diff --git a/kdc/digest.c b/kdc/digest.c
index 1e0201ba2..710d06b39 100644
--- a/kdc/digest.c
+++ b/kdc/digest.c
@@ -201,7 +201,7 @@ _kdc_do_digest(krb5_context context,
 	unsigned char server_nonce[16], identifier;
 
 	RAND_pseudo_bytes(&identifier, sizeof(identifier));
-	RAND_pseudo_bytes(&server_nonce, sizeof(server_nonce));
+	RAND_pseudo_bytes(server_nonce, sizeof(server_nonce));
 
 	server_nonce[0] = kdc_time & 0xff;
 	server_nonce[1] = (kdc_time >> 8) & 0xff;
@@ -488,7 +488,7 @@ _kdc_do_digest(krb5_context context,
 
 	if (strcasecmp(ireq.u.digestRequest.type, "CHAP") == 0) {
 	    MD5_CTX ctx;
-	    char md[MD5_DIGEST_LENGTH];
+	    unsigned char md[MD5_DIGEST_LENGTH];
 	    char id;
 
 	    if (ireq.u.digestRequest.identifier == NULL) {
@@ -519,7 +519,7 @@ _kdc_do_digest(krb5_context context,
 	    }
 	} else if (strcasecmp(ireq.u.digestRequest.type, "SASL-DIGEST-MD5") == 0) {
 	    MD5_CTX ctx;
-	    char md[MD5_DIGEST_LENGTH];
+	    unsigned char md[MD5_DIGEST_LENGTH];
 	    char *A1, *A2;
 
 	    if (ireq.u.digestRequest.nonceCount == NULL) 
diff --git a/kuser/kdigest.c b/kuser/kdigest.c
index 5ddf522a0..12be5cb97 100644
--- a/kuser/kdigest.c
+++ b/kuser/kdigest.c
@@ -167,7 +167,8 @@ client_request(struct client_request_options *opt, int argc, char **argv)
     char *server_nonce, server_identifier;
     ssize_t size;
     MD5_CTX ctx;
-    char md[16], *h;
+    unsigned char md[16];
+    char *h;
 
     if (opt->server_nonce_string == NULL)
 	errx(1, "server nonce missing");