More include header cleanups

125 files changed, 101 insertions, 148 deletions

diff --git a/src/cli/credentials.h b/src/cli/credentials.h
index 23d651240..38f91141e 100644
--- a/src/cli/credentials.h
+++ b/src/cli/credentials.h
@@ -10,6 +10,7 @@
 #include <botan/pkcs8.h>
 #include <botan/credentials_manager.h>
 #include <botan/x509self.h>
+#include <botan/data_src.h>
 #include <fstream>
 #include <memory>
 
diff --git a/src/cli/encryption.cpp b/src/cli/encryption.cpp
index a09101fe5..9c9279901 100644
--- a/src/cli/encryption.cpp
+++ b/src/cli/encryption.cpp
@@ -8,9 +8,7 @@
 
 #if defined(BOTAN_HAS_AES) && defined(BOTAN_HAS_AEAD_MODES)
 
-#include <botan/aes.h>
 #include <botan/aead.h>
-
 #include <iterator>
 #include <sstream>
 
diff --git a/src/cli/speed.cpp b/src/cli/speed.cpp
index e53c3e785..d576e15c8 100644
--- a/src/cli/speed.cpp
+++ b/src/cli/speed.cpp
@@ -69,6 +69,7 @@
 
 #if defined(BOTAN_HAS_NUMBERTHEORY)
    #include <botan/numthry.h>
+   #include <botan/pow_mod.h>
 #endif
 
 #if defined(BOTAN_HAS_RSA)
diff --git a/src/cli/tls_client.cpp b/src/cli/tls_client.cpp
index 1379b49be..7716cfade 100644
--- a/src/cli/tls_client.cpp
+++ b/src/cli/tls_client.cpp
@@ -11,6 +11,7 @@
 #if defined(BOTAN_HAS_TLS) && defined(BOTAN_TARGET_OS_HAS_SOCKETS)
 
 #include <botan/tls_client.h>
+#include <botan/tls_policy.h>
 #include <botan/x509path.h>
 #include <botan/ocsp.h>
 #include <botan/hex.h>
diff --git a/src/cli/tls_server.cpp b/src/cli/tls_server.cpp
index 92d227673..eb4869899 100644
--- a/src/cli/tls_server.cpp
+++ b/src/cli/tls_server.cpp
@@ -11,6 +11,7 @@
 #if defined(BOTAN_HAS_TLS) && defined(BOTAN_TARGET_OS_HAS_SOCKETS)
 
 #include <botan/tls_server.h>
+#include <botan/tls_policy.h>
 #include <botan/hex.h>
 #include <botan/internal/os_utils.h>
 #include "credentials.h"
diff --git a/src/cli/utils.cpp b/src/cli/utils.cpp
index 4974877a5..c074a11fc 100644
--- a/src/cli/utils.cpp
+++ b/src/cli/utils.cpp
@@ -41,14 +41,6 @@
    #include <botan/bcrypt.h>
 #endif
 
-#if defined(BOTAN_HAS_HMAC)
-   #include <botan/hmac.h>
-#endif
-
-#if defined(BOTAN_HAS_HOTP)
-   #include <botan/hotp.h>
-#endif
-
 namespace Botan_CLI {
 
 std::unique_ptr<Botan::RandomNumberGenerator>
@@ -418,8 +410,8 @@ class HMAC final : public Command
       void go() override
          {
          const std::string hash_algo = get_arg("hash");
-         std::unique_ptr<Botan::MessageAuthenticationCode> hmac(Botan::MessageAuthenticationCode::create("HMAC(" + hash_algo +
-               ")"));
+         std::unique_ptr<Botan::MessageAuthenticationCode> hmac =
+            Botan::MessageAuthenticationCode::create("HMAC(" + hash_algo + ")");
 
          if(!hmac)
             { throw CLI_Error_Unsupported("HMAC", hash_algo); }
diff --git a/src/cli/x509.cpp b/src/cli/x509.cpp
index 0094fef2b..e569a2de5 100644
--- a/src/cli/x509.cpp
+++ b/src/cli/x509.cpp
@@ -15,6 +15,7 @@
 #include <botan/x509cert.h>
 #include <botan/x509path.h>
 #include <botan/x509self.h>
+#include <botan/data_src.h>
 
 #if defined(BOTAN_HAS_OCSP)
    #include <botan/ocsp.h>
diff --git a/src/lib/ffi/ffi_pkey.cpp b/src/lib/ffi/ffi_pkey.cpp
index d4c629149..bea012e5f 100644
--- a/src/lib/ffi/ffi_pkey.cpp
+++ b/src/lib/ffi/ffi_pkey.cpp
@@ -8,6 +8,7 @@
 #include <botan/internal/ffi_util.h>
 #include <botan/internal/ffi_pkey.h>
 #include <botan/internal/ffi_rng.h>
+#include <botan/data_src.h>
 #include <botan/hash.h>
 #include <botan/pkcs8.h>
 #include <botan/x509_key.h>
diff --git a/src/lib/filters/key_filt.h b/src/lib/filters/key_filt.h
index 9ce4fd1fd..67b689f99 100644
--- a/src/lib/filters/key_filt.h
+++ b/src/lib/filters/key_filt.h
@@ -8,9 +8,9 @@
 #ifndef BOTAN_KEYED_FILTER_H_
 #define BOTAN_KEYED_FILTER_H_
 
+#include <botan/symkey.h>
 #include <botan/filter.h>
 #include <botan/cipher_mode.h>
-#include <botan/sym_algo.h>
 
 namespace Botan {
 
diff --git a/src/lib/mac/gmac/gmac.h b/src/lib/mac/gmac/gmac.h
index ed586b4ea..6d1c6e1fe 100644
--- a/src/lib/mac/gmac/gmac.h
+++ b/src/lib/mac/gmac/gmac.h
@@ -10,6 +10,7 @@
 
 #include <botan/mac.h>
 #include <botan/gcm.h>
+#include <botan/block_cipher.h>
 
 namespace Botan {
 
diff --git a/src/lib/math/numbertheory/numthry.cpp b/src/lib/math/numbertheory/numthry.cpp
index 961f50043..45a81daa8 100644
--- a/src/lib/math/numbertheory/numthry.cpp
+++ b/src/lib/math/numbertheory/numthry.cpp
@@ -6,8 +6,8 @@
 */
 
 #include <botan/numthry.h>
+#include <botan/pow_mod.h>
 #include <botan/reducer.h>
-#include <botan/rng.h>
 #include <botan/internal/bit_ops.h>
 #include <botan/internal/mp_core.h>
 #include <botan/internal/ct_utils.h>
diff --git a/src/lib/math/numbertheory/numthry.h b/src/lib/math/numbertheory/numthry.h
index 286304f7e..7d37ea1b7 100644
--- a/src/lib/math/numbertheory/numthry.h
+++ b/src/lib/math/numbertheory/numthry.h
@@ -9,7 +9,6 @@
 #define BOTAN_NUMBER_THEORY_H_
 
 #include <botan/bigint.h>
-#include <botan/pow_mod.h>
 
 namespace Botan {
 
diff --git a/src/lib/math/numbertheory/powm_fw.cpp b/src/lib/math/numbertheory/powm_fw.cpp
index ea3f5ecf0..c4af8b012 100644
--- a/src/lib/math/numbertheory/powm_fw.cpp
+++ b/src/lib/math/numbertheory/powm_fw.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/internal/def_powm.h>
-#include <botan/numthry.h>
 #include <vector>
 
 namespace Botan {
diff --git a/src/lib/misc/srp6/srp6.cpp b/src/lib/misc/srp6/srp6.cpp
index 44e137237..e41c67c81 100644
--- a/src/lib/misc/srp6/srp6.cpp
+++ b/src/lib/misc/srp6/srp6.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/srp6.h>
-#include <botan/rng.h>
 #include <botan/hash.h>
 #include <botan/dl_group.h>
 #include <botan/numthry.h>
diff --git a/src/lib/modes/aead/gcm/gcm.cpp b/src/lib/modes/aead/gcm/gcm.cpp
index 9c6a85282..bb832245e 100644
--- a/src/lib/modes/aead/gcm/gcm.cpp
+++ b/src/lib/modes/aead/gcm/gcm.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/gcm.h>
+#include <botan/block_cipher.h>
 #include <botan/internal/ct_utils.h>
 #include <botan/loadstor.h>
 #include <botan/ctr.h>
@@ -188,6 +189,8 @@ GCM_Mode::GCM_Mode(BlockCipher* cipher, size_t tag_size) :
       throw Invalid_Argument(name() + ": Bad tag size " + std::to_string(m_tag_size));
    }
 
+GCM_Mode::~GCM_Mode() { /* for unique_ptr */ }
+
 void GCM_Mode::clear()
    {
    m_ctr->clear();
diff --git a/src/lib/modes/aead/gcm/gcm.h b/src/lib/modes/aead/gcm/gcm.h
index 0c5edba45..deedfdade 100644
--- a/src/lib/modes/aead/gcm/gcm.h
+++ b/src/lib/modes/aead/gcm/gcm.h
@@ -10,11 +10,12 @@
 #define BOTAN_AEAD_GCM_H_
 
 #include <botan/aead.h>
-#include <botan/block_cipher.h>
-#include <botan/stream_cipher.h>
+#include <botan/sym_algo.h>
 
 namespace Botan {
 
+class BlockCipher;
+class StreamCipher;
 class GHASH;
 
 /**
@@ -44,6 +45,8 @@ class BOTAN_PUBLIC_API(2,0) GCM_Mode : public AEAD_Mode
    protected:
       GCM_Mode(BlockCipher* cipher, size_t tag_size);
 
+      ~GCM_Mode();
+
       const size_t m_BS = 16;
 
       const size_t m_tag_size;
diff --git a/src/lib/modes/aead/ocb/ocb.cpp b/src/lib/modes/aead/ocb/ocb.cpp
index a48f0751a..6644b4935 100644
--- a/src/lib/modes/aead/ocb/ocb.cpp
+++ b/src/lib/modes/aead/ocb/ocb.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/ocb.h>
+#include <botan/block_cipher.h>
 #include <botan/internal/poly_dbl.h>
 #include <botan/internal/bit_ops.h>
 
diff --git a/src/lib/modes/aead/ocb/ocb.h b/src/lib/modes/aead/ocb/ocb.h
index e53ee0867..4188e8574 100644
--- a/src/lib/modes/aead/ocb/ocb.h
+++ b/src/lib/modes/aead/ocb/ocb.h
@@ -10,10 +10,10 @@
 #define BOTAN_AEAD_OCB_H_
 
 #include <botan/aead.h>
-#include <botan/block_cipher.h>
 
 namespace Botan {
 
+class BlockCipher;
 class L_computer;
 
 /**
diff --git a/src/lib/modes/aead/siv/siv.cpp b/src/lib/modes/aead/siv/siv.cpp
index 8e3d07059..665d25ec9 100644
--- a/src/lib/modes/aead/siv/siv.cpp
+++ b/src/lib/modes/aead/siv/siv.cpp
@@ -7,6 +7,7 @@
 */
 
 #include <botan/siv.h>
+#include <botan/block_cipher.h>
 #include <botan/cmac.h>
 #include <botan/internal/poly_dbl.h>
 #include <botan/ctr.h>
diff --git a/src/lib/modes/aead/siv/siv.h b/src/lib/modes/aead/siv/siv.h
index 2f76847a8..e4454dade 100644
--- a/src/lib/modes/aead/siv/siv.h
+++ b/src/lib/modes/aead/siv/siv.h
@@ -10,12 +10,13 @@
 #define BOTAN_AEAD_SIV_H_
 
 #include <botan/aead.h>
-#include <botan/block_cipher.h>
-#include <botan/stream_cipher.h>
-#include <botan/mac.h>
 
 namespace Botan {
 
+class BlockCipher;
+class StreamCipher;
+class MessageAuthenticationCode;
+
 /**
 * Base class for SIV encryption and decryption (@see RFC 5297)
 */
diff --git a/src/lib/prov/pkcs11/p11_rsa.cpp b/src/lib/prov/pkcs11/p11_rsa.cpp
index 3bb7b7534..8332a945f 100644
--- a/src/lib/prov/pkcs11/p11_rsa.cpp
+++ b/src/lib/prov/pkcs11/p11_rsa.cpp
@@ -14,6 +14,7 @@
 #include <botan/pk_ops.h>
 #include <botan/rng.h>
 #include <botan/blinding.h>
+#include <botan/pow_mod.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/blinding.cpp b/src/lib/pubkey/blinding.cpp
index 47436bcb0..ecd420780 100644
--- a/src/lib/pubkey/blinding.cpp
+++ b/src/lib/pubkey/blinding.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/blinding.h>
-#include <botan/numthry.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/cecpq1/cecpq1.cpp b/src/lib/pubkey/cecpq1/cecpq1.cpp
index 83c0a383c..e11a1e083 100644
--- a/src/lib/pubkey/cecpq1/cecpq1.cpp
+++ b/src/lib/pubkey/cecpq1/cecpq1.cpp
@@ -8,6 +8,7 @@
 #include <botan/cecpq1.h>
 #include <botan/newhope.h>
 #include <botan/curve25519.h>
+#include <botan/rng.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/dl_algo/dl_algo.h b/src/lib/pubkey/dl_algo/dl_algo.h
index a0a898bca..52b38a529 100644
--- a/src/lib/pubkey/dl_algo/dl_algo.h
+++ b/src/lib/pubkey/dl_algo/dl_algo.h
@@ -9,7 +9,7 @@
 #define BOTAN_DL_ALGO_H_
 
 #include <botan/dl_group.h>
-#include <botan/x509_key.h>
+#include <botan/pk_keys.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/dl_group/dl_group.cpp b/src/lib/pubkey/dl_group/dl_group.cpp
index 6d7f0b107..ea47c71a1 100644
--- a/src/lib/pubkey/dl_group/dl_group.cpp
+++ b/src/lib/pubkey/dl_group/dl_group.cpp
@@ -6,13 +6,11 @@
 */
 
 #include <botan/dl_group.h>
-#include <botan/parsing.h>
 #include <botan/numthry.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/pem.h>
 #include <botan/workfactor.h>
-#include <botan/pow_mod.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/dl_group/dl_group.h b/src/lib/pubkey/dl_group/dl_group.h
index 5bd28bc27..4ec9962d7 100644
--- a/src/lib/pubkey/dl_group/dl_group.h
+++ b/src/lib/pubkey/dl_group/dl_group.h
@@ -9,7 +9,6 @@
 #define BOTAN_DL_PARAM_H_
 
 #include <botan/bigint.h>
-#include <botan/data_src.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/ecc_key/ecc_key.cpp b/src/lib/pubkey/ecc_key/ecc_key.cpp
index 7274a3cd9..962cd3f45 100644
--- a/src/lib/pubkey/ecc_key/ecc_key.cpp
+++ b/src/lib/pubkey/ecc_key/ecc_key.cpp
@@ -8,7 +8,6 @@
 */
 
 #include <botan/ecc_key.h>
-#include <botan/x509_key.h>
 #include <botan/numthry.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
diff --git a/src/lib/pubkey/ecc_key/ecc_key.h b/src/lib/pubkey/ecc_key/ecc_key.h
index c189b38b6..427be56ef 100644
--- a/src/lib/pubkey/ecc_key/ecc_key.h
+++ b/src/lib/pubkey/ecc_key/ecc_key.h
@@ -12,7 +12,6 @@
 
 #include <botan/ec_group.h>
 #include <botan/pk_keys.h>
-#include <botan/x509_key.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/ecies/ecies.cpp b/src/lib/pubkey/ecies/ecies.cpp
index d1edf058c..e295efbef 100644
--- a/src/lib/pubkey/ecies/ecies.cpp
+++ b/src/lib/pubkey/ecies/ecies.cpp
@@ -9,6 +9,7 @@
 #include <botan/ecies.h>
 #include <botan/numthry.h>
 #include <botan/cipher_mode.h>
+#include <botan/mac.h>
 
 #include <botan/internal/ct_utils.h>
 #include <botan/internal/pk_ops_impl.h>
diff --git a/src/lib/pubkey/ecies/ecies.h b/src/lib/pubkey/ecies/ecies.h
index 0e3229cdc..382147db2 100644
--- a/src/lib/pubkey/ecies/ecies.h
+++ b/src/lib/pubkey/ecies/ecies.h
@@ -10,9 +10,7 @@
 
 #include <botan/ecdh.h>
 #include <botan/ec_group.h>
-#include <botan/kdf.h>
 #include <botan/cipher_mode.h>
-#include <botan/mac.h>
 #include <botan/point_gfp.h>
 #include <botan/pubkey.h>
 #include <botan/secmem.h>
@@ -24,6 +22,7 @@
 
 namespace Botan {
 
+class MessageAuthenticationCode;
 class RandomNumberGenerator;
 
 enum class ECIES_Flags : uint32_t
diff --git a/src/lib/pubkey/elgamal/elgamal.cpp b/src/lib/pubkey/elgamal/elgamal.cpp
index b7ce643f1..5a3f19362 100644
--- a/src/lib/pubkey/elgamal/elgamal.cpp
+++ b/src/lib/pubkey/elgamal/elgamal.cpp
@@ -11,6 +11,7 @@
 #include <botan/reducer.h>
 #include <botan/blinding.h>
 #include <botan/workfactor.h>
+#include <botan/pow_mod.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/mce/mceliece.cpp b/src/lib/pubkey/mce/mceliece.cpp
index fd985c032..a68ae2a16 100644
--- a/src/lib/pubkey/mce/mceliece.cpp
+++ b/src/lib/pubkey/mce/mceliece.cpp
@@ -13,7 +13,6 @@
 #include <botan/mceliece.h>
 #include <botan/internal/code_based_util.h>
 #include <botan/internal/bit_ops.h>
-#include <set>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/mce/polyn_gf2m.h b/src/lib/pubkey/mce/polyn_gf2m.h
index 08d1fc98a..987e1cffe 100644
--- a/src/lib/pubkey/mce/polyn_gf2m.h
+++ b/src/lib/pubkey/mce/polyn_gf2m.h
@@ -14,7 +14,6 @@
 
 #include <botan/secmem.h>
 #include <botan/gf2m_small_m.h>
-#include <memory>
 #include <utility>
 
 namespace Botan {
diff --git a/src/lib/pubkey/mceies/mceies.cpp b/src/lib/pubkey/mceies/mceies.cpp
index e50df3156..3cdb9a6f8 100644
--- a/src/lib/pubkey/mceies/mceies.cpp
+++ b/src/lib/pubkey/mceies/mceies.cpp
@@ -7,6 +7,7 @@
 
 #include <botan/mceies.h>
 #include <botan/aead.h>
+#include <botan/rng.h>
 #include <botan/mceliece.h>
 #include <botan/pubkey.h>
 
diff --git a/src/lib/pubkey/mceies/mceies.h b/src/lib/pubkey/mceies/mceies.h
index ca920a7ab..85ec5b618 100644
--- a/src/lib/pubkey/mceies/mceies.h
+++ b/src/lib/pubkey/mceies/mceies.h
@@ -9,10 +9,10 @@
 #define BOTAN_MCEIES_H_
 
 #include <botan/secmem.h>
-#include <botan/rng.h>
 
 namespace Botan {
 
+class RandomNumberGenerator;
 class McEliece_PublicKey;
 class McEliece_PrivateKey;
 
diff --git a/src/lib/pubkey/newhope/newhope.cpp b/src/lib/pubkey/newhope/newhope.cpp
index 69ea3d6d3..b5d841144 100644
--- a/src/lib/pubkey/newhope/newhope.cpp
+++ b/src/lib/pubkey/newhope/newhope.cpp
@@ -11,6 +11,7 @@
 
 #include <botan/newhope.h>
 #include <botan/hash.h>
+#include <botan/rng.h>
 #include <botan/stream_cipher.h>
 #include <botan/loadstor.h>
 
diff --git a/src/lib/pubkey/newhope/newhope.h b/src/lib/pubkey/newhope/newhope.h
index 12b7f2e48..070652db9 100644
--- a/src/lib/pubkey/newhope/newhope.h
+++ b/src/lib/pubkey/newhope/newhope.h
@@ -12,10 +12,12 @@
 #ifndef BOTAN_NEWHOPE_H_
 #define BOTAN_NEWHOPE_H_
 
-#include <botan/rng.h>
+#include <botan/mem_ops.h>
 
 namespace Botan {
 
+class RandomNumberGenerator;
+
 /*
 * WARNING: This API is preliminary and will change
 * Currently pubkey.h does not support a 2-phase KEM scheme of
diff --git a/src/lib/pubkey/pbes2/pbes2.cpp b/src/lib/pubkey/pbes2/pbes2.cpp
index 6bc7a23c3..41d18a86d 100644
--- a/src/lib/pubkey/pbes2/pbes2.cpp
+++ b/src/lib/pubkey/pbes2/pbes2.cpp
@@ -14,7 +14,6 @@
 #include <botan/alg_id.h>
 #include <botan/oids.h>
 #include <botan/rng.h>
-#include <algorithm>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/pbes2/pbes2.h b/src/lib/pubkey/pbes2/pbes2.h
index 0138d1bf3..bc56abd97 100644
--- a/src/lib/pubkey/pbes2/pbes2.h
+++ b/src/lib/pubkey/pbes2/pbes2.h
@@ -8,12 +8,13 @@
 #ifndef BOTAN_PBE_PKCS_v20_H_
 #define BOTAN_PBE_PKCS_v20_H_
 
-#include <botan/rng.h>
 #include <botan/alg_id.h>
 #include <chrono>
 
 namespace Botan {
 
+class RandomNumberGenerator;
+
 /**
 * Encrypt with PBES2 from PKCS #5 v2.0
 * @param key_bits the input
diff --git a/src/lib/pubkey/pem/pem.cpp b/src/lib/pubkey/pem/pem.cpp
index bc94e3b53..1303e4ac2 100644
--- a/src/lib/pubkey/pem/pem.cpp
+++ b/src/lib/pubkey/pem/pem.cpp
@@ -6,8 +6,8 @@
 */
 
 #include <botan/pem.h>
+#include <botan/data_src.h>
 #include <botan/base64.h>
-#include <botan/parsing.h>
 #include <botan/exceptn.h>
 
 namespace Botan {
diff --git a/src/lib/pubkey/pem/pem.h b/src/lib/pubkey/pem/pem.h
index 8be93c0f9..b2b27282d 100644
--- a/src/lib/pubkey/pem/pem.h
+++ b/src/lib/pubkey/pem/pem.h
@@ -8,10 +8,13 @@
 #ifndef BOTAN_PEM_H_
 #define BOTAN_PEM_H_
 
-#include <botan/data_src.h>
+#include <botan/secmem.h>
+#include <string>
 
 namespace Botan {
 
+class DataSource;
+
 namespace PEM_Code {
 
 /**
diff --git a/src/lib/pubkey/pk_keys.h b/src/lib/pubkey/pk_keys.h
index 1d7d1f2b5..f513cea6c 100644
--- a/src/lib/pubkey/pk_keys.h
+++ b/src/lib/pubkey/pk_keys.h
@@ -11,7 +11,6 @@
 #include <botan/secmem.h>
 #include <botan/asn1_oid.h>
 #include <botan/alg_id.h>
-#include <botan/rng.h>
 #include <botan/pk_ops_fwd.h>
 
 namespace Botan {
diff --git a/src/lib/pubkey/pubkey.h b/src/lib/pubkey/pubkey.h
index 366acea65..bfe94509e 100644
--- a/src/lib/pubkey/pubkey.h
+++ b/src/lib/pubkey/pubkey.h
@@ -11,10 +11,6 @@
 #include <botan/pk_keys.h>
 #include <botan/pk_ops_fwd.h>
 #include <botan/symkey.h>
-#include <botan/rng.h>
-#include <botan/eme.h>
-#include <botan/emsa.h>
-#include <botan/kdf.h>
 
 #if defined(BOTAN_HAS_SYSTEM_RNG)
   #include <botan/system_rng.h>
@@ -23,6 +19,8 @@
 
 namespace Botan {
 
+class RandomNumberGenerator;
+
 /**
 * The two types of signature format supported by Botan.
 */
diff --git a/src/lib/pubkey/rsa/rsa.cpp b/src/lib/pubkey/rsa/rsa.cpp
index 7d48fd814..cafe6b069 100644
--- a/src/lib/pubkey/rsa/rsa.cpp
+++ b/src/lib/pubkey/rsa/rsa.cpp
@@ -7,13 +7,13 @@
 
 #include <botan/rsa.h>
 #include <botan/internal/pk_ops_impl.h>
-#include <botan/parsing.h>
 #include <botan/keypair.h>
 #include <botan/blinding.h>
 #include <botan/reducer.h>
 #include <botan/workfactor.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
+#include <botan/pow_mod.h>
 
 #if defined(BOTAN_HAS_OPENSSL)
   #include <botan/internal/openssl.h>
diff --git a/src/lib/pubkey/rsa/rsa.h b/src/lib/pubkey/rsa/rsa.h
index 0525e21ac..09c945c82 100644
--- a/src/lib/pubkey/rsa/rsa.h
+++ b/src/lib/pubkey/rsa/rsa.h
@@ -8,8 +8,8 @@
 #ifndef BOTAN_RSA_H_
 #define BOTAN_RSA_H_
 
+#include <botan/pk_keys.h>
 #include <botan/bigint.h>
-#include <botan/x509_key.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/x509_key.cpp b/src/lib/pubkey/x509_key.cpp
index 6fadeb70d..6e49d953a 100644
--- a/src/lib/pubkey/x509_key.cpp
+++ b/src/lib/pubkey/x509_key.cpp
@@ -6,7 +6,7 @@
 */
 
 #include <botan/x509_key.h>
-#include <botan/der_enc.h>
+#include <botan/data_src.h>
 #include <botan/ber_dec.h>
 #include <botan/pem.h>
 #include <botan/alg_id.h>
diff --git a/src/lib/pubkey/x509_key.h b/src/lib/pubkey/x509_key.h
index 323ff5a01..b562208aa 100644
--- a/src/lib/pubkey/x509_key.h
+++ b/src/lib/pubkey/x509_key.h
@@ -10,11 +10,12 @@
 
 #include <botan/pk_keys.h>
 #include <botan/alg_id.h>
-#include <botan/data_src.h>
 #include <string>
 
 namespace Botan {
 
+class DataSource;
+
 /**
 * The two types of X509 encoding supported by Botan.
 */
diff --git a/src/lib/pubkey/xmss/xmss_index_registry.cpp b/src/lib/pubkey/xmss/xmss_index_registry.cpp
index 530d926c4..6a0995868 100644
--- a/src/lib/pubkey/xmss/xmss_index_registry.cpp
+++ b/src/lib/pubkey/xmss/xmss_index_registry.cpp
@@ -8,6 +8,7 @@
  **/
 
 #include <botan/xmss_index_registry.h>
+#include <botan/hash.h>
 #include <limits>
 
 namespace Botan {
diff --git a/src/lib/pubkey/xmss/xmss_index_registry.h b/src/lib/pubkey/xmss/xmss_index_registry.h
index 88dfb7517..d7448693a 100644
--- a/src/lib/pubkey/xmss/xmss_index_registry.h
+++ b/src/lib/pubkey/xmss/xmss_index_registry.h
@@ -8,7 +8,7 @@
 #ifndef BOTAN_XMSS_INDEX_REGISTRY_H_
 #define BOTAN_XMSS_INDEX_REGISTRY_H_
 
-#include <botan/hash.h>
+#include <botan/secmem.h>
 #include <botan/atomic.h>
 #include <botan/mutex.h>
 
diff --git a/src/lib/pubkey/xmss/xmss_parameters.h b/src/lib/pubkey/xmss/xmss_parameters.h
index a2f763d97..3e59634f4 100644
--- a/src/lib/pubkey/xmss/xmss_parameters.h
+++ b/src/lib/pubkey/xmss/xmss_parameters.h
@@ -10,7 +10,6 @@
 
 #include <botan/xmss_wots_parameters.h>
 #include <string>
-#include <map>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/xmss/xmss_privatekey.cpp b/src/lib/pubkey/xmss/xmss_privatekey.cpp
index 753893c8c..0cb167f61 100644
--- a/src/lib/pubkey/xmss/xmss_privatekey.cpp
+++ b/src/lib/pubkey/xmss/xmss_privatekey.cpp
@@ -15,8 +15,8 @@
  * Botan is released under the Simplified BSD License (see license.txt)
  **/
 
-#include <botan/internal/xmss_signature_operation.h>
 #include <botan/xmss_privatekey.h>
+#include <botan/internal/xmss_signature_operation.h>
 #include <cmath>
 
 namespace Botan {
diff --git a/src/lib/pubkey/xmss/xmss_signature.h b/src/lib/pubkey/xmss/xmss_signature.h
index ce8ed6d9b..493697d51 100644
--- a/src/lib/pubkey/xmss/xmss_signature.h
+++ b/src/lib/pubkey/xmss/xmss_signature.h
@@ -9,7 +9,6 @@
 #define BOTAN_XMSS_SIGNATURE_H_
 
 #include <cstddef>
-#include <iterator>
 #include <botan/exceptn.h>
 #include <botan/types.h>
 #include <botan/secmem.h>
diff --git a/src/lib/pubkey/xmss/xmss_wots_publickey.h b/src/lib/pubkey/xmss/xmss_wots_publickey.h
index 86b4bc803..57009154b 100644
--- a/src/lib/pubkey/xmss/xmss_wots_publickey.h
+++ b/src/lib/pubkey/xmss/xmss_wots_publickey.h
@@ -12,6 +12,7 @@
 #include <string>
 #include <vector>
 #include <botan/alg_id.h>
+#include <botan/rng.h>
 #include <botan/asn1_oid.h>
 #include <botan/exceptn.h>
 #include <botan/pk_keys.h>
diff --git a/src/lib/rng/rng.cpp b/src/lib/rng/rng.cpp
index 4fa8e42a6..2cf3b7b81 100644
--- a/src/lib/rng/rng.cpp
+++ b/src/lib/rng/rng.cpp
@@ -5,6 +5,7 @@
 */
 
 #include <botan/rng.h>
+#include <botan/entropy_src.h>
 #include <botan/loadstor.h>
 #include <botan/internal/os_utils.h>
 
diff --git a/src/lib/rng/rng.h b/src/lib/rng/rng.h
index f86f80d61..75c5b4e78 100644
--- a/src/lib/rng/rng.h
+++ b/src/lib/rng/rng.h
@@ -8,7 +8,6 @@
 #ifndef BOTAN_RANDOM_NUMBER_GENERATOR_H_
 #define BOTAN_RANDOM_NUMBER_GENERATOR_H_
 
-#include <botan/entropy_src.h>
 #include <botan/secmem.h>
 #include <botan/exceptn.h>
 #include <botan/mutex.h>
diff --git a/src/lib/tls/credentials_manager.cpp b/src/lib/tls/credentials_manager.cpp
index c59933762..9a7e25ddf 100644
--- a/src/lib/tls/credentials_manager.cpp
+++ b/src/lib/tls/credentials_manager.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/credentials_manager.h>
-#include <botan/x509path.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/msg_cert_req.cpp b/src/lib/tls/msg_cert_req.cpp
index 6488034ef..c6d09481e 100644
--- a/src/lib/tls/msg_cert_req.cpp
+++ b/src/lib/tls/msg_cert_req.cpp
@@ -12,7 +12,6 @@
 #include <botan/internal/tls_handshake_hash.h>
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
-#include <botan/loadstor.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/msg_certificate.cpp b/src/lib/tls/msg_certificate.cpp
index e00bec926..a2a48ceea 100644
--- a/src/lib/tls/msg_certificate.cpp
+++ b/src/lib/tls/msg_certificate.cpp
@@ -10,9 +10,8 @@
 #include <botan/internal/tls_reader.h>
 #include <botan/internal/tls_handshake_io.h>
 #include <botan/internal/tls_handshake_hash.h>
-#include <botan/der_enc.h>
-#include <botan/ber_dec.h>
 #include <botan/loadstor.h>
+#include <botan/data_src.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/msg_client_hello.cpp b/src/lib/tls/msg_client_hello.cpp
index 3dc3127b9..bb7d84df8 100644
--- a/src/lib/tls/msg_client_hello.cpp
+++ b/src/lib/tls/msg_client_hello.cpp
@@ -9,6 +9,7 @@
 #include <botan/tls_messages.h>
 #include <botan/tls_alert.h>
 #include <botan/tls_exceptn.h>
+#include <botan/rng.h>
 #include <botan/internal/tls_reader.h>
 #include <botan/internal/tls_session_key.h>
 #include <botan/internal/tls_handshake_io.h>
diff --git a/src/lib/tls/msg_client_kex.cpp b/src/lib/tls/msg_client_kex.cpp
index 2d132af04..3291b6eb5 100644
--- a/src/lib/tls/msg_client_kex.cpp
+++ b/src/lib/tls/msg_client_kex.cpp
@@ -7,13 +7,13 @@
 
 #include <botan/tls_messages.h>
 #include <botan/tls_extensions.h>
+#include <botan/rng.h>
+
 #include <botan/internal/tls_reader.h>
 #include <botan/internal/tls_handshake_io.h>
 #include <botan/internal/tls_handshake_state.h>
 #include <botan/internal/tls_handshake_hash.h>
 #include <botan/credentials_manager.h>
-#include <botan/rng.h>
-#include <botan/loadstor.h>
 #include <botan/internal/ct_utils.h>
 
 #include <botan/pubkey.h>
diff --git a/src/lib/tls/msg_finished.cpp b/src/lib/tls/msg_finished.cpp
index 0fbfc0738..47c875a51 100644
--- a/src/lib/tls/msg_finished.cpp
+++ b/src/lib/tls/msg_finished.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/tls_messages.h>
+#include <botan/kdf.h>
 #include <botan/internal/tls_handshake_io.h>
 #include <botan/internal/tls_handshake_state.h>
 
diff --git a/src/lib/tls/msg_server_kex.cpp b/src/lib/tls/msg_server_kex.cpp
index 17f5cad4f..97ac4ac8f 100644
--- a/src/lib/tls/msg_server_kex.cpp
+++ b/src/lib/tls/msg_server_kex.cpp
@@ -13,7 +13,6 @@
 #include <botan/credentials_manager.h>
 #include <botan/loadstor.h>
 #include <botan/pubkey.h>
-#include <botan/oids.h>
 
 #include <botan/dh.h>
 #include <botan/ecdh.h>
diff --git a/src/lib/tls/msg_session_ticket.cpp b/src/lib/tls/msg_session_ticket.cpp
index 28204958f..b9bf7e94d 100644
--- a/src/lib/tls/msg_session_ticket.cpp
+++ b/src/lib/tls/msg_session_ticket.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/tls_messages.h>
-#include <botan/tls_extensions.h>
 #include <botan/internal/tls_reader.h>
 #include <botan/internal/tls_handshake_io.h>
 #include <botan/internal/tls_handshake_hash.h>
diff --git a/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp b/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
index 594822829..4287172f4 100644
--- a/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
+++ b/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
@@ -9,6 +9,7 @@
 #include <botan/database.h>
 #include <botan/pbkdf.h>
 #include <botan/hex.h>
+#include <botan/rng.h>
 #include <botan/loadstor.h>
 #include <chrono>
 
diff --git a/src/lib/tls/sessions_sql/tls_session_manager_sql.h b/src/lib/tls/sessions_sql/tls_session_manager_sql.h
index a334cb687..d96a8b5bb 100644
--- a/src/lib/tls/sessions_sql/tls_session_manager_sql.h
+++ b/src/lib/tls/sessions_sql/tls_session_manager_sql.h
@@ -10,10 +10,11 @@
 
 #include <botan/tls_session_manager.h>
 #include <botan/database.h>
-#include <botan/rng.h>
 
 namespace Botan {
 
+class RandomNumberGenerator;
+
 namespace TLS {
 
 /**
diff --git a/src/lib/tls/sessions_sqlite3/tls_session_manager_sqlite.h b/src/lib/tls/sessions_sqlite3/tls_session_manager_sqlite.h
index 797180687..bd092c5b0 100644
--- a/src/lib/tls/sessions_sqlite3/tls_session_manager_sqlite.h
+++ b/src/lib/tls/sessions_sqlite3/tls_session_manager_sqlite.h
@@ -9,10 +9,11 @@
 #define BOTAN_TLS_SQLITE3_SESSION_MANAGER_H_
 
 #include <botan/tls_session_manager_sql.h>
-#include <botan/rng.h>
 
 namespace Botan {
 
+class RandomNumberGenerator;
+
 namespace TLS {
 
 /**
diff --git a/src/lib/tls/tls_blocking.h b/src/lib/tls/tls_blocking.h
index 851bf846c..01620c652 100644
--- a/src/lib/tls/tls_blocking.h
+++ b/src/lib/tls/tls_blocking.h
@@ -10,13 +10,9 @@
 #define BOTAN_TLS_BLOCKING_CHANNELS_H_
 
 #include <botan/tls_client.h>
-#include <botan/tls_server.h>
-#include <deque>
 
 namespace Botan {
 
-//template<typename T> using secure_deque = std::vector<T, secure_allocator<T>>;
-
 namespace TLS {
 
 /**
diff --git a/src/lib/tls/tls_callbacks.cpp b/src/lib/tls/tls_callbacks.cpp
index 45d0518eb..59620aec2 100644
--- a/src/lib/tls/tls_callbacks.cpp
+++ b/src/lib/tls/tls_callbacks.cpp
@@ -9,7 +9,6 @@
 #include <botan/tls_policy.h>
 #include <botan/x509path.h>
 #include <botan/ocsp.h>
-#include <botan/certstor.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/tls_cbc/tls_cbc.cpp b/src/lib/tls/tls_cbc/tls_cbc.cpp
index 244ddfb99..69aa9725d 100644
--- a/src/lib/tls/tls_cbc/tls_cbc.cpp
+++ b/src/lib/tls/tls_cbc/tls_cbc.cpp
@@ -12,7 +12,6 @@
 #include <botan/internal/rounding.h>
 #include <botan/internal/ct_utils.h>
 #include <botan/tls_alert.h>
-#include <botan/tls_magic.h>
 #include <botan/tls_exceptn.h>
 
 namespace Botan {
diff --git a/src/lib/tls/tls_channel.cpp b/src/lib/tls/tls_channel.cpp
index c905862c6..034976ec4 100644
--- a/src/lib/tls/tls_channel.cpp
+++ b/src/lib/tls/tls_channel.cpp
@@ -7,7 +7,9 @@
 */
 
 #include <botan/tls_channel.h>
+#include <botan/tls_policy.h>
 #include <botan/tls_messages.h>
+#include <botan/kdf.h>
 #include <botan/internal/tls_handshake_state.h>
 #include <botan/internal/tls_record.h>
 #include <botan/internal/tls_seq_numbers.h>
diff --git a/src/lib/tls/tls_channel.h b/src/lib/tls/tls_channel.h
index 61d85756b..2b21b163d 100644
--- a/src/lib/tls/tls_channel.h
+++ b/src/lib/tls/tls_channel.h
@@ -9,7 +9,6 @@
 #ifndef BOTAN_TLS_CHANNEL_H_
 #define BOTAN_TLS_CHANNEL_H_
 
-#include <botan/tls_policy.h>
 #include <botan/tls_session.h>
 #include <botan/tls_alert.h>
 #include <botan/tls_session_manager.h>
@@ -29,6 +28,7 @@ class Handshake_State;
 class Handshake_Message;
 class Client_Hello;
 class Server_Hello;
+class Policy;
 
 /**
 * Generic interface for TLS endpoint
diff --git a/src/lib/tls/tls_ciphersuite.cpp b/src/lib/tls/tls_ciphersuite.cpp
index 346d62bea..cef6bb3c7 100644
--- a/src/lib/tls/tls_ciphersuite.cpp
+++ b/src/lib/tls/tls_ciphersuite.cpp
@@ -10,7 +10,6 @@
 #include <botan/block_cipher.h>
 #include <botan/stream_cipher.h>
 #include <botan/hash.h>
-#include <botan/mac.h>
 #include <algorithm>
 
 namespace Botan {
diff --git a/src/lib/tls/tls_client.cpp b/src/lib/tls/tls_client.cpp
index d866b5a1f..53d673a5c 100644
--- a/src/lib/tls/tls_client.cpp
+++ b/src/lib/tls/tls_client.cpp
@@ -13,8 +13,6 @@
 #include <iterator>
 #include <sstream>
 
-#include <botan/hex.h>
-
 namespace Botan {
 
 namespace TLS {
diff --git a/src/lib/tls/tls_client.h b/src/lib/tls/tls_client.h
index b5cb30527..67a086e15 100644
--- a/src/lib/tls/tls_client.h
+++ b/src/lib/tls/tls_client.h
@@ -10,6 +10,7 @@
 #define BOTAN_TLS_CLIENT_H_
 
 #include <botan/tls_channel.h>
+#include <botan/tls_policy.h>
 #include <botan/credentials_manager.h>
 #include <vector>
 
diff --git a/src/lib/tls/tls_extensions.h b/src/lib/tls/tls_extensions.h
index 645d1a4e3..9a92a1135 100644
--- a/src/lib/tls/tls_extensions.h
+++ b/src/lib/tls/tls_extensions.h
@@ -11,7 +11,6 @@
 #define BOTAN_TLS_EXTENSIONS_H_
 
 #include <botan/secmem.h>
-#include <botan/tls_magic.h>
 #include <botan/ocsp.h>
 #include <vector>
 #include <string>
diff --git a/src/lib/tls/tls_handshake_hash.cpp b/src/lib/tls/tls_handshake_hash.cpp
index a3e90ebc5..a48251d06 100644
--- a/src/lib/tls/tls_handshake_hash.cpp
+++ b/src/lib/tls/tls_handshake_hash.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/internal/tls_handshake_hash.h>
-#include <botan/tls_exceptn.h>
 #include <botan/hash.h>
 
 namespace Botan {
diff --git a/src/lib/tls/tls_handshake_hash.h b/src/lib/tls/tls_handshake_hash.h
index ab03f883d..1f80e2c3a 100644
--- a/src/lib/tls/tls_handshake_hash.h
+++ b/src/lib/tls/tls_handshake_hash.h
@@ -10,7 +10,6 @@
 
 #include <botan/secmem.h>
 #include <botan/tls_version.h>
-#include <botan/tls_magic.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/tls_handshake_io.h b/src/lib/tls/tls_handshake_io.h
index 52cb7d90f..8e1a0eca7 100644
--- a/src/lib/tls/tls_handshake_io.h
+++ b/src/lib/tls/tls_handshake_io.h
@@ -10,7 +10,6 @@
 
 #include <botan/tls_magic.h>
 #include <botan/tls_version.h>
-#include <botan/loadstor.h>
 #include <functional>
 #include <vector>
 #include <deque>
diff --git a/src/lib/tls/tls_handshake_state.cpp b/src/lib/tls/tls_handshake_state.cpp
index 35973b359..d995802ed 100644
--- a/src/lib/tls/tls_handshake_state.cpp
+++ b/src/lib/tls/tls_handshake_state.cpp
@@ -9,6 +9,7 @@
 #include <botan/internal/tls_record.h>
 #include <botan/tls_messages.h>
 #include <botan/tls_callbacks.h>
+#include <botan/kdf.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/tls_policy.cpp b/src/lib/tls/tls_policy.cpp
index 822b41e5e..863958eaa 100644
--- a/src/lib/tls/tls_policy.cpp
+++ b/src/lib/tls/tls_policy.cpp
@@ -11,7 +11,6 @@
 #include <botan/tls_magic.h>
 #include <botan/tls_exceptn.h>
 #include <botan/internal/stl_util.h>
-#include <botan/parsing.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/tls_policy.h b/src/lib/tls/tls_policy.h
index 1ac3e40f2..ef31dacbe 100644
--- a/src/lib/tls/tls_policy.h
+++ b/src/lib/tls/tls_policy.h
@@ -11,7 +11,6 @@
 #include <botan/tls_version.h>
 #include <botan/tls_ciphersuite.h>
 #include <botan/x509cert.h>
-#include <botan/dl_group.h>
 #include <botan/parsing.h>
 #include <vector>
 #include <sstream>
diff --git a/src/lib/tls/tls_record.h b/src/lib/tls/tls_record.h
index 42939b7fd..63989a17e 100644
--- a/src/lib/tls/tls_record.h
+++ b/src/lib/tls/tls_record.h
@@ -12,8 +12,6 @@
 #include <botan/tls_magic.h>
 #include <botan/tls_version.h>
 #include <botan/aead.h>
-#include <botan/block_cipher.h>
-#include <botan/mac.h>
 #include <vector>
 #include <chrono>
 #include <functional>
diff --git a/src/lib/tls/tls_server.h b/src/lib/tls/tls_server.h
index a7db74f27..eb6e710e1 100644
--- a/src/lib/tls/tls_server.h
+++ b/src/lib/tls/tls_server.h
@@ -10,10 +10,10 @@
 #define BOTAN_TLS_SERVER_H_
 
 #include <botan/tls_channel.h>
+#include <botan/tls_policy.h>
 #include <botan/credentials_manager.h>
 #include <vector>
 
-
 namespace Botan {
 
 namespace TLS {
diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp
index d82c490ab..e73aa4fa6 100644
--- a/src/lib/tls/tls_session.cpp
+++ b/src/lib/tls/tls_session.cpp
@@ -12,6 +12,7 @@
 #include <botan/pem.h>
 #include <botan/aead.h>
 #include <botan/mac.h>
+#include <botan/rng.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/tls_session_key.cpp b/src/lib/tls/tls_session_key.cpp
index 9e8dab86e..469d1d387 100644
--- a/src/lib/tls/tls_session_key.cpp
+++ b/src/lib/tls/tls_session_key.cpp
@@ -8,6 +8,7 @@
 #include <botan/internal/tls_session_key.h>
 #include <botan/internal/tls_handshake_state.h>
 #include <botan/tls_messages.h>
+#include <botan/kdf.h>
 
 namespace Botan {
 
diff --git a/src/lib/tls/tls_session_manager_memory.cpp b/src/lib/tls/tls_session_manager_memory.cpp
index f120a4290..5768723d2 100644
--- a/src/lib/tls/tls_session_manager_memory.cpp
+++ b/src/lib/tls/tls_session_manager_memory.cpp
@@ -7,6 +7,7 @@
 
 #include <botan/tls_session_manager.h>
 #include <botan/hex.h>
+#include <botan/rng.h>
 #include <chrono>
 
 namespace Botan {
diff --git a/src/lib/tls/tls_version.cpp b/src/lib/tls/tls_version.cpp
index 274cedc11..2b8b68566 100644
--- a/src/lib/tls/tls_version.cpp
+++ b/src/lib/tls/tls_version.cpp
@@ -7,7 +7,6 @@
 
 #include <botan/tls_version.h>
 #include <botan/tls_exceptn.h>
-#include <botan/parsing.h>
 
 namespace Botan {
 
diff --git a/src/lib/utils/charset.cpp b/src/lib/utils/charset.cpp
index 72db6c792..546e4e74d 100644
--- a/src/lib/utils/charset.cpp
+++ b/src/lib/utils/charset.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/charset.h>
-#include <botan/parsing.h>
 #include <botan/exceptn.h>
 #include <cctype>
 
diff --git a/src/lib/utils/http_util/http_util.h b/src/lib/utils/http_util/http_util.h
index 9e4d215ef..acaed54d4 100644
--- a/src/lib/utils/http_util/http_util.h
+++ b/src/lib/utils/http_util/http_util.h
@@ -12,7 +12,6 @@
 #include <botan/exceptn.h>
 #include <vector>
 #include <map>
-#include <chrono>
 #include <string>
 #include <functional>
 
diff --git a/src/lib/utils/version.cpp b/src/lib/utils/version.cpp
index 166e75678..ff4c4f0f3 100644
--- a/src/lib/utils/version.cpp
+++ b/src/lib/utils/version.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/version.h>
-#include <botan/parsing.h>
 #include <sstream>
 
 namespace Botan {
diff --git a/src/lib/x509/certstor_sql/certstor_sql.cpp b/src/lib/x509/certstor_sql/certstor_sql.cpp
index 13239252b..cd0aebdb1 100644
--- a/src/lib/x509/certstor_sql/certstor_sql.cpp
+++ b/src/lib/x509/certstor_sql/certstor_sql.cpp
@@ -10,8 +10,6 @@
 #include <botan/der_enc.h>
 #include <botan/pkcs8.h>
 #include <botan/data_src.h>
-#include <botan/hash.h>
-#include <botan/hex.h>
 
 namespace Botan {
 
diff --git a/src/lib/x509/crl_ent.cpp b/src/lib/x509/crl_ent.cpp
index f717e7b07..fabd88326 100644
--- a/src/lib/x509/crl_ent.cpp
+++ b/src/lib/x509/crl_ent.cpp
@@ -11,7 +11,6 @@
 #include <botan/der_enc.h>
 #include <botan/ber_dec.h>
 #include <botan/bigint.h>
-#include <botan/oids.h>
 
 namespace Botan {
 
diff --git a/src/lib/x509/datastor.h b/src/lib/x509/datastor.h
index 5cb9fad9d..c730c7140 100644
--- a/src/lib/x509/datastor.h
+++ b/src/lib/x509/datastor.h
@@ -10,7 +10,6 @@
 
 #include <botan/secmem.h>
 #include <functional>
-#include <utility>
 #include <string>
 #include <vector>
 #include <map>
diff --git a/src/lib/x509/key_constraint.cpp b/src/lib/x509/key_constraint.cpp
index a39747f9a..d8a2bf844 100644
--- a/src/lib/x509/key_constraint.cpp
+++ b/src/lib/x509/key_constraint.cpp
@@ -8,6 +8,7 @@
 
 #include <botan/key_constraint.h>
 #include <botan/x509_key.h>
+#include <vector>
 
 namespace Botan {
 
diff --git a/src/lib/x509/name_constraint.cpp b/src/lib/x509/name_constraint.cpp
index fc91a5477..ea922a3b9 100644
--- a/src/lib/x509/name_constraint.cpp
+++ b/src/lib/x509/name_constraint.cpp
@@ -7,7 +7,6 @@
 
 #include <botan/name_constraint.h>
 #include <botan/ber_dec.h>
-#include <botan/der_enc.h>
 #include <botan/charset.h>
 #include <botan/loadstor.h>
 #include <botan/x509_dn.h>
@@ -17,6 +16,8 @@
 
 namespace Botan {
 
+class DER_Encoder;
+
 GeneralName::GeneralName(const std::string& str) : GeneralName()
    {
    size_t p = str.find(':');
@@ -32,7 +33,7 @@ GeneralName::GeneralName(const std::string& str) : GeneralName()
       }
    }
 
-void GeneralName::encode_into(class DER_Encoder&) const
+void GeneralName::encode_into(DER_Encoder&) const
    {
    throw Not_Implemented("GeneralName encoding");
    }
@@ -248,7 +249,7 @@ GeneralSubtree::GeneralSubtree(const std::string& str) : GeneralSubtree()
       }
    }
 
-void GeneralSubtree::encode_into(class DER_Encoder&) const
+void GeneralSubtree::encode_into(DER_Encoder&) const
    {
    throw Not_Implemented("General Subtree encoding");
    }
diff --git a/src/lib/x509/name_constraint.h b/src/lib/x509/name_constraint.h
index 28c3a2f4f..108028413 100644
--- a/src/lib/x509/name_constraint.h
+++ b/src/lib/x509/name_constraint.h
@@ -14,6 +14,8 @@
 
 namespace Botan {
 
+class BER_Encoder;
+class DER_Encoder;
 class X509_Certificate;
 
 /**
@@ -46,9 +48,9 @@ class BOTAN_PUBLIC_API(2,0) GeneralName : public ASN1_Object
       */
       GeneralName(const std::string& str);
 
-      void encode_into(class DER_Encoder&) const override;
+      void encode_into(DER_Encoder&) const override;
 
-      void decode_from(class BER_Decoder&) override;
+      void decode_from(BER_Decoder&) override;
 
       /**
       * @return Type of the name. Can be DN, DNS, IP, RFC822 or URI.
@@ -110,9 +112,9 @@ class BOTAN_PUBLIC_API(2,0) GeneralSubtree : public ASN1_Object
       */
       GeneralSubtree(const std::string& str);
 
-      void encode_into(class DER_Encoder&) const override;
+      void encode_into(DER_Encoder&) const override;
 
-      void decode_from(class BER_Decoder&) override;
+      void decode_from(BER_Decoder&) override;
 
       /**
       * @return name
diff --git a/src/lib/x509/ocsp.cpp b/src/lib/x509/ocsp.cpp
index c437fa45e..cf0c1064b 100644
--- a/src/lib/x509/ocsp.cpp
+++ b/src/lib/x509/ocsp.cpp
@@ -13,7 +13,6 @@
 #include <botan/oids.h>
 #include <botan/base64.h>
 #include <botan/pubkey.h>
-#include <botan/x509path.h>
 #include <botan/parsing.h>
 
 #if defined(BOTAN_HAS_HTTP_UTIL)
diff --git a/src/lib/x509/pkcs10.cpp b/src/lib/x509/pkcs10.cpp
index a9cec86ee..ab52769f7 100644
--- a/src/lib/x509/pkcs10.cpp
+++ b/src/lib/x509/pkcs10.cpp
@@ -8,9 +8,7 @@
 #include <botan/pkcs10.h>
 #include <botan/x509_ext.h>
 #include <botan/x509cert.h>
-#include <botan/der_enc.h>
 #include <botan/ber_dec.h>
-#include <botan/parsing.h>
 #include <botan/oids.h>
 #include <botan/pem.h>
 
diff --git a/src/lib/x509/x509_ca.cpp b/src/lib/x509/x509_ca.cpp
index e1a8c3af7..ca4d258fd 100644
--- a/src/lib/x509/x509_ca.cpp
+++ b/src/lib/x509/x509_ca.cpp
@@ -8,16 +8,13 @@
 #include <botan/x509_ca.h>
 #include <botan/pubkey.h>
 #include <botan/der_enc.h>
-#include <botan/ber_dec.h>
 #include <botan/bigint.h>
 #include <botan/parsing.h>
 #include <botan/oids.h>
 #include <botan/hash.h>
 #include <botan/key_constraint.h>
 #include <algorithm>
-#include <typeinfo>
 #include <iterator>
-#include <set>
 
 namespace Botan {
 
diff --git a/src/lib/x509/x509_crl.cpp b/src/lib/x509/x509_crl.cpp
index 65d426f20..41a93d6d0 100644
--- a/src/lib/x509/x509_crl.cpp
+++ b/src/lib/x509/x509_crl.cpp
@@ -9,9 +9,6 @@
 #include <botan/x509_ext.h>
 #include <botan/x509cert.h>
 #include <botan/ber_dec.h>
-#include <botan/parsing.h>
-#include <botan/bigint.h>
-#include <botan/oids.h>
 
 namespace Botan {
 
diff --git a/src/lib/x509/x509_obj.cpp b/src/lib/x509/x509_obj.cpp
index 43e92d322..b4ad086af 100644
--- a/src/lib/x509/x509_obj.cpp
+++ b/src/lib/x509/x509_obj.cpp
@@ -6,7 +6,6 @@
 */
 
 #include <botan/x509_obj.h>
-#include <botan/x509_key.h>
 #include <botan/pubkey.h>
 #include <botan/oids.h>
 #include <botan/der_enc.h>
diff --git a/src/lib/x509/x509_obj.h b/src/lib/x509/x509_obj.h
index fdce9cb1f..be686a8c0 100644
--- a/src/lib/x509/x509_obj.h
+++ b/src/lib/x509/x509_obj.h
@@ -9,12 +9,14 @@
 #define BOTAN_X509_OBJECT_H_
 
 #include <botan/asn1_obj.h>
-#include <botan/x509_key.h>
-#include <botan/rng.h>
+#include <botan/alg_id.h>
 #include <vector>
 
 namespace Botan {
 
+class Public_Key;
+class RandomNumberGenerator;
+
 /**
 * This class represents abstract X.509 signed objects as
 * in the X.500 SIGNED macro
diff --git a/src/lib/x509/x509cert.cpp b/src/lib/x509/x509cert.cpp
index 785f414c3..8050a5d68 100644
--- a/src/lib/x509/x509cert.cpp
+++ b/src/lib/x509/x509cert.cpp
@@ -15,7 +15,6 @@
 #include <botan/hash.h>
 #include <botan/hex.h>
 #include <algorithm>
-#include <iterator>
 #include <sstream>
 
 namespace Botan {
diff --git a/src/lib/x509/x509cert.h b/src/lib/x509/x509cert.h
index f2100c8b9..14db2c133 100644
--- a/src/lib/x509/x509cert.h
+++ b/src/lib/x509/x509cert.h
@@ -16,7 +16,6 @@
 #include <botan/datastor.h>
 #include <botan/key_constraint.h>
 #include <botan/name_constraint.h>
-#include <map>
 #include <memory>
 
 namespace Botan {
diff --git a/src/lib/x509/x509path.cpp b/src/lib/x509/x509path.cpp
index beb04ea07..bc44a5cae 100644
--- a/src/lib/x509/x509path.cpp
+++ b/src/lib/x509/x509path.cpp
@@ -7,9 +7,6 @@
 
 #include <botan/x509path.h>
 #include <botan/ocsp.h>
-#include <botan/parsing.h>
-#include <botan/pubkey.h>
-#include <botan/oids.h>
 #include <algorithm>
 #include <chrono>
 #include <vector>
diff --git a/src/tests/test_bigint.cpp b/src/tests/test_bigint.cpp
index 132723727..7692aecea 100644
--- a/src/tests/test_bigint.cpp
+++ b/src/tests/test_bigint.cpp
@@ -9,9 +9,8 @@
 #if defined(BOTAN_HAS_NUMBERTHEORY)
    #include <botan/bigint.h>
    #include <botan/numthry.h>
-   #include <botan/reducer.h>
+   #include <botan/pow_mod.h>
    #include <botan/parsing.h>
-   #include <cmath>
 #endif
 
 namespace Botan_Tests {
diff --git a/src/tests/test_c25519.cpp b/src/tests/test_c25519.cpp
index cb6c8a2d5..deccc88b3 100644
--- a/src/tests/test_c25519.cpp
+++ b/src/tests/test_c25519.cpp
@@ -10,6 +10,7 @@
    #include "test_pubkey.h"
    #include <botan/curve25519.h>
    #include <botan/pkcs8.h>
+   #include <botan/data_src.h>
 #endif
 
 namespace Botan_Tests {
diff --git a/src/tests/test_dlies.cpp b/src/tests/test_dlies.cpp
index 515f7a319..42ee0b55f 100644
--- a/src/tests/test_dlies.cpp
+++ b/src/tests/test_dlies.cpp
@@ -11,7 +11,6 @@
    #include "test_pubkey.h"
    #include <botan/dlies.h>
    #include <botan/dh.h>
-   #include <botan/pubkey.h>
 #endif
 
 namespace Botan_Tests {
diff --git a/src/tests/test_ecc_pointmul.cpp b/src/tests/test_ecc_pointmul.cpp
index 9517be400..a1117a3d3 100644
--- a/src/tests/test_ecc_pointmul.cpp
+++ b/src/tests/test_ecc_pointmul.cpp
@@ -7,8 +7,6 @@
 #include "tests.h"
 
 #if defined(BOTAN_HAS_ECDSA)
-   #include "test_pubkey.h"
-   #include <botan/pubkey.h>
    #include <botan/ecdsa.h>
    #include <botan/oids.h>
 #endif
diff --git a/src/tests/test_ecdh.cpp b/src/tests/test_ecdh.cpp
index 99c8665f2..73622d015 100644
--- a/src/tests/test_ecdh.cpp
+++ b/src/tests/test_ecdh.cpp
@@ -8,7 +8,6 @@
 
 #if defined(BOTAN_HAS_ECDH)
    #include "test_pubkey.h"
-   #include <botan/pubkey.h>
    #include <botan/ecdh.h>
 #endif
 
diff --git a/src/tests/test_ecies.cpp b/src/tests/test_ecies.cpp
index 6b5f92b1e..a35725d62 100644
--- a/src/tests/test_ecies.cpp
+++ b/src/tests/test_ecies.cpp
@@ -8,7 +8,6 @@
 #include "tests.h"
 
 #if defined(BOTAN_HAS_ECIES)
-   #include "test_pubkey.h"
    #include <botan/ecies.h>
    #include <botan/ecdh.h>
 #endif
diff --git a/src/tests/test_ed25519.cpp b/src/tests/test_ed25519.cpp
index 32023589c..7cef95a48 100644
--- a/src/tests/test_ed25519.cpp
+++ b/src/tests/test_ed25519.cpp
@@ -7,9 +7,10 @@
 #include "tests.h"
 
 #if defined(BOTAN_HAS_ED25519)
+   #include "test_pubkey.h"
    #include <botan/ed25519.h>
    #include <botan/pkcs8.h>
-   #include "test_pubkey.h"
+   #include <botan/data_src.h>
 #endif
 
 namespace Botan_Tests {
diff --git a/src/tests/test_keywrap.cpp b/src/tests/test_keywrap.cpp
index 3a036ba8f..05e9cea01 100644
--- a/src/tests/test_keywrap.cpp
+++ b/src/tests/test_keywrap.cpp
@@ -6,8 +6,6 @@
 
 #include "tests.h"
 
-#include <botan/hex.h>
-
 #if defined(BOTAN_HAS_RFC3394_KEYWRAP)
    #include <botan/rfc3394.h>
 #endif
diff --git a/src/tests/test_mceliece.cpp b/src/tests/test_mceliece.cpp
index ad5fc9055..821a80f12 100644
--- a/src/tests/test_mceliece.cpp
+++ b/src/tests/test_mceliece.cpp
@@ -12,7 +12,6 @@
 
    #include <botan/mceliece.h>
    #include <botan/pubkey.h>
-   #include <botan/oids.h>
    #include <botan/loadstor.h>
    #include <botan/hash.h>
    #include <botan/hex.h>
diff --git a/src/tests/test_name_constraint.cpp b/src/tests/test_name_constraint.cpp
index 4fc6f437d..96d7bee00 100644
--- a/src/tests/test_name_constraint.cpp
+++ b/src/tests/test_name_constraint.cpp
@@ -11,13 +11,7 @@
    #include <botan/calendar.h>
 #endif
 
-#include <algorithm>
-#include <fstream>
-#include <iomanip>
-#include <string>
-#include <vector>
-#include <map>
-#include <cstdlib>
+#include <utility>
 
 namespace Botan_Tests {
 
diff --git a/src/tests/test_ocb.cpp b/src/tests/test_ocb.cpp
index a51829ef4..61d77144b 100644
--- a/src/tests/test_ocb.cpp
+++ b/src/tests/test_ocb.cpp
@@ -8,6 +8,7 @@
 
 #if defined(BOTAN_HAS_AEAD_OCB)
    #include <botan/ocb.h>
+   #include <botan/block_cipher.h>
    #include <botan/loadstor.h>
    #include <botan/internal/poly_dbl.h>
 #endif
diff --git a/src/tests/test_pkcs11_high_level.cpp b/src/tests/test_pkcs11_high_level.cpp
index 7422aed84..069aba5cb 100644
--- a/src/tests/test_pkcs11_high_level.cpp
+++ b/src/tests/test_pkcs11_high_level.cpp
@@ -10,11 +10,7 @@
 
 #include <string>
 #include <vector>
-#include <functional>
 #include <memory>
-#include <array>
-#include <type_traits>
-#include <map>
 #include <numeric>
 
 #if defined(BOTAN_HAS_PKCS11)
diff --git a/src/tests/test_pkcs11_low_level.cpp b/src/tests/test_pkcs11_low_level.cpp
index 01933b359..04659e6f6 100644
--- a/src/tests/test_pkcs11_low_level.cpp
+++ b/src/tests/test_pkcs11_low_level.cpp
@@ -13,7 +13,6 @@
 #include <functional>
 #include <memory>
 #include <array>
-#include <type_traits>
 #include <map>
 
 #if defined(BOTAN_HAS_PKCS11)
diff --git a/src/tests/test_pubkey.cpp b/src/tests/test_pubkey.cpp
index a7e58b10f..3859fcf8f 100644
--- a/src/tests/test_pubkey.cpp
+++ b/src/tests/test_pubkey.cpp
@@ -15,8 +15,8 @@
 #include <botan/pk_algs.h>
 #include <botan/x509_key.h>
 #include <botan/pkcs8.h>
-#include <botan/oids.h>
 #include <botan/hex.h>
+#include <botan/data_src.h>
 
 namespace Botan_Tests {
 
diff --git a/src/tests/test_rfc6979.cpp b/src/tests/test_rfc6979.cpp
index a9992b4f2..9dcba0f40 100644
--- a/src/tests/test_rfc6979.cpp
+++ b/src/tests/test_rfc6979.cpp
@@ -8,7 +8,6 @@
 
 #if defined(BOTAN_HAS_RFC6979_GENERATOR)
    #include <botan/rfc6979.h>
-   #include <botan/hex.h>
 #endif
 
 #include <botan/hash.h>
diff --git a/src/tests/test_x509_path.cpp b/src/tests/test_x509_path.cpp
index 544d1b35d..84b3b682b 100644
--- a/src/tests/test_x509_path.cpp
+++ b/src/tests/test_x509_path.cpp
@@ -11,15 +11,13 @@
    #include <botan/calendar.h>
    #include <botan/internal/filesystem.h>
    #include <botan/parsing.h>
+   #include <botan/data_src.h>
 #endif
 
-#include <algorithm>
 #include <fstream>
-#include <iomanip>
 #include <string>
 #include <vector>
 #include <map>
-#include <cstdlib>
 
 namespace Botan_Tests {
 
diff --git a/src/tests/unit_ecdsa.cpp b/src/tests/unit_ecdsa.cpp
index 2654753eb..46d270aab 100644
--- a/src/tests/unit_ecdsa.cpp
+++ b/src/tests/unit_ecdsa.cpp
@@ -19,6 +19,7 @@
    #include <botan/oids.h>
    #include <botan/pkcs8.h>
    #include <botan/hash.h>
+   #include <botan/data_src.h>
 #endif
 
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
diff --git a/src/tests/unit_tls.cpp b/src/tests/unit_tls.cpp
index 5ec44331c..2983aa3eb 100644
--- a/src/tests/unit_tls.cpp
+++ b/src/tests/unit_tls.cpp
@@ -18,13 +18,13 @@
 
    #include <botan/tls_client.h>
    #include <botan/tls_server.h>
+   #include <botan/tls_policy.h>
 
    #include <botan/ec_group.h>
    #include <botan/hex.h>
    #include <botan/pkcs10.h>
    #include <botan/rsa.h>
    #include <botan/ecdsa.h>
-   #include <botan/tls_handshake_msg.h>
    #include <botan/x509_ca.h>
    #include <botan/x509self.h>
 
diff --git a/src/tests/unit_tls_policy.cpp b/src/tests/unit_tls_policy.cpp
index 909a3cd57..aa337a81b 100644
--- a/src/tests/unit_tls_policy.cpp
+++ b/src/tests/unit_tls_policy.cpp
@@ -9,8 +9,6 @@
 #include "tests.h"
 
 #if defined(BOTAN_HAS_TLS)
-   #include <botan/pubkey.h>
-   #include <botan/oids.h>
    #include <botan/tls_policy.h>
    #include <botan/tls_exceptn.h>
 #endif
diff --git a/src/tests/unit_x509.cpp b/src/tests/unit_x509.cpp
index 0979325ce..3f28da4a0 100644
--- a/src/tests/unit_x509.cpp
+++ b/src/tests/unit_x509.cpp
@@ -10,8 +10,6 @@
 #if defined(BOTAN_HAS_X509_CERTIFICATES)
 
    #include <botan/calendar.h>
-   #include <botan/pkcs8.h>
-   #include <botan/hash.h>
    #include <botan/pkcs10.h>
    #include <botan/x509self.h>
    #include <botan/x509path.h>