diff --git a/include/keymaster/km_openssl/ecdsa_operation.h b/include/keymaster/km_openssl/ecdsa_operation.h
index 6050784..4be0d2e 100644
--- a/include/keymaster/km_openssl/ecdsa_operation.h
+++ b/include/keymaster/km_openssl/ecdsa_operation.h
@@ -84,20 +84,20 @@
   private:
     KeyType registry_key() const override { return KeyType(KM_ALGORITHM_EC, purpose()); }
     OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                 keymaster_error_t* error) override;
+                                 keymaster_error_t* error) const override;
     const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
 
     virtual keymaster_purpose_t purpose() const = 0;
     virtual Operation* InstantiateOperation(AuthorizationSet&& hw_enforced,
                                             AuthorizationSet&& sw_enforced,
-                                            keymaster_digest_t digest, EVP_PKEY* key) = 0;
+                                            keymaster_digest_t digest, EVP_PKEY* key) const = 0;
 };
 
 class EcdsaSignOperationFactory : public EcdsaOperationFactory {
   private:
     keymaster_purpose_t purpose() const override { return KM_PURPOSE_SIGN; }
     Operation* InstantiateOperation(AuthorizationSet&& hw_enforced, AuthorizationSet&& sw_enforced,
-                                    keymaster_digest_t digest, EVP_PKEY* key) override {
+                                    keymaster_digest_t digest, EVP_PKEY* key) const override {
         return new (std::nothrow)
             EcdsaSignOperation(move(hw_enforced), move(sw_enforced), digest, key);
     }
@@ -107,7 +107,7 @@
   public:
     keymaster_purpose_t purpose() const override { return KM_PURPOSE_VERIFY; }
     Operation* InstantiateOperation(AuthorizationSet&& hw_enforced, AuthorizationSet&& sw_enforced,
-                                    keymaster_digest_t digest, EVP_PKEY* key) override {
+                                    keymaster_digest_t digest, EVP_PKEY* key) const override {
         return new (std::nothrow)
             EcdsaVerifyOperation(move(hw_enforced), move(sw_enforced), digest, key);
     }
diff --git a/include/keymaster/km_openssl/rsa_operation.h b/include/keymaster/km_openssl/rsa_operation.h
index 578a3d2..dd14b57 100644
--- a/include/keymaster/km_openssl/rsa_operation.h
+++ b/include/keymaster/km_openssl/rsa_operation.h
@@ -188,7 +188,7 @@
     virtual keymaster_purpose_t purpose() const = 0;
 
     OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                 keymaster_error_t* error) override {
+                                 keymaster_error_t* error) const override {
         return OperationPtr(CreateRsaOperation(move(key), begin_params, error));
     }
     const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
@@ -196,13 +196,14 @@
   protected:
     static EVP_PKEY* GetRsaKey(Key&& key, keymaster_error_t* error);
     virtual RsaOperation* CreateRsaOperation(Key&& key, const AuthorizationSet& begin_params,
-                                             keymaster_error_t* error);
+                                             keymaster_error_t* error) const;
 
   private:
     virtual RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
                                                AuthorizationSet&& sw_enforced,
                                                keymaster_digest_t digest,
-                                               keymaster_padding_t padding, EVP_PKEY* key) = 0;
+                                               keymaster_padding_t padding,
+                                               EVP_PKEY* key) const = 0;
 };
 
 /**
@@ -220,7 +221,7 @@
 class RsaCryptingOperationFactory : public RsaOperationFactory {
   public:
     RsaOperation* CreateRsaOperation(Key&& key, const AuthorizationSet& begin_params,
-                                     keymaster_error_t* error) override;
+                                     keymaster_error_t* error) const override;
     const keymaster_padding_t* SupportedPaddingModes(size_t* padding_mode_count) const override;
 };
 
@@ -232,7 +233,7 @@
     keymaster_purpose_t purpose() const override { return KM_PURPOSE_SIGN; }
     RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
                                        AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
-                                       keymaster_padding_t padding, EVP_PKEY* key) override {
+                                       keymaster_padding_t padding, EVP_PKEY* key) const override {
         return new (std::nothrow)
             RsaSignOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
     }
@@ -245,7 +246,7 @@
     keymaster_purpose_t purpose() const override { return KM_PURPOSE_VERIFY; }
     RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
                                        AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
-                                       keymaster_padding_t padding, EVP_PKEY* key) override {
+                                       keymaster_padding_t padding, EVP_PKEY* key) const override {
         return new (std::nothrow)
             RsaVerifyOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
     }
@@ -258,7 +259,7 @@
     keymaster_purpose_t purpose() const override { return KM_PURPOSE_ENCRYPT; }
     RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
                                        AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
-                                       keymaster_padding_t padding, EVP_PKEY* key) override {
+                                       keymaster_padding_t padding, EVP_PKEY* key) const override {
         return new (std::nothrow)
             RsaEncryptOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
     }
@@ -271,7 +272,7 @@
     keymaster_purpose_t purpose() const override { return KM_PURPOSE_DECRYPT; }
     RsaOperation* InstantiateOperation(AuthorizationSet&& hw_enforced,
                                        AuthorizationSet&& sw_enforced, keymaster_digest_t digest,
-                                       keymaster_padding_t padding, EVP_PKEY* key) override {
+                                       keymaster_padding_t padding, EVP_PKEY* key) const override {
         return new (std::nothrow)
             RsaDecryptOperation(move(hw_enforced), move(sw_enforced), digest, padding, key);
     }
diff --git a/include/keymaster/operation.h b/include/keymaster/operation.h
index 682aadf..f643e6b 100644
--- a/include/keymaster/operation.h
+++ b/include/keymaster/operation.h
@@ -53,7 +53,7 @@
 
     // Factory methods
     virtual OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                         keymaster_error_t* error) = 0;
+                                         keymaster_error_t* error) const = 0;
 
     // Informational methods.  The returned arrays reference static memory and must not be
     // deallocated or modified.
diff --git a/km_openssl/block_cipher_operation.cpp b/km_openssl/block_cipher_operation.cpp
index 20bd2a6..91440ea 100644
--- a/km_openssl/block_cipher_operation.cpp
+++ b/km_openssl/block_cipher_operation.cpp
@@ -78,7 +78,7 @@
 
 OperationPtr BlockCipherOperationFactory::CreateOperation(Key&& key,
                                                           const AuthorizationSet& begin_params,
-                                                          keymaster_error_t* error) {
+                                                          keymaster_error_t* error) const {
     *error = KM_ERROR_OK;
     keymaster_block_mode_t block_mode;
     if (!begin_params.GetTagValue(TAG_BLOCK_MODE, &block_mode)) {
diff --git a/km_openssl/block_cipher_operation.h b/km_openssl/block_cipher_operation.h
index 1da94eb..92f510e 100644
--- a/km_openssl/block_cipher_operation.h
+++ b/km_openssl/block_cipher_operation.h
@@ -52,7 +52,7 @@
     }
 
     OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                 keymaster_error_t* error) override;
+                                 keymaster_error_t* error) const override;
 
     const keymaster_block_mode_t* SupportedBlockModes(size_t* block_mode_count) const override {
         return GetCipherDescription().SupportedBlockModes(block_mode_count);
diff --git a/km_openssl/ecdsa_operation.cpp b/km_openssl/ecdsa_operation.cpp
index 59ce624..cd9f1ce 100644
--- a/km_openssl/ecdsa_operation.cpp
+++ b/km_openssl/ecdsa_operation.cpp
@@ -29,7 +29,7 @@
                                                        KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512};
 
 OperationPtr EcdsaOperationFactory::CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                                    keymaster_error_t* error) {
+                                                    keymaster_error_t* error) const {
     const EcKey& ecdsa_key = static_cast<EcKey&>(key);
 
     UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKEY_new());
diff --git a/km_openssl/hmac_operation.cpp b/km_openssl/hmac_operation.cpp
index 30edf36..46941dc 100644
--- a/km_openssl/hmac_operation.cpp
+++ b/km_openssl/hmac_operation.cpp
@@ -35,7 +35,7 @@
 namespace keymaster {
 
 OperationPtr HmacOperationFactory::CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                                   keymaster_error_t* error) {
+                                                   keymaster_error_t* error) const {
     uint32_t min_mac_length_bits;
     if (!key.authorizations().GetTagValue(TAG_MIN_MAC_LENGTH, &min_mac_length_bits)) {
         LOG_E("HMAC key must have KM_TAG_MIN_MAC_LENGTH", 0);
diff --git a/km_openssl/hmac_operation.h b/km_openssl/hmac_operation.h
index e67af93..3485f70 100644
--- a/km_openssl/hmac_operation.h
+++ b/km_openssl/hmac_operation.h
@@ -56,7 +56,7 @@
     virtual KeyType registry_key() const { return KeyType(KM_ALGORITHM_HMAC, purpose()); }
 
     virtual OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                         keymaster_error_t* error);
+                                         keymaster_error_t* error) const;
 
     virtual const keymaster_digest_t* SupportedDigests(size_t* digest_count) const;
 
diff --git a/km_openssl/rsa_operation.cpp b/km_openssl/rsa_operation.cpp
index b8d1443..d2ceeb5 100644
--- a/km_openssl/rsa_operation.cpp
+++ b/km_openssl/rsa_operation.cpp
@@ -61,7 +61,7 @@
 
 RsaOperation* RsaOperationFactory::CreateRsaOperation(Key&& key,
                                                       const AuthorizationSet& begin_params,
-                                                      keymaster_error_t* error) {
+                                                      keymaster_error_t* error) const {
     keymaster_padding_t padding;
     if (!GetAndValidatePadding(begin_params, key, &padding, error)) return nullptr;
 
@@ -90,7 +90,7 @@
 
 RsaOperation* RsaCryptingOperationFactory::CreateRsaOperation(Key&& key,
                                                               const AuthorizationSet& begin_params,
-                                                              keymaster_error_t* error) {
+                                                              keymaster_error_t* error) const {
     UniquePtr<RsaOperation> op(
         RsaOperationFactory::CreateRsaOperation(move(key), begin_params, error));
     if (op.get()) {
diff --git a/legacy_support/ecdsa_keymaster1_operation.cpp b/legacy_support/ecdsa_keymaster1_operation.cpp
index e3d2ace..f3cc4a2 100644
--- a/legacy_support/ecdsa_keymaster1_operation.cpp
+++ b/legacy_support/ecdsa_keymaster1_operation.cpp
@@ -97,7 +97,7 @@
 
 OperationPtr EcdsaKeymaster1OperationFactory::CreateOperation(Key&& key,
                                                               const AuthorizationSet& begin_params,
-                                                              keymaster_error_t* error) {
+                                                              keymaster_error_t* error) const {
     keymaster_digest_t digest;
     if (!GetAndValidateDigest(begin_params, key, &digest, error)) return nullptr;
 
diff --git a/legacy_support/ecdsa_keymaster1_operation.h b/legacy_support/ecdsa_keymaster1_operation.h
index a24cc2b..5867a55 100644
--- a/legacy_support/ecdsa_keymaster1_operation.h
+++ b/legacy_support/ecdsa_keymaster1_operation.h
@@ -108,7 +108,7 @@
     KeyType registry_key() const override { return KeyType(KM_ALGORITHM_EC, purpose_); }
 
     OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                 keymaster_error_t* error) override;
+                                 keymaster_error_t* error) const override;
 
     const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
     const keymaster_padding_t* SupportedPaddingModes(size_t* padding_mode_count) const override;
diff --git a/legacy_support/keymaster_passthrough_operation.h b/legacy_support/keymaster_passthrough_operation.h
index 29c0372..aadcc73 100644
--- a/legacy_support/keymaster_passthrough_operation.h
+++ b/legacy_support/keymaster_passthrough_operation.h
@@ -102,7 +102,7 @@
 
     // Factory methods
     OperationPtr CreateOperation(Key&& key, const AuthorizationSet& /*begin_params*/,
-                                 keymaster_error_t* error) override {
+                                 keymaster_error_t* error) const override {
         if (!error) return nullptr;
         *error = KM_ERROR_OK;
         OperationPtr op(new (std::nothrow) KeymasterPassthroughOperation<KeymasterDeviceType>(
diff --git a/legacy_support/rsa_keymaster1_operation.cpp b/legacy_support/rsa_keymaster1_operation.cpp
index dd2c094..c313206 100644
--- a/legacy_support/rsa_keymaster1_operation.cpp
+++ b/legacy_support/rsa_keymaster1_operation.cpp
@@ -118,7 +118,7 @@
 
 OperationPtr RsaKeymaster1OperationFactory::CreateOperation(Key&& key,
                                                             const AuthorizationSet& begin_params,
-                                                            keymaster_error_t* error) {
+                                                            keymaster_error_t* error) const {
     keymaster_digest_t digest;
     if (!GetAndValidateDigest(begin_params, key, &digest, error)) return nullptr;
 
diff --git a/legacy_support/rsa_keymaster1_operation.h b/legacy_support/rsa_keymaster1_operation.h
index c0219ea..04d82c9 100644
--- a/legacy_support/rsa_keymaster1_operation.h
+++ b/legacy_support/rsa_keymaster1_operation.h
@@ -108,7 +108,7 @@
     KeyType registry_key() const override { return KeyType(KM_ALGORITHM_RSA, purpose_); }
 
     OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
-                                 keymaster_error_t* error) override;
+                                 keymaster_error_t* error) const override;
 
     const keymaster_digest_t* SupportedDigests(size_t* digest_count) const override;
     const keymaster_padding_t* SupportedPaddingModes(size_t* padding_mode_count) const override;