diff --git a/import.c b/import.c
index 13243f2e..5d7bf88a 100644
--- a/import.c
+++ b/import.c
@@ -602,14 +602,14 @@ struct ssh2_userkey *openssh_pem_read(const Filename *filename,
         unsigned char keybuf[32];
 
         MD5Init(&md5c);
-        MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-        MD5Update(&md5c, (unsigned char *)key->iv, 8);
+        put_data(&md5c, passphrase, strlen(passphrase));
+        put_data(&md5c, key->iv, 8);
         MD5Final(keybuf, &md5c);
 
         MD5Init(&md5c);
-        MD5Update(&md5c, keybuf, 16);
-        MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-        MD5Update(&md5c, (unsigned char *)key->iv, 8);
+        put_data(&md5c, keybuf, 16);
+        put_data(&md5c, passphrase, strlen(passphrase));
+        put_data(&md5c, key->iv, 8);
         MD5Final(keybuf+16, &md5c);
 
         /*
@@ -1201,14 +1201,14 @@ int openssh_pem_write(const Filename *filename, struct ssh2_userkey *key,
 	for (i = 0; i < 8; i++) iv[i] = random_byte();
 
 	MD5Init(&md5c);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-	MD5Update(&md5c, iv, 8);
+	put_data(&md5c, passphrase, strlen(passphrase));
+	put_data(&md5c, iv, 8);
 	MD5Final(keybuf, &md5c);
 
 	MD5Init(&md5c);
-	MD5Update(&md5c, keybuf, 16);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-	MD5Update(&md5c, iv, 8);
+	put_data(&md5c, keybuf, 16);
+	put_data(&md5c, passphrase, strlen(passphrase));
+	put_data(&md5c, iv, 8);
 	MD5Final(keybuf+16, &md5c);
 
 	/*
@@ -2362,12 +2362,12 @@ struct ssh2_userkey *sshcom_read(const Filename *filename, char *passphrase,
         }
 
 	MD5Init(&md5c);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
+	put_data(&md5c, passphrase, strlen(passphrase));
 	MD5Final(keybuf, &md5c);
 
 	MD5Init(&md5c);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-	MD5Update(&md5c, keybuf, 16);
+	put_data(&md5c, passphrase, strlen(passphrase));
+	put_data(&md5c, keybuf, 16);
 	MD5Final(keybuf+16, &md5c);
 
 	/*
@@ -2646,12 +2646,12 @@ int sshcom_write(const Filename *filename, struct ssh2_userkey *key,
 	unsigned char keybuf[32], iv[8];
 
 	MD5Init(&md5c);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
+	put_data(&md5c, passphrase, strlen(passphrase));
 	MD5Final(keybuf, &md5c);
 
 	MD5Init(&md5c);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-	MD5Update(&md5c, keybuf, 16);
+	put_data(&md5c, passphrase, strlen(passphrase));
+	put_data(&md5c, keybuf, 16);
 	MD5Final(keybuf+16, &md5c);
 
 	/*
diff --git a/pageant.c b/pageant.c
index 1a5690e5..c3446a89 100644
--- a/pageant.c
+++ b/pageant.c
@@ -452,7 +452,7 @@ void *pageant_handle_msg(const void *msg, int msglen, int *outlen,
 		response_source[i] = bignum_byte(response, 31 - i);
 
 	    MD5Init(&md5c);
-	    MD5Update(&md5c, response_source, 48);
+	    put_data(&md5c, response_source, 48);
 	    MD5Final(response_md5, &md5c);
 	    smemclr(response_source, 48);	/* burn the evidence */
 	    freebn(response);	       /* and that evidence */
diff --git a/ssh.c b/ssh.c
index 552b1cce..d6d0701f 100644
--- a/ssh.c
+++ b/ssh.c
@@ -4349,9 +4349,9 @@ static void do_ssh1_login(void *vctx)
     ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
 
     MD5Init(&md5c);
-    MD5Update(&md5c, s->keystr2, s->hostkey.bytes);
-    MD5Update(&md5c, s->keystr1, s->servkey.bytes);
-    MD5Update(&md5c, s->cookie, 8);
+    put_data(&md5c, s->keystr2, s->hostkey.bytes);
+    put_data(&md5c, s->keystr1, s->servkey.bytes);
+    put_data(&md5c, s->cookie, 8);
     MD5Final(s->session_id, &md5c);
 
     for (i = 0; i < 32; i++)
@@ -4950,8 +4950,8 @@ static void do_ssh1_login(void *vctx)
 		    }
 
 		    MD5Init(&md5c);
-		    MD5Update(&md5c, buffer, 32);
-		    MD5Update(&md5c, s->session_id, 16);
+		    put_data(&md5c, buffer, 32);
+		    put_data(&md5c, s->session_id, 16);
 		    MD5Final(buffer, &md5c);
 
 		    send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
diff --git a/ssh.h b/ssh.h
index 3919a0c7..7b6751f0 100644
--- a/ssh.h
+++ b/ssh.h
@@ -254,8 +254,6 @@ struct MD5Context {
 };
 
 void MD5Init(struct MD5Context *context);
-void MD5Update(struct MD5Context *context, unsigned char const *buf,
-	       unsigned len);
 void MD5Final(unsigned char digest[16], struct MD5Context *context);
 void MD5Simple(void const *p, unsigned len, unsigned char output[16]);
 
@@ -276,7 +274,6 @@ typedef struct SHA_State {
     BinarySink_IMPLEMENTATION;
 } SHA_State;
 void SHA_Init(SHA_State * s);
-void SHA_Bytes(SHA_State * s, const void *p, int len);
 void SHA_Final(SHA_State * s, unsigned char *output);
 void SHA_Simple(const void *p, int len, unsigned char *output);
 
@@ -291,7 +288,6 @@ typedef struct SHA256_State {
     BinarySink_IMPLEMENTATION;
 } SHA256_State;
 void SHA256_Init(SHA256_State * s);
-void SHA256_Bytes(SHA256_State * s, const void *p, int len);
 void SHA256_Final(SHA256_State * s, unsigned char *output);
 void SHA256_Simple(const void *p, int len, unsigned char *output);
 
@@ -304,11 +300,9 @@ typedef struct {
 } SHA512_State;
 #define SHA384_State SHA512_State
 void SHA512_Init(SHA512_State * s);
-void SHA512_Bytes(SHA512_State * s, const void *p, int len);
 void SHA512_Final(SHA512_State * s, unsigned char *output);
 void SHA512_Simple(const void *p, int len, unsigned char *output);
 void SHA384_Init(SHA384_State * s);
-#define SHA384_Bytes(s, p, len) SHA512_Bytes(s, p, len)
 void SHA384_Final(SHA384_State * s, unsigned char *output);
 void SHA384_Simple(const void *p, int len, unsigned char *output);
 
diff --git a/sshbcrypt.c b/sshbcrypt.c
index a6c163c6..c4584618 100644
--- a/sshbcrypt.c
+++ b/sshbcrypt.c
@@ -56,16 +56,13 @@ void bcrypt_genblock(int counter,
 {
     SHA512_State shastate;
     unsigned char hashed_salt[64];
-    unsigned char countbuf[4];
 
     /* Hash the input salt with the counter value optionally suffixed
      * to get our real 32-byte salt */
     SHA512_Init(&shastate);
-    SHA512_Bytes(&shastate, salt, saltbytes);
-    if (counter) {
-        PUT_32BIT_MSB_FIRST(countbuf, counter);
-        SHA512_Bytes(&shastate, countbuf, 4);
-    }
+    put_data(&shastate, salt, saltbytes);
+    if (counter)
+        put_uint32(&shastate, counter);
     SHA512_Final(&shastate, hashed_salt);
 
     bcrypt_hash(hashed_passphrase, 64, hashed_salt, 64, output);
diff --git a/sshdss.c b/sshdss.c
index ffe7157e..02d7fc63 100644
--- a/sshdss.c
+++ b/sshdss.c
@@ -540,7 +540,7 @@ Bignum *dss_gen_k(const char *id_string, Bignum modulus, Bignum private_key,
      * Hash some identifying text plus x.
      */
     SHA512_Init(&ss);
-    SHA512_Bytes(&ss, id_string, strlen(id_string) + 1);
+    put_asciz(&ss, id_string);
     put_mp_ssh2(&ss, private_key);
     SHA512_Final(&ss, digest512);
 
@@ -548,8 +548,8 @@ Bignum *dss_gen_k(const char *id_string, Bignum modulus, Bignum private_key,
      * Now hash that digest plus the message hash.
      */
     SHA512_Init(&ss);
-    SHA512_Bytes(&ss, digest512, sizeof(digest512));
-    SHA512_Bytes(&ss, digest, digest_len);
+    put_data(&ss, digest512, sizeof(digest512));
+    put_data(&ss, digest, digest_len);
 
     while (1) {
         SHA512_State ss2 = ss;         /* structure copy */
@@ -573,7 +573,7 @@ Bignum *dss_gen_k(const char *id_string, Bignum modulus, Bignum private_key,
         /* Very unlikely we get here, but if so, k was unsuitable. */
         freebn(k);
         /* Perturb the hash to think of a different k. */
-        SHA512_Bytes(&ss, "x", 1);
+        put_byte(&ss, 'x');
         /* Go round and try again. */
     }
 }
diff --git a/sshecc.c b/sshecc.c
index e1166827..64375966 100644
--- a/sshecc.c
+++ b/sshecc.c
@@ -1421,10 +1421,8 @@ struct ec_point *ec_public(const Bignum privateKey, const struct ec_curve *curve
         SHA512_Init(&s);
 
         keylen = curve->fieldBits / 8;
-        for (i = 0; i < keylen; ++i) {
-            unsigned char b = bignum_byte(privateKey, i);
-            SHA512_Bytes(&s, &b, 1);
-        }
+        for (i = 0; i < keylen; ++i)
+            put_byte(&s, bignum_byte(privateKey, i));
         SHA512_Final(&s, hash);
 
         /* The second part is simply turning the hash into a Bignum,
@@ -2298,27 +2296,25 @@ static int ecdsa_verifysig(void *key, const char *sig, int siglen,
         /* Get the hash of the encoded value of R + encoded value of pk + message */
         {
             int i, pointlen;
-            unsigned char b;
             unsigned char digest[512 / 8];
             SHA512_State hs;
             SHA512_Init(&hs);
 
-            /* Add encoded r (no need to encode it again, it was in the signature) */
-            SHA512_Bytes(&hs, p, ec->publicKey.curve->fieldBits / 8);
+            pointlen = ec->publicKey.curve->fieldBits / 8;
+
+            /* Add encoded r (no need to encode it again, it was in
+             * the signature) */
+            put_data(&hs, p, pointlen);
 
             /* Encode pk and add it */
-            pointlen = ec->publicKey.curve->fieldBits / 8;
-            for (i = 0; i < pointlen - 1; ++i) {
-                b = bignum_byte(ec->publicKey.y, i);
-                SHA512_Bytes(&hs, &b, 1);
-            }
+            for (i = 0; i < pointlen - 1; ++i)
+                put_byte(&hs, bignum_byte(ec->publicKey.y, i));
             /* Unset last bit of y and set first bit of x in its place */
-            b = bignum_byte(ec->publicKey.y, i) & 0x7f;
-            b |= bignum_bit(ec->publicKey.x, 0) << 7;
-            SHA512_Bytes(&hs, &b, 1);
+            put_byte(&hs, ((bignum_byte(ec->publicKey.y, i) & 0x7f) |
+                           (bignum_bit(ec->publicKey.x, 0) << 7)));
 
             /* Add the message itself */
-            SHA512_Bytes(&hs, data, datalen);
+            put_data(&hs, data, datalen);
 
             /* Get the hash */
             SHA512_Final(&hs, digest);
@@ -2425,15 +2421,12 @@ static unsigned char *ecdsa_sign(void *key, const char *data, int datalen,
          * S = (r + H(encodepoint(R) + encodepoint(pk) + m) * a) % l */
         {
             unsigned char hash[512/8];
-            unsigned char b;
             Bignum a;
             SHA512_State hs;
             SHA512_Init(&hs);
 
-            for (i = 0; i < pointlen; ++i) {
-                unsigned char b = (unsigned char)bignum_byte(ec->privateKey, i);
-                SHA512_Bytes(&hs, &b, 1);
-            }
+            for (i = 0; i < pointlen; ++i)
+                put_byte(&hs, bignum_byte(ec->privateKey, i));
 
             SHA512_Final(&hs, hash);
 
@@ -2447,11 +2440,10 @@ static unsigned char *ecdsa_sign(void *key, const char *data, int datalen,
             a = bignum_from_bytes_le(hash, 32);
 
             SHA512_Init(&hs);
-            SHA512_Bytes(&hs,
-                         hash+(ec->publicKey.curve->fieldBits / 8),
-                         (ec->publicKey.curve->fieldBits / 4)
-                         - (ec->publicKey.curve->fieldBits / 8));
-            SHA512_Bytes(&hs, data, datalen);
+            put_data(&hs, hash+(ec->publicKey.curve->fieldBits / 8),
+                     ((ec->publicKey.curve->fieldBits / 4) -
+                      (ec->publicKey.curve->fieldBits / 8)));
+            put_data(&hs, data, datalen);
             SHA512_Final(&hs, hash);
 
             r = bignum_from_bytes_le(hash, 512/8);
@@ -2465,27 +2457,21 @@ static unsigned char *ecdsa_sign(void *key, const char *data, int datalen,
             /* Now calculate s */
             SHA512_Init(&hs);
             /* Encode the point R */
-            for (i = 0; i < pointlen - 1; ++i) {
-                b = bignum_byte(rp->y, i);
-                SHA512_Bytes(&hs, &b, 1);
-            }
+            for (i = 0; i < pointlen - 1; ++i)
+                put_byte(&hs, bignum_byte(rp->y, i));
             /* Unset last bit of y and set first bit of x in its place */
-            b = bignum_byte(rp->y, i) & 0x7f;
-            b |= bignum_bit(rp->x, 0) << 7;
-            SHA512_Bytes(&hs, &b, 1);
+            put_byte(&hs, ((bignum_byte(rp->y, i) & 0x7f) |
+                           (bignum_bit(rp->x, 0) << 7)));
 
             /* Encode the point pk */
-            for (i = 0; i < pointlen - 1; ++i) {
-                b = bignum_byte(ec->publicKey.y, i);
-                SHA512_Bytes(&hs, &b, 1);
-            }
+            for (i = 0; i < pointlen - 1; ++i)
+                put_byte(&hs, bignum_byte(ec->publicKey.y, i));
             /* Unset last bit of y and set first bit of x in its place */
-            b = bignum_byte(ec->publicKey.y, i) & 0x7f;
-            b |= bignum_bit(ec->publicKey.x, 0) << 7;
-            SHA512_Bytes(&hs, &b, 1);
+            put_byte(&hs, ((bignum_byte(ec->publicKey.y, i) & 0x7f) |
+                           (bignum_bit(ec->publicKey.x, 0) << 7)));
 
             /* Add the message */
-            SHA512_Bytes(&hs, data, datalen);
+            put_data(&hs, data, datalen);
             SHA512_Final(&hs, hash);
 
             {
diff --git a/sshmd5.c b/sshmd5.c
index 1fe14959..67f776ad 100644
--- a/sshmd5.c
+++ b/sshmd5.c
@@ -1,3 +1,4 @@
+#include <assert.h>
 #include "ssh.h"
 
 /*
@@ -115,12 +116,7 @@ static void MD5_Block(MD5_Core_State * s, uint32 * block)
 
 #define BLKSIZE 64
 
-static void MD5_BinarySink_write(BinarySink *bs,
-                              const void *data, size_t len)
-{
-    struct MD5Context *s = BinarySink_DOWNCAST(bs, struct MD5Context);
-    MD5Update(s, data, len);
-}
+static void MD5_BinarySink_write(BinarySink *bs, const void *data, size_t len);
 
 void MD5Init(struct MD5Context *s)
 {
@@ -130,13 +126,16 @@ void MD5Init(struct MD5Context *s)
     BinarySink_INIT(s, MD5_BinarySink_write);
 }
 
-void MD5Update(struct MD5Context *s, unsigned char const *p, unsigned len)
+static void MD5_BinarySink_write(BinarySink *bs, const void *data, size_t len)
 {
-    unsigned char *q = (unsigned char *) p;
+    struct MD5Context *s = BinarySink_DOWNCAST(bs, struct MD5Context);
+    const unsigned char *q = (const unsigned char *)data;
     uint32 wordblock[16];
     uint32 lenw = len;
     int i;
 
+    assert(lenw == len);
+
     /*
      * Update the length field.
      */
@@ -190,7 +189,7 @@ void MD5Final(unsigned char output[16], struct MD5Context *s)
 
     memset(c, 0, pad);
     c[0] = 0x80;
-    MD5Update(s, c, pad);
+    put_data(s, c, pad);
 
     c[7] = (lenhi >> 24) & 0xFF;
     c[6] = (lenhi >> 16) & 0xFF;
@@ -201,7 +200,7 @@ void MD5Final(unsigned char output[16], struct MD5Context *s)
     c[1] = (lenlo >> 8) & 0xFF;
     c[0] = (lenlo >> 0) & 0xFF;
 
-    MD5Update(s, c, 8);
+    put_data(s, c, 8);
 
     for (i = 0; i < 4; i++) {
 	output[4 * i + 3] = (s->core.h[i] >> 24) & 0xFF;
@@ -216,7 +215,7 @@ void MD5Simple(void const *p, unsigned len, unsigned char output[16])
     struct MD5Context s;
 
     MD5Init(&s);
-    MD5Update(&s, (unsigned char const *)p, len);
+    put_data(&s, (unsigned char const *)p, len);
     MD5Final(output, &s);
     smemclr(&s, sizeof(s));
 }
@@ -251,13 +250,13 @@ void hmacmd5_key(void *handle, void const *keyv, int len)
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
     MD5Init(&keys[0]);
-    MD5Update(&keys[0], foo, 64);
+    put_data(&keys[0], foo, 64);
 
     memset(foo, 0x5C, 64);
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
     MD5Init(&keys[1]);
-    MD5Update(&keys[1], foo, 64);
+    put_data(&keys[1], foo, 64);
 
     smemclr(foo, 64);		       /* burn the evidence */
 }
@@ -278,7 +277,7 @@ static void hmacmd5_start(void *handle)
 static void hmacmd5_bytes(void *handle, unsigned char const *blk, int len)
 {
     struct MD5Context *keys = (struct MD5Context *)handle;
-    MD5Update(&keys[2], blk, len);
+    put_data(&keys[2], blk, len);
 }
 
 static void hmacmd5_genresult(void *handle, unsigned char *hmac)
@@ -292,7 +291,7 @@ static void hmacmd5_genresult(void *handle, unsigned char *hmac)
     MD5Final(intermediate, &s);
     s = keys[1];		       /* structure copy */
     BinarySink_COPIED(&s);
-    MD5Update(&s, intermediate, 16);
+    put_data(&s, intermediate, 16);
     MD5Final(hmac, &s);
 }
 
diff --git a/sshpubk.c b/sshpubk.c
index 1198a009..4b4264ca 100644
--- a/sshpubk.c
+++ b/sshpubk.c
@@ -108,7 +108,7 @@ static int rsa_ssh1_load_main(FILE * fp, struct RSAKey *key, int pub_only,
      */
     if (ciphertype) {
 	MD5Init(&md5c);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
+	put_data(&md5c, passphrase, strlen(passphrase));
 	MD5Final(keybuf, &md5c);
 	des3_decrypt_pubkey(keybuf, buf + i, (len - i + 7) & ~7);
 	smemclr(keybuf, sizeof(keybuf));	/* burn the evidence */
@@ -412,7 +412,7 @@ int rsa_ssh1_savekey(const Filename *filename, struct RSAKey *key,
      */
     if (passphrase) {
 	MD5Init(&md5c);
-	MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
+	put_data(&md5c, passphrase, strlen(passphrase));
 	MD5Final(keybuf, &md5c);
 	des3_encrypt_pubkey(keybuf, estart, p - estart);
 	smemclr(keybuf, sizeof(keybuf));	/* burn the evidence */
@@ -761,12 +761,12 @@ struct ssh2_userkey *ssh2_load_userkey(const Filename *filename,
 	    goto error;
 
 	SHA_Init(&s);
-	SHA_Bytes(&s, "\0\0\0\0", 4);
-	SHA_Bytes(&s, passphrase, passlen);
+	put_uint32(&s, 0);
+	put_data(&s, passphrase, passlen);
 	SHA_Final(&s, key + 0);
 	SHA_Init(&s);
-	SHA_Bytes(&s, "\0\0\0\1", 4);
-	SHA_Bytes(&s, passphrase, passlen);
+	put_uint32(&s, 1);
+	put_data(&s, passphrase, passlen);
 	SHA_Final(&s, key + 20);
 	aes256_decrypt_pubkey(key, private_blob, private_blob_len);
     }
@@ -814,9 +814,9 @@ struct ssh2_userkey *ssh2_load_userkey(const Filename *filename,
 	    char header[] = "putty-private-key-file-mac-key";
 
 	    SHA_Init(&s);
-	    SHA_Bytes(&s, header, sizeof(header)-1);
+	    put_data(&s, header, sizeof(header)-1);
 	    if (cipher && passphrase)
-		SHA_Bytes(&s, passphrase, passlen);
+		put_data(&s, passphrase, passlen);
 	    SHA_Final(&s, mackey);
 
 	    hmac_sha1_simple(mackey, 20, macdata, maclen, binary);
@@ -1377,9 +1377,9 @@ int ssh2_save_userkey(const Filename *filename, struct ssh2_userkey *key,
 	DO_STR(priv_blob_encrypted, priv_encrypted_len);
 
 	SHA_Init(&s);
-	SHA_Bytes(&s, header, sizeof(header)-1);
+	put_data(&s, header, sizeof(header)-1);
 	if (passphrase)
-	    SHA_Bytes(&s, passphrase, strlen(passphrase));
+	    put_data(&s, passphrase, strlen(passphrase));
 	SHA_Final(&s, mackey);
 	hmac_sha1_simple(mackey, 20, macdata, maclen, priv_mac);
 	smemclr(macdata, maclen);
@@ -1395,12 +1395,12 @@ int ssh2_save_userkey(const Filename *filename, struct ssh2_userkey *key,
 	passlen = strlen(passphrase);
 
 	SHA_Init(&s);
-	SHA_Bytes(&s, "\0\0\0\0", 4);
-	SHA_Bytes(&s, passphrase, passlen);
+	put_uint32(&s, 0);
+	put_data(&s, passphrase, passlen);
 	SHA_Final(&s, key + 0);
 	SHA_Init(&s);
-	SHA_Bytes(&s, "\0\0\0\1", 4);
-	SHA_Bytes(&s, passphrase, passlen);
+	put_uint32(&s, 1);
+	put_data(&s, passphrase, passlen);
 	SHA_Final(&s, key + 20);
 	aes256_encrypt_pubkey(key, priv_blob_encrypted,
 			      priv_encrypted_len);
diff --git a/sshrsa.c b/sshrsa.c
index 39936bcd..a9c11f54 100644
--- a/sshrsa.c
+++ b/sshrsa.c
@@ -219,7 +219,7 @@ static Bignum rsa_privkey_op(Bignum input, struct RSAKey *key)
 		 */
 		if (digestused >= lenof(digest512)) {
 		    SHA512_Init(&ss);
-		    SHA512_Bytes(&ss, "RSA deterministic blinding", 26);
+		    put_data(&ss, "RSA deterministic blinding", 26);
 		    put_uint32(&ss, hashseq);
 		    put_mp_ssh2(&ss, key->private_exponent);
 		    SHA512_Final(&ss, digest512);
@@ -230,7 +230,7 @@ static Bignum rsa_privkey_op(Bignum input, struct RSAKey *key)
 		     * input.
 		     */
 		    SHA512_Init(&ss);
-		    SHA512_Bytes(&ss, digest512, sizeof(digest512));
+		    put_data(&ss, digest512, sizeof(digest512));
 		    put_mp_ssh2(&ss, input);
 		    SHA512_Final(&ss, digest512);
 
@@ -351,19 +351,11 @@ void rsa_fingerprint(char *str, int len, struct RSAKey *key)
     struct MD5Context md5c;
     unsigned char digest[16];
     char buffer[16 * 3 + 40];
-    int numlen, slen, i;
+    int slen, i;
 
     MD5Init(&md5c);
-    numlen = ssh1_bignum_length(key->modulus) - 2;
-    for (i = numlen; i--;) {
-	unsigned char c = bignum_byte(key->modulus, i);
-	MD5Update(&md5c, &c, 1);
-    }
-    numlen = ssh1_bignum_length(key->exponent) - 2;
-    for (i = numlen; i--;) {
-	unsigned char c = bignum_byte(key->exponent, i);
-	MD5Update(&md5c, &c, 1);
-    }
+    put_mp_ssh1(&md5c, key->modulus);
+    put_mp_ssh1(&md5c, key->exponent);
     MD5Final(digest, &md5c);
 
     sprintf(buffer, "%d ", bignum_bitcount(key->modulus));
diff --git a/sshsh256.c b/sshsh256.c
index cd9f8fe3..67fe329e 100644
--- a/sshsh256.c
+++ b/sshsh256.c
@@ -98,11 +98,7 @@ void SHA256_Block(SHA256_State *s, uint32 *block) {
 #define BLKSIZE 64
 
 static void SHA256_BinarySink_write(BinarySink *bs,
-                                 const void *data, size_t len)
-{
-    struct SHA256_State *s = BinarySink_DOWNCAST(bs, struct SHA256_State);
-    SHA256_Bytes(s, data, len);
-}
+                                    const void *p, size_t len);
 
 void SHA256_Init(SHA256_State *s) {
     SHA256_Core_Init(s);
@@ -115,9 +111,14 @@ void SHA256_Init(SHA256_State *s) {
     BinarySink_INIT(s, SHA256_BinarySink_write);
 }
 
-void SHA256_Bytes(SHA256_State *s, const void *p, int len) {
+static void SHA256_BinarySink_write(BinarySink *bs,
+                                    const void *p, size_t len)
+{
+    struct SHA256_State *s = BinarySink_DOWNCAST(bs, struct SHA256_State);
     unsigned char *q = (unsigned char *)p;
+
     uint32 lenw = len;
+    assert(len == lenw);
 
     /*
      * Update the length field.
@@ -177,18 +178,10 @@ void SHA256_Final(SHA256_State *s, unsigned char *digest) {
 
     memset(c, 0, pad);
     c[0] = 0x80;
-    SHA256_Bytes(s, &c, pad);
+    put_data(s, &c, pad);
 
-    c[0] = (lenhi >> 24) & 0xFF;
-    c[1] = (lenhi >> 16) & 0xFF;
-    c[2] = (lenhi >>  8) & 0xFF;
-    c[3] = (lenhi >>  0) & 0xFF;
-    c[4] = (lenlo >> 24) & 0xFF;
-    c[5] = (lenlo >> 16) & 0xFF;
-    c[6] = (lenlo >>  8) & 0xFF;
-    c[7] = (lenlo >>  0) & 0xFF;
-
-    SHA256_Bytes(s, &c, 8);
+    put_uint32(s, lenhi);
+    put_uint32(s, lenlo);
 
     for (i = 0; i < 8; i++) {
 	digest[i*4+0] = (s->h[i] >> 24) & 0xFF;
@@ -202,7 +195,7 @@ void SHA256_Simple(const void *p, int len, unsigned char *output) {
     SHA256_State s;
 
     SHA256_Init(&s);
-    SHA256_Bytes(&s, p, len);
+    put_data(&s, p, len);
     SHA256_Final(&s, output);
     smemclr(&s, sizeof(s));
 }
@@ -243,7 +236,7 @@ static void sha256_bytes(void *handle, const void *p, int len)
 {
     SHA256_State *s = handle;
 
-    SHA256_Bytes(s, p, len);
+    put_data(s, p, len);
 }
 
 static void sha256_final(void *handle, unsigned char *output)
@@ -285,13 +278,13 @@ static void sha256_key_internal(void *handle, unsigned char *key, int len)
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
     SHA256_Init(&keys[0]);
-    SHA256_Bytes(&keys[0], foo, 64);
+    put_data(&keys[0], foo, 64);
 
     memset(foo, 0x5C, 64);
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
     SHA256_Init(&keys[1]);
-    SHA256_Bytes(&keys[1], foo, 64);
+    put_data(&keys[1], foo, 64);
 
     smemclr(foo, 64);		       /* burn the evidence */
 }
@@ -312,7 +305,7 @@ static void hmacsha256_start(void *handle)
 static void hmacsha256_bytes(void *handle, unsigned char const *blk, int len)
 {
     SHA256_State *keys = (SHA256_State *)handle;
-    SHA256_Bytes(&keys[2], (void *)blk, len);
+    put_data(&keys[2], blk, len);
 }
 
 static void hmacsha256_genresult(void *handle, unsigned char *hmac)
@@ -326,7 +319,7 @@ static void hmacsha256_genresult(void *handle, unsigned char *hmac)
     SHA256_Final(&s, intermediate);
     s = keys[1];		       /* structure copy */
     BinarySink_COPIED(&s);
-    SHA256_Bytes(&s, intermediate, 32);
+    put_data(&s, intermediate, 32);
     SHA256_Final(&s, hmac);
 }
 
diff --git a/sshsh512.c b/sshsh512.c
index 975bb3c9..8878d33a 100644
--- a/sshsh512.c
+++ b/sshsh512.c
@@ -6,6 +6,7 @@
  * Modifications made for SHA-384 also
  */
 
+#include <assert.h>
 #include "ssh.h"
 
 #define BLKSIZE 128
@@ -186,11 +187,7 @@ static void SHA512_Block(SHA512_State *s, uint64 *block) {
  */
 
 static void SHA512_BinarySink_write(BinarySink *bs,
-                                 const void *data, size_t len)
-{
-    SHA512_State *s = BinarySink_DOWNCAST(bs, SHA512_State);
-    SHA512_Bytes(s, data, len);
-}
+                                    const void *p, size_t len);
 
 void SHA512_Init(SHA512_State *s) {
     int i;
@@ -210,12 +207,17 @@ void SHA384_Init(SHA512_State *s) {
     BinarySink_INIT(s, SHA512_BinarySink_write);
 }
 
-void SHA512_Bytes(SHA512_State *s, const void *p, int len) {
+static void SHA512_BinarySink_write(BinarySink *bs,
+                                    const void *p, size_t len)
+{
+    SHA512_State *s = BinarySink_DOWNCAST(bs, SHA512_State);
     unsigned char *q = (unsigned char *)p;
     uint64 wordblock[16];
     uint32 lenw = len;
     int i;
 
+    assert(lenw == len);
+
     /*
      * Update the length field.
      */
@@ -278,16 +280,10 @@ void SHA512_Final(SHA512_State *s, unsigned char *digest) {
 
     memset(c, 0, pad);
     c[0] = 0x80;
-    SHA512_Bytes(s, &c, pad);
+    put_data(s, &c, pad);
 
-    for (i = 0; i < 4; i++) {
-	c[i*4+0] = (len[3-i] >> 24) & 0xFF;
-	c[i*4+1] = (len[3-i] >> 16) & 0xFF;
-	c[i*4+2] = (len[3-i] >>  8) & 0xFF;
-	c[i*4+3] = (len[3-i] >>  0) & 0xFF;
-    }
-
-    SHA512_Bytes(s, &c, 16);
+    for (i = 0; i < 4; i++)
+        put_uint32(s, len[3-i]);
 
     for (i = 0; i < 8; i++) {
 	uint32 h, l;
@@ -313,7 +309,7 @@ void SHA512_Simple(const void *p, int len, unsigned char *output) {
     SHA512_State s;
 
     SHA512_Init(&s);
-    SHA512_Bytes(&s, p, len);
+    put_data(&s, p, len);
     SHA512_Final(&s, output);
     smemclr(&s, sizeof(s));
 }
@@ -322,7 +318,7 @@ void SHA384_Simple(const void *p, int len, unsigned char *output) {
     SHA512_State s;
 
     SHA384_Init(&s);
-    SHA512_Bytes(&s, p, len);
+    put_data(&s, p, len);
     SHA384_Final(&s, output);
     smemclr(&s, sizeof(s));
 }
@@ -363,7 +359,7 @@ static void sha512_bytes(void *handle, const void *p, int len)
 {
     SHA512_State *s = handle;
 
-    SHA512_Bytes(s, p, len);
+    put_data(s, p, len);
 }
 
 static void sha512_final(void *handle, unsigned char *output)
@@ -460,8 +456,7 @@ int main(void) {
 	    int n;
 	    SHA512_Init(&s);
 	    for (n = 0; n < 1000000 / 40; n++)
-		SHA512_Bytes(&s, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-			     40);
+		put_data(&s, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 40);
 	    SHA512_Final(&s, digest);
 	}
 	for (j = 0; j < 64; j++) {
diff --git a/sshsha.c b/sshsha.c
index 164202fd..7558497b 100644
--- a/sshsha.c
+++ b/sshsha.c
@@ -124,12 +124,7 @@ void SHATransform(word32 * digest, word32 * block)
  * the end, and pass those blocks to the core SHA algorithm.
  */
 
-static void SHA_BinarySink_write(BinarySink *bs,
-                              const void *data, size_t len)
-{
-    struct SHA_State *s = BinarySink_DOWNCAST(bs, struct SHA_State);
-    SHA_Bytes(s, data, len);
-}
+static void SHA_BinarySink_write(BinarySink *bs, const void *p, size_t len);
 
 void SHA_Init(SHA_State * s)
 {
@@ -143,10 +138,12 @@ void SHA_Init(SHA_State * s)
     BinarySink_INIT(s, SHA_BinarySink_write);
 }
 
-void SHA_Bytes(SHA_State * s, const void *p, int len)
+static void SHA_BinarySink_write(BinarySink *bs, const void *p, size_t len)
 {
+    struct SHA_State *s = BinarySink_DOWNCAST(bs, struct SHA_State);
     const unsigned char *q = (const unsigned char *) p;
     uint32 lenw = len;
+    assert(lenw == len);
 
     /*
      * Update the length field.
@@ -208,18 +205,10 @@ void SHA_Final(SHA_State * s, unsigned char *output)
 
     memset(c, 0, pad);
     c[0] = 0x80;
-    SHA_Bytes(s, &c, pad);
+    put_data(s, &c, pad);
 
-    c[0] = (lenhi >> 24) & 0xFF;
-    c[1] = (lenhi >> 16) & 0xFF;
-    c[2] = (lenhi >> 8) & 0xFF;
-    c[3] = (lenhi >> 0) & 0xFF;
-    c[4] = (lenlo >> 24) & 0xFF;
-    c[5] = (lenlo >> 16) & 0xFF;
-    c[6] = (lenlo >> 8) & 0xFF;
-    c[7] = (lenlo >> 0) & 0xFF;
-
-    SHA_Bytes(s, &c, 8);
+    put_uint32(s, lenhi);
+    put_uint32(s, lenlo);
 
     for (i = 0; i < 5; i++) {
 	output[i * 4] = (s->h[i] >> 24) & 0xFF;
@@ -234,7 +223,7 @@ void SHA_Simple(const void *p, int len, unsigned char *output)
     SHA_State s;
 
     SHA_Init(&s);
-    SHA_Bytes(&s, p, len);
+    put_data(&s, p, len);
     SHA_Final(&s, output);
     smemclr(&s, sizeof(s));
 }
@@ -275,7 +264,7 @@ static void sha1_bytes(void *handle, const void *p, int len)
 {
     SHA_State *s = handle;
 
-    SHA_Bytes(s, p, len);
+    put_data(s, p, len);
 }
 
 static void sha1_final(void *handle, unsigned char *output)
@@ -316,13 +305,13 @@ static void sha1_key_internal(void *handle, unsigned char *key, int len)
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
     SHA_Init(&keys[0]);
-    SHA_Bytes(&keys[0], foo, 64);
+    put_data(&keys[0], foo, 64);
 
     memset(foo, 0x5C, 64);
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
     SHA_Init(&keys[1]);
-    SHA_Bytes(&keys[1], foo, 64);
+    put_data(&keys[1], foo, 64);
 
     smemclr(foo, 64);		       /* burn the evidence */
 }
@@ -348,7 +337,7 @@ static void hmacsha1_start(void *handle)
 static void hmacsha1_bytes(void *handle, unsigned char const *blk, int len)
 {
     SHA_State *keys = (SHA_State *)handle;
-    SHA_Bytes(&keys[2], (void *)blk, len);
+    put_data(&keys[2], blk, len);
 }
 
 static void hmacsha1_genresult(void *handle, unsigned char *hmac)
@@ -362,7 +351,7 @@ static void hmacsha1_genresult(void *handle, unsigned char *hmac)
     SHA_Final(&s, intermediate);
     s = keys[1];		       /* structure copy */
     BinarySink_COPIED(&s);
-    SHA_Bytes(&s, intermediate, 20);
+    put_data(&s, intermediate, 20);
     SHA_Final(&s, hmac);
 }
 
@@ -435,10 +424,10 @@ void hmac_sha1_simple(void *key, int keylen, void *data, int datalen,
     unsigned char intermediate[20];
 
     sha1_key_internal(states, key, keylen);
-    SHA_Bytes(&states[0], data, datalen);
+    put_data(&states[0], data, datalen);
     SHA_Final(&states[0], intermediate);
 
-    SHA_Bytes(&states[1], intermediate, 20);
+    put_data(&states[1], intermediate, 20);
     SHA_Final(&states[1], output);
 }
 
diff --git a/unix/uxshare.c b/unix/uxshare.c
index 9279a049..93de5e66 100644
--- a/unix/uxshare.c
+++ b/unix/uxshare.c
@@ -219,19 +219,12 @@ static char *make_dirname(const char *pi_name, char **logtext)
          */
         {
             SHA256_State sha;
-            unsigned len;
-            unsigned char lenbuf[4];
             unsigned char digest[32];
             char retbuf[65];
 
             SHA256_Init(&sha);
-            PUT_32BIT(lenbuf, SALT_SIZE);
-            SHA256_Bytes(&sha, lenbuf, 4);
-            SHA256_Bytes(&sha, saltbuf, SALT_SIZE);
-            len = strlen(pi_name);
-            PUT_32BIT(lenbuf, len);
-            SHA256_Bytes(&sha, lenbuf, 4);
-            SHA256_Bytes(&sha, pi_name, len);
+            put_string(&sha, saltbuf, SALT_SIZE);
+            put_stringz(&sha, pi_name);
             SHA256_Final(&sha, digest);
 
             /*
diff --git a/windows/winshare.c b/windows/winshare.c
index 56276045..3b81d06c 100644
--- a/windows/winshare.c
+++ b/windows/winshare.c
@@ -49,7 +49,6 @@ static char *obfuscate_name(const char *realname)
     char *cryptdata;
     int cryptlen;
     SHA256_State sha;
-    unsigned char lenbuf[4];
     unsigned char digest[32];
     char retbuf[65];
     int i;
@@ -90,9 +89,7 @@ static char *obfuscate_name(const char *realname)
      * so having got it back out of CryptProtectMemory we now hash it.
      */
     SHA256_Init(&sha);
-    PUT_32BIT_MSB_FIRST(lenbuf, cryptlen);
-    SHA256_Bytes(&sha, lenbuf, 4);
-    SHA256_Bytes(&sha, cryptdata, cryptlen);
+    put_string(&sha, cryptdata, cryptlen);
     SHA256_Final(&sha, digest);
 
     sfree(cryptdata);