diff --git a/ChangeLog b/ChangeLog
index 53cdc41d07e460a57601e88c25167508e11efa73..a7a4355f065984988f8a4724f891979411d0ecba 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2019-06-01  Niels Möller  <nisse@lysator.liu.se>
+
+	* cmac.h (struct cmac128_key): New struct.
+	* cmac.h (struct cmac128_ctx): Use struct cmac128_key.
+	* cmac.c (cmac128_set_key, cmac128_digest): Update accordingly.
+
 2019-05-12  Niels Möller  <nisse@lysator.liu.se>
 
 	Delete old libdes/openssl compatibility interface.
diff --git a/cmac.c b/cmac.c
index ed3b5eb8f613c7115f11ffada7f88c3608c79cf4..07d805f380e8ebaf8e7643a60dd16d1e075676c3 100644
--- a/cmac.c
+++ b/cmac.c
@@ -83,8 +83,8 @@ cmac128_set_key(struct cmac128_ctx *ctx, const void *cipher,
   /* step 1 - generate subkeys k1 and k2 */
   encrypt(cipher, 16, L->b, const_zero);
 
-  block_mulx(&ctx->K1, L);
-  block_mulx(&ctx->K2, &ctx->K1);
+  block_mulx(&ctx->key.K1, L);
+  block_mulx(&ctx->key.K2, &ctx->key.K1);
 }
 
 #define MIN(x,y) ((x)<(y)?(x):(y))
@@ -148,11 +148,11 @@ cmac128_digest(struct cmac128_ctx *ctx, const void *cipher,
   if (ctx->index < 16)
     {
       ctx->block.b[ctx->index] = 0x80;
-      memxor(ctx->block.b, ctx->K2.b, 16);
+      memxor(ctx->block.b, ctx->key.K2.b, 16);
     }
   else
     {
-      memxor(ctx->block.b, ctx->K1.b, 16);
+      memxor(ctx->block.b, ctx->key.K1.b, 16);
     }
 
   memxor3(Y.b, ctx->block.b, ctx->X.b, 16);
diff --git a/cmac.h b/cmac.h
index 6d107982273e65cff175a4f578c37d9a5c0134e3..9d972ea5a9b0098bda92a3527573c9d1358a16ce 100644
--- a/cmac.h
+++ b/cmac.h
@@ -55,18 +55,22 @@ extern "C" {
 #define cmac_aes256_update nettle_cmac_aes256_update
 #define cmac_aes256_digest nettle_cmac_aes256_digest
 
-struct cmac128_ctx
+struct cmac128_key
 {
-  /* Key */
   union nettle_block16 K1;
   union nettle_block16 K2;
+};
+
+struct cmac128_ctx
+{
+  struct cmac128_key key;
 
   /* MAC state */
   union nettle_block16 X;
 
   /* Block buffer */
-  union nettle_block16 block;
   size_t index;
+  union nettle_block16 block;
 };
 
 void