diff --git a/lib/krb5/crypto-arcfour.c b/lib/krb5/crypto-arcfour.c
index d09856147..af56a1d27 100644
--- a/lib/krb5/crypto-arcfour.c
+++ b/lib/krb5/crypto-arcfour.c
@@ -57,7 +57,7 @@ static struct key_type keytype_arcfour = {
 
 krb5_error_code
 _krb5_HMAC_MD5_checksum(krb5_context context,
-			struct key_data *key,
+			struct _krb5_key_data *key,
 			const void *data,
 			size_t len,
 			unsigned usage,
@@ -67,7 +67,7 @@ _krb5_HMAC_MD5_checksum(krb5_context context,
     struct checksum_type *c = _krb5_find_checksum (CKSUMTYPE_RSA_MD5);
     const char signature[] = "signaturekey";
     Checksum ksign_c;
-    struct key_data ksign;
+    struct _krb5_key_data ksign;
     krb5_keyblock kb;
     unsigned char t[4];
     unsigned char tmp[16];
@@ -123,7 +123,7 @@ struct checksum_type _krb5_checksum_hmac_md5 = {
 
 static krb5_error_code
 ARCFOUR_subencrypt(krb5_context context,
-		   struct key_data *key,
+		   struct _krb5_key_data *key,
 		   void *data,
 		   size_t len,
 		   unsigned usage,
@@ -132,7 +132,7 @@ ARCFOUR_subencrypt(krb5_context context,
     EVP_CIPHER_CTX ctx;
     struct checksum_type *c = _krb5_find_checksum (CKSUMTYPE_RSA_MD5);
     Checksum k1_c, k2_c, k3_c, cksum;
-    struct key_data ke;
+    struct _krb5_key_data ke;
     krb5_keyblock kb;
     unsigned char t[4];
     unsigned char *cdata = data;
@@ -190,7 +190,7 @@ ARCFOUR_subencrypt(krb5_context context,
 
 static krb5_error_code
 ARCFOUR_subdecrypt(krb5_context context,
-		   struct key_data *key,
+		   struct _krb5_key_data *key,
 		   void *data,
 		   size_t len,
 		   unsigned usage,
@@ -199,7 +199,7 @@ ARCFOUR_subdecrypt(krb5_context context,
     EVP_CIPHER_CTX ctx;
     struct checksum_type *c = _krb5_find_checksum (CKSUMTYPE_RSA_MD5);
     Checksum k1_c, k2_c, k3_c, cksum;
-    struct key_data ke;
+    struct _krb5_key_data ke;
     krb5_keyblock kb;
     unsigned char t[4];
     unsigned char *cdata = data;
@@ -290,7 +290,7 @@ _krb5_usage2arcfour(krb5_context context, unsigned *usage)
 
 static krb5_error_code
 ARCFOUR_encrypt(krb5_context context,
-		struct key_data *key,
+		struct _krb5_key_data *key,
 		void *data,
 		size_t len,
 		krb5_boolean encryptp,
diff --git a/lib/krb5/crypto-des-common.c b/lib/krb5/crypto-des-common.c
index 82d344f28..762177997 100644
--- a/lib/krb5/crypto-des-common.c
+++ b/lib/krb5/crypto-des-common.c
@@ -57,7 +57,7 @@ _krb5_xor (DES_cblock *key, const unsigned char *b)
 krb5_error_code
 _krb5_des_checksum(krb5_context context,
 		   const EVP_MD *evp_md,
-		   struct key_data *key,
+		   struct _krb5_key_data *key,
 		   const void *data,
 		   size_t len,
 		   Checksum *cksum)
@@ -90,7 +90,7 @@ _krb5_des_checksum(krb5_context context,
 krb5_error_code
 _krb5_des_verify(krb5_context context,
 		 const EVP_MD *evp_md,
-		 struct key_data *key,
+		 struct _krb5_key_data *key,
 		 const void *data,
 		 size_t len,
 		 Checksum *C)
@@ -130,7 +130,7 @@ _krb5_des_verify(krb5_context context,
 
 static krb5_error_code
 RSA_MD5_checksum(krb5_context context,
-		 struct key_data *key,
+		 struct _krb5_key_data *key,
 		 const void *data,
 		 size_t len,
 		 unsigned usage,
diff --git a/lib/krb5/crypto-des.c b/lib/krb5/crypto-des.c
index f6c09ba40..31b15afa3 100644
--- a/lib/krb5/crypto-des.c
+++ b/lib/krb5/crypto-des.c
@@ -50,7 +50,7 @@ krb5_DES_random_key(krb5_context context,
 static void
 krb5_DES_schedule_old(krb5_context context,
 		      struct key_type *kt,
-		      struct key_data *key)
+		      struct _krb5_key_data *key)
 {
     DES_set_key_unchecked(key->key->keyvalue.data, key->schedule->data);
 }
@@ -96,7 +96,7 @@ static struct key_type keytype_des = {
 
 static krb5_error_code
 CRC32_checksum(krb5_context context,
-	       struct key_data *key,
+	       struct _krb5_key_data *key,
 	       const void *data,
 	       size_t len,
 	       unsigned usage,
@@ -115,7 +115,7 @@ CRC32_checksum(krb5_context context,
 
 static krb5_error_code
 RSA_MD4_checksum(krb5_context context,
-		 struct key_data *key,
+		 struct _krb5_key_data *key,
 		 const void *data,
 		 size_t len,
 		 unsigned usage,
@@ -128,7 +128,7 @@ RSA_MD4_checksum(krb5_context context,
 
 static krb5_error_code
 RSA_MD4_DES_checksum(krb5_context context,
-		     struct key_data *key,
+		     struct _krb5_key_data *key,
 		     const void *data,
 		     size_t len,
 		     unsigned usage,
@@ -139,7 +139,7 @@ RSA_MD4_DES_checksum(krb5_context context,
 
 static krb5_error_code
 RSA_MD4_DES_verify(krb5_context context,
-		   struct key_data *key,
+		   struct _krb5_key_data *key,
 		   const void *data,
 		   size_t len,
 		   unsigned usage,
@@ -150,7 +150,7 @@ RSA_MD4_DES_verify(krb5_context context,
 
 static krb5_error_code
 RSA_MD5_DES_checksum(krb5_context context,
-		     struct key_data *key,
+		     struct _krb5_key_data *key,
 		     const void *data,
 		     size_t len,
 		     unsigned usage,
@@ -161,7 +161,7 @@ RSA_MD5_DES_checksum(krb5_context context,
 
 static krb5_error_code
 RSA_MD5_DES_verify(krb5_context context,
-		   struct key_data *key,
+		   struct _krb5_key_data *key,
 		   const void *data,
 		   size_t len,
 		   unsigned usage,
@@ -212,7 +212,7 @@ struct checksum_type _krb5_checksum_rsa_md5_des = {
 
 static krb5_error_code
 evp_des_encrypt_null_ivec(krb5_context context,
-			  struct key_data *key,
+			  struct _krb5_key_data *key,
 			  void *data,
 			  size_t len,
 			  krb5_boolean encryptp,
@@ -231,7 +231,7 @@ evp_des_encrypt_null_ivec(krb5_context context,
 
 static krb5_error_code
 evp_des_encrypt_key_ivec(krb5_context context,
-			 struct key_data *key,
+			 struct _krb5_key_data *key,
 			 void *data,
 			 size_t len,
 			 krb5_boolean encryptp,
@@ -250,7 +250,7 @@ evp_des_encrypt_key_ivec(krb5_context context,
 
 static krb5_error_code
 DES_CFB64_encrypt_null_ivec(krb5_context context,
-			    struct key_data *key,
+			    struct _krb5_key_data *key,
 			    void *data,
 			    size_t len,
 			    krb5_boolean encryptp,
@@ -268,7 +268,7 @@ DES_CFB64_encrypt_null_ivec(krb5_context context,
 
 static krb5_error_code
 DES_PCBC_encrypt_key_ivec(krb5_context context,
-			  struct key_data *key,
+			  struct _krb5_key_data *key,
 			  void *data,
 			  size_t len,
 			  krb5_boolean encryptp,
diff --git a/lib/krb5/crypto-des3.c b/lib/krb5/crypto-des3.c
index 1ff692b52..90092123d 100644
--- a/lib/krb5/crypto-des3.c
+++ b/lib/krb5/crypto-des3.c
@@ -86,7 +86,7 @@ static struct key_type keytype_des3_derived = {
 #ifdef DES3_OLD_ENCTYPE
 static krb5_error_code
 RSA_MD5_DES3_checksum(krb5_context context,
-		      struct key_data *key,
+		      struct _krb5_key_data *key,
 		      const void *data,
 		      size_t len,
 		      unsigned usage,
@@ -97,7 +97,7 @@ RSA_MD5_DES3_checksum(krb5_context context,
 
 static krb5_error_code
 RSA_MD5_DES3_verify(krb5_context context,
-		    struct key_data *key,
+		    struct _krb5_key_data *key,
 		    const void *data,
 		    size_t len,
 		    unsigned usage,
diff --git a/lib/krb5/crypto-evp.c b/lib/krb5/crypto-evp.c
index 69d1e2679..8ba1b282d 100644
--- a/lib/krb5/crypto-evp.c
+++ b/lib/krb5/crypto-evp.c
@@ -36,7 +36,7 @@
 void
 _krb5_evp_schedule(krb5_context context,
 		   struct key_type *kt,
-		   struct key_data *kd)
+		   struct _krb5_key_data *kd)
 {
     struct evp_schedule *key = kd->schedule->data;
     const EVP_CIPHER *c = (*kt->evp)();
@@ -49,7 +49,7 @@ _krb5_evp_schedule(krb5_context context,
 }
 
 void
-_krb5_evp_cleanup(krb5_context context, struct key_data *kd)
+_krb5_evp_cleanup(krb5_context context, struct _krb5_key_data *kd)
 {
     struct evp_schedule *key = kd->schedule->data;
     EVP_CIPHER_CTX_cleanup(&key->ectx);
@@ -58,7 +58,7 @@ _krb5_evp_cleanup(krb5_context context, struct key_data *kd)
 
 krb5_error_code
 _krb5_evp_encrypt(krb5_context context,
-		struct key_data *key,
+		struct _krb5_key_data *key,
 		void *data,
 		size_t len,
 		krb5_boolean encryptp,
@@ -89,7 +89,7 @@ static const unsigned char zero_ivec[EVP_MAX_BLOCK_LENGTH] = { 0 };
 
 krb5_error_code
 _krb5_evp_encrypt_cts(krb5_context context,
-		      struct key_data *key,
+		      struct _krb5_key_data *key,
 		      void *data,
 		      size_t len,
 		      krb5_boolean encryptp,
diff --git a/lib/krb5/crypto-null.c b/lib/krb5/crypto-null.c
index 3a5c6b6cb..075d17a0c 100644
--- a/lib/krb5/crypto-null.c
+++ b/lib/krb5/crypto-null.c
@@ -50,7 +50,7 @@ static struct key_type keytype_null = {
 
 static krb5_error_code
 NONE_checksum(krb5_context context,
-	      struct key_data *key,
+	      struct _krb5_key_data *key,
 	      const void *data,
 	      size_t len,
 	      unsigned usage,
@@ -71,7 +71,7 @@ struct checksum_type _krb5_checksum_none = {
 
 static krb5_error_code
 NULL_encrypt(krb5_context context,
-	     struct key_data *key,
+	     struct _krb5_key_data *key,
 	     void *data,
 	     size_t len,
 	     krb5_boolean encryptp,
diff --git a/lib/krb5/crypto.c b/lib/krb5/crypto.c
index aa417e15e..a9f85f921 100644
--- a/lib/krb5/crypto.c
+++ b/lib/krb5/crypto.c
@@ -35,16 +35,22 @@
 
 #include "krb5_locl.h"
 
+struct _krb5_key_usage {
+    unsigned usage;
+    struct _krb5_key_data key;
+};
+
+
 #ifndef HEIMDAL_SMALLER
 #define DES3_OLD_ENCTYPE 1
 #endif
 
 static krb5_error_code _get_derived_key(krb5_context, krb5_crypto,
-					unsigned, struct key_data**);
-static struct key_data *_new_derived_key(krb5_crypto crypto, unsigned usage);
+					unsigned, struct _krb5_key_data**);
+static struct _krb5_key_data *_new_derived_key(krb5_crypto crypto, unsigned usage);
 
 static void free_key_schedule(krb5_context,
-			      struct key_data *,
+			      struct _krb5_key_data *,
 			      struct encryption_type *);
 
 /************************************************************
@@ -110,7 +116,7 @@ krb5_generate_random_keyblock(krb5_context context,
 
 static krb5_error_code
 _key_schedule(krb5_context context,
-	      struct key_data *key)
+	      struct _krb5_key_data *key)
 {
     krb5_error_code ret;
     struct encryption_type *et = _krb5_find_enctype(key->key->keytype);
@@ -150,7 +156,7 @@ _key_schedule(krb5_context context,
 
 static krb5_error_code
 SHA1_checksum(krb5_context context,
-	      struct key_data *key,
+	      struct _krb5_key_data *key,
 	      const void *data,
 	      size_t len,
 	      unsigned usage,
@@ -168,7 +174,7 @@ _krb5_internal_hmac(krb5_context context,
 		    const void *data,
 		    size_t len,
 		    unsigned usage,
-		    struct key_data *keyblock,
+		    struct _krb5_key_data *keyblock,
 		    Checksum *result)
 {
     unsigned char *ipad, *opad;
@@ -229,7 +235,7 @@ krb5_hmac(krb5_context context,
 	  Checksum *result)
 {
     struct checksum_type *c = _krb5_find_checksum(cktype);
-    struct key_data kd;
+    struct _krb5_key_data kd;
     krb5_error_code ret;
 
     if (c == NULL) {
@@ -252,7 +258,7 @@ krb5_hmac(krb5_context context,
 
 krb5_error_code
 _krb5_SP_HMAC_SHA1_checksum(krb5_context context,
-			    struct key_data *key,
+			    struct _krb5_key_data *key,
 			    const void *data,
 			    size_t len,
 			    unsigned usage,
@@ -298,7 +304,7 @@ get_checksum_key(krb5_context context,
 		 krb5_crypto crypto,
 		 unsigned usage,  /* not krb5_key_usage */
 		 struct checksum_type *ct,
-		 struct key_data **key)
+		 struct _krb5_key_data **key)
 {
     krb5_error_code ret = 0;
 
@@ -335,7 +341,7 @@ create_checksum (krb5_context context,
 		 Checksum *result)
 {
     krb5_error_code ret;
-    struct key_data *dkey;
+    struct _krb5_key_data *dkey;
     int keyed_checksum;
 
     if (ct->flags & F_DISABLED) {
@@ -417,7 +423,7 @@ verify_checksum(krb5_context context,
 		Checksum *cksum)
 {
     krb5_error_code ret;
-    struct key_data *dkey;
+    struct _krb5_key_data *dkey;
     int keyed_checksum;
     Checksum c;
     struct checksum_type *ct;
@@ -798,7 +804,7 @@ encrypt_internal_derived(krb5_context context,
     Checksum cksum;
     unsigned char *p, *q;
     krb5_error_code ret;
-    struct key_data *dkey;
+    struct _krb5_key_data *dkey;
     const struct encryption_type *et = crypto->et;
 
     checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
@@ -967,7 +973,7 @@ decrypt_internal_derived(krb5_context context,
     Checksum cksum;
     unsigned char *p;
     krb5_error_code ret;
-    struct key_data *dkey;
+    struct _krb5_key_data *dkey;
     struct encryption_type *et = crypto->et;
     unsigned long l;
 
@@ -1201,7 +1207,7 @@ krb5_encrypt_iov_ivec(krb5_context context,
     Checksum cksum;
     unsigned char *p, *q;
     krb5_error_code ret;
-    struct key_data *dkey;
+    struct _krb5_key_data *dkey;
     const struct encryption_type *et = crypto->et;
     krb5_crypto_iov *tiv, *piv, *hiv;
 
@@ -1393,7 +1399,7 @@ krb5_decrypt_iov_ivec(krb5_context context,
     Checksum cksum;
     unsigned char *p, *q;
     krb5_error_code ret;
-    struct key_data *dkey;
+    struct _krb5_key_data *dkey;
     struct encryption_type *et = crypto->et;
     krb5_crypto_iov *tiv, *hiv;
 
@@ -1834,7 +1840,7 @@ krb5_decrypt_EncryptedData(krb5_context context,
 krb5_error_code
 _krb5_derive_key(krb5_context context,
 		 struct encryption_type *et,
-		 struct key_data *key,
+		 struct _krb5_key_data *key,
 		 const void *constant,
 		 size_t len)
 {
@@ -1923,10 +1929,10 @@ _krb5_derive_key(krb5_context context,
     return ret;
 }
 
-static struct key_data *
+static struct _krb5_key_data *
 _new_derived_key(krb5_crypto crypto, unsigned usage)
 {
-    struct key_usage *d = crypto->key_usage;
+    struct _krb5_key_usage *d = crypto->key_usage;
     d = realloc(d, (crypto->num_key_usage + 1) * sizeof(*d));
     if(d == NULL)
 	return NULL;
@@ -1947,7 +1953,7 @@ krb5_derive_key(krb5_context context,
 {
     krb5_error_code ret;
     struct encryption_type *et;
-    struct key_data d;
+    struct _krb5_key_data d;
 
     *derived_key = NULL;
 
@@ -1975,10 +1981,10 @@ static krb5_error_code
 _get_derived_key(krb5_context context,
 		 krb5_crypto crypto,
 		 unsigned usage,
-		 struct key_data **key)
+		 struct _krb5_key_data **key)
 {
     int i;
-    struct key_data *d;
+    struct _krb5_key_data *d;
     unsigned char constant[5];
 
     for(i = 0; i < crypto->num_key_usage; i++)
@@ -2060,7 +2066,7 @@ krb5_crypto_init(krb5_context context,
 
 static void
 free_key_schedule(krb5_context context,
-		  struct key_data *key,
+		  struct _krb5_key_data *key,
 		  struct encryption_type *et)
 {
     if (et->keytype->cleanup)
@@ -2070,7 +2076,7 @@ free_key_schedule(krb5_context context,
 }
 
 void
-_krb5_free_key_data(krb5_context context, struct key_data *key,
+_krb5_free_key_data(krb5_context context, struct _krb5_key_data *key,
 	      struct encryption_type *et)
 {
     krb5_free_keyblock(context, key->key);
@@ -2081,7 +2087,7 @@ _krb5_free_key_data(krb5_context context, struct key_data *key,
 }
 
 static void
-free_key_usage(krb5_context context, struct key_usage *ku,
+free_key_usage(krb5_context context, struct _krb5_key_usage *ku,
 	       struct encryption_type *et)
 {
     _krb5_free_key_data(context, &ku->key, et);
diff --git a/lib/krb5/crypto.h b/lib/krb5/crypto.h
index c57221b1e..15e7e0457 100644
--- a/lib/krb5/crypto.h
+++ b/lib/krb5/crypto.h
@@ -35,21 +35,18 @@
 #define DES3_OLD_ENCTYPE 1
 #endif
 
-struct key_data {
+struct _krb5_key_data {
     krb5_keyblock *key;
     krb5_data *schedule;
 };
 
-struct key_usage {
-    unsigned usage;
-    struct key_data key;
-};
+struct _krb5_key_usage;
 
 struct krb5_crypto_data {
     struct encryption_type *et;
-    struct key_data key;
+    struct _krb5_key_data key;
     int num_key_usage;
-    struct key_usage *key_usage;
+    struct _krb5_key_usage *key_usage;
 };
 
 #define CRYPTO_ETYPE(C) ((C)->et->type)
@@ -78,10 +75,10 @@ struct key_type {
     size_t size;
     size_t schedule_size;
     void (*random_key)(krb5_context, krb5_keyblock*);
-    void (*schedule)(krb5_context, struct key_type *, struct key_data *);
+    void (*schedule)(krb5_context, struct key_type *, struct _krb5_key_data *);
     struct salt_type *string_to_key;
     void (*random_to_key)(krb5_context, krb5_keyblock*, const void*, size_t);
-    void (*cleanup)(krb5_context, struct key_data *);
+    void (*cleanup)(krb5_context, struct _krb5_key_data *);
     const EVP_CIPHER *(*evp)(void);
 };
 
@@ -92,12 +89,12 @@ struct checksum_type {
     size_t checksumsize;
     unsigned flags;
     krb5_error_code (*checksum)(krb5_context context,
-				struct key_data *key,
+				struct _krb5_key_data *key,
 				const void *buf, size_t len,
 				unsigned usage,
 				Checksum *csum);
     krb5_error_code (*verify)(krb5_context context,
-			      struct key_data *key,
+			      struct _krb5_key_data *key,
 			      const void *buf, size_t len,
 			      unsigned usage,
 			      Checksum *csum);
@@ -114,7 +111,7 @@ struct encryption_type {
     struct checksum_type *keyed_checksum;
     unsigned flags;
     krb5_error_code (*encrypt)(krb5_context context,
-			       struct key_data *key,
+			       struct _krb5_key_data *key,
 			       void *data, size_t len,
 			       krb5_boolean encryptp,
 			       int usage,
diff --git a/lib/krb5/pac.c b/lib/krb5/pac.c
index fa746b87f..046a89cc6 100644
--- a/lib/krb5/pac.c
+++ b/lib/krb5/pac.c
@@ -87,7 +87,7 @@ HMAC_MD5_any_checksum(krb5_context context,
 		      unsigned usage,
 		      Checksum *result)
 {
-    struct key_data local_key;
+    struct _krb5_key_data local_key;
     krb5_error_code ret;
 
     memset(&local_key, 0, sizeof(local_key));
diff --git a/lib/krb5/salt-aes.c b/lib/krb5/salt-aes.c
index 1c40b54f6..d59204cf0 100644
--- a/lib/krb5/salt-aes.c
+++ b/lib/krb5/salt-aes.c
@@ -46,7 +46,7 @@ AES_string_to_key(krb5_context context,
     krb5_error_code ret;
     uint32_t iter;
     struct encryption_type *et;
-    struct key_data kd;
+    struct _krb5_key_data kd;
 
     if (opaque.length == 0)
 	iter = _krb5_AES_string_to_default_iterator;
diff --git a/lib/krb5/salt.c b/lib/krb5/salt.c
index 69375f6a8..d8f515149 100644
--- a/lib/krb5/salt.c
+++ b/lib/krb5/salt.c
@@ -249,7 +249,7 @@ krb5_string_to_key_derived(krb5_context context,
 {
     struct encryption_type *et = _krb5_find_enctype(etype);
     krb5_error_code ret;
-    struct key_data kd;
+    struct _krb5_key_data kd;
     size_t keylen;
     u_char *tmp;