diff --git a/configure.ac b/configure.ac
index 78a3d4e..dfb151e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -645,9 +645,9 @@ if test "x$nettle_cv_fcntl_locking" = "xyes" ; then
 fi

 # Checks for libraries
-AC_CHECK_LIB(gmp, __gmpz_getlimbn,,
+AC_CHECK_LIB(gmp, __gmpz_powm_sec,,
     [AC_MSG_WARN(
-[GNU MP not found, or not 3.1 or up, see http://gmplib.org/.
+[GNU MP not found, or not 5.0 or up, see http://gmplib.org/.
 Support for public key algorithms will be unavailable.])]
     enable_public_key=no)

diff --git a/dsa-sign.c b/dsa-sign.c
index 0b5ab1d..d0baa27 100644
--- a/dsa-sign.c
+++ b/dsa-sign.c
@@ -54,6 +54,11 @@ _dsa_sign(const struct dsa_public_key *pub,
   if (mpz_sizeinbase(pub->q, 2) != 8 * digest_size)
     return 0;

+  /* Check that p is odd, so that invalid keys don't result in a crash
+     inside mpz_powm_sec. */
+  if (mpz_even_p (pub->p))
+    return 0;
+
   /* Select k, 0<k<q, randomly */
   mpz_init_set(tmp, pub->q);
   mpz_sub_ui(tmp, tmp, 1);
@@ -63,7 +68,7 @@ _dsa_sign(const struct dsa_public_key *pub,
   mpz_add_ui(k, k, 1);

   /* Compute r = (g^k (mod p)) (mod q) */
-  mpz_powm(tmp, pub->g, k, pub->p);
+  mpz_powm_sec(tmp, pub->g, k, pub->p);
   mpz_fdiv_r(signature->r, tmp, pub->q);

   /* Compute hash */
diff --git a/rsa-blind.c b/rsa-blind.c
index 97485be..468b68e 100644
--- a/rsa-blind.c
+++ b/rsa-blind.c
@@ -53,7 +53,7 @@ _rsa_blind (const struct rsa_public_key *pub,
   while (!mpz_invert (ri, r, pub->n));

   /* c = c*(r^e) mod n */
-  mpz_powm(r, r, pub->e, pub->n);
+  mpz_powm_sec(r, r, pub->e, pub->n);
   mpz_mul(c, c, r);
   mpz_fdiv_r(c, c, pub->n);

diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c
index 312b182..4066619 100644
--- a/rsa-decrypt-tr.c
+++ b/rsa-decrypt-tr.c
@@ -43,6 +43,9 @@ rsa_decrypt_tr(const struct rsa_public_key *pub,
   mpz_t m, ri;
   int res;

+  if (mpz_even_p (pub->n) || mpz_even_p (key->p) || mpz_even_p (key->q))
+    return 0;
+
   mpz_init_set(m, gibberish);
   mpz_init (ri);

diff --git a/rsa-decrypt.c b/rsa-decrypt.c
index a3abf6e..64d12ae 100644
--- a/rsa-decrypt.c
+++ b/rsa-decrypt.c
@@ -39,6 +39,9 @@ rsa_decrypt(const struct rsa_private_key *key,
   mpz_t m;
   int res;

+  if (mpz_even_p (key->p) || mpz_even_p (key->q))
+    return 0;
+
   mpz_init(m);
   rsa_compute_root(key, m, gibberish);

diff --git a/rsa-pkcs1-sign-tr.c b/rsa-pkcs1-sign-tr.c
index 5efc155..0031706 100644
--- a/rsa-pkcs1-sign-tr.c
+++ b/rsa-pkcs1-sign-tr.c
@@ -40,6 +40,9 @@ rsa_pkcs1_sign_tr(const struct rsa_public_key *pub,
 {
   mpz_t ri;

+  if (mpz_even_p (pub->n) || mpz_even_p (key->p) || mpz_even_p (key->q))
+    return 0;
+
   if (pkcs1_rsa_digest_encode (s, key->size, length, digest_info))
     {
       mpz_init (ri);
diff --git a/rsa-pkcs1-sign.c b/rsa-pkcs1-sign.c
index 9162cfc..e39485b 100644
--- a/rsa-pkcs1-sign.c
+++ b/rsa-pkcs1-sign.c
@@ -36,6 +36,9 @@ rsa_pkcs1_sign(const struct rsa_private_key *key,
	       unsigned length, const uint8_t *digest_info,
	       mpz_t s)
 {
+  if (mpz_even_p (key->p) || mpz_even_p (key->q))
+    return 0;
+
   if (pkcs1_rsa_digest_encode (s, key->size, length, digest_info))
     {
       rsa_compute_root(key, s, s);
diff --git a/rsa-sign.c b/rsa-sign.c
index 56adda3..9f2a707 100644
--- a/rsa-sign.c
+++ b/rsa-sign.c
@@ -88,11 +88,11 @@ rsa_compute_root(const struct rsa_private_key *key,

   /* Compute xq = m^d % q = (m%q)^b % q */
   mpz_fdiv_r(xq, m, key->q);
-  mpz_powm(xq, xq, key->b, key->q);
+  mpz_powm_sec(xq, xq, key->b, key->q);

   /* Compute xp = m^d % p = (m%p)^a % p */
   mpz_fdiv_r(xp, m, key->p);
-  mpz_powm(xp, xp, key->a, key->p);
+  mpz_powm_sec(xp, xp, key->a, key->p);

   /* Set xp' = (xp - xq) c % p. */
   mpz_sub(xp, xp, xq);
diff --git a/rsa.c b/rsa.c
index e303a8c..91b3f85 100644
--- a/rsa.c
+++ b/rsa.c
@@ -58,6 +58,9 @@ _rsa_check_size(mpz_t n)
   /* Round upwards */
   unsigned size = (mpz_sizeinbase(n, 2) + 7) / 8;

+  if (mpz_even_p (n))
+    return 0;
+
   if (size < RSA_MINIMUM_N_OCTETS)
     return 0;

diff --git a/testsuite/rsa-test.c b/testsuite/rsa-test.c
index e9b1c03..a429664 100644
--- a/testsuite/rsa-test.c
+++ b/testsuite/rsa-test.c
@@ -57,6 +57,13 @@ test_main(void)

   test_rsa_sha512(&pub, &key, expected);

+  /* Test detection of invalid keys with even modulo */
+  mpz_clrbit (pub.n, 0);
+  ASSERT (!rsa_public_key_prepare (&pub));
+
+  mpz_clrbit (key.p, 0);
+  ASSERT (!rsa_private_key_prepare (&key));
+
   /* 777-bit key, generated by
    *
    *   lsh-keygen -a rsa -l 777 -f advanced-hex