diff --git a/lib/krb5/crypto.c b/lib/krb5/crypto.c
index f379e8007..38becf429 100644
--- a/lib/krb5/crypto.c
+++ b/lib/krb5/crypto.c
@@ -2690,7 +2690,7 @@ krb5_string_to_enctype(krb5_context context,
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
-krb5_enctype_to_oid(krb5_context context,
+_krb5_enctype_to_oid(krb5_context context,
 		    krb5_enctype etype,
 		    heim_oid *oid)
 {
@@ -2705,7 +2705,7 @@ krb5_enctype_to_oid(krb5_context context,
 	return KRB5_PROG_ETYPE_NOSUPP;
     }
     krb5_clear_error_string(context);
-    return copy_oid(et->oid, oid);
+    return der_copy_oid(et->oid, oid);
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
@@ -2715,7 +2715,7 @@ _krb5_oid_to_enctype(krb5_context context,
 {
     int i;
     for(i = 0; i < num_etypes; i++) {
-	if(etypes[i]->oid && heim_oid_cmp(etypes[i]->oid, oid) == 0) {
+	if(etypes[i]->oid && der_heim_oid_cmp(etypes[i]->oid, oid) == 0) {
 	    *etype = etypes[i]->type;
 	    return 0;
 	}
diff --git a/lib/krb5/data.c b/lib/krb5/data.c
index 3849c203c..f017a78f5 100644
--- a/lib/krb5/data.c
+++ b/lib/krb5/data.c
@@ -110,7 +110,7 @@ krb5_copy_data(krb5_context context,
 	krb5_set_error_string(context, "malloc: out of memory");
 	return ENOMEM;
     }
-    ret = copy_octet_string(indata, *outdata);
+    ret = der_copy_octet_string(indata, *outdata);
     if(ret) {
 	krb5_clear_error_string (context);
 	free(*outdata);
diff --git a/lib/krb5/digest.c b/lib/krb5/digest.c
index 284d8dba0..257d3a1fa 100644
--- a/lib/krb5/digest.c
+++ b/lib/krb5/digest.c
@@ -790,7 +790,7 @@ krb5_digest_get_a1_hash(krb5_context context,
     krb5_data_zero(data);
     if (digest->response.hash_a1 == NULL)
 	return 0;
-    ret = copy_octet_string(digest->response.hash_a1, data);
+    ret = der_copy_octet_string(digest->response.hash_a1, data);
     if (ret)
 	krb5_clear_error_string(context);
 
diff --git a/lib/krb5/mit_glue.c b/lib/krb5/mit_glue.c
index abce5e431..d52aabd07 100644
--- a/lib/krb5/mit_glue.c
+++ b/lib/krb5/mit_glue.c
@@ -98,7 +98,7 @@ krb5_c_get_checksum(krb5_context context, const krb5_checksum *cksum,
 	if (*data == NULL)
 	    return ENOMEM;
 
-	ret = copy_octet_string(&cksum->checksum, *data);
+	ret = der_copy_octet_string(&cksum->checksum, *data);
 	if (ret) {
 	    free(*data);
 	    *data = NULL;
@@ -113,7 +113,7 @@ krb5_c_set_checksum(krb5_context context, krb5_checksum *cksum,
 		    krb5_cksumtype type, const krb5_data *data)
 {
     cksum->cksumtype = type;
-    return copy_octet_string(data, &cksum->checksum);
+    return der_copy_octet_string(data, &cksum->checksum);
 }
 
 void KRB5_LIB_FUNCTION 
diff --git a/lib/krb5/pkinit.c b/lib/krb5/pkinit.c
index 674f24869..d0b95358a 100644
--- a/lib/krb5/pkinit.c
+++ b/lib/krb5/pkinit.c
@@ -344,8 +344,8 @@ build_auth_pack(krb5_context context,
 	ALLOC(a->clientPublicValue, 1);
 	if (a->clientPublicValue == NULL)
 	    return ENOMEM;
-	ret = copy_oid(oid_id_dhpublicnumber(),
-		       &a->clientPublicValue->algorithm.algorithm);
+	ret = der_copy_oid(oid_id_dhpublicnumber(),
+			   &a->clientPublicValue->algorithm.algorithm);
 	if (ret)
 	    return ret;
 	
@@ -392,7 +392,7 @@ build_auth_pack(krb5_context context,
 
 	ASN1_MALLOC_ENCODE(DHPublicKey, dhbuf.data, dhbuf.length,
 			   &dh_pub_key, &size, ret);
-	free_heim_integer(&dh_pub_key);
+	der_free_heim_integer(&dh_pub_key);
 	if (ret)
 	    return ret;
 	if (size != dhbuf.length)
@@ -413,7 +413,7 @@ _krb5_pk_mk_ContentInfo(krb5_context context,
 {
     krb5_error_code ret;
 
-    ret = copy_oid(oid, &content_info->contentType);
+    ret = der_copy_oid(oid, &content_info->contentType);
     if (ret)
 	return ret;
     ALLOC(content_info->content, 1);
@@ -914,7 +914,7 @@ pk_rd_pa_reply_enckey(krb5_context context,
     krb5_data content;
     heim_oid contentType = { 0, NULL };
 
-    if (heim_oid_cmp(oid_id_pkcs7_envelopedData(), &rep->contentType)) {
+    if (der_heim_oid_cmp(oid_id_pkcs7_envelopedData(), &rep->contentType)) {
 	krb5_set_error_string(context, "PKINIT: Invalid content type");
 	return EINVAL;
     }
@@ -950,7 +950,7 @@ pk_rd_pa_reply_enckey(krb5_context context,
 	    goto out;
 	}
 
-	if (heim_oid_cmp(&ci.contentType, oid_id_pkcs7_signedData())) {
+	if (der_heim_oid_cmp(&ci.contentType, oid_id_pkcs7_signedData())) {
 	    ret = EINVAL; /* XXX */
 	    krb5_set_error_string(context, "PKINIT: Invalid content type");
 	    goto out;
@@ -984,13 +984,13 @@ pk_rd_pa_reply_enckey(krb5_context context,
 
 #if 0
     if (type == COMPAT_WIN2K) {
-	if (heim_oid_cmp(&contentType, oid_id_pkcs7_data()) != 0) {
+	if (der_heim_oid_cmp(&contentType, oid_id_pkcs7_data()) != 0) {
 	    krb5_set_error_string(context, "PKINIT: reply key, wrong oid");
 	    ret = KRB5KRB_AP_ERR_MSG_TYPE;
 	    goto out;
 	}
     } else {
-	if (heim_oid_cmp(&contentType, oid_id_pkrkeydata()) != 0) {
+	if (der_heim_oid_cmp(&contentType, oid_id_pkrkeydata()) != 0) {
 	    krb5_set_error_string(context, "PKINIT: reply key, wrong oid");
 	    ret = KRB5KRB_AP_ERR_MSG_TYPE;
 	    goto out;
@@ -1016,7 +1016,7 @@ pk_rd_pa_reply_enckey(krb5_context context,
  out:
     if (host)
 	_krb5_pk_cert_free(host);
-    free_oid(&contentType);
+    der_free_oid(&contentType);
     krb5_data_free(&content);
 
     return ret;
@@ -1048,7 +1048,7 @@ pk_rd_pa_reply_dh(krb5_context context,
     krb5_data_zero(&content);
     memset(&kdc_dh_info, 0, sizeof(kdc_dh_info));
 
-    if (heim_oid_cmp(oid_id_pkcs7_signedData(), &rep->contentType)) {
+    if (der_heim_oid_cmp(oid_id_pkcs7_signedData(), &rep->contentType)) {
 	krb5_set_error_string(context, "PKINIT: Invalid content type");
 	return EINVAL;
     }
@@ -1073,7 +1073,7 @@ pk_rd_pa_reply_dh(krb5_context context,
     if (ret)
 	goto out;
 
-    if (heim_oid_cmp(&contentType, oid_id_pkdhkeydata())) {
+    if (der_heim_oid_cmp(&contentType, oid_id_pkdhkeydata())) {
 	krb5_set_error_string(context, "pkinit - dh reply contains wrong oid");
 	ret = KRB5KRB_AP_ERR_MSG_TYPE;
 	goto out;
@@ -1613,9 +1613,9 @@ _krb5_parse_moduli_line(krb5_context context,
     return 0;
 out:
     free(m1->name);
-    free_heim_integer(&m1->p);
-    free_heim_integer(&m1->g);
-    free_heim_integer(&m1->q);
+    der_free_heim_integer(&m1->p);
+    der_free_heim_integer(&m1->g);
+    der_free_heim_integer(&m1->q);
     free(m1);
     return ret;
 }
@@ -1626,9 +1626,9 @@ _krb5_free_moduli(struct krb5_dh_moduli **moduli)
     int i;
     for (i = 0; moduli[i] != NULL; i++) {
 	free(moduli[i]->name);
-	free_heim_integer(&moduli[i]->p);
-	free_heim_integer(&moduli[i]->g);
-	free_heim_integer(&moduli[i]->q);
+	der_free_heim_integer(&moduli[i]->p);
+	der_free_heim_integer(&moduli[i]->g);
+	der_free_heim_integer(&moduli[i]->q);
 	free(moduli[i]);
     }
     free(moduli);
@@ -1737,9 +1737,9 @@ _krb5_dh_group_ok(krb5_context context, unsigned long bits,
 	*name = NULL;
 
     for (i = 0; moduli[i] != NULL; i++) {
-	if (heim_integer_cmp(&moduli[i]->g, g) == 0 &&
-	    heim_integer_cmp(&moduli[i]->p, p) == 0 &&
-	    (q == NULL || heim_integer_cmp(&moduli[i]->q, q) == 0))
+	if (der_heim_integer_cmp(&moduli[i]->g, g) == 0 &&
+	    der_heim_integer_cmp(&moduli[i]->p, p) == 0 &&
+	    (q == NULL || der_heim_integer_cmp(&moduli[i]->q, q) == 0))
 	{
 	    if (bits && bits > moduli[i]->bits) {
 		krb5_set_error_string(context, "PKINIT: DH group parameter %s "
diff --git a/lib/krb5/ticket.c b/lib/krb5/ticket.c
index d7a3c19fc..8db06ed34 100644
--- a/lib/krb5/ticket.c
+++ b/lib/krb5/ticket.c
@@ -124,7 +124,7 @@ find_type_in_ad(krb5_context context,
      */
     for (i = 0; i < ad->len; i++) {
 	if (!*found && ad->val[i].ad_type == type) {
-	    ret = copy_octet_string(&ad->val[i].ad_data, data);
+	    ret = der_copy_octet_string(&ad->val[i].ad_data, data);
 	    if (ret) {
 		krb5_set_error_string(context, "malloc - out of memory");
 		goto out;