diff --git a/src/crypto.h b/src/crypto.h
index edcdce5d..9906d4c8 100644
--- a/src/crypto.h
+++ b/src/crypto.h
@@ -310,7 +310,7 @@ int ssh2_bn_to_bin(const ssh2_bn *bn, unsigned char *bin);
 void ssh2_dh_init(ssh2_dh_ctx *dhctx);
 int ssh2_dh_key_pair(ssh2_dh_ctx *dhctx, ssh2_bn *pub, ssh2_bn *g,
                      ssh2_bn *p, int group_order, ssh2_bn_ctx *bnctx);
-int ssh2_dh_validate(ssh2_bn *f, ssh2_bn *p); /* for unit tests */
+int ssh2_dh_validate(const ssh2_bn *f, const ssh2_bn *p); /* for unit tests */
 int ssh2_dh_secret(ssh2_dh_ctx *dhctx, ssh2_bn *secret, ssh2_bn *f,
                    ssh2_bn *p, ssh2_bn_ctx *bnctx);
 void ssh2_dh_dtor(ssh2_dh_ctx *dhctx);
diff --git a/src/libgcrypt.c b/src/libgcrypt.c
index 781edbc4..abcdebb0 100644
--- a/src/libgcrypt.c
+++ b/src/libgcrypt.c
@@ -696,26 +696,27 @@ int ssh2_dh_key_pair(ssh2_dh_ctx *dhctx, ssh2_bn *pub, ssh2_bn *g,
     return 0;
 }
 
-int ssh2_dh_validate(ssh2_bn *f, ssh2_bn *p)
+int ssh2_dh_validate(const ssh2_bn *f, const ssh2_bn *p)
 {
     gcry_mpi_t tmp;
     unsigned int n, i, bits_set;
 
-    if(gcry_mpi_cmp_ui(f, 1) <= 0)
+    if(gcry_mpi_cmp_ui(SSH2_UNCONST(f), 1) <= 0)
         return -1;  /* f <= 1 */
 
     tmp = gcry_mpi_new(0);
     if(!tmp)
         return -4;
-    gcry_mpi_sub_ui(tmp, p, 1);
-    if(gcry_mpi_cmp(f, tmp) >= 0) {
+    gcry_mpi_sub_ui(tmp, SSH2_UNCONST(p), 1);
+    if(gcry_mpi_cmp(SSH2_UNCONST(f), tmp) >= 0) {
         gcry_mpi_release(tmp);
         return -2;  /* f >= p - 1 (== f > p - 2) */
     }
     gcry_mpi_release(tmp);
 
-    for(i = 0, n = gcry_mpi_get_nbits(f), bits_set = 0; i < n; ++i)
-        if(gcry_mpi_test_bit(f, i))
+    for(i = 0, n = gcry_mpi_get_nbits(SSH2_UNCONST(f)), bits_set = 0; i < n;
+        ++i)
+        if(gcry_mpi_test_bit(SSH2_UNCONST(f), i))
             ++bits_set;
 
     if(bits_set < 4)
diff --git a/src/mbedtls.c b/src/mbedtls.c
index af05eefc..c5d5804d 100644
--- a/src/mbedtls.c
+++ b/src/mbedtls.c
@@ -696,7 +696,7 @@ int ssh2_dh_key_pair(ssh2_dh_ctx *dhctx, ssh2_bn *pub, ssh2_bn *g,
     return 0;
 }
 
-int ssh2_dh_validate(ssh2_bn *f, ssh2_bn *p)
+int ssh2_dh_validate(const ssh2_bn *f, const ssh2_bn *p)
 {
     mbedtls_mpi one, tmp;
     size_t n, i, bits_set;
diff --git a/src/openssl.c b/src/openssl.c
index 9d5fa505..8ee41e21 100644
--- a/src/openssl.c
+++ b/src/openssl.c
@@ -3624,7 +3624,7 @@ int ssh2_dh_key_pair(ssh2_dh_ctx *dhctx, ssh2_bn *pub, ssh2_bn *g,
     return 0;
 }
 
-int ssh2_dh_validate(ssh2_bn *f, ssh2_bn *p)
+int ssh2_dh_validate(const ssh2_bn *f, const ssh2_bn *p)
 {
     BIGNUM *tmp;
     int n, i, bits_set;