diff --git a/sys/crypto/modes/ccm.c b/sys/crypto/modes/ccm.c
index 322a568fd3..c76088dc1b 100644
--- a/sys/crypto/modes/ccm.c
+++ b/sys/crypto/modes/ccm.c
@@ -34,8 +34,8 @@ static inline int min(int a, int b)
     }
 }
 
-static int ccm_compute_cbc_mac(cipher_t *cipher, const uint8_t iv[16],
-                        const uint8_t *input, size_t length, uint8_t *mac)
+static int ccm_compute_cbc_mac(const cipher_t *cipher, const uint8_t iv[16],
+                               const uint8_t *input, size_t length, uint8_t *mac)
 {
     uint8_t block_size, mac_enc[16] = { 0 };
     uint32_t offset;
@@ -70,9 +70,9 @@ static int ccm_compute_cbc_mac(cipher_t *cipher, const uint8_t iv[16],
 }
 
 
-static int ccm_create_mac_iv(cipher_t *cipher, uint8_t auth_data_len, uint8_t M,
-                      uint8_t L, const uint8_t *nonce, uint8_t nonce_len,
-                      size_t plaintext_len, uint8_t X1[16])
+static int ccm_create_mac_iv(const cipher_t *cipher, uint8_t auth_data_len, uint8_t M,
+                             uint8_t L, const uint8_t *nonce, uint8_t nonce_len,
+                             size_t plaintext_len, uint8_t X1[16])
 {
     uint8_t M_, L_;
 
@@ -106,8 +106,8 @@ static int ccm_create_mac_iv(cipher_t *cipher, uint8_t auth_data_len, uint8_t M,
     return 0;
 }
 
-static int ccm_compute_adata_mac(cipher_t *cipher, const uint8_t *auth_data,
-                          uint32_t auth_data_len, uint8_t X1[16])
+static int ccm_compute_adata_mac(const cipher_t *cipher, const uint8_t *auth_data,
+                                 uint32_t auth_data_len, uint8_t X1[16])
 {
     if (auth_data_len > 0) {
         int len;
@@ -174,7 +174,7 @@ static inline int _fits_in_nbytes(size_t value, uint8_t num_bytes)
 }
 
 
-int cipher_encrypt_ccm(cipher_t *cipher,
+int cipher_encrypt_ccm(const cipher_t *cipher,
                        const uint8_t *auth_data, uint32_t auth_data_len,
                        uint8_t mac_length, uint8_t length_encoding,
                        const uint8_t *nonce, size_t nonce_len,
@@ -240,7 +240,7 @@ int cipher_encrypt_ccm(cipher_t *cipher,
 }
 
 
-int cipher_decrypt_ccm(cipher_t *cipher,
+int cipher_decrypt_ccm(const cipher_t *cipher,
                        const uint8_t *auth_data, uint32_t auth_data_len,
                        uint8_t mac_length, uint8_t length_encoding,
                        const uint8_t *nonce, size_t nonce_len,
diff --git a/sys/include/crypto/modes/ccm.h b/sys/include/crypto/modes/ccm.h
index 12912132cb..68d7c4c542 100644
--- a/sys/include/crypto/modes/ccm.h
+++ b/sys/include/crypto/modes/ccm.h
@@ -69,7 +69,7 @@ extern "C" {
  *                         can be 0 if input_len=0 (no plaintext)
  * @return                 A negative error code if something went wrong
  */
-int cipher_encrypt_ccm(cipher_t *cipher,
+int cipher_encrypt_ccm(const cipher_t *cipher,
                        const uint8_t *auth_data, uint32_t auth_data_len,
                        uint8_t mac_length, uint8_t length_encoding,
                        const uint8_t *nonce, size_t nonce_len,
@@ -99,7 +99,7 @@ int cipher_encrypt_ccm(cipher_t *cipher,
  *                         can be 0 if only auth_data and MAC is present.
  * @return                 A negative error code if something went wrong
  */
-int cipher_decrypt_ccm(cipher_t *cipher,
+int cipher_decrypt_ccm(const cipher_t *cipher,
                        const uint8_t *auth_data, uint32_t auth_data_len,
                        uint8_t mac_length, uint8_t length_encoding,
                        const uint8_t *nonce, size_t nonce_len,