diff --git a/include/mbedtls/pkcs5.h b/include/mbedtls/pkcs5.h
index 6a21af10b..5a765e02b 100644
--- a/include/mbedtls/pkcs5.h
+++ b/include/mbedtls/pkcs5.h
@@ -63,7 +63,7 @@ extern "C" {
  *
  * \returns        0 on success, or a POLARSSL_ERR_xxx code if verification fails.
  */
-int pkcs5_pbes2( asn1_buf *pbe_params, int mode,
+int pkcs5_pbes2( const asn1_buf *pbe_params, int mode,
                  const unsigned char *pwd,  size_t pwdlen,
                  const unsigned char *data, size_t datalen,
                  unsigned char *output );
diff --git a/library/pkcs5.c b/library/pkcs5.c
index 12ec5ea27..79d67e9a5 100644
--- a/library/pkcs5.c
+++ b/library/pkcs5.c
@@ -109,7 +109,7 @@ static int pkcs5_parse_pbkdf2_params( const asn1_buf *params,
     return( 0 );
 }
 
-int pkcs5_pbes2( asn1_buf *pbe_params, int mode,
+int pkcs5_pbes2( const asn1_buf *pbe_params, int mode,
                  const unsigned char *pwd,  size_t pwdlen,
                  const unsigned char *data, size_t datalen,
                  unsigned char *output )