Repository: randombit/botan
Pull request #2061 (2019-08-06 10:11:34)

Deprecate many publically available headers
Currently Botan has 300 (!) public headers.

This change deprecates public access to many of these headers, which in a future (major) release will bring the total header count down to 'just' 161. Probably this can/will be trimmed further in future PRs.

The benefits are several:
 * Reducing the number of APIs which a developer must learn (which of the 300 headers has the functionality you want?)
 * Freeing us to change (now internal) APIs whenever useful.
 * Reducing ABI surface. We typically have to increment the soname with each release, sometimes due to trivial reasons like a single struct changing size. Hiding as much as possible reduces soname churn. This in particular would make it easier for updates to get into Debian and downstream distros since they don't like soname bumps.
 * Reducing soname exports. If the compiler knows a symbol is not exported (and thus cannot be overridden eg via `LD_PRELOAD`) then it can optimize somewhat better. This will be a bit marginal since a lot of functionality is already exported (only) for tests via internal headers.

There are a few major categories of headers so deprecated:
 * Algorithm headers like ``aes.h``, ``gcm.h``, ``kdf2.h``, etc. Instead the application should use ``X::create``. This does not apply to public key headers since there is some functionality only available via direct call right now, namely keygen and accessing fields. But we could look at that in the future, since that could reduce the header count by a further 20 or 30.
 * The EME/EMSA headers are entirely deprecated, even the base class - there doesn't seem to be any reason for an application to instantiate these.
 * Utility headers like ``bswap.h``, ``rotate.h``,  ``cpuid.h``, ``parsing.h`` - these are used to implement the library but aren't part of our core functionality offering.
 * Implementation detail headers like ``xmss_common_ops.h``, ``divide.h``, ``keypair.h`` which an application has no obvious reason to use directly.



codecov-io: # [Codecov](https://codecov.io/gh/randombit/botan/pull/2061?src=pr&el=h1) Report
> Merging [#2061](https://codecov.io/gh/randombit/botan/pull/2061?src=pr&el=desc) into [master](https://codecov.io/gh/randombit/botan/commit/d70d2ba441a8961b8a26cd49c63d2b88fb9ab8df?src=pr&el=desc) will **decrease** coverage by `0.02%`.
> The diff coverage is `75.86%`.

[![Impacted file tree graph](https://codecov.io/gh/randombit/botan/pull/2061/graphs/tree.svg?width=650&token=VR6iYmSPH8&height=150&src=pr)](https://codecov.io/gh/randombit/botan/pull/2061?src=pr&el=tree)

```diff
@@            Coverage Diff            @@
##           master   #2061      +/-   ##
=========================================
- Coverage   92.42%   92.4%   -0.03%     
=========================================
  Files         546     547       +1     
  Lines       59107   59133      +26     
  Branches     6222    6222              
=========================================
+ Hits        54628   54639      +11     
- Misses       4479    4494      +15
```


| [Impacted Files](https://codecov.io/gh/randombit/botan/pull/2061?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [src/lib/pbkdf/bcrypt\_pbkdf/bcrypt\_pbkdf.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9wYmtkZi9iY3J5cHRfcGJrZGYvYmNyeXB0X3Bia2RmLmNwcA==) | `91.66% <ø> (ø)` | :arrow_up: |
| [src/lib/mac/siphash/siphash.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9tYWMvc2lwaGFzaC9zaXBoYXNoLmNwcA==) | `100% <ø> (ø)` | :arrow_up: |
| [src/lib/hash/sha2\_64/sha2\_64.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9oYXNoL3NoYTJfNjQvc2hhMl82NC5jcHA=) | `100% <ø> (ø)` | :arrow_up: |
| [src/lib/hash/sha2\_32/sha2\_32\_bmi2/sha2\_32\_bmi2.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9oYXNoL3NoYTJfMzIvc2hhMl8zMl9ibWkyL3NoYTJfMzJfYm1pMi5jcHA=) | `100% <ø> (ø)` | :arrow_up: |
| [src/lib/misc/hotp/hotp.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9taXNjL2hvdHAvaG90cC5jcHA=) | `96.55% <ø> (ø)` | :arrow_up: |
| [src/lib/pubkey/sm2/sm2.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9wdWJrZXkvc20yL3NtMi5jcHA=) | `99.08% <ø> (ø)` | :arrow_up: |
| [src/lib/hash/sm3/sm3.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9oYXNoL3NtMy9zbTMuY3Bw) | `100% <ø> (ø)` | :arrow_up: |
| [src/lib/kdf/sp800\_108/sp800\_108.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9rZGYvc3A4MDBfMTA4L3NwODAwXzEwOC5jcHA=) | `96.55% <ø> (ø)` | :arrow_up: |
| [src/lib/hash/whirlpool/whirlpool.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL2xpYi9oYXNoL3doaXJscG9vbC93aGlybHBvb2wuY3Bw) | `100% <ø> (ø)` | :arrow_up: |
| [src/tests/test\_tls\_messages.cpp](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree#diff-c3JjL3Rlc3RzL3Rlc3RfdGxzX21lc3NhZ2VzLmNwcA==) | `96.74% <ø> (ø)` | :arrow_up: |
| ... and [44 more](https://codecov.io/gh/randombit/botan/pull/2061/diff?src=pr&el=tree-more) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/randombit/botan/pull/2061?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/randombit/botan/pull/2061?src=pr&el=footer). Last update [d70d2ba...d76a7f0](https://codecov.io/gh/randombit/botan/pull/2061?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

randombit: https://lists.randombit.net/pipermail/botan-devel/2019-August/002286.html

Patch:
diff --git a/doc/deprecated.rst b/doc/deprecated.rst
index 57fa9957c..8f81bd719 100644
--- a/doc/deprecated.rst
+++ b/doc/deprecated.rst
@@ -1,74 +1,61 @@
 Deprecated Features
 ========================
 
-The following functionality is currently deprecated, and will likely
-be removed in a future release. If you think you have a good reason to
-be using one of the following, contact the developers to explain your
-use case if you want to make sure your code continues to work.
+Certain functionality is deprecated and is likely to be removed in
+a future major release.
 
-This is in addition to specific API calls marked with BOTAN_DEPRECATED
-in the source.
+To help warn users, macros are used to annotate deprecated functions
+and headers. These warnings are enabled by default, but can be
+disabled by defining the macro ``BOTAN_NO_DEPRECATED_WARNINGS`` prior
+to including any Botan headers.
 
-- Configuring a build (with ``configure.py``) using Python2. In a future
-  major release, Python3 will be required.
+.. warning::
+    Not all of the functionality which is currently deprecated has an
+    associated warning.
 
-- Using the Python wrapper with Python2.
-
-- Directly using an algorithm class like ``AES_128`` or ``SHA_256``. Instead
-  create the objects via a ``T::create`` call. A future major release may
-  make such declarations private.
-
-- Directly accessing the member variables of types calendar_point, ASN1_Attribute,
-  AlgorithmIdentifier, and BER_Object
-
-- The following headers are currently public, but will be completely
-  removed in a future major release: ``botan.h``, ``init.h``,
-  ``lookup.h``, ``threefish.h``, ``sm2_enc.h``, ``datastor.h``,
-  ``basefilt.h``, ``hex_filt.h``, ``b64_filt.h``, ``comp_filter.h``,
-  ``key_filt.h``, ``buf_filt.h``, ``cipher_filter.h``,
-  ``tls_blocking.h``, ``pbkdf1.h``, ``xmss_key_pair.h``,
-
-- The following headers are currently public, but will be made
-  internal in a future major release, and no longer usable by
-  applications: ``rotate.h``, ``loadstor.h``, ``mul128.h``,
-  ``dyn_load.h``, ``atomic.h``, ``blinding.h``, ``gf2m_small_m.h``,
-  ``locking_allocator.h``, ``polyn_gf2m.h`,, ``parsing.h``,
-  ``rfc6979.h``, ``divide.h``, ``charset.h``, ``secqueue.h``,
-  ``keypair.h``, ``http_util.h``, ``scan_name.h``, ``ghash.h``,
-  ``tls_extensions.h``, ``tls_messages.h``, ``tls_algos.h``,
-  ``tls_magic.h``, ``oids.h``, ``stl_compatability.h``, ``bswap.h``,
-  ``calendar.h``, ``curve_nistp.h``, ``curve_gfp.h``, ``eme.h``,
-  ``eme_pkcs.h``, ``eme_raw.h``, ``oaep.h``, ``emsa1.h``, ``emsa.h``,
-  ``emsa_pkcs1.h``, ``emsa_raw.h``, ``emsa_x931.h``, ``hash_id.h``,
-  ``iso9796.h``, ``pssr.h``, ``kdf1.h``, ``kdf1_iso18033.h``,
-  ``kdf2.h``, ``sp800_108.h``, ``sp800_56a.h``, ``sp800_56c.h``,
-  ``prf_tls.h``, ``prf_x942.h``, ``mode_pad.h``, ``monty.h``,
-  ``mul128.h``, ``pbes2.h``, ``pbkdf2.h``, ``pk_ops.h``,
-  ``pow_mod.h``, ``reducer.h``, ``stream_mode.h``, ``workfactor.h``,
-  ``xmss_common_ops.h``, ``xmss_tools.h``, ``xmss_hash.h``,
-  ``xmss_tools.h``,
+If you are using something which is currently deprecated and there
+doesn't seem to be an obvious alternative, contact the developers to
+explain your use case if you want to make sure your code continues to
+work.
 
-- Using a default output length for "SHAKE-128" and "SHAKE-256". Instead,
-  always specify the desired output length.
+TLS Protocol Deprecations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-- All or nothing package transform (``package.h``)
+The following TLS protocol features are deprecated and will be removed
+in a future major release:
 
-- The TLS constructors taking `std::function` for callbacks. Instead
-  use the TLS::Callbacks interface.
+- Support for TLSv1.0/v1.1 and DTLS v1.0
 
-- Using ``X509_Certificate::subject_info`` and ``issuer_info`` to access any
-  information that is not included in the DN or subject alternative name. Prefer
-  using the specific assessor functions for other data, eg instead of
-  ``cert.subject_info("X509.Certificate.serial")`` use ``cert.serial_number()``.
+- All support for DSA ciphersuites/certificates
 
-- The Buffered_Computation base class. In a future release the class will be
-  removed, and all of member functions instead declared directly on
-  MessageAuthenticationCode and HashFunction. So this only affects you if you
-  are directly referencing `Botan::Buffered_Computation` in some way.
+- Support for point compression in TLS. This is supported in v1.2 but
+  removed in v1.3. For simplicity it will be removed in v1.2 also.
 
-- Platform support for Google Native Client
+- Support for using SHA-1 to sign TLS v1.2 ServerKeyExchange.
 
-- Support for PathScale and HP compilers
+- All CBC mode ciphersuites. This includes all available 3DES and SEED
+  ciphersuites. This implies also removing Encrypt-then-MAC extension.
+
+- All ciphersuites using DH key exchange (DHE-DSS, DHE-RSA, DHE-PSK, anon DH)
+
+- All ciphersuites using static RSA key exchange
+
+- All anonymous (DH/ECDH) ciphersuites. This does not include PSK and
+  ECDHE-PSK, which will be retained.
+
+- SRP ciphersuites. This is implied by the removal of CBC mode, since
+  all available SRP ciphersuites use CBC. To avoid use of obsolete
+  ciphers, it would be better to instead perform a standard TLS
+  negotiation, then a PAKE authentication within (and bound to) the
+  TLS channel.
+
+- OCB ciphersuites using 128-bit keys
+
+Deprecated Functionality
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+This section lists cryptographic functionality which will be removed
+in a future major release.
 
 - Block ciphers CAST-256, Kasumi, MISTY1, and DESX.
 
@@ -89,35 +76,184 @@ in the source.
 
 - All pre-created DSA groups
 
-TLS Protocol Deprecations
----------------------------
+- All or nothing package transform (``package.h``)
 
-The following TLS protocol features are deprecated and will be removed
-in a future major release:
 
-- Support for TLSv1.0/v1.1 and DTLS v1.0
+Deprecated Headers
+^^^^^^^^^^^^^^^^^^^^^^
+
+* The following headers and all functionality contained within them
+  are outright deprecated, and will be removed entirely in a future
+  major release. Most are either simply forwarding includes to another
+  (still public) header, or contain functionality which is entirely
+  deprecated. Consult the relevent file for more information.
+  ``basefilt.h``, ``botan.h``, ``buf_filt.h``, ``cipher_filter.h``, ``comp_filter.h``,
+  ``compiler.h``, ``init.h``, ``key_filt.h``, ``lookup.h``, ``sm2_enc.h``, ``threefish.h``,
+  ``xmss_key_pair.h``
+
+* The following headers have useful functionality but which we wish to
+  hide from applications to allow easier library evolution. They will
+  be made internal in a future major release, and will only be
+  available to the library itself. In most cases, there is an
+  alternative available. For example instead of using algorithm
+  specific interfaces, use X::create to create the object dynamically.
+  ``adler32.h``,
+  ``aes.h``,
+  ``aria.h``,
+  ``atomic.h``,
+  ``bcrypt_pbkdf.h``,
+  ``blake2b.h``,
+  ``blinding.h``,
+  ``blowfish.h``,
+  ``bswap.h``,
+  ``camellia.h``,
+  ``cascade.h``,
+  ``cast128.h``,
+  ``cast256.h``,
+  ``cbc.h``,
+  ``cbc_mac.h``,
+  ``ccm.h``,
+  ``cfb.h``,
+  ``chacha20poly1305.h``,
+  ``chacha.h``,
+  ``charset.h``,
+  ``cmac.h``,
+  ``comb4p.h``,
+  ``compiler.h``,
+  ``cpuid.h``,
+  ``crc24.h``,
+  ``crc32.h``,
+  ``ctr.h``,
+  ``curve_gfp.h``,
+  ``curve_nistp.h``,
+  ``datastor.h``,
+  ``des.h``,
+  ``desx.h``,
+  ``divide.h``,
+  ``eax.h``,
+  ``eme.h``,
+  ``eme_pkcs.h``,
+  ``eme_raw.h``,
+  ``emsa1.h``,
+  ``emsa.h``,
+  ``emsa_pkcs1.h``,
+  ``emsa_raw.h``,
+  ``emsa_x931.h``,
+  ``gcm.h``,
+  ``gf2m_small_m.h``,
+  ``ghash.h``,
+  ``gmac.h``,
+  ``gost_28147.h``,
+  ``gost_3411.h``,
+  ``hash_id.h``,
+  ``hkdf.h``,
+  ``hmac.h``,
+  ``http_util.h``,
+  ``idea.h``,
+  ``iso9796.h``,
+  ``kasumi.h``,
+  ``kdf1.h``,
+  ``kdf1_iso18033.h``,
+  ``kdf2.h``,
+  ``keccak.h``,
+  ``keypair.h``,
+  ``lion.h``,
+  ``loadstor.h``,
+  ``locking_allocator.h``,
+  ``md4.h``,
+  ``md5.h``,
+  ``mdx_hash.h``,
+  ``misty1.h``,
+  ``mode_pad.h``,
+  ``mul128.h``,
+  ``noekeon.h``,
+  ``oaep.h``,
+  ``ocb.h``,
+  ``ofb.h``,
+  ``par_hash.h``,
+  ``parsing.h``,
+  ``pbes2.h``,
+  ``pbkdf1.h``,
+  ``pbkdf2.h``,
+  ``pgp_s2k.h``,
+  ``poly1305.h``,
+  ``polyn_gf2m.h``,
+  ``pow_mod.h``,
+  ``prf_tls.h``,
+  ``prf_x942.h``,
+  ``pssr.h``,
+  ``rc4.h``,
+  ``rfc6979.h``,
+  ``rmd160.h``,
+  ``rotate.h``,
+  ``salsa20.h``,
+  ``scan_name.h``,
+  ``scrypt.h``,
+  ``secqueue.h``,
+  ``seed.h``,
+  ``serpent.h``,
+  ``sha160.h``,
+  ``sha2_32.h``,
+  ``sha2_64.h``,
+  ``sha3.h``,
+  ``shacal2.h``,
+  ``shake_cipher.h``,
+  ``shake.h``,
+  ``siphash.h``,
+  ``siv.h``,
+  ``skein_512.h``,
+  ``sm3.h``,
+  ``sm4.h``,
+  ``sp800_108.h``,
+  ``sp800_56a.h``,
+  ``sp800_56c.h``,
+  ``stl_compatibility.h``,
+  ``stream_mode.h``,
+  ``streebog.h``,
+  ``threefish_512.h``,
+  ``tiger.h``,
+  ``tls_algos.h``,
+  ``tls_magic.h``,
+  ``twofish.h``,
+  ``uuid.h``,
+  ``whrlpool.h``,
+  ``x919_mac.h``,
+  ``xmss_common_ops.h``,
+  ``xmss_hash.h``,
+  ``xmss_index_registry.h``,
+  ``xmss_tools.h``,
+  ``xtea.h``,
+  ``xts.h``,
 
-- All support for DSA ciphersuites/certificates
+Other API deprecations
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-- Support for point compression in TLS. This is supported in v1.2 but
-  removed in v1.3. For simplicity it will be removed in v1.2 also.
+- Directly accessing the member variables of types ``calendar_point``,
+  ``ASN1_Attribute``, ``AlgorithmIdentifier``, and ``BER_Object``
 
-- Support for using SHA-1 to sign TLS v1.2 ServerKeyExchange.
+- Using a default output length for "SHAKE-128" and "SHAKE-256". Instead,
+  always specify the desired output length.
 
-- All CBC mode ciphersuites. This includes all available 3DES and SEED
-  ciphersuites. This implies also removing Encrypt-then-MAC extension.
+- The TLS constructors taking ``std::function`` for callbacks. Instead
+  use the ``TLS::Callbacks`` interface.
 
-- All ciphersuites using DH key exchange (DHE-DSS, DHE-RSA, DHE-PSK, anon DH)
+- Using ``X509_Certificate::subject_info`` and ``issuer_info`` to access any
+  information that is not included in the DN or subject alternative name. Prefer
+  using the specific assessor functions for other data, eg instead of
+  ``cert.subject_info("X509.Certificate.serial")`` use ``cert.serial_number()``.
 
-- All ciphersuites using static RSA key exchange
+- The ``Buffered_Computation`` base class. In a future release the
+  class will be removed, and all of member functions instead declared
+  directly on ``MessageAuthenticationCode`` and ``HashFunction``. So
+  this only affects you if you are directly referencing
+  ``Botan::Buffered_Computation`` in some way.
 
-- All anonymous (DH/ECDH) ciphersuites. This does not include PSK and
-  ECDHE-PSK, which will be retained.
+Deprecated Build Targets
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-- SRP ciphersuites. This is implied by the removal of CBC mode, since
-  all available SRP ciphersuites use CBC. To avoid use of obsolete
-  ciphers, it would be better to instead perform a standard TLS
-  negotiation, then a PAKE authentication within (and bound to) the
-  TLS channel.
+- Configuring a build (with ``configure.py``) using Python2. In a future
+  major release, Python3 will be required.
 
-- OCB ciphersuites using 128-bit keys
+- Platform support for Google Native Client
+
+- Support for PathScale and HP compilers
diff --git a/src/build-data/makefile.in b/src/build-data/makefile.in
index 1bd3c83aa..242c7b95f 100644
--- a/src/build-data/makefile.in
+++ b/src/build-data/makefile.in
@@ -13,7 +13,7 @@ PYTHON_EXE     = %{python_exe}
 
 ABI_FLAGS      = %{cc_sysroot} %{cxx_abi_flags}
 LANG_FLAGS     = %{cc_lang_flags} %{os_feature_macros}
-CXXFLAGS       = %{cc_compile_flags}
+CXXFLAGS       = %{cc_compile_flags} -DBOTAN_IS_BEING_BUILT
 WARN_FLAGS     = %{cc_warning_flags}
 LIB_FLAGS      = %{lib_flags}
 LDFLAGS        = %{ldflags}
diff --git a/src/cli/cli_rng.cpp b/src/cli/cli_rng.cpp
index 2fea7ec65..8f1cb750b 100644
--- a/src/cli/cli_rng.cpp
+++ b/src/cli/cli_rng.cpp
@@ -7,7 +7,6 @@
 #include "cli.h"
 #include <botan/rng.h>
 #include <botan/entropy_src.h>
-#include <botan/cpuid.h>
 #include <botan/hex.h>
 #include <botan/parsing.h>
 
@@ -77,7 +76,7 @@ cli_make_rng(const std::string& rng_type, const std::string& hex_drbg_seed)
 #if defined(BOTAN_HAS_RDRAND_RNG)
    if(rng_type == "rdrand" || rng_type.empty())
       {
-      if(Botan::CPUID::has_rdrand())
+      if(Botan::RDRAND_RNG::available())
          return std::unique_ptr<Botan::RandomNumberGenerator>(new Botan::RDRAND_RNG);
       else if(rng_type.empty() == false)
          throw CLI_Error("RDRAND instruction not supported on this processor");
diff --git a/src/cli/math.cpp b/src/cli/math.cpp
index 0ba709f36..1268cd3e5 100644
--- a/src/cli/math.cpp
+++ b/src/cli/math.cpp
@@ -8,7 +8,6 @@
 
 #if defined(BOTAN_HAS_NUMBERTHEORY)
 
-#include <botan/reducer.h>
 #include <botan/numthry.h>
 #include <botan/monty.h>
 #include <iterator>
diff --git a/src/cli/tls_utils.cpp b/src/cli/tls_utils.cpp
index 648975250..e275ea9c1 100644
--- a/src/cli/tls_utils.cpp
+++ b/src/cli/tls_utils.cpp
@@ -11,6 +11,7 @@
 #include <botan/tls_policy.h>
 #include <botan/tls_version.h>
 #include <botan/tls_messages.h>
+#include <botan/loadstor.h>
 #include <botan/hex.h>
 #include <sstream>
 
diff --git a/src/lib/asn1/oids.h b/src/lib/asn1/oids.h
index 480e4f982..1f8f88905 100644
--- a/src/lib/asn1/oids.h
+++ b/src/lib/asn1/oids.h
@@ -65,12 +65,18 @@ inline bool BOTAN_DEPRECATED("Use oid == OID::from_string(name)") name_of(const
    return (oid == str2oid_or_empty(name));
    }
 
-inline std::string BOTAN_DEPRECATED("Use oid2str_or_empty") lookup(const OID& oid)
+/**
+* Prefer oid2str_or_empty
+*/
+inline std::string lookup(const OID& oid)
    {
    return oid2str_or_empty(oid);
    }
 
-inline OID BOTAN_DEPRECATED("Use str2oid_or_empty") lookup(const std::string& name)
+/**
+* Prefer str2oid_or_empty
+*/
+inline OID lookup(const std::string& name)
    {
    return str2oid_or_empty(name);
    }
diff --git a/src/lib/base/buf_comp.cpp b/src/lib/base/buf_comp.cpp
new file mode 100644
index 000000000..e9a33c9d7
--- /dev/null
+++ b/src/lib/base/buf_comp.cpp
@@ -0,0 +1,54 @@
+/*
+* (C) 2019 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/buf_comp.h>
+#include <botan/loadstor.h>
+
+namespace Botan {
+
+void Buffered_Computation::update_be(uint16_t val)
+   {
+   uint8_t inb[sizeof(val)];
+   store_be(val, inb);
+   add_data(inb, sizeof(inb));
+   }
+
+void Buffered_Computation::update_be(uint32_t val)
+   {
+   uint8_t inb[sizeof(val)];
+   store_be(val, inb);
+   add_data(inb, sizeof(inb));
+   }
+
+void Buffered_Computation::update_be(uint64_t val)
+   {
+   uint8_t inb[sizeof(val)];
+   store_be(val, inb);
+   add_data(inb, sizeof(inb));
+   }
+
+void Buffered_Computation::update_le(uint16_t val)
+   {
+   uint8_t inb[sizeof(val)];
+   store_le(val, inb);
+   add_data(inb, sizeof(inb));
+   }
+
+void Buffered_Computation::update_le(uint32_t val)
+   {
+   uint8_t inb[sizeof(val)];
+   store_le(val, inb);
+   add_data(inb, sizeof(inb));
+   }
+
+void Buffered_Computation::update_le(uint64_t val)
+   {
+   uint8_t inb[sizeof(val)];
+   store_le(val, inb);
+   add_data(inb, sizeof(inb));
+   }
+
+}
diff --git a/src/lib/base/buf_comp.h b/src/lib/base/buf_comp.h
index e1971c458..31bf48529 100644
--- a/src/lib/base/buf_comp.h
+++ b/src/lib/base/buf_comp.h
@@ -9,7 +9,6 @@
 #define BOTAN_BUFFERED_COMPUTATION_H_
 
 #include <botan/secmem.h>
-#include <botan/loadstor.h>
 #include <string>
 
 namespace Botan {
@@ -51,27 +50,13 @@ class BOTAN_PUBLIC_API(2,0) Buffered_Computation
          add_data(in.data(), in.size());
          }
 
-      /**
-      * Add an integer in big-endian order
-      * @param in the value
-      */
-      template<typename T> void update_be(const T in)
-         {
-         uint8_t inb[sizeof(T)];
-         store_be(in, inb);
-         add_data(inb, sizeof(inb));
-         }
+      void update_be(uint16_t val);
+      void update_be(uint32_t val);
+      void update_be(uint64_t val);
 
-      /**
-      * Add an integer in little-endian order
-      * @param in the value
-      */
-      template<typename T> void update_le(const T in)
-         {
-         uint8_t inb[sizeof(T)];
-         store_le(in, inb);
-         add_data(inb, sizeof(inb));
-         }
+      void update_le(uint16_t val);
+      void update_le(uint32_t val);
+      void update_le(uint64_t val);
 
       /**
       * Add new input to process.
diff --git a/src/lib/base/scan_name.h b/src/lib/base/scan_name.h
index 4028ce9ab..069783d1b 100644
--- a/src/lib/base/scan_name.h
+++ b/src/lib/base/scan_name.h
@@ -12,6 +12,8 @@
 #include <string>
 #include <vector>
 
+BOTAN_FUTURE_INTERNAL_HEADER(scan_name.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/aes/aes.h b/src/lib/block/aes/aes.h
index 6083467b6..84d997d05 100644
--- a/src/lib/block/aes/aes.h
+++ b/src/lib/block/aes/aes.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(aes.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/aria/aria.h b/src/lib/block/aria/aria.h
index 374277686..507226b7d 100644
--- a/src/lib/block/aria/aria.h
+++ b/src/lib/block/aria/aria.h
@@ -18,6 +18,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(aria.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/blowfish/blowfish.h b/src/lib/block/blowfish/blowfish.h
index 97a1b841c..3ba39cbdb 100644
--- a/src/lib/block/blowfish/blowfish.h
+++ b/src/lib/block/blowfish/blowfish.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(blowfish.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/camellia/camellia.h b/src/lib/block/camellia/camellia.h
index 3d639bf77..4995eb0c9 100644
--- a/src/lib/block/camellia/camellia.h
+++ b/src/lib/block/camellia/camellia.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(camellia.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/cascade/cascade.h b/src/lib/block/cascade/cascade.h
index 8a641fc2f..26f513381 100644
--- a/src/lib/block/cascade/cascade.h
+++ b/src/lib/block/cascade/cascade.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cascade.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/cast128/cast128.h b/src/lib/block/cast128/cast128.h
index 3a1740777..a5f2a6401 100644
--- a/src/lib/block/cast128/cast128.h
+++ b/src/lib/block/cast128/cast128.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cast128.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/cast256/cast256.h b/src/lib/block/cast256/cast256.h
index 798649ef7..3c3016937 100644
--- a/src/lib/block/cast256/cast256.h
+++ b/src/lib/block/cast256/cast256.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cast256.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/des/des.h b/src/lib/block/des/des.h
index 7ba563545..d8bbcfdd1 100644
--- a/src/lib/block/des/des.h
+++ b/src/lib/block/des/des.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(des.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/des/desx.h b/src/lib/block/des/desx.h
index fa9a99663..0189a9982 100644
--- a/src/lib/block/des/desx.h
+++ b/src/lib/block/des/desx.h
@@ -10,6 +10,8 @@
 
 #include <botan/des.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(desx.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/gost_28147/gost_28147.h b/src/lib/block/gost_28147/gost_28147.h
index 34e45779b..f71bb28bd 100644
--- a/src/lib/block/gost_28147/gost_28147.h
+++ b/src/lib/block/gost_28147/gost_28147.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(gost_28147.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/idea/idea.h b/src/lib/block/idea/idea.h
index 4c45a3aaa..e5e51606b 100644
--- a/src/lib/block/idea/idea.h
+++ b/src/lib/block/idea/idea.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(idea.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/kasumi/kasumi.h b/src/lib/block/kasumi/kasumi.h
index 4a3712cd2..9ea09a103 100644
--- a/src/lib/block/kasumi/kasumi.h
+++ b/src/lib/block/kasumi/kasumi.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(kasumi.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/lion/lion.h b/src/lib/block/lion/lion.h
index 846c3cd30..fa8e9f414 100644
--- a/src/lib/block/lion/lion.h
+++ b/src/lib/block/lion/lion.h
@@ -12,6 +12,8 @@
 #include <botan/stream_cipher.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(lion.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/misty1/misty1.h b/src/lib/block/misty1/misty1.h
index c63e3713e..b6c4abbd5 100644
--- a/src/lib/block/misty1/misty1.h
+++ b/src/lib/block/misty1/misty1.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(misty1.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/noekeon/noekeon.h b/src/lib/block/noekeon/noekeon.h
index a93266309..9e7e4a5ff 100644
--- a/src/lib/block/noekeon/noekeon.h
+++ b/src/lib/block/noekeon/noekeon.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(noekeon.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/seed/seed.h b/src/lib/block/seed/seed.h
index e30293645..a61624313 100644
--- a/src/lib/block/seed/seed.h
+++ b/src/lib/block/seed/seed.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(seed.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/serpent/serpent.h b/src/lib/block/serpent/serpent.h
index 641ee0b9c..64eb8a8b0 100644
--- a/src/lib/block/serpent/serpent.h
+++ b/src/lib/block/serpent/serpent.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(serpent.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/shacal2/shacal2.h b/src/lib/block/shacal2/shacal2.h
index c4a8f2073..9a1ccff03 100644
--- a/src/lib/block/shacal2/shacal2.h
+++ b/src/lib/block/shacal2/shacal2.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(shacal2.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/sm4/sm4.h b/src/lib/block/sm4/sm4.h
index 7d1d8ba98..637ffd4be 100644
--- a/src/lib/block/sm4/sm4.h
+++ b/src/lib/block/sm4/sm4.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sm4.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/threefish_512/threefish_512.h b/src/lib/block/threefish_512/threefish_512.h
index 2e936b25f..f3adf71a9 100644
--- a/src/lib/block/threefish_512/threefish_512.h
+++ b/src/lib/block/threefish_512/threefish_512.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(threefish_512.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/twofish/twofish.h b/src/lib/block/twofish/twofish.h
index 8201ede76..027e2c701 100644
--- a/src/lib/block/twofish/twofish.h
+++ b/src/lib/block/twofish/twofish.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(twofish.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/block/xtea/xtea.h b/src/lib/block/xtea/xtea.h
index 5ec94fd05..bae0bc7e6 100644
--- a/src/lib/block/xtea/xtea.h
+++ b/src/lib/block/xtea/xtea.h
@@ -10,6 +10,8 @@
 
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(xtea.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/filters/secqueue.h b/src/lib/filters/secqueue.h
index 00616f5cf..42d2f09e2 100644
--- a/src/lib/filters/secqueue.h
+++ b/src/lib/filters/secqueue.h
@@ -12,6 +12,8 @@
 #include <botan/data_src.h>
 #include <botan/filter.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(secqueue.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/blake2/blake2b.h b/src/lib/hash/blake2/blake2b.h
index 1c47e32cc..9b0b655f2 100644
--- a/src/lib/hash/blake2/blake2b.h
+++ b/src/lib/hash/blake2/blake2b.h
@@ -12,6 +12,8 @@
 #include <string>
 #include <memory>
 
+BOTAN_FUTURE_INTERNAL_HEADER(blake2b.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/checksum/adler32/adler32.h b/src/lib/hash/checksum/adler32/adler32.h
index f0aac72b5..cd84a7597 100644
--- a/src/lib/hash/checksum/adler32/adler32.h
+++ b/src/lib/hash/checksum/adler32/adler32.h
@@ -10,6 +10,8 @@
 
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(adler32.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/checksum/crc24/crc24.h b/src/lib/hash/checksum/crc24/crc24.h
index cebb171f6..1809740a4 100644
--- a/src/lib/hash/checksum/crc24/crc24.h
+++ b/src/lib/hash/checksum/crc24/crc24.h
@@ -11,6 +11,8 @@
 
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(crc24.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/checksum/crc32/crc32.h b/src/lib/hash/checksum/crc32/crc32.h
index 2c24acf04..f712b42ca 100644
--- a/src/lib/hash/checksum/crc32/crc32.h
+++ b/src/lib/hash/checksum/crc32/crc32.h
@@ -10,6 +10,8 @@
 
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(crc32.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/comb4p/comb4p.h b/src/lib/hash/comb4p/comb4p.h
index 6e47151bd..518314c17 100644
--- a/src/lib/hash/comb4p/comb4p.h
+++ b/src/lib/hash/comb4p/comb4p.h
@@ -10,6 +10,8 @@
 
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(comb4p.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/gost_3411/gost_3411.cpp b/src/lib/hash/gost_3411/gost_3411.cpp
index 27773c795..e3bcd2110 100644
--- a/src/lib/hash/gost_3411/gost_3411.cpp
+++ b/src/lib/hash/gost_3411/gost_3411.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/gost_3411.h>
+#include <botan/loadstor.h>
 
 namespace Botan {
 
diff --git a/src/lib/hash/gost_3411/gost_3411.h b/src/lib/hash/gost_3411/gost_3411.h
index 9bafa6828..51d7aa477 100644
--- a/src/lib/hash/gost_3411/gost_3411.h
+++ b/src/lib/hash/gost_3411/gost_3411.h
@@ -11,6 +11,8 @@
 #include <botan/hash.h>
 #include <botan/gost_28147.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(gost_3411.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/keccak/keccak.cpp b/src/lib/hash/keccak/keccak.cpp
index f79a7f3ce..b8196495c 100644
--- a/src/lib/hash/keccak/keccak.cpp
+++ b/src/lib/hash/keccak/keccak.cpp
@@ -8,6 +8,7 @@
 #include <botan/keccak.h>
 #include <botan/sha3.h>
 #include <botan/exceptn.h>
+#include <botan/loadstor.h>
 
 namespace Botan {
 
diff --git a/src/lib/hash/keccak/keccak.h b/src/lib/hash/keccak/keccak.h
index b6a50fb6d..083d7fc5a 100644
--- a/src/lib/hash/keccak/keccak.h
+++ b/src/lib/hash/keccak/keccak.h
@@ -14,6 +14,8 @@
 
 namespace Botan {
 
+BOTAN_FUTURE_INTERNAL_HEADER(keccak.h)
+
 /**
 * Keccak[1600], a SHA-3 candidate
 */
diff --git a/src/lib/hash/md4/md4.cpp b/src/lib/hash/md4/md4.cpp
index c0c3472de..9cc92e1e3 100644
--- a/src/lib/hash/md4/md4.cpp
+++ b/src/lib/hash/md4/md4.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/md4.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 
 namespace Botan {
diff --git a/src/lib/hash/md4/md4.h b/src/lib/hash/md4/md4.h
index 1dd857bce..0e6f5dc08 100644
--- a/src/lib/hash/md4/md4.h
+++ b/src/lib/hash/md4/md4.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(md4.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/md5/md5.cpp b/src/lib/hash/md5/md5.cpp
index 3b9b4d281..590af4641 100644
--- a/src/lib/hash/md5/md5.cpp
+++ b/src/lib/hash/md5/md5.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/md5.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 
 namespace Botan {
diff --git a/src/lib/hash/md5/md5.h b/src/lib/hash/md5/md5.h
index 07d10fb7a..182145523 100644
--- a/src/lib/hash/md5/md5.h
+++ b/src/lib/hash/md5/md5.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(md5.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/mdx_hash/mdx_hash.h b/src/lib/hash/mdx_hash/mdx_hash.h
index b18c2e270..a061e9c8a 100644
--- a/src/lib/hash/mdx_hash/mdx_hash.h
+++ b/src/lib/hash/mdx_hash/mdx_hash.h
@@ -10,6 +10,8 @@
 
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(mdx_hash.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/par_hash/par_hash.h b/src/lib/hash/par_hash/par_hash.h
index 78077cc61..8942cfe4d 100644
--- a/src/lib/hash/par_hash/par_hash.h
+++ b/src/lib/hash/par_hash/par_hash.h
@@ -11,6 +11,8 @@
 #include <botan/hash.h>
 #include <vector>
 
+BOTAN_FUTURE_INTERNAL_HEADER(par_hash.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/rmd160/rmd160.cpp b/src/lib/hash/rmd160/rmd160.cpp
index e85feec08..2fa8f84d0 100644
--- a/src/lib/hash/rmd160/rmd160.cpp
+++ b/src/lib/hash/rmd160/rmd160.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/rmd160.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 
 namespace Botan {
diff --git a/src/lib/hash/rmd160/rmd160.h b/src/lib/hash/rmd160/rmd160.h
index daba812d9..2ee311680 100644
--- a/src/lib/hash/rmd160/rmd160.h
+++ b/src/lib/hash/rmd160/rmd160.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(rmd160.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/sha1/sha160.cpp b/src/lib/hash/sha1/sha160.cpp
index 4170722b1..5893c5dc7 100644
--- a/src/lib/hash/sha1/sha160.cpp
+++ b/src/lib/hash/sha1/sha160.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/sha160.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 #include <botan/cpuid.h>
 
diff --git a/src/lib/hash/sha1/sha160.h b/src/lib/hash/sha1/sha160.h
index 9f7035ee6..bbab2e853 100644
--- a/src/lib/hash/sha1/sha160.h
+++ b/src/lib/hash/sha1/sha160.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sha160.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/sha2_32/sha2_32.cpp b/src/lib/hash/sha2_32/sha2_32.cpp
index 1f1ab69f4..61e98d22f 100644
--- a/src/lib/hash/sha2_32/sha2_32.cpp
+++ b/src/lib/hash/sha2_32/sha2_32.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/sha2_32.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 #include <botan/cpuid.h>
 
diff --git a/src/lib/hash/sha2_32/sha2_32.h b/src/lib/hash/sha2_32/sha2_32.h
index 7a3fce9d2..90a059721 100644
--- a/src/lib/hash/sha2_32/sha2_32.h
+++ b/src/lib/hash/sha2_32/sha2_32.h
@@ -11,6 +11,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sha2_32.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/sha2_32/sha2_32_bmi2/sha2_32_bmi2.cpp b/src/lib/hash/sha2_32/sha2_32_bmi2/sha2_32_bmi2.cpp
index 12ceb11c4..e3194e4af 100644
--- a/src/lib/hash/sha2_32/sha2_32_bmi2/sha2_32_bmi2.cpp
+++ b/src/lib/hash/sha2_32/sha2_32_bmi2/sha2_32_bmi2.cpp
@@ -5,6 +5,7 @@
 */
 
 #include <botan/sha2_32.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 
 namespace Botan {
diff --git a/src/lib/hash/sha2_64/sha2_64.cpp b/src/lib/hash/sha2_64/sha2_64.cpp
index e554b3aa5..01abb4f00 100644
--- a/src/lib/hash/sha2_64/sha2_64.cpp
+++ b/src/lib/hash/sha2_64/sha2_64.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/sha2_64.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 #include <botan/cpuid.h>
 
diff --git a/src/lib/hash/sha2_64/sha2_64.h b/src/lib/hash/sha2_64/sha2_64.h
index ec3512dfc..dc5f0dd18 100644
--- a/src/lib/hash/sha2_64/sha2_64.h
+++ b/src/lib/hash/sha2_64/sha2_64.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sha2_64.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/sha2_64/sha2_64_bmi2/sha2_64_bmi2.cpp b/src/lib/hash/sha2_64/sha2_64_bmi2/sha2_64_bmi2.cpp
index 202dadbbe..1ef0ecc56 100644
--- a/src/lib/hash/sha2_64/sha2_64_bmi2/sha2_64_bmi2.cpp
+++ b/src/lib/hash/sha2_64/sha2_64_bmi2/sha2_64_bmi2.cpp
@@ -5,6 +5,7 @@
 */
 
 #include <botan/sha2_64.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 
 namespace Botan {
diff --git a/src/lib/hash/sha3/sha3.cpp b/src/lib/hash/sha3/sha3.cpp
index d01d33635..690c2b264 100644
--- a/src/lib/hash/sha3/sha3.cpp
+++ b/src/lib/hash/sha3/sha3.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/sha3.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 #include <botan/exceptn.h>
 #include <botan/cpuid.h>
diff --git a/src/lib/hash/sha3/sha3.h b/src/lib/hash/sha3/sha3.h
index 310468599..e290e60a2 100644
--- a/src/lib/hash/sha3/sha3.h
+++ b/src/lib/hash/sha3/sha3.h
@@ -12,6 +12,8 @@
 #include <botan/secmem.h>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sha3.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/shake/shake.h b/src/lib/hash/shake/shake.h
index 72b8e123e..c52df136b 100644
--- a/src/lib/hash/shake/shake.h
+++ b/src/lib/hash/shake/shake.h
@@ -12,6 +12,8 @@
 #include <botan/secmem.h>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(shake.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/skein/skein_512.cpp b/src/lib/hash/skein/skein_512.cpp
index 67b02e5c1..edf95d596 100644
--- a/src/lib/hash/skein/skein_512.cpp
+++ b/src/lib/hash/skein/skein_512.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/skein_512.h>
+#include <botan/loadstor.h>
 #include <botan/exceptn.h>
 #include <algorithm>
 
diff --git a/src/lib/hash/skein/skein_512.h b/src/lib/hash/skein/skein_512.h
index 8bf6e3e7a..0bf173ceb 100644
--- a/src/lib/hash/skein/skein_512.h
+++ b/src/lib/hash/skein/skein_512.h
@@ -13,6 +13,8 @@
 #include <string>
 #include <memory>
 
+BOTAN_FUTURE_INTERNAL_HEADER(skin_512.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/sm3/sm3.cpp b/src/lib/hash/sm3/sm3.cpp
index 4c746ce2f..cfd1409cd 100644
--- a/src/lib/hash/sm3/sm3.cpp
+++ b/src/lib/hash/sm3/sm3.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/sm3.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 
 namespace Botan {
diff --git a/src/lib/hash/sm3/sm3.h b/src/lib/hash/sm3/sm3.h
index 56471e7d1..268bd87fb 100644
--- a/src/lib/hash/sm3/sm3.h
+++ b/src/lib/hash/sm3/sm3.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sm3.h)
+
 namespace Botan {
 
 enum {
diff --git a/src/lib/hash/streebog/streebog.cpp b/src/lib/hash/streebog/streebog.cpp
index 0e2a43b78..0134daded 100644
--- a/src/lib/hash/streebog/streebog.cpp
+++ b/src/lib/hash/streebog/streebog.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/streebog.h>
+#include <botan/loadstor.h>
 #include <botan/exceptn.h>
 
 namespace Botan {
diff --git a/src/lib/hash/streebog/streebog.h b/src/lib/hash/streebog/streebog.h
index 2a98beb4e..a573964d8 100644
--- a/src/lib/hash/streebog/streebog.h
+++ b/src/lib/hash/streebog/streebog.h
@@ -10,6 +10,8 @@
 
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(streebog.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/tiger/tiger.cpp b/src/lib/hash/tiger/tiger.cpp
index 13ae4a792..ac2038a0f 100644
--- a/src/lib/hash/tiger/tiger.cpp
+++ b/src/lib/hash/tiger/tiger.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/tiger.h>
+#include <botan/loadstor.h>
 #include <botan/exceptn.h>
 
 namespace Botan {
diff --git a/src/lib/hash/tiger/tiger.h b/src/lib/hash/tiger/tiger.h
index ef15fb16e..6e17ce83c 100644
--- a/src/lib/hash/tiger/tiger.h
+++ b/src/lib/hash/tiger/tiger.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(tiger.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/hash/whirlpool/whirlpool.cpp b/src/lib/hash/whirlpool/whirlpool.cpp
index f78cc7572..e1ffa4f20 100644
--- a/src/lib/hash/whirlpool/whirlpool.cpp
+++ b/src/lib/hash/whirlpool/whirlpool.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/whrlpool.h>
+#include <botan/loadstor.h>
 
 namespace Botan {
 
diff --git a/src/lib/hash/whirlpool/whrlpool.h b/src/lib/hash/whirlpool/whrlpool.h
index 3a07ea5c5..26ee7f775 100644
--- a/src/lib/hash/whirlpool/whrlpool.h
+++ b/src/lib/hash/whirlpool/whrlpool.h
@@ -10,6 +10,8 @@
 
 #include <botan/mdx_hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(whrlpool.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/hkdf/hkdf.cpp b/src/lib/kdf/hkdf/hkdf.cpp
index 4b2ee1b3d..679a2ed42 100644
--- a/src/lib/kdf/hkdf/hkdf.cpp
+++ b/src/lib/kdf/hkdf/hkdf.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/hkdf.h>
+#include <botan/loadstor.h>
 
 namespace Botan {
 
diff --git a/src/lib/kdf/hkdf/hkdf.h b/src/lib/kdf/hkdf/hkdf.h
index cd2b13dd8..4b1ed2922 100644
--- a/src/lib/kdf/hkdf/hkdf.h
+++ b/src/lib/kdf/hkdf/hkdf.h
@@ -12,6 +12,12 @@
 #include <botan/mac.h>
 #include <botan/kdf.h>
 
+/*
+* The definitions of HKDF, HKDF_Extract, HKDF_Expand will be made internal
+* in the future. However the function hkdf_expand_label will still be defined.
+*/
+//BOTAN_FUTURE_INTERNAL_HEADER(hkdf.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/kdf1/kdf1.h b/src/lib/kdf/kdf1/kdf1.h
index 803aae300..388b55251 100644
--- a/src/lib/kdf/kdf1/kdf1.h
+++ b/src/lib/kdf/kdf1/kdf1.h
@@ -11,6 +11,8 @@
 #include <botan/kdf.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(kdf1.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/kdf1_iso18033/kdf1_iso18033.h b/src/lib/kdf/kdf1_iso18033/kdf1_iso18033.h
index 7a95a093b..5f913057e 100644
--- a/src/lib/kdf/kdf1_iso18033/kdf1_iso18033.h
+++ b/src/lib/kdf/kdf1_iso18033/kdf1_iso18033.h
@@ -11,6 +11,8 @@
 #include <botan/kdf.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(kdf1_iso18033.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/kdf2/kdf2.h b/src/lib/kdf/kdf2/kdf2.h
index 2fd40e736..43abbf087 100644
--- a/src/lib/kdf/kdf2/kdf2.h
+++ b/src/lib/kdf/kdf2/kdf2.h
@@ -11,6 +11,8 @@
 #include <botan/kdf.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(kdf2.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/prf_tls/prf_tls.h b/src/lib/kdf/prf_tls/prf_tls.h
index 3ed8db247..a8a30ee2c 100644
--- a/src/lib/kdf/prf_tls/prf_tls.h
+++ b/src/lib/kdf/prf_tls/prf_tls.h
@@ -11,6 +11,8 @@
 #include <botan/kdf.h>
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(prf_tls.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/prf_x942/prf_x942.h b/src/lib/kdf/prf_x942/prf_x942.h
index 4b93d5966..1987b9bc3 100644
--- a/src/lib/kdf/prf_x942/prf_x942.h
+++ b/src/lib/kdf/prf_x942/prf_x942.h
@@ -11,6 +11,8 @@
 #include <botan/kdf.h>
 #include <botan/asn1_oid.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(prf_x942.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/sp800_108/sp800_108.cpp b/src/lib/kdf/sp800_108/sp800_108.cpp
index 990e10386..fbeae23cd 100644
--- a/src/lib/kdf/sp800_108/sp800_108.cpp
+++ b/src/lib/kdf/sp800_108/sp800_108.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/sp800_108.h>
+#include <botan/loadstor.h>
 #include <botan/exceptn.h>
 #include <iterator>
 
diff --git a/src/lib/kdf/sp800_108/sp800_108.h b/src/lib/kdf/sp800_108/sp800_108.h
index 25802f69e..46f734e8e 100644
--- a/src/lib/kdf/sp800_108/sp800_108.h
+++ b/src/lib/kdf/sp800_108/sp800_108.h
@@ -11,6 +11,8 @@
 #include <botan/kdf.h>
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sp800_108.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/sp800_56a/sp800_56a.h b/src/lib/kdf/sp800_56a/sp800_56a.h
index 17fd3a84b..e83f117e2 100644
--- a/src/lib/kdf/sp800_56a/sp800_56a.h
+++ b/src/lib/kdf/sp800_56a/sp800_56a.h
@@ -13,6 +13,8 @@
 #include <botan/hash.h>
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sp800_56a.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/kdf/sp800_56c/sp800_56c.h b/src/lib/kdf/sp800_56c/sp800_56c.h
index a6db91658..bdbdfcd9e 100644
--- a/src/lib/kdf/sp800_56c/sp800_56c.h
+++ b/src/lib/kdf/sp800_56c/sp800_56c.h
@@ -11,6 +11,8 @@
 #include <botan/kdf.h>
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(sp800_56c.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/mac/cbc_mac/cbc_mac.h b/src/lib/mac/cbc_mac/cbc_mac.h
index aed3a8caf..ed4eb2bd1 100644
--- a/src/lib/mac/cbc_mac/cbc_mac.h
+++ b/src/lib/mac/cbc_mac/cbc_mac.h
@@ -11,6 +11,8 @@
 #include <botan/mac.h>
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cbc_mac.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/mac/cmac/cmac.h b/src/lib/mac/cmac/cmac.h
index 7f155c6bf..f73167590 100644
--- a/src/lib/mac/cmac/cmac.h
+++ b/src/lib/mac/cmac/cmac.h
@@ -11,6 +11,8 @@
 #include <botan/mac.h>
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cmac.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/mac/gmac/gmac.h b/src/lib/mac/gmac/gmac.h
index 4b02ebf85..b78aeec6f 100644
--- a/src/lib/mac/gmac/gmac.h
+++ b/src/lib/mac/gmac/gmac.h
@@ -11,6 +11,8 @@
 
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(gmac.h)
+
 namespace Botan {
 
 class BlockCipher;
diff --git a/src/lib/mac/hmac/hmac.h b/src/lib/mac/hmac/hmac.h
index 1a6bcd6a0..1f2f4227d 100644
--- a/src/lib/mac/hmac/hmac.h
+++ b/src/lib/mac/hmac/hmac.h
@@ -11,6 +11,8 @@
 #include <botan/mac.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(hmac.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/mac/poly1305/poly1305.h b/src/lib/mac/poly1305/poly1305.h
index aa94b5807..fdd01ecd1 100644
--- a/src/lib/mac/poly1305/poly1305.h
+++ b/src/lib/mac/poly1305/poly1305.h
@@ -11,6 +11,8 @@
 #include <botan/mac.h>
 #include <memory>
 
+BOTAN_FUTURE_INTERNAL_HEADER(poly1305.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/mac/siphash/siphash.cpp b/src/lib/mac/siphash/siphash.cpp
index 30fe354b7..566d5d5de 100644
--- a/src/lib/mac/siphash/siphash.cpp
+++ b/src/lib/mac/siphash/siphash.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/siphash.h>
+#include <botan/loadstor.h>
 #include <botan/rotate.h>
 
 namespace Botan {
diff --git a/src/lib/mac/siphash/siphash.h b/src/lib/mac/siphash/siphash.h
index 0e05c8407..d60df8dfc 100644
--- a/src/lib/mac/siphash/siphash.h
+++ b/src/lib/mac/siphash/siphash.h
@@ -10,6 +10,8 @@
 
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(siphash.h)
+
 namespace Botan {
 
 class BOTAN_PUBLIC_API(2,0) SipHash final : public MessageAuthenticationCode
diff --git a/src/lib/mac/x919_mac/x919_mac.h b/src/lib/mac/x919_mac/x919_mac.h
index 3da8048e4..3df38b9aa 100644
--- a/src/lib/mac/x919_mac/x919_mac.h
+++ b/src/lib/mac/x919_mac/x919_mac.h
@@ -11,6 +11,8 @@
 #include <botan/mac.h>
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(x919_mac.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/math/bigint/bigint.cpp b/src/lib/math/bigint/bigint.cpp
index 6f5f1f473..bdb0f4214 100644
--- a/src/lib/math/bigint/bigint.cpp
+++ b/src/lib/math/bigint/bigint.cpp
@@ -10,6 +10,7 @@
 #include <botan/internal/rounding.h>
 #include <botan/internal/bit_ops.h>
 #include <botan/internal/ct_utils.h>
+#include <botan/loadstor.h>
 
 namespace Botan {
 
@@ -106,6 +107,12 @@ BigInt::BigInt(RandomNumberGenerator& rng, size_t bits, bool set_high_bit)
    randomize(rng, bits, set_high_bit);
    }
 
+uint8_t BigInt::byte_at(size_t n) const
+   {
+   return get_byte(sizeof(word) - (n % sizeof(word)) - 1,
+                   word_at(n / sizeof(word)));
+   }
+
 int32_t BigInt::cmp_word(word other) const
    {
    if(is_negative())
diff --git a/src/lib/math/bigint/bigint.h b/src/lib/math/bigint/bigint.h
index 505bacde0..ac0a57038 100644
--- a/src/lib/math/bigint/bigint.h
+++ b/src/lib/math/bigint/bigint.h
@@ -12,7 +12,6 @@
 #include <botan/types.h>
 #include <botan/secmem.h>
 #include <botan/exceptn.h>
-#include <botan/loadstor.h>
 #include <iosfwd>
 
 namespace Botan {
@@ -497,11 +496,7 @@ class BOTAN_PUBLIC_API(2,0) BigInt final
      * @param n the offset to get a byte from
      * @result byte at offset n
      */
-     uint8_t byte_at(size_t n) const
-        {
-        return get_byte(sizeof(word) - (n % sizeof(word)) - 1,
-                        word_at(n / sizeof(word)));
-        }
+     uint8_t byte_at(size_t n) const;
 
      /**
      * Return the word at a specified position of the internal register
diff --git a/src/lib/math/bigint/divide.h b/src/lib/math/bigint/divide.h
index e365dabb3..deb6ffdbb 100644
--- a/src/lib/math/bigint/divide.h
+++ b/src/lib/math/bigint/divide.h
@@ -10,6 +10,8 @@
 
 #include <botan/bigint.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(divide.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/math/numbertheory/curve_nistp.h b/src/lib/math/numbertheory/curve_nistp.h
index 963526d5a..19d1bd256 100644
--- a/src/lib/math/numbertheory/curve_nistp.h
+++ b/src/lib/math/numbertheory/curve_nistp.h
@@ -10,6 +10,8 @@
 
 #include <botan/bigint.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(curve_nistp.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/math/numbertheory/make_prm.cpp b/src/lib/math/numbertheory/make_prm.cpp
index 7455a0049..67bdcd678 100644
--- a/src/lib/math/numbertheory/make_prm.cpp
+++ b/src/lib/math/numbertheory/make_prm.cpp
@@ -8,6 +8,7 @@
 #include <botan/numthry.h>
 #include <botan/rng.h>
 #include <botan/internal/bit_ops.h>
+#include <botan/loadstor.h>
 #include <algorithm>
 
 namespace Botan {
diff --git a/src/lib/math/numbertheory/pow_mod.h b/src/lib/math/numbertheory/pow_mod.h
index d179d8c85..b465013e5 100644
--- a/src/lib/math/numbertheory/pow_mod.h
+++ b/src/lib/math/numbertheory/pow_mod.h
@@ -10,6 +10,8 @@
 
 #include <botan/bigint.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(pow_mod.h)
+
 namespace Botan {
 
 class Modular_Exponentiator;
diff --git a/src/lib/misc/fpe_fe1/fpe_fe1.cpp b/src/lib/misc/fpe_fe1/fpe_fe1.cpp
index 98ada495a..7e3dac502 100644
--- a/src/lib/misc/fpe_fe1/fpe_fe1.cpp
+++ b/src/lib/misc/fpe_fe1/fpe_fe1.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/fpe_fe1.h>
+#include <botan/loadstor.h>
 #include <botan/numthry.h>
 #include <botan/divide.h>
 #include <botan/reducer.h>
diff --git a/src/lib/misc/hotp/hotp.cpp b/src/lib/misc/hotp/hotp.cpp
index 9ca37c101..b92528492 100644
--- a/src/lib/misc/hotp/hotp.cpp
+++ b/src/lib/misc/hotp/hotp.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/hotp.h>
+#include <botan/loadstor.h>
 #include <botan/exceptn.h>
 
 namespace Botan {
diff --git a/src/lib/modes/aead/ccm/ccm.h b/src/lib/modes/aead/ccm/ccm.h
index 37d3c0c04..9b4bcecbf 100644
--- a/src/lib/modes/aead/ccm/ccm.h
+++ b/src/lib/modes/aead/ccm/ccm.h
@@ -12,6 +12,8 @@
 #include <botan/aead.h>
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(ccm.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.cpp b/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.cpp
index ca0c55184..2e1d913ef 100644
--- a/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.cpp
+++ b/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/chacha20poly1305.h>
+#include <botan/loadstor.h>
 
 namespace Botan {
 
diff --git a/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.h b/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.h
index c7ed615d6..dbba58cc9 100644
--- a/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.h
+++ b/src/lib/modes/aead/chacha20poly1305/chacha20poly1305.h
@@ -13,6 +13,8 @@
 #include <botan/stream_cipher.h>
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(chacha20poly1305.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/modes/aead/eax/eax.h b/src/lib/modes/aead/eax/eax.h
index 84a4f3f92..b9b02c192 100644
--- a/src/lib/modes/aead/eax/eax.h
+++ b/src/lib/modes/aead/eax/eax.h
@@ -14,6 +14,8 @@
 #include <botan/stream_cipher.h>
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(eax.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/modes/aead/gcm/gcm.h b/src/lib/modes/aead/gcm/gcm.h
index 8f27c3679..fe3c40572 100644
--- a/src/lib/modes/aead/gcm/gcm.h
+++ b/src/lib/modes/aead/gcm/gcm.h
@@ -12,6 +12,8 @@
 #include <botan/aead.h>
 #include <botan/sym_algo.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(gcm.h)
+
 namespace Botan {
 
 class BlockCipher;
diff --git a/src/lib/modes/aead/gcm/ghash.h b/src/lib/modes/aead/gcm/ghash.h
index fb7565134..db4500133 100644
--- a/src/lib/modes/aead/gcm/ghash.h
+++ b/src/lib/modes/aead/gcm/ghash.h
@@ -10,6 +10,8 @@
 
 #include <botan/sym_algo.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(ghash.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/modes/aead/ocb/ocb.h b/src/lib/modes/aead/ocb/ocb.h
index 173af3704..d38122593 100644
--- a/src/lib/modes/aead/ocb/ocb.h
+++ b/src/lib/modes/aead/ocb/ocb.h
@@ -11,6 +11,8 @@
 
 #include <botan/aead.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(ocb.h)
+
 namespace Botan {
 
 class BlockCipher;
diff --git a/src/lib/modes/aead/siv/siv.h b/src/lib/modes/aead/siv/siv.h
index 4d9a30222..44e0a6bf9 100644
--- a/src/lib/modes/aead/siv/siv.h
+++ b/src/lib/modes/aead/siv/siv.h
@@ -12,6 +12,8 @@
 #include <botan/aead.h>
 #include <botan/stream_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(siv.h)
+
 namespace Botan {
 
 class BlockCipher;
diff --git a/src/lib/modes/cbc/cbc.h b/src/lib/modes/cbc/cbc.h
index aaa425712..7a488dbd5 100644
--- a/src/lib/modes/cbc/cbc.h
+++ b/src/lib/modes/cbc/cbc.h
@@ -13,6 +13,8 @@
 #include <botan/block_cipher.h>
 #include <botan/mode_pad.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cbc.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/modes/cfb/cfb.h b/src/lib/modes/cfb/cfb.h
index eddc2a121..1f9e55487 100644
--- a/src/lib/modes/cfb/cfb.h
+++ b/src/lib/modes/cfb/cfb.h
@@ -12,6 +12,8 @@
 #include <botan/cipher_mode.h>
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cfb.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/modes/mode_pad/mode_pad.h b/src/lib/modes/mode_pad/mode_pad.h
index 25e4221af..b0e4a3cfa 100644
--- a/src/lib/modes/mode_pad/mode_pad.h
+++ b/src/lib/modes/mode_pad/mode_pad.h
@@ -12,6 +12,8 @@
 #include <botan/secmem.h>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(mode_pad.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/modes/stream_mode.h b/src/lib/modes/stream_mode.h
index 3bce01731..da3fc38cf 100644
--- a/src/lib/modes/stream_mode.h
+++ b/src/lib/modes/stream_mode.h
@@ -14,6 +14,8 @@
    #include <botan/stream_cipher.h>
 #endif
 
+BOTAN_FUTURE_INTERNAL_HEADER(stream_mode.h)
+
 namespace Botan {
 
 #if defined(BOTAN_HAS_STREAM_CIPHER)
diff --git a/src/lib/modes/xts/xts.h b/src/lib/modes/xts/xts.h
index 1fd86b2f4..e64a6de9f 100644
--- a/src/lib/modes/xts/xts.h
+++ b/src/lib/modes/xts/xts.h
@@ -12,6 +12,8 @@
 #include <botan/cipher_mode.h>
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(xts.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pbkdf/argon2/argon2.cpp b/src/lib/pbkdf/argon2/argon2.cpp
index 05b1e9c48..0d767e04e 100644
--- a/src/lib/pbkdf/argon2/argon2.cpp
+++ b/src/lib/pbkdf/argon2/argon2.cpp
@@ -5,6 +5,7 @@
 */
 
 #include <botan/argon2.h>
+#include <botan/loadstor.h>
 #include <botan/hash.h>
 #include <botan/mem_ops.h>
 #include <botan/rotate.h>
@@ -26,23 +27,23 @@ secure_vector<uint8_t> argon2_H0(HashFunction& blake2b,
    {
    const uint8_t v = 19; // Argon2 version code
 
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(p));
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(output_len));
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(M));
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(t));
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(v));
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(y));
+   blake2b.update_le(static_cast<uint32_t>(p));
+   blake2b.update_le(static_cast<uint32_t>(output_len));
+   blake2b.update_le(static_cast<uint32_t>(M));
+   blake2b.update_le(static_cast<uint32_t>(t));
+   blake2b.update_le(static_cast<uint32_t>(v));
+   blake2b.update_le(static_cast<uint32_t>(y));
 
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(password_len));
+   blake2b.update_le(static_cast<uint32_t>(password_len));
    blake2b.update(cast_char_ptr_to_uint8(password), password_len);
 
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(salt_len));
+   blake2b.update_le(static_cast<uint32_t>(salt_len));
    blake2b.update(salt, salt_len);
 
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(key_len));
+   blake2b.update_le(static_cast<uint32_t>(key_len));
    blake2b.update(key, key_len);
 
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(ad_len));
+   blake2b.update_le(static_cast<uint32_t>(ad_len));
    blake2b.update(ad, ad_len);
 
    return blake2b.final();
@@ -57,10 +58,10 @@ void Htick(secure_vector<uint8_t>& T,
    {
    BOTAN_ASSERT_NOMSG(output_len % 64 == 0);
 
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(output_len));
+   blake2b.update_le(static_cast<uint32_t>(output_len));
    blake2b.update(H0);
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(p0));
-   blake2b.update_le<uint32_t>(static_cast<uint32_t>(p1));
+   blake2b.update_le(static_cast<uint32_t>(p0));
+   blake2b.update_le(static_cast<uint32_t>(p1));
 
    blake2b.final(&T[0]);
 
diff --git a/src/lib/pbkdf/argon2/argon2.h b/src/lib/pbkdf/argon2/argon2.h
index a6fa03314..468a44f94 100644
--- a/src/lib/pbkdf/argon2/argon2.h
+++ b/src/lib/pbkdf/argon2/argon2.h
@@ -11,6 +11,8 @@
 
 namespace Botan {
 
+BOTAN_FUTURE_INTERNAL_HEADER(argon2.h)
+
 class RandomNumberGenerator;
 
 /**
diff --git a/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.cpp b/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.cpp
index 36501b4cb..2f2c77025 100644
--- a/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.cpp
+++ b/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.cpp
@@ -5,6 +5,7 @@
 */
 
 #include <botan/bcrypt_pbkdf.h>
+#include <botan/loadstor.h>
 #include <botan/blowfish.h>
 #include <botan/hash.h>
 #include <botan/internal/timer.h>
diff --git a/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.h b/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.h
index 5f0f9e80f..0d459e8db 100644
--- a/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.h
+++ b/src/lib/pbkdf/bcrypt_pbkdf/bcrypt_pbkdf.h
@@ -9,6 +9,8 @@
 
 #include <botan/pwdhash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(bcrypt_pbkdf.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pbkdf/pbkdf1/pbkdf1.h b/src/lib/pbkdf/pbkdf1/pbkdf1.h
index 74b2644f6..f5e95b836 100644
--- a/src/lib/pbkdf/pbkdf1/pbkdf1.h
+++ b/src/lib/pbkdf/pbkdf1/pbkdf1.h
@@ -11,6 +11,8 @@
 #include <botan/pbkdf.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(pbkdf1.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pbkdf/pbkdf2/pbkdf2.h b/src/lib/pbkdf/pbkdf2/pbkdf2.h
index 65955eb28..9f90799c4 100644
--- a/src/lib/pbkdf/pbkdf2/pbkdf2.h
+++ b/src/lib/pbkdf/pbkdf2/pbkdf2.h
@@ -13,6 +13,8 @@
 #include <botan/pwdhash.h>
 #include <botan/mac.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(pbkdf2.h)
+
 namespace Botan {
 
 BOTAN_PUBLIC_API(2,0) size_t pbkdf2(MessageAuthenticationCode& prf,
diff --git a/src/lib/pbkdf/pgp_s2k/pgp_s2k.h b/src/lib/pbkdf/pgp_s2k/pgp_s2k.h
index 4ce934a2b..7fda724c2 100644
--- a/src/lib/pbkdf/pgp_s2k/pgp_s2k.h
+++ b/src/lib/pbkdf/pgp_s2k/pgp_s2k.h
@@ -13,6 +13,14 @@
 #include <botan/pwdhash.h>
 #include <botan/hash.h>
 
+/*
+This header will not be fully internal - the RFC4880 count
+encoding functions will remain here. But the definition of
+OpenPGP_S2K will be made internal
+*/
+
+//BOTAN_FUTURE_INTERNAL_HEADER(pgp_s2k.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pbkdf/scrypt/scrypt.h b/src/lib/pbkdf/scrypt/scrypt.h
index 83a3b0cca..1af59b6a5 100644
--- a/src/lib/pbkdf/scrypt/scrypt.h
+++ b/src/lib/pbkdf/scrypt/scrypt.h
@@ -10,6 +10,8 @@
 
 #include <botan/pwdhash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(scrypt.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/eme.h b/src/lib/pk_pad/eme.h
index 659d2ecc9..38cce4b09 100644
--- a/src/lib/pk_pad/eme.h
+++ b/src/lib/pk_pad/eme.h
@@ -11,6 +11,8 @@
 #include <botan/secmem.h>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(eme.h)
+
 namespace Botan {
 
 class RandomNumberGenerator;
diff --git a/src/lib/pk_pad/eme_oaep/oaep.h b/src/lib/pk_pad/eme_oaep/oaep.h
index 4bb12d27e..383617b82 100644
--- a/src/lib/pk_pad/eme_oaep/oaep.h
+++ b/src/lib/pk_pad/eme_oaep/oaep.h
@@ -11,6 +11,8 @@
 #include <botan/eme.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(oaep.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/eme_pkcs1/eme_pkcs.h b/src/lib/pk_pad/eme_pkcs1/eme_pkcs.h
index 26b03e47a..fb7cf1419 100644
--- a/src/lib/pk_pad/eme_pkcs1/eme_pkcs.h
+++ b/src/lib/pk_pad/eme_pkcs1/eme_pkcs.h
@@ -10,6 +10,8 @@
 
 #include <botan/eme.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(eme_pkcs.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/eme_raw/eme_raw.h b/src/lib/pk_pad/eme_raw/eme_raw.h
index d736a80bb..840448c55 100644
--- a/src/lib/pk_pad/eme_raw/eme_raw.h
+++ b/src/lib/pk_pad/eme_raw/eme_raw.h
@@ -9,6 +9,8 @@
 
 #include <botan/eme.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(eme_raw.h)
+
 namespace Botan {
 
 class BOTAN_PUBLIC_API(2,0) EME_Raw final : public EME
diff --git a/src/lib/pk_pad/emsa.h b/src/lib/pk_pad/emsa.h
index 019047045..06c18a488 100644
--- a/src/lib/pk_pad/emsa.h
+++ b/src/lib/pk_pad/emsa.h
@@ -12,6 +12,8 @@
 #include <botan/alg_id.h>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(emsa.h)
+
 namespace Botan {
 
 class Private_Key;
diff --git a/src/lib/pk_pad/emsa1/emsa1.h b/src/lib/pk_pad/emsa1/emsa1.h
index 7b4d027da..76736bc27 100644
--- a/src/lib/pk_pad/emsa1/emsa1.h
+++ b/src/lib/pk_pad/emsa1/emsa1.h
@@ -11,6 +11,8 @@
 #include <botan/emsa.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(emsa1.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/emsa_pkcs1/emsa_pkcs1.h b/src/lib/pk_pad/emsa_pkcs1/emsa_pkcs1.h
index 31032320e..5b9cf7aea 100644
--- a/src/lib/pk_pad/emsa_pkcs1/emsa_pkcs1.h
+++ b/src/lib/pk_pad/emsa_pkcs1/emsa_pkcs1.h
@@ -11,6 +11,8 @@
 #include <botan/emsa.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(emsa_pkcs1.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/emsa_pssr/pssr.h b/src/lib/pk_pad/emsa_pssr/pssr.h
index fa0ae1228..47efacb51 100644
--- a/src/lib/pk_pad/emsa_pssr/pssr.h
+++ b/src/lib/pk_pad/emsa_pssr/pssr.h
@@ -11,6 +11,8 @@
 #include <botan/emsa.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(pssr.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/emsa_raw/emsa_raw.h b/src/lib/pk_pad/emsa_raw/emsa_raw.h
index 3bac4ef67..dc01b94a2 100644
--- a/src/lib/pk_pad/emsa_raw/emsa_raw.h
+++ b/src/lib/pk_pad/emsa_raw/emsa_raw.h
@@ -10,6 +10,8 @@
 
 #include <botan/emsa.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(emsa_raw.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/emsa_x931/emsa_x931.h b/src/lib/pk_pad/emsa_x931/emsa_x931.h
index e20d303b6..a2fef0468 100644
--- a/src/lib/pk_pad/emsa_x931/emsa_x931.h
+++ b/src/lib/pk_pad/emsa_x931/emsa_x931.h
@@ -11,6 +11,8 @@
 #include <botan/emsa.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(emsa_x931.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/hash_id/hash_id.h b/src/lib/pk_pad/hash_id/hash_id.h
index 75c86c0c6..3c2eba791 100644
--- a/src/lib/pk_pad/hash_id/hash_id.h
+++ b/src/lib/pk_pad/hash_id/hash_id.h
@@ -11,6 +11,8 @@
 #include <botan/secmem.h>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(hash_id)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pk_pad/iso9796/iso9796.h b/src/lib/pk_pad/iso9796/iso9796.h
index 7af9a269b..9782e53b2 100644
--- a/src/lib/pk_pad/iso9796/iso9796.h
+++ b/src/lib/pk_pad/iso9796/iso9796.h
@@ -11,6 +11,8 @@
 #include <botan/emsa.h>
 #include <botan/hash.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(iso9796.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pubkey/blinding.h b/src/lib/pubkey/blinding.h
index 1bdd235f0..988a41a35 100644
--- a/src/lib/pubkey/blinding.h
+++ b/src/lib/pubkey/blinding.h
@@ -12,6 +12,8 @@
 #include <botan/reducer.h>
 #include <functional>
 
+BOTAN_FUTURE_INTERNAL_HEADER(blinding.h)
+
 namespace Botan {
 
 class RandomNumberGenerator;
diff --git a/src/lib/pubkey/ec_group/curve_gfp.h b/src/lib/pubkey/ec_group/curve_gfp.h
index fe7a0a54d..158f7f8c8 100644
--- a/src/lib/pubkey/ec_group/curve_gfp.h
+++ b/src/lib/pubkey/ec_group/curve_gfp.h
@@ -13,6 +13,9 @@
 #include <botan/bigint.h>
 #include <memory>
 
+// Currently exposed in PointGFp
+//BOTAN_FUTURE_INTERNAL_HEADER(curve_gfp.h)
+
 namespace Botan {
 
 class BOTAN_UNSTABLE_API CurveGFp_Repr
diff --git a/src/lib/pubkey/keypair/keypair.h b/src/lib/pubkey/keypair/keypair.h
index 4f28f325f..6900faa35 100644
--- a/src/lib/pubkey/keypair/keypair.h
+++ b/src/lib/pubkey/keypair/keypair.h
@@ -10,6 +10,8 @@
 
 #include <botan/pk_keys.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(keypair.h)
+
 namespace Botan {
 
 namespace KeyPair {
diff --git a/src/lib/pubkey/mce/gf2m_small_m.h b/src/lib/pubkey/mce/gf2m_small_m.h
index a74094930..9acc50c72 100644
--- a/src/lib/pubkey/mce/gf2m_small_m.h
+++ b/src/lib/pubkey/mce/gf2m_small_m.h
@@ -12,8 +12,11 @@
 #ifndef BOTAN_GF2M_SMALL_M_H_
 #define BOTAN_GF2M_SMALL_M_H_
 
-#include <vector>
 #include <botan/types.h>
+#include <vector>
+
+// fixme - still used in mceliece.h
+//BOTAN_FUTURE_INTERNAL_HEADER(gf2m_small_m.h)
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/mce/polyn_gf2m.h b/src/lib/pubkey/mce/polyn_gf2m.h
index f2d3ac53c..e4d3d4d1c 100644
--- a/src/lib/pubkey/mce/polyn_gf2m.h
+++ b/src/lib/pubkey/mce/polyn_gf2m.h
@@ -17,6 +17,8 @@
 #include <utility>
 #include <string>
 
+//BOTAN_FUTURE_INTERNAL_HEADER(polyn_gf2m.h)
+
 namespace Botan {
 
 class RandomNumberGenerator;
diff --git a/src/lib/pubkey/pbes2/pbes2.h b/src/lib/pubkey/pbes2/pbes2.h
index bc56abd97..daa9ac580 100644
--- a/src/lib/pubkey/pbes2/pbes2.h
+++ b/src/lib/pubkey/pbes2/pbes2.h
@@ -11,6 +11,8 @@
 #include <botan/alg_id.h>
 #include <chrono>
 
+BOTAN_FUTURE_INTERNAL_HEADER(pbes2.h)
+
 namespace Botan {
 
 class RandomNumberGenerator;
diff --git a/src/lib/pubkey/rfc6979/rfc6979.h b/src/lib/pubkey/rfc6979/rfc6979.h
index d78effc26..54134a682 100644
--- a/src/lib/pubkey/rfc6979/rfc6979.h
+++ b/src/lib/pubkey/rfc6979/rfc6979.h
@@ -12,6 +12,8 @@
 #include <string>
 #include <memory>
 
+BOTAN_FUTURE_INTERNAL_HEADER(rfc6979.h)
+
 namespace Botan {
 
 class HMAC_DRBG;
diff --git a/src/lib/pubkey/sm2/sm2.cpp b/src/lib/pubkey/sm2/sm2.cpp
index 5ffd547cf..a976c097b 100644
--- a/src/lib/pubkey/sm2/sm2.cpp
+++ b/src/lib/pubkey/sm2/sm2.cpp
@@ -9,6 +9,7 @@
 #include <botan/sm2.h>
 #include <botan/internal/pk_ops_impl.h>
 #include <botan/internal/point_mul.h>
+#include <botan/loadstor.h>
 #include <botan/numthry.h>
 #include <botan/keypair.h>
 #include <botan/hash.h>
diff --git a/src/lib/pubkey/xmss/atomic.h b/src/lib/pubkey/xmss/atomic.h
index d2e65c104..a542d4c00 100644
--- a/src/lib/pubkey/xmss/atomic.h
+++ b/src/lib/pubkey/xmss/atomic.h
@@ -8,9 +8,12 @@
 #ifndef BOTAN_ATOMIC_H_
 #define BOTAN_ATOMIC_H_
 
+#include <botan/types.h>
 #include <atomic>
 #include <memory>
 
+//BOTAN_FUTURE_INTERNAL_HEADER(atomic.h)
+
 namespace Botan {
 
 template <typename T>
diff --git a/src/lib/pubkey/xmss/xmss_common_ops.h b/src/lib/pubkey/xmss/xmss_common_ops.h
index 065a727d9..f3c59f85f 100644
--- a/src/lib/pubkey/xmss/xmss_common_ops.h
+++ b/src/lib/pubkey/xmss/xmss_common_ops.h
@@ -14,6 +14,8 @@
 #include <botan/xmss_address.h>
 #include <botan/xmss_hash.h>
 
+//BOTAN_FUTURE_INTERNAL_HEADER(xmss_common_ops.h)
+
 namespace Botan {
 
 typedef std::vector<secure_vector<uint8_t>> wots_keysig_t;
diff --git a/src/lib/pubkey/xmss/xmss_hash.h b/src/lib/pubkey/xmss/xmss_hash.h
index f45432d59..5d8cbab53 100644
--- a/src/lib/pubkey/xmss/xmss_hash.h
+++ b/src/lib/pubkey/xmss/xmss_hash.h
@@ -10,6 +10,8 @@
 
 #include <botan/hash.h>
 
+//BOTAN_FUTURE_INTERNAL_HEADER(xmss_hash.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pubkey/xmss/xmss_index_registry.h b/src/lib/pubkey/xmss/xmss_index_registry.h
index 27a68631a..6ec9137d3 100644
--- a/src/lib/pubkey/xmss/xmss_index_registry.h
+++ b/src/lib/pubkey/xmss/xmss_index_registry.h
@@ -12,6 +12,8 @@
 #include <botan/atomic.h>
 #include <botan/mutex.h>
 
+//BOTAN_FUTURE_INTERNAL_HEADER(xmss_index_registry.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pubkey/xmss/xmss_key_pair.h b/src/lib/pubkey/xmss/xmss_key_pair.h
index 2e7cc06da..3b586cfd4 100644
--- a/src/lib/pubkey/xmss/xmss_key_pair.h
+++ b/src/lib/pubkey/xmss/xmss_key_pair.h
@@ -8,12 +8,13 @@
 #ifndef BOTAN_XMSS_KEY_PAIR_H_
 #define BOTAN_XMSS_KEY_PAIR_H_
 
-#include <botan/botan.h>
 #include <botan/xmss_parameters.h>
 #include <botan/xmss_wots_parameters.h>
 #include <botan/xmss_publickey.h>
 #include <botan/xmss_privatekey.h>
 
+BOTAN_DEPRECATED_HEADER(xmss_key_pair.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/pubkey/xmss/xmss_tools.h b/src/lib/pubkey/xmss/xmss_tools.h
index bbd31fd9f..81d17f5bf 100644
--- a/src/lib/pubkey/xmss/xmss_tools.h
+++ b/src/lib/pubkey/xmss/xmss_tools.h
@@ -13,6 +13,8 @@
 #include <iterator>
 #include <type_traits>
 
+//BOTAN_FUTURE_INTERNAL_HEADER(xmss_tools.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/stream/chacha/chacha.h b/src/lib/stream/chacha/chacha.h
index 261d950bd..1749127f2 100644
--- a/src/lib/stream/chacha/chacha.h
+++ b/src/lib/stream/chacha/chacha.h
@@ -10,6 +10,8 @@
 
 #include <botan/stream_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(chacha.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/stream/ctr/ctr.h b/src/lib/stream/ctr/ctr.h
index 79911b2fe..0687c606e 100644
--- a/src/lib/stream/ctr/ctr.h
+++ b/src/lib/stream/ctr/ctr.h
@@ -11,6 +11,8 @@
 #include <botan/block_cipher.h>
 #include <botan/stream_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(ctr.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/stream/ofb/ofb.h b/src/lib/stream/ofb/ofb.h
index 1e9866c64..994d3d198 100644
--- a/src/lib/stream/ofb/ofb.h
+++ b/src/lib/stream/ofb/ofb.h
@@ -11,6 +11,8 @@
 #include <botan/stream_cipher.h>
 #include <botan/block_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(ofb.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/stream/rc4/rc4.h b/src/lib/stream/rc4/rc4.h
index d59ce01f0..eff3c568d 100644
--- a/src/lib/stream/rc4/rc4.h
+++ b/src/lib/stream/rc4/rc4.h
@@ -11,6 +11,8 @@
 #include <botan/stream_cipher.h>
 #include <botan/types.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(rc4.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/stream/salsa20/salsa20.h b/src/lib/stream/salsa20/salsa20.h
index 0870c9fd2..6ad0da770 100644
--- a/src/lib/stream/salsa20/salsa20.h
+++ b/src/lib/stream/salsa20/salsa20.h
@@ -10,6 +10,8 @@
 
 #include <botan/stream_cipher.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(salsa20.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/stream/shake_cipher/shake_cipher.h b/src/lib/stream/shake_cipher/shake_cipher.h
index 492341a7c..85eaec2a8 100644
--- a/src/lib/stream/shake_cipher/shake_cipher.h
+++ b/src/lib/stream/shake_cipher/shake_cipher.h
@@ -11,6 +11,8 @@
 #include <botan/stream_cipher.h>
 #include <botan/secmem.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(shake_cipher.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/tls/tls_algos.h b/src/lib/tls/tls_algos.h
index 4852a4349..3b0be8128 100644
--- a/src/lib/tls/tls_algos.h
+++ b/src/lib/tls/tls_algos.h
@@ -11,6 +11,8 @@
 #include <string>
 #include <vector>
 
+//BOTAN_FUTURE_INTERNAL_HEADER(tls_algos.h)
+
 namespace Botan {
 
 namespace TLS {
diff --git a/src/lib/tls/tls_cbc/tls_cbc.cpp b/src/lib/tls/tls_cbc/tls_cbc.cpp
index b23718d89..a23fa8595 100644
--- a/src/lib/tls/tls_cbc/tls_cbc.cpp
+++ b/src/lib/tls/tls_cbc/tls_cbc.cpp
@@ -13,6 +13,7 @@
 
 #include <botan/internal/rounding.h>
 #include <botan/internal/ct_utils.h>
+#include <botan/loadstor.h>
 #include <botan/tls_alert.h>
 #include <botan/tls_exceptn.h>
 
diff --git a/src/lib/tls/tls_handshake_io.cpp b/src/lib/tls/tls_handshake_io.cpp
index 6e2bf0284..7f9e2c86c 100644
--- a/src/lib/tls/tls_handshake_io.cpp
+++ b/src/lib/tls/tls_handshake_io.cpp
@@ -10,6 +10,7 @@
 #include <botan/internal/tls_seq_numbers.h>
 #include <botan/tls_messages.h>
 #include <botan/exceptn.h>
+#include <botan/loadstor.h>
 #include <chrono>
 
 namespace Botan {
diff --git a/src/lib/tls/tls_magic.h b/src/lib/tls/tls_magic.h
index 48bb34f4a..49d69c7d8 100644
--- a/src/lib/tls/tls_magic.h
+++ b/src/lib/tls/tls_magic.h
@@ -8,6 +8,10 @@
 #ifndef BOTAN_TLS_PROTOCOL_MAGIC_H_
 #define BOTAN_TLS_PROTOCOL_MAGIC_H_
 
+#include <botan/types.h>
+
+//BOTAN_FUTURE_INTERNAL_HEADER(tls_magic.h)
+
 namespace Botan {
 
 namespace TLS {
diff --git a/src/lib/tls/tls_version.h b/src/lib/tls/tls_version.h
index 4d56f94ca..18e2c0f65 100644
--- a/src/lib/tls/tls_version.h
+++ b/src/lib/tls/tls_version.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_TLS_PROTOCOL_VERSION_H_
 #define BOTAN_TLS_PROTOCOL_VERSION_H_
 
-#include <botan/loadstor.h>
+#include <botan/types.h>
 #include <string>
 
 namespace Botan {
@@ -76,12 +76,12 @@ class BOTAN_PUBLIC_API(2,0) Protocol_Version final
       /**
       * @return major version of the protocol version
       */
-      uint8_t major_version() const { return get_byte(0, m_version); }
+      uint8_t major_version() const { return static_cast<uint8_t>(m_version >> 8); }
 
       /**
       * @return minor version of the protocol version
       */
-      uint8_t minor_version() const { return get_byte(1, m_version); }
+      uint8_t minor_version() const { return static_cast<uint8_t>(m_version & 0xFF); }
 
       /**
       * @return the version code
diff --git a/src/lib/utils/bswap.h b/src/lib/utils/bswap.h
index 02f63c64e..584fa3323 100644
--- a/src/lib/utils/bswap.h
+++ b/src/lib/utils/bswap.h
@@ -15,6 +15,8 @@
   #include <stdlib.h>
 #endif
 
+BOTAN_FUTURE_INTERNAL_HEADER(bswap.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/utils/charset.h b/src/lib/utils/charset.h
index 4913f0a5a..6e7ce30c9 100644
--- a/src/lib/utils/charset.h
+++ b/src/lib/utils/charset.h
@@ -11,6 +11,8 @@
 #include <botan/types.h>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(charset.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/utils/compiler.h b/src/lib/utils/compiler.h
index 2da40b665..a38bffb5d 100644
--- a/src/lib/utils/compiler.h
+++ b/src/lib/utils/compiler.h
@@ -103,14 +103,26 @@
     #define BOTAN_DEPRECATED(msg) __attribute__ ((deprecated))
     #define BOTAN_DEPRECATED_HEADER(hdr) _Pragma("message \"this header is deprecated\"")
 
+    #if !defined(BOTAN_IS_BEING_BUILT)
+      #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) _Pragma("message \"this header will be made internal in the future\"")
+    #endif
+
   #elif defined(_MSC_VER)
     #define BOTAN_DEPRECATED(msg) __declspec(deprecated(msg))
     #define BOTAN_DEPRECATED_HEADER(hdr) __pragma("message \"this header is deprecated\"")
 
+    #if !defined(BOTAN_IS_BEING_BUILT)
+      #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) __pragma("message \"this header will be made internal in the future\"")
+    #endif
+
   #elif defined(__GNUC__)
     /* msg supported since GCC 4.5, earliest we support is 4.8 */
     #define BOTAN_DEPRECATED(msg) __attribute__ ((deprecated(msg)))
     #define BOTAN_DEPRECATED_HEADER(hdr) _Pragma("GCC warning \"this header is deprecated\"")
+
+    #if !defined(BOTAN_IS_BEING_BUILT)
+      #define BOTAN_FUTURE_INTERNAL_HEADER(hdr) _Pragma("GCC warning \"this header will be made internal in the future\"")
+    #endif
   #endif
 
 #endif
@@ -123,6 +135,10 @@
   #define BOTAN_DEPRECATED_HEADER(hdr)
 #endif
 
+#if !defined(BOTAN_FUTURE_INTERNAL_HEADER)
+  #define BOTAN_FUTURE_INTERNAL_HEADER(hdr)
+#endif
+
 /*
 * Define BOTAN_NORETURN
 */
diff --git a/src/lib/utils/cpuid/cpuid.h b/src/lib/utils/cpuid/cpuid.h
index d998d5364..7dd4468d7 100644
--- a/src/lib/utils/cpuid/cpuid.h
+++ b/src/lib/utils/cpuid/cpuid.h
@@ -13,6 +13,8 @@
 #include <string>
 #include <iosfwd>
 
+BOTAN_FUTURE_INTERNAL_HEADER(cpuid.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/utils/http_util/http_util.h b/src/lib/utils/http_util/http_util.h
index 92a67e42b..0eeda60f1 100644
--- a/src/lib/utils/http_util/http_util.h
+++ b/src/lib/utils/http_util/http_util.h
@@ -16,6 +16,8 @@
 #include <functional>
 #include <chrono>
 
+BOTAN_FUTURE_INTERNAL_HEADER(http_util.h)
+
 namespace Botan {
 
 namespace HTTP {
diff --git a/src/lib/utils/loadstor.h b/src/lib/utils/loadstor.h
index 0b1cebdb4..9a8e9d4be 100644
--- a/src/lib/utils/loadstor.h
+++ b/src/lib/utils/loadstor.h
@@ -14,6 +14,8 @@
 #include <botan/mem_ops.h>
 #include <vector>
 
+BOTAN_FUTURE_INTERNAL_HEADER(loadstor.h)
+
 #if defined(BOTAN_TARGET_CPU_IS_BIG_ENDIAN)
    #define BOTAN_ENDIAN_N2L(x) reverse_bytes(x)
    #define BOTAN_ENDIAN_L2N(x) reverse_bytes(x)
diff --git a/src/lib/utils/locking_allocator/locking_allocator.h b/src/lib/utils/locking_allocator/locking_allocator.h
index 21baa8ec2..8d1d24980 100644
--- a/src/lib/utils/locking_allocator/locking_allocator.h
+++ b/src/lib/utils/locking_allocator/locking_allocator.h
@@ -12,6 +12,8 @@
 #include <vector>
 #include <memory>
 
+BOTAN_FUTURE_INTERNAL_HEADER(locking_allocator.h)
+
 namespace Botan {
 
 class Memory_Pool;
diff --git a/src/lib/utils/mul128.h b/src/lib/utils/mul128.h
index ce1ef693b..8cdaae21e 100644
--- a/src/lib/utils/mul128.h
+++ b/src/lib/utils/mul128.h
@@ -10,6 +10,8 @@
 
 #include <botan/types.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(mul128.h)
+
 namespace Botan {
 
 #if defined(__SIZEOF_INT128__) && defined(BOTAN_TARGET_CPU_HAS_NATIVE_64BIT)
diff --git a/src/lib/utils/parsing.h b/src/lib/utils/parsing.h
index ed42ea8f5..216dbc822 100644
--- a/src/lib/utils/parsing.h
+++ b/src/lib/utils/parsing.h
@@ -17,6 +17,8 @@
 #include <functional>
 #include <map>
 
+BOTAN_FUTURE_INTERNAL_HEADER(parsing.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/utils/rotate.h b/src/lib/utils/rotate.h
index 16a44c71e..15c78ac26 100644
--- a/src/lib/utils/rotate.h
+++ b/src/lib/utils/rotate.h
@@ -10,6 +10,8 @@
 
 #include <botan/types.h>
 
+BOTAN_FUTURE_INTERNAL_HEADER(rotate.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/utils/stl_compatibility.h b/src/lib/utils/stl_compatibility.h
index 099af83b3..03bd5c8ac 100644
--- a/src/lib/utils/stl_compatibility.h
+++ b/src/lib/utils/stl_compatibility.h
@@ -8,6 +8,7 @@
 #ifndef BOTAN_STL_COMPATIBILITY_H_
 #define BOTAN_STL_COMPATIBILITY_H_
 
+#include <botan/types.h>
 #include <memory>
 
 #if __cplusplus < 201402L
@@ -16,6 +17,8 @@
 #include <utility>
 #endif
 
+BOTAN_FUTURE_INTERNAL_HEADER(stl_compatability.h)
+
 namespace Botan
 {
 /*
diff --git a/src/lib/utils/uuid/uuid.h b/src/lib/utils/uuid/uuid.h
index 38b5aab1b..8f95f4d67 100644
--- a/src/lib/utils/uuid/uuid.h
+++ b/src/lib/utils/uuid/uuid.h
@@ -12,6 +12,8 @@
 #include <vector>
 #include <string>
 
+BOTAN_FUTURE_INTERNAL_HEADER(uuid.h)
+
 namespace Botan {
 
 class RandomNumberGenerator;
diff --git a/src/lib/x509/datastor.h b/src/lib/x509/datastor.h
index ec3c5189b..e849c3d89 100644
--- a/src/lib/x509/datastor.h
+++ b/src/lib/x509/datastor.h
@@ -15,6 +15,8 @@
 #include <vector>
 #include <map>
 
+BOTAN_FUTURE_INTERNAL_HEADER(datastor.h)
+
 namespace Botan {
 
 /**
diff --git a/src/lib/x509/x509_ext.cpp b/src/lib/x509/x509_ext.cpp
index 0bfc337c4..55e3c434e 100644
--- a/src/lib/x509/x509_ext.cpp
+++ b/src/lib/x509/x509_ext.cpp
@@ -13,6 +13,7 @@
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/hash.h>
+#include <botan/loadstor.h>
 #include <botan/internal/bit_ops.h>
 #include <algorithm>
 #include <set>


Test patch:
diff --git a/src/tests/test_newhope.cpp b/src/tests/test_newhope.cpp
index be75ebeb7..90d44263a 100644
--- a/src/tests/test_newhope.cpp
+++ b/src/tests/test_newhope.cpp
@@ -8,8 +8,8 @@
 
 #if defined(BOTAN_HAS_NEWHOPE) && defined(BOTAN_HAS_CHACHA)
    #include <botan/newhope.h>
-   #include <botan/sha3.h>
-   #include <botan/chacha.h>
+   #include <botan/hash.h>
+   #include <botan/stream_cipher.h>
    #include <botan/rng.h>
 #endif
 
@@ -48,7 +48,7 @@ class NEWHOPE_RNG final : public Botan::RandomNumberGenerator
          * random seed we compute the exact same result.
          */
          Botan::clear_mem(out, len);
-         m_chacha.cipher1(out, len);
+         m_chacha->cipher1(out, len);
 
          m_calls += 1;
 
@@ -63,7 +63,7 @@ class NEWHOPE_RNG final : public Botan::RandomNumberGenerator
             nonce[7] = m_calls;
             }
 
-         m_chacha.set_iv(nonce, 8);
+         m_chacha->set_iv(nonce, 8);
          }
 
       bool is_seeded() const override
@@ -80,6 +80,8 @@ class NEWHOPE_RNG final : public Botan::RandomNumberGenerator
 
       NEWHOPE_RNG(const std::vector<uint8_t>& seed)
          {
+         m_chacha = Botan::StreamCipher::create_or_throw("ChaCha20");
+
          if(seed.size() != 64 && seed.size() != 32)
             {
             throw Test_Error("Invalid NEWHOPE RNG seed");
@@ -88,16 +90,16 @@ class NEWHOPE_RNG final : public Botan::RandomNumberGenerator
          if(seed.size() == 64)
             {
             m_first.assign(seed.begin(), seed.begin() + 32);
-            m_chacha.set_key(seed.data() + 32, 32);
+            m_chacha->set_key(seed.data() + 32, 32);
             }
          else
             {
-            m_chacha.set_key(seed.data(), 32);
+            m_chacha->set_key(seed.data(), 32);
             }
          }
 
    private:
-      Botan::ChaCha m_chacha;
+      std::unique_ptr<Botan::StreamCipher> m_chacha;
       std::vector<uint8_t> m_first;
       uint8_t m_calls = 0;
    };
@@ -121,15 +123,15 @@ class NEWHOPE_Tests final : public Text_Based_Test
          NEWHOPE_RNG drbg_a(vars.get_req_bin("DRBG_SeedA"));
          NEWHOPE_RNG drbg_b(vars.get_req_bin("DRBG_SeedB"));
 
-         Botan::SHA_3_256 sha3;
+         std::unique_ptr<Botan::HashFunction> sha3 = Botan::HashFunction::create("SHA-3(256)");
 
          std::vector<uint8_t> send_a(Botan::NEWHOPE_SENDABYTES);
          Botan::newhope_poly a_sk;
          Botan::newhope_keygen(send_a.data(), &a_sk, drbg_a);
 
-         std::vector<uint8_t> h_send_a(sha3.output_length());
-         sha3.update(send_a);
-         sha3.final(h_send_a.data());
+         std::vector<uint8_t> h_send_a(sha3->output_length());
+         sha3->update(send_a);
+         sha3->final(h_send_a.data());
          result.test_eq("Hash Output A", h_send_a, h_output_a);
 
          std::vector<uint8_t> sharedkey_b(32);
@@ -137,9 +139,9 @@ class NEWHOPE_Tests final : public Text_Based_Test
          Botan::newhope_sharedb(sharedkey_b.data(), send_b.data(), send_a.data(), drbg_b);
          result.test_eq("Key B", sharedkey_b, shared_key);
 
-         std::vector<uint8_t> h_send_b(sha3.output_length());
-         sha3.update(send_b);
-         sha3.final(h_send_b.data());
+         std::vector<uint8_t> h_send_b(sha3->output_length());
+         sha3->update(send_b);
+         sha3->final(h_send_b.data());
          result.test_eq("Hash Output B", h_send_b, h_output_b);
 
          std::vector<uint8_t> sharedkey_a(32);
diff --git a/src/tests/test_rng.cpp b/src/tests/test_rng.cpp
index e62f81623..3751ac5ca 100644
--- a/src/tests/test_rng.cpp
+++ b/src/tests/test_rng.cpp
@@ -30,7 +30,6 @@
 
 #if defined(BOTAN_HAS_RDRAND_RNG)
    #include <botan/rdrand_rng.h>
-   #include <botan/cpuid.h>
 #endif
 
 #if defined(BOTAN_HAS_ENTROPY_SOURCE)
@@ -756,7 +755,7 @@ class RDRAND_RNG_Tests final : public Test
          {
          Test::Result result("RDRAND_RNG");
 
-         if(Botan::CPUID::has_rdrand())
+         if(Botan::RDRAND_RNG::available())
             {
             Botan::RDRAND_RNG rng;
 
diff --git a/src/tests/test_tls_messages.cpp b/src/tests/test_tls_messages.cpp
index f176839db..15cc63b2e 100644
--- a/src/tests/test_tls_messages.cpp
+++ b/src/tests/test_tls_messages.cpp
@@ -14,6 +14,7 @@
    #include <botan/tls_handshake_msg.h>
    #include <botan/tls_messages.h>
    #include <botan/tls_alert.h>
+   #include <botan/loadstor.h>
 #endif
 
 namespace Botan_Tests {
diff --git a/src/tests/test_utils.cpp b/src/tests/test_utils.cpp
index 52d10058b..19350e2d3 100644
--- a/src/tests/test_utils.cpp
+++ b/src/tests/test_utils.cpp
@@ -16,6 +16,7 @@
 #include <botan/internal/rounding.h>
 #include <botan/internal/ct_utils.h>
 #include <botan/internal/bit_ops.h>
+#include <botan/cpuid.h>
 #include <botan/charset.h>
 #include <botan/parsing.h>
 #include <botan/version.h>
diff --git a/src/tests/tests.cpp b/src/tests/tests.cpp
index 8e21a8d38..cbc1a3426 100644
--- a/src/tests/tests.cpp
+++ b/src/tests/tests.cpp
@@ -13,6 +13,7 @@
 #include <botan/parsing.h>
 #include <botan/internal/filesystem.h>
 #include <botan/internal/stl_util.h>
+#include <botan/cpuid.h>
 
 #if defined(BOTAN_HAS_BIGINT)
    #include <botan/bigint.h>
@@ -959,10 +960,10 @@ std::string strip_ws(const std::string& in)
    return in.substr(first_c, last_c - first_c + 1);
    }
 
-std::vector<Botan::CPUID::CPUID_bits>
+std::vector<uint64_t>
 parse_cpuid_bits(const std::vector<std::string>& tok)
    {
-   std::vector<Botan::CPUID::CPUID_bits> bits;
+   std::vector<uint64_t> bits;
    for(size_t i = 1; i < tok.size(); ++i)
       {
       const std::vector<Botan::CPUID::CPUID_bits> more = Botan::CPUID::bit_from_string(tok[i]);
@@ -1065,8 +1066,9 @@ std::vector<Test::Result> Text_Based_Test::run()
             Test::Result result = run_one_test(header, vars);
             if(m_cpu_flags.size() > 0)
                {
-               for(auto const& cpuid_bit : m_cpu_flags)
+               for(auto const& cpuid_u64 : m_cpu_flags)
                   {
+                  Botan::CPUID::CPUID_bits cpuid_bit = static_cast<Botan::CPUID::CPUID_bits>(cpuid_u64);
                   if(Botan::CPUID::has_cpuid_bit(cpuid_bit))
                      {
                      Botan::CPUID::clear_cpuid_bit(cpuid_bit);
diff --git a/src/tests/tests.h b/src/tests/tests.h
index 17a3f8610..bff479605 100644
--- a/src/tests/tests.h
+++ b/src/tests/tests.h
@@ -12,7 +12,6 @@
 #include <botan/rng.h>
 #include <botan/hex.h>
 #include <botan/symkey.h>
-#include <botan/cpuid.h>
 #include <iosfwd>
 #include <functional>
 #include <map>
@@ -642,7 +641,7 @@ class Text_Based_Test : public Test
       std::unique_ptr<std::istream> m_cur;
       std::string m_cur_src_name;
       std::deque<std::string> m_srcs;
-      std::vector<Botan::CPUID::CPUID_bits> m_cpu_flags;
+      std::vector<uint64_t> m_cpu_flags;
    };
 
 }
diff --git a/src/tests/unit_tls.cpp b/src/tests/unit_tls.cpp
index c6114b010..1055ca885 100644
--- a/src/tests/unit_tls.cpp
+++ b/src/tests/unit_tls.cpp
@@ -355,11 +355,6 @@ class TLS_Handshake_Test final
                                                    (side == Botan::TLS::CLIENT) ? client_extn : server_extn,
                                                    6, 1);
                }
-
-            Test_Extension(Botan::TLS::TLS_Data_Reader& reader, uint16_t)
-               {
-               m_buf = reader.get_range_vector<uint8_t>(1, 6, 6);
-               }
          private:
             std::vector<uint8_t> m_buf;
          };