &c, buf, OID_PKCS1_RSA ) );
+    ASN1_CHK_ADD( len, asn1_write_algorithm_identifier( &c, buf, (char *) OID_PKCS1_RSA ) );
 
     ASN1_CHK_ADD( len, asn1_write_len( &c, buf, len ) );
     ASN1_CHK_ADD( len, asn1_write_tag( &c, buf, ASN1_CONSTRUCTED | ASN1_SEQUENCE ) );
@@ -112,8 +112,8 @@
     return( len );
 }
 
-int x509_write_name( unsigned char **p, unsigned char *start, char *oid,
-                     char *name )
+static int x509_write_name( unsigned char **p, unsigned char *start, char *oid,
+                            char *name )
 {
     int ret;
     size_t string_len = 0;
@@ -178,8 +178,8 @@
     }
 }
 
-int x509_write_sig( unsigned char **p, unsigned char *start, char *oid,
-                    unsigned char *sig, size_t size )
+static int x509_write_sig( unsigned char **p, unsigned char *start, char *oid,
+                           unsigned char *sig, size_t size )
 {
     int ret;
     size_t len = 0;
@@ -237,7 +237,7 @@
     ASN1_CHK_ADD( pub_len, asn1_write_len( &c, tmp_buf, pub_len ) );
     ASN1_CHK_ADD( pub_len, asn1_write_tag( &c, tmp_buf, ASN1_BIT_STRING ) );
 
-    ASN1_CHK_ADD( pub_len, asn1_write_algorithm_identifier( &c, tmp_buf, OID_PKCS1_RSA ) );
+    ASN1_CHK_ADD( pub_len, asn1_write_algorithm_identifier( &c, tmp_buf, (char *) OID_PKCS1_RSA ) );
 
     len += pub_len;
     ASN1_CHK_ADD( len, asn1_write_len( &c, tmp_buf, pub_len ) );
diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function
index 2cf98f1..4aad85f 100644
--- a/tests/suites/test_suite_x509write.function
+++ b/tests/suites/test_suite_x509write.function
@@ -56,7 +56,7 @@
     fclose( f );
 
     pem_init( &pem );
-    pem_read_buffer( &pem, "-----BEGIN CERTIFICATE REQUEST-----", "-----END CERTIFICATE REQUEST-----", check_buf, NULL, 0, &olen );
+    pem_read_buffer( &pem, (char *) "-----BEGIN CERTIFICATE REQUEST-----", (char *) "-----END CERTIFICATE REQUEST-----", check_buf, NULL, 0, &olen );
 
     TEST_ASSERT( memcmp( c, pem.buf, pem.buflen ) == 0 );
     TEST_ASSERT( pem.buflen == (size_t) ret );