diff --git a/src/Geralt/Crypto/AEGIS128L.cs b/src/Geralt/Crypto/AEGIS128L.cs
index 6b7c1fa..7982818 100644
--- a/src/Geralt/Crypto/AEGIS128L.cs
+++ b/src/Geralt/Crypto/AEGIS128L.cs
@@ -9,30 +9,24 @@ public static class AEGIS128L
     public const int NonceSize = crypto_aead_aegis128l_NPUBBYTES;
     public const int TagSize = crypto_aead_aegis128l_ABYTES;
 
-    public static unsafe void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.EqualToSize(nameof(ciphertext), ciphertext.Length, plaintext.Length + TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* c = ciphertext, p = plaintext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_aegis128l_encrypt(c, ciphertextLength: out _, p, (ulong)plaintext.Length, ad, (ulong)associatedData.Length, nsec: null, n, k);
-            if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
-        }
+        int ret = crypto_aead_aegis128l_encrypt(ciphertext, ciphertextLength: out _, plaintext, (ulong)plaintext.Length, associatedData, (ulong)associatedData.Length, nsec: null, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
     }
 
-    public static unsafe void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.NotLessThanMin(nameof(ciphertext), ciphertext.Length, TagSize);
         Validation.EqualToSize(nameof(plaintext), plaintext.Length, ciphertext.Length - TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* p = plaintext, c = ciphertext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_aegis128l_decrypt(p, plaintextLength: out _, nsec: null, c, (ulong)ciphertext.Length, ad, (ulong)associatedData.Length, n, k);
-            if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
-        }
+        int ret = crypto_aead_aegis128l_decrypt(plaintext, plaintextLength: out _, nsec: null, ciphertext, (ulong)ciphertext.Length, associatedData, (ulong)associatedData.Length, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
     }
 }
diff --git a/src/Geralt/Crypto/AEGIS256.cs b/src/Geralt/Crypto/AEGIS256.cs
index e1d7f72..16b0688 100644
--- a/src/Geralt/Crypto/AEGIS256.cs
+++ b/src/Geralt/Crypto/AEGIS256.cs
@@ -9,30 +9,24 @@ public static class AEGIS256
     public const int NonceSize = crypto_aead_aegis256_NPUBBYTES;
     public const int TagSize = crypto_aead_aegis256_ABYTES;
 
-    public static unsafe void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.EqualToSize(nameof(ciphertext), ciphertext.Length, plaintext.Length + TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* c = ciphertext, p = plaintext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_aegis256_encrypt(c, ciphertextLength: out _, p, (ulong)plaintext.Length, ad, (ulong)associatedData.Length, nsec: null, n, k);
-            if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
-        }
+        int ret = crypto_aead_aegis256_encrypt(ciphertext, ciphertextLength: out _, plaintext, (ulong)plaintext.Length, associatedData, (ulong)associatedData.Length, nsec: null, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
     }
 
-    public static unsafe void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.NotLessThanMin(nameof(ciphertext), ciphertext.Length, TagSize);
         Validation.EqualToSize(nameof(plaintext), plaintext.Length, ciphertext.Length - TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* p = plaintext, c = ciphertext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_aegis256_decrypt(p, plaintextLength: out _, nsec: null, c, (ulong)ciphertext.Length, ad, (ulong)associatedData.Length, n, k);
-            if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
-        }
+        int ret = crypto_aead_aegis256_decrypt(plaintext, plaintextLength: out _, nsec: null, ciphertext, (ulong)ciphertext.Length, associatedData, (ulong)associatedData.Length, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
     }
 }
diff --git a/src/Geralt/Crypto/Argon2id.cs b/src/Geralt/Crypto/Argon2id.cs
index 57847a3..7e6cd1e 100644
--- a/src/Geralt/Crypto/Argon2id.cs
+++ b/src/Geralt/Crypto/Argon2id.cs
@@ -14,54 +14,44 @@ public static class Argon2id
     public const int MaxHashSize = crypto_pwhash_STRBYTES;
     private const string HashPrefix = crypto_pwhash_argon2id_STRPREFIX;
 
-    public static unsafe void DeriveKey(Span<byte> outputKeyingMaterial, ReadOnlySpan<byte> password, ReadOnlySpan<byte> salt, int iterations, int memorySize)
+    public static void DeriveKey(Span<byte> outputKeyingMaterial, ReadOnlySpan<byte> password, ReadOnlySpan<byte> salt, int iterations, int memorySize)
     {
         Validation.NotLessThanMin(nameof(outputKeyingMaterial), outputKeyingMaterial.Length, MinKeySize);
         Validation.EqualToSize(nameof(salt), salt.Length, SaltSize);
         Validation.NotLessThanMin(nameof(iterations), iterations, MinIterations);
         Validation.NotLessThanMin(nameof(memorySize), memorySize, MinMemorySize);
         Sodium.Initialize();
-        fixed (byte* okm = outputKeyingMaterial, p = password, s = salt)
-        {
-            int ret = crypto_pwhash(okm, (ulong)outputKeyingMaterial.Length, p, (ulong)password.Length, s, (ulong)iterations, (nuint)memorySize, crypto_pwhash_argon2id_ALG_ARGON2ID13);
-            if (ret != 0) { throw new InsufficientMemoryException("Insufficient memory to perform key derivation."); }
-        }
+        int ret = crypto_pwhash(outputKeyingMaterial, (ulong)outputKeyingMaterial.Length, password, (ulong)password.Length, salt, (ulong)iterations, (nuint)memorySize, crypto_pwhash_argon2id_ALG_ARGON2ID13);
+        if (ret != 0) { throw new InsufficientMemoryException("Insufficient memory to perform key derivation."); }
     }
 
-    public static unsafe void ComputeHash(Span<byte> hash, ReadOnlySpan<byte> password, int iterations, int memorySize)
+    public static void ComputeHash(Span<byte> hash, ReadOnlySpan<byte> password, int iterations, int memorySize)
     {
         Validation.EqualToSize(nameof(hash), hash.Length, MaxHashSize);
         Validation.NotLessThanMin(nameof(iterations), iterations, MinIterations);
         Validation.NotLessThanMin(nameof(memorySize), memorySize, MinMemorySize);
         Sodium.Initialize();
-        fixed (byte* h = hash, p = password)
-        {
-            int ret = crypto_pwhash_str_alg(h, p, (ulong)password.Length, (ulong)iterations, (nuint)memorySize, crypto_pwhash_argon2id_ALG_ARGON2ID13);
-            if (ret != 0) { throw new InsufficientMemoryException("Insufficient memory to perform password hashing."); }
-        }
+        int ret = crypto_pwhash_str_alg(hash, password, (ulong)password.Length, (ulong)iterations, (nuint)memorySize, crypto_pwhash_argon2id_ALG_ARGON2ID13);
+        if (ret != 0) { throw new InsufficientMemoryException("Insufficient memory to perform password hashing."); }
     }
 
-    public static unsafe bool VerifyHash(ReadOnlySpan<byte> hash, ReadOnlySpan<byte> password)
+    public static bool VerifyHash(ReadOnlySpan<byte> hash, ReadOnlySpan<byte> password)
     {
         Validation.SizeBetween(nameof(hash), hash.Length, MinHashSize, MaxHashSize);
         ThrowIfInvalidHashPrefix(hash);
         Sodium.Initialize();
-        fixed (byte* h = hash, p = password)
-            return crypto_pwhash_str_verify(h, p, (ulong)password.Length) == 0;
+        return crypto_pwhash_str_verify(hash, password, (ulong)password.Length) == 0;
     }
 
-    public static unsafe bool NeedsRehash(ReadOnlySpan<byte> hash, int iterations, int memorySize)
+    public static bool NeedsRehash(ReadOnlySpan<byte> hash, int iterations, int memorySize)
     {
         Validation.SizeBetween(nameof(hash), hash.Length, MinHashSize, MaxHashSize);
         Validation.NotLessThanMin(nameof(iterations), iterations, MinIterations);
         Validation.NotLessThanMin(nameof(memorySize), memorySize, MinMemorySize);
         ThrowIfInvalidHashPrefix(hash);
         Sodium.Initialize();
-        fixed (byte* h = hash)
-        {
-            int ret = crypto_pwhash_str_needs_rehash(h, (ulong)iterations, (nuint)memorySize);
-            return ret == -1 ? throw new FormatException("Invalid encoded password hash.") : ret == 1;
-        }
+        int ret = crypto_pwhash_str_needs_rehash(hash, (ulong)iterations, (nuint)memorySize);
+        return ret == -1 ? throw new FormatException("Invalid encoded password hash.") : ret == 1;
     }
 
     private static void ThrowIfInvalidHashPrefix(ReadOnlySpan<byte> hash)
diff --git a/src/Geralt/Crypto/BLAKE2b.cs b/src/Geralt/Crypto/BLAKE2b.cs
index 2b63cc6..1c301cc 100644
--- a/src/Geralt/Crypto/BLAKE2b.cs
+++ b/src/Geralt/Crypto/BLAKE2b.cs
@@ -18,15 +18,12 @@ public static class BLAKE2b
     public const int MaxKeySize = crypto_generichash_KEYBYTES_MAX;
     private const int StreamBufferSize = 4096;
 
-    public static unsafe void ComputeHash(Span<byte> hash, ReadOnlySpan<byte> message)
+    public static void ComputeHash(Span<byte> hash, ReadOnlySpan<byte> message)
     {
         Validation.SizeBetween(nameof(hash), hash.Length, MinHashSize, MaxHashSize);
         Sodium.Initialize();
-        fixed (byte* h = hash, m = message)
-        {
-            int ret = crypto_generichash_blake2b(h, (nuint)hash.Length, m, (ulong)message.Length, key: null, keyLength: 0);
-            if (ret != 0) { throw new CryptographicException("Error computing hash."); }
-        }
+        int ret = crypto_generichash_blake2b(hash, (nuint)hash.Length, message, (ulong)message.Length, key: null, keyLength: 0);
+        if (ret != 0) { throw new CryptographicException("Error computing hash."); }
     }
 
     public static void ComputeHash(Span<byte> hash, Stream message)
@@ -43,16 +40,13 @@ public static void ComputeHash(Span<byte> hash, Stream message)
         blake2b.Finalize(hash);
     }
 
-    public static unsafe void ComputeTag(Span<byte> tag, ReadOnlySpan<byte> message, ReadOnlySpan<byte> key)
+    public static void ComputeTag(Span<byte> tag, ReadOnlySpan<byte> message, ReadOnlySpan<byte> key)
     {
         Validation.SizeBetween(nameof(tag), tag.Length, MinTagSize, MaxTagSize);
         Validation.SizeBetween(nameof(key), key.Length, MinKeySize, MaxKeySize);
         Sodium.Initialize();
-        fixed (byte* t = tag, m = message, k = key)
-        {
-            int ret = crypto_generichash_blake2b(t, (nuint)tag.Length, m, (ulong)message.Length, k, (nuint)key.Length);
-            if (ret != 0) { throw new CryptographicException("Error computing tag."); }
-        }
+        int ret = crypto_generichash_blake2b(tag, (nuint)tag.Length, message, (ulong)message.Length, key, (nuint)key.Length);
+        if (ret != 0) { throw new CryptographicException("Error computing tag."); }
     }
 
     public static bool VerifyTag(ReadOnlySpan<byte> tag, ReadOnlySpan<byte> message, ReadOnlySpan<byte> key)
@@ -66,17 +60,14 @@ public static bool VerifyTag(ReadOnlySpan<byte> tag, ReadOnlySpan<byte> message,
         return equal;
     }
 
-    public static unsafe void DeriveKey(Span<byte> outputKeyingMaterial, ReadOnlySpan<byte> inputKeyingMaterial, ReadOnlySpan<byte> personalization, ReadOnlySpan<byte> salt = default, ReadOnlySpan<byte> info = default)
+    public static void DeriveKey(Span<byte> outputKeyingMaterial, ReadOnlySpan<byte> inputKeyingMaterial, ReadOnlySpan<byte> personalization, ReadOnlySpan<byte> salt = default, ReadOnlySpan<byte> info = default)
     {
         Validation.SizeBetween(nameof(outputKeyingMaterial), outputKeyingMaterial.Length, MinKeySize, MaxKeySize);
         Validation.SizeBetween(nameof(inputKeyingMaterial), inputKeyingMaterial.Length, MinKeySize, MaxKeySize);
         Validation.EqualToSize(nameof(personalization), personalization.Length, PersonalSize);
         if (salt.Length != 0) { Validation.EqualToSize(nameof(salt), salt.Length, SaltSize); }
         Sodium.Initialize();
-        fixed (byte* okm = outputKeyingMaterial, ikm = inputKeyingMaterial, p = personalization, s = salt, i = info)
-        {
-            int ret = crypto_generichash_blake2b_salt_personal(okm, (nuint)outputKeyingMaterial.Length, i, (ulong)info.Length, ikm, (nuint)inputKeyingMaterial.Length, s, p);
-            if (ret != 0) { throw new CryptographicException("Error deriving key."); }
-        }
+        int ret = crypto_generichash_blake2b_salt_personal(outputKeyingMaterial, (nuint)outputKeyingMaterial.Length, info, (ulong)info.Length, inputKeyingMaterial, (nuint)inputKeyingMaterial.Length, salt.Length != 0 ? salt : new byte[SaltSize], personalization);
+        if (ret != 0) { throw new CryptographicException("Error deriving key."); }
     }
 }
diff --git a/src/Geralt/Crypto/ChaCha20.cs b/src/Geralt/Crypto/ChaCha20.cs
index 8d87cfa..17c05de 100644
--- a/src/Geralt/Crypto/ChaCha20.cs
+++ b/src/Geralt/Crypto/ChaCha20.cs
@@ -9,45 +9,36 @@ public static class ChaCha20
     public const int NonceSize = crypto_stream_chacha20_ietf_NONCEBYTES;
     public const int BlockSize = 64;
 
-    public static unsafe void Fill(Span<byte> buffer, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key)
+    public static void Fill(Span<byte> buffer, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key)
     {
         Validation.NotEmpty(nameof(buffer), buffer.Length);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* b = buffer, n = nonce, k = key)
-        {
-            int ret = crypto_stream_chacha20_ietf(b, (ulong)buffer.Length, n, k);
-            if (ret != 0) { throw new CryptographicException("Error computing pseudorandom bytes."); }
-        }
+        int ret = crypto_stream_chacha20_ietf(buffer, (ulong)buffer.Length, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Error computing pseudorandom bytes."); }
     }
 
-    public static unsafe void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, uint counter = 0)
+    public static void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, uint counter = 0)
     {
         Validation.EqualToSize(nameof(ciphertext), ciphertext.Length, plaintext.Length);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         ThrowIfCounterOverflow(plaintext.Length, counter);
         Sodium.Initialize();
-        fixed (byte* c = ciphertext, p = plaintext, n = nonce, k = key)
-        {
-            int ret = crypto_stream_chacha20_ietf_xor_ic(c, p, (ulong)plaintext.Length, n, counter, k);
-            if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
-        }
+        int ret = crypto_stream_chacha20_ietf_xor_ic(ciphertext, plaintext, (ulong)plaintext.Length, nonce, counter, key);
+        if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
     }
 
-    public static unsafe void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, uint counter = 0)
+    public static void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, uint counter = 0)
     {
         Validation.EqualToSize(nameof(plaintext), plaintext.Length, ciphertext.Length);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         ThrowIfCounterOverflow(ciphertext.Length, counter);
         Sodium.Initialize();
-        fixed (byte* p = plaintext, c = ciphertext, n = nonce, k = key)
-        {
-            int ret = crypto_stream_chacha20_ietf_xor_ic(p, c, (ulong)ciphertext.Length, n, counter, k);
-            if (ret != 0) { throw new CryptographicException("Error decrypting ciphertext."); }
-        }
+        int ret = crypto_stream_chacha20_ietf_xor_ic(plaintext, ciphertext, (ulong)ciphertext.Length, nonce, counter, key);
+        if (ret != 0) { throw new CryptographicException("Error decrypting ciphertext."); }
     }
 
     private static void ThrowIfCounterOverflow(int messageSize, uint counter)
diff --git a/src/Geralt/Crypto/ChaCha20Poly1305.cs b/src/Geralt/Crypto/ChaCha20Poly1305.cs
index ee7bcc0..eb7f45c 100644
--- a/src/Geralt/Crypto/ChaCha20Poly1305.cs
+++ b/src/Geralt/Crypto/ChaCha20Poly1305.cs
@@ -9,30 +9,24 @@ public static class ChaCha20Poly1305
     public const int NonceSize = crypto_aead_chacha20poly1305_IETF_NPUBBYTES;
     public const int TagSize = crypto_aead_chacha20poly1305_IETF_ABYTES;
 
-    public static unsafe void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.EqualToSize(nameof(ciphertext), ciphertext.Length, plaintext.Length + TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* c = ciphertext, p = plaintext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_chacha20poly1305_ietf_encrypt(c, ciphertextLength: out _, p, (ulong)plaintext.Length, ad, (ulong)associatedData.Length, nsec: null, n, k);
-            if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
-        }
+        int ret = crypto_aead_chacha20poly1305_ietf_encrypt(ciphertext, ciphertextLength: out _, plaintext, (ulong)plaintext.Length, associatedData, (ulong)associatedData.Length, nsec: null, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
     }
 
-    public static unsafe void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.NotLessThanMin(nameof(ciphertext), ciphertext.Length, TagSize);
         Validation.EqualToSize(nameof(plaintext), plaintext.Length, ciphertext.Length - TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* p = plaintext, c = ciphertext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_chacha20poly1305_ietf_decrypt(p, plaintextLength: out _, nsec: null, c, (ulong)ciphertext.Length, ad, (ulong)associatedData.Length, n, k);
-            if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
-        }
+        int ret = crypto_aead_chacha20poly1305_ietf_decrypt(plaintext, plaintextLength: out _, nsec: null, ciphertext, (ulong)ciphertext.Length, associatedData, (ulong)associatedData.Length, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
     }
 }
diff --git a/src/Geralt/Crypto/ConstantTime.cs b/src/Geralt/Crypto/ConstantTime.cs
index 6b21ef1..1eefd76 100644
--- a/src/Geralt/Crypto/ConstantTime.cs
+++ b/src/Geralt/Crypto/ConstantTime.cs
@@ -4,26 +4,24 @@ namespace Geralt;
 
 public static class ConstantTime
 {
-    public static unsafe bool Equals(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
+    public static bool Equals(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
     {
         Validation.NotEmpty(nameof(a), a.Length);
         Validation.NotEmpty(nameof(b), b.Length);
         Sodium.Initialize();
         // It's impossible to prevent the lengths being leaked
         if (a.Length != b.Length) { return false; }
-        fixed (byte* aa = a, bb = b)
-            return sodium_memcmp(aa, bb, (nuint)a.Length) == 0;
+        return sodium_memcmp(a, b, (nuint)a.Length) == 0;
     }
 
-    public static unsafe void Increment(Span<byte> buffer)
+    public static void Increment(Span<byte> buffer)
     {
         Validation.NotEmpty(nameof(buffer), buffer.Length);
         Sodium.Initialize();
-        fixed (byte* b = buffer)
-            sodium_increment(b, (nuint)buffer.Length);
+        sodium_increment(buffer, (nuint)buffer.Length);
     }
 
-    public static unsafe void Add(Span<byte> buffer, ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
+    public static void Add(Span<byte> buffer, ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
     {
         Validation.NotEmpty(nameof(buffer), buffer.Length);
         Validation.NotEmpty(nameof(a), a.Length);
@@ -32,11 +30,10 @@ public static unsafe void Add(Span<byte> buffer, ReadOnlySpan<byte> a, ReadOnlyS
         Validation.EqualToSize(nameof(a), a.Length, b.Length);
         Sodium.Initialize();
         a.CopyTo(buffer);
-        fixed (byte* aa = buffer, bb = b)
-            sodium_add(aa, bb, (nuint)buffer.Length);
+        sodium_add(buffer, b, (nuint)buffer.Length);
     }
 
-    public static unsafe void Subtract(Span<byte> buffer, ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
+    public static void Subtract(Span<byte> buffer, ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
     {
         Validation.NotEmpty(nameof(buffer), buffer.Length);
         Validation.NotEmpty(nameof(a), a.Length);
@@ -45,34 +42,30 @@ public static unsafe void Subtract(Span<byte> buffer, ReadOnlySpan<byte> a, Read
         Validation.EqualToSize(nameof(a), a.Length, b.Length);
         Sodium.Initialize();
         a.CopyTo(buffer);
-        fixed (byte* aa = buffer, bb = b)
-            sodium_sub(aa, bb, (nuint)buffer.Length);
+        sodium_sub(buffer, b, (nuint)buffer.Length);
     }
 
-    public static unsafe bool IsLessThan(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
+    public static bool IsLessThan(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
     {
         Validation.NotEmpty(nameof(a), a.Length);
         Validation.NotEmpty(nameof(b), b.Length);
         Validation.EqualToSize(nameof(a), a.Length, b.Length);
         Sodium.Initialize();
-        fixed (byte* aa = a, bb = b)
-            return sodium_compare(aa, bb, (nuint)a.Length) == -1;
+        return sodium_compare(a, b, (nuint)a.Length) == -1;
     }
 
-    public static unsafe bool IsGreaterThan(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
+    public static bool IsGreaterThan(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b)
     {
         Validation.NotEmpty(nameof(a), a.Length);
         Validation.NotEmpty(nameof(b), b.Length);
         Validation.EqualToSize(nameof(a), a.Length, b.Length);
         Sodium.Initialize();
-        fixed (byte* aa = a, bb = b)
-            return sodium_compare(aa, bb, (nuint)a.Length) == 1;
+        return sodium_compare(a, b, (nuint)a.Length) == 1;
     }
 
-    public static unsafe bool IsAllZeros(ReadOnlySpan<byte> buffer)
+    public static bool IsAllZeros(ReadOnlySpan<byte> buffer)
     {
         Sodium.Initialize();
-        fixed (byte* b = buffer)
-            return sodium_is_zero(b, (nuint)buffer.Length) == 1;
+        return sodium_is_zero(buffer, (nuint)buffer.Length) == 1;
     }
 }
diff --git a/src/Geralt/Crypto/Ed25519.cs b/src/Geralt/Crypto/Ed25519.cs
index 6065bdf..31ac364 100644
--- a/src/Geralt/Crypto/Ed25519.cs
+++ b/src/Geralt/Crypto/Ed25519.cs
@@ -10,85 +10,66 @@ public static class Ed25519
     public const int SignatureSize = crypto_sign_BYTES;
     public const int SeedSize = crypto_sign_SEEDBYTES;
 
-    public static unsafe void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey)
+    public static void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey)
     {
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         Sodium.Initialize();
-        fixed (byte* pk = publicKey, sk = privateKey)
-        {
-            int ret = crypto_sign_keypair(pk, sk);
-            if (ret != 0) { throw new CryptographicException("Unable to generate key pair."); }
-        }
+        int ret = crypto_sign_keypair(publicKey, privateKey);
+        if (ret != 0) { throw new CryptographicException("Unable to generate key pair."); }
     }
 
-    public static unsafe void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey, ReadOnlySpan<byte> seed)
+    public static void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey, ReadOnlySpan<byte> seed)
     {
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         Validation.EqualToSize(nameof(seed), seed.Length, SeedSize);
         Sodium.Initialize();
-        fixed (byte* pk = publicKey, sk = privateKey, s = seed)
-        {
-            int ret = crypto_sign_seed_keypair(pk, sk, s);
-            if (ret != 0) { throw new CryptographicException("Unable to generate key pair from seed."); }
-        }
+        int ret = crypto_sign_seed_keypair(publicKey, privateKey, seed);
+        if (ret != 0) { throw new CryptographicException("Unable to generate key pair from seed."); }
     }
 
-    public static unsafe void ComputePublicKey(Span<byte> publicKey, ReadOnlySpan<byte> privateKey)
+    public static void ComputePublicKey(Span<byte> publicKey, ReadOnlySpan<byte> privateKey)
     {
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         Sodium.Initialize();
-        fixed (byte* pk = publicKey, sk = privateKey)
-        {
-            int ret = crypto_sign_ed25519_sk_to_pk(pk, sk);
-            if (ret != 0) { throw new CryptographicException("Unable to compute public key from private key."); }
-        }
+        int ret = crypto_sign_ed25519_sk_to_pk(publicKey, privateKey);
+        if (ret != 0) { throw new CryptographicException("Unable to compute public key from private key."); }
     }
 
-    public static unsafe void GetX25519PublicKey(Span<byte> x25519PublicKey, ReadOnlySpan<byte> ed25519PublicKey)
+    public static void GetX25519PublicKey(Span<byte> x25519PublicKey, ReadOnlySpan<byte> ed25519PublicKey)
     {
         Validation.EqualToSize(nameof(x25519PublicKey), x25519PublicKey.Length, X25519.PublicKeySize);
         Validation.EqualToSize(nameof(ed25519PublicKey), ed25519PublicKey.Length, PublicKeySize);
         Sodium.Initialize();
-        fixed (byte* x = x25519PublicKey, e = ed25519PublicKey)
-        {
-            int ret = crypto_sign_ed25519_pk_to_curve25519(x, e);
-            if (ret != 0) { throw new CryptographicException("Unable to compute X25519 public key."); }
-        }
+        int ret = crypto_sign_ed25519_pk_to_curve25519(x25519PublicKey, ed25519PublicKey);
+        if (ret != 0) { throw new CryptographicException("Unable to compute X25519 public key."); }
     }
 
-    public static unsafe void GetX25519PrivateKey(Span<byte> x25519PrivateKey, ReadOnlySpan<byte> ed25519PrivateKey)
+    public static void GetX25519PrivateKey(Span<byte> x25519PrivateKey, ReadOnlySpan<byte> ed25519PrivateKey)
     {
         Validation.EqualToSize(nameof(x25519PrivateKey), x25519PrivateKey.Length, X25519.PrivateKeySize);
         Validation.EqualToSize(nameof(ed25519PrivateKey), ed25519PrivateKey.Length, PrivateKeySize);
         Sodium.Initialize();
-        fixed (byte* x = x25519PrivateKey, e = ed25519PrivateKey)
-        {
-            int ret = crypto_sign_ed25519_sk_to_curve25519(x, e);
-            if (ret != 0) { throw new CryptographicException("Unable to compute X25519 private key."); }
-        }
+        int ret = crypto_sign_ed25519_sk_to_curve25519(x25519PrivateKey, ed25519PrivateKey);
+        if (ret != 0) { throw new CryptographicException("Unable to compute X25519 private key."); }
     }
 
-    public static unsafe void Sign(Span<byte> signature, ReadOnlySpan<byte> message, ReadOnlySpan<byte> privateKey)
+    public static void Sign(Span<byte> signature, ReadOnlySpan<byte> message, ReadOnlySpan<byte> privateKey)
     {
         Validation.EqualToSize(nameof(signature), signature.Length, SignatureSize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         Sodium.Initialize();
-        fixed (byte* s = signature, m = message, sk = privateKey)
-        {
-            int ret = crypto_sign_detached(s, signatureLength: out _, m, (ulong)message.Length, sk);
-            if (ret != 0) { throw new CryptographicException("Unable to compute signature."); }
-        }
+        int ret = crypto_sign_detached(signature, signatureLength: out _, message, (ulong)message.Length, privateKey);
+        if (ret != 0) { throw new CryptographicException("Unable to compute signature."); }
     }
 
-    public static unsafe bool Verify(ReadOnlySpan<byte> signature, ReadOnlySpan<byte> message, ReadOnlySpan<byte> publicKey)
+    public static bool Verify(ReadOnlySpan<byte> signature, ReadOnlySpan<byte> message, ReadOnlySpan<byte> publicKey)
     {
         Validation.EqualToSize(nameof(signature), signature.Length, SignatureSize);
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         Sodium.Initialize();
-        fixed (byte* s = signature, m = message, pk = publicKey)
-            return crypto_sign_verify_detached(s, m, (ulong)message.Length, pk) == 0;
+        return crypto_sign_verify_detached(signature, message, (ulong)message.Length, publicKey) == 0;
     }
 }
diff --git a/src/Geralt/Crypto/HChaCha20.cs b/src/Geralt/Crypto/HChaCha20.cs
index c3339aa..8f7f242 100644
--- a/src/Geralt/Crypto/HChaCha20.cs
+++ b/src/Geralt/Crypto/HChaCha20.cs
@@ -10,17 +10,14 @@ public static class HChaCha20
     public const int NonceSize = crypto_core_hchacha20_INPUTBYTES;
     public const int PersonalSize = crypto_core_hchacha20_CONSTBYTES;
 
-    public static unsafe void DeriveKey(Span<byte> outputKeyingMaterial, ReadOnlySpan<byte> inputKeyingMaterial, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> personalization = default)
+    public static void DeriveKey(Span<byte> outputKeyingMaterial, ReadOnlySpan<byte> inputKeyingMaterial, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> personalization = default)
     {
         Validation.EqualToSize(nameof(outputKeyingMaterial), outputKeyingMaterial.Length, OutputSize);
         Validation.EqualToSize(nameof(inputKeyingMaterial), inputKeyingMaterial.Length, KeySize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         if (personalization.Length != 0) { Validation.EqualToSize(nameof(personalization), personalization.Length, PersonalSize); }
         Sodium.Initialize();
-        fixed (byte* okm = outputKeyingMaterial, ikm = inputKeyingMaterial, n = nonce, p = personalization)
-        {
-            int ret = crypto_core_hchacha20(okm, n, ikm, p);
-            if (ret != 0) { throw new CryptographicException("Error deriving key."); }
-        }
+        int ret = crypto_core_hchacha20(outputKeyingMaterial, nonce, inputKeyingMaterial, personalization);
+        if (ret != 0) { throw new CryptographicException("Error deriving key."); }
     }
 }
diff --git a/src/Geralt/Crypto/IncrementalBLAKE2b.cs b/src/Geralt/Crypto/IncrementalBLAKE2b.cs
index df7de70..f6ce600 100644
--- a/src/Geralt/Crypto/IncrementalBLAKE2b.cs
+++ b/src/Geralt/Crypto/IncrementalBLAKE2b.cs
@@ -27,39 +27,30 @@ public IncrementalBLAKE2b(int hashSize, ReadOnlySpan<byte> key = default)
         Reinitialize(hashSize, key);
     }
 
-    public unsafe void Reinitialize(int hashSize, ReadOnlySpan<byte> key = default)
+    public void Reinitialize(int hashSize, ReadOnlySpan<byte> key = default)
     {
         Validation.SizeBetween(nameof(hashSize), hashSize, MinHashSize, MaxHashSize);
         if (key.Length != 0) { Validation.SizeBetween(nameof(key), key.Length, MinKeySize, MaxKeySize); }
         _hashSize = hashSize;
         _finalized = false;
-        fixed (byte* k = key)
-        {
-            int ret = crypto_generichash_init(ref _state, k, (nuint)key.Length, (nuint)hashSize);
-            if (ret != 0) { throw new CryptographicException("Error initializing hash function state."); }
-        }
+        int ret = crypto_generichash_init(ref _state, key, (nuint)key.Length, (nuint)hashSize);
+        if (ret != 0) { throw new CryptographicException("Error initializing hash function state."); }
     }
 
-    public unsafe void Update(ReadOnlySpan<byte> message)
+    public void Update(ReadOnlySpan<byte> message)
     {
         if (_finalized) { throw new InvalidOperationException("Cannot update after finalizing without reinitializing or restoring a cached state."); }
-        fixed (byte* m = message)
-        {
-            int ret = crypto_generichash_update(ref _state, m, (ulong)message.Length);
-            if (ret != 0) { throw new CryptographicException("Error updating hash function state."); }
-        }
+        int ret = crypto_generichash_update(ref _state, message, (ulong)message.Length);
+        if (ret != 0) { throw new CryptographicException("Error updating hash function state."); }
     }
 
-    public unsafe void Finalize(Span<byte> hash)
+    public void Finalize(Span<byte> hash)
     {
         if (_finalized) { throw new InvalidOperationException("Cannot finalize twice without reinitializing or restoring a cached state."); }
         Validation.EqualToSize(nameof(hash), hash.Length, _hashSize);
         _finalized = true;
-        fixed (byte* h = hash)
-        {
-            int ret = crypto_generichash_final(ref _state, h, (nuint)hash.Length);
-            if (ret != 0) { throw new CryptographicException("Error finalizing hash."); }
-        }
+        int ret = crypto_generichash_final(ref _state, hash, (nuint)hash.Length);
+        if (ret != 0) { throw new CryptographicException("Error finalizing hash."); }
     }
 
     public bool FinalizeAndVerify(ReadOnlySpan<byte> hash)
diff --git a/src/Geralt/Crypto/IncrementalEd25519ph.cs b/src/Geralt/Crypto/IncrementalEd25519ph.cs
index 6e64f22..7f52ef4 100644
--- a/src/Geralt/Crypto/IncrementalEd25519ph.cs
+++ b/src/Geralt/Crypto/IncrementalEd25519ph.cs
@@ -25,39 +25,30 @@ public void Reinitialize()
         if (ret != 0) { throw new CryptographicException("Error initializing signature scheme state."); }
     }
 
-    public unsafe void Update(ReadOnlySpan<byte> message)
+    public void Update(ReadOnlySpan<byte> message)
     {
         if (_finalized) { throw new InvalidOperationException("Cannot update after finalizing without reinitializing."); }
-        fixed (byte* m = message)
-        {
-            int ret = crypto_sign_update(ref _state, m, (ulong)message.Length);
-            if (ret != 0) { throw new CryptographicException("Error updating signature scheme state."); }
-        }
+        int ret = crypto_sign_update(ref _state, message, (ulong)message.Length);
+        if (ret != 0) { throw new CryptographicException("Error updating signature scheme state."); }
     }
 
-    public unsafe void Finalize(Span<byte> signature, ReadOnlySpan<byte> privateKey)
+    public void Finalize(Span<byte> signature, ReadOnlySpan<byte> privateKey)
     {
         if (_finalized) { throw new InvalidOperationException("Cannot finalize twice without reinitializing."); }
         Validation.EqualToSize(nameof(signature), signature.Length, SignatureSize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         _finalized = true;
-        fixed (byte* s = signature, sk = privateKey)
-        {
-            int ret = crypto_sign_final_create(ref _state, s, signatureLength: out _, sk);
-            if (ret != 0) { throw new CryptographicException("Error finalizing signature."); }
-        }
+        int ret = crypto_sign_final_create(ref _state, signature, signatureLength: out _, privateKey);
+        if (ret != 0) { throw new CryptographicException("Error finalizing signature."); }
     }
 
-    public unsafe bool FinalizeAndVerify(ReadOnlySpan<byte> signature, ReadOnlySpan<byte> publicKey)
+    public bool FinalizeAndVerify(ReadOnlySpan<byte> signature, ReadOnlySpan<byte> publicKey)
     {
         if (_finalized) { throw new InvalidOperationException("Cannot finalize twice without reinitializing."); }
         Validation.EqualToSize(nameof(signature), signature.Length, SignatureSize);
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         _finalized = true;
-        fixed (byte* s = signature, pk = publicKey)
-        {
-            return crypto_sign_final_verify(ref _state, s, pk) == 0;
-        }
+        return crypto_sign_final_verify(ref _state, signature, publicKey) == 0;
     }
 
     public void Dispose()
diff --git a/src/Geralt/Crypto/IncrementalPoly1305.cs b/src/Geralt/Crypto/IncrementalPoly1305.cs
index e044d5d..e2ce07b 100644
--- a/src/Geralt/Crypto/IncrementalPoly1305.cs
+++ b/src/Geralt/Crypto/IncrementalPoly1305.cs
@@ -17,37 +17,28 @@ public IncrementalPoly1305(ReadOnlySpan<byte> oneTimeKey)
         Reinitialize(oneTimeKey);
     }
 
-    public unsafe void Reinitialize(ReadOnlySpan<byte> oneTimeKey)
+    public void Reinitialize(ReadOnlySpan<byte> oneTimeKey)
     {
         Validation.EqualToSize(nameof(oneTimeKey), oneTimeKey.Length, KeySize);
         _finalized = false;
-        fixed (byte* k = oneTimeKey)
-        {
-            int ret = crypto_onetimeauth_init(ref _state, k);
-            if (ret != 0) { throw new CryptographicException("Error initializing message authentication code state."); }
-        }
+        int ret = crypto_onetimeauth_init(ref _state, oneTimeKey);
+        if (ret != 0) { throw new CryptographicException("Error initializing message authentication code state."); }
     }
 
-    public unsafe void Update(ReadOnlySpan<byte> message)
+    public void Update(ReadOnlySpan<byte> message)
     {
         if (_finalized) { throw new InvalidOperationException("Cannot update after finalizing without reinitializing."); }
-        fixed (byte* m = message)
-        {
-            int ret = crypto_onetimeauth_update(ref _state, m, (ulong)message.Length);
-            if (ret != 0) { throw new CryptographicException("Error updating message authentication code state."); }
-        }
+        int ret = crypto_onetimeauth_update(ref _state, message, (ulong)message.Length);
+        if (ret != 0) { throw new CryptographicException("Error updating message authentication code state."); }
     }
 
-    public unsafe void Finalize(Span<byte> tag)
+    public void Finalize(Span<byte> tag)
     {
         if (_finalized) { throw new InvalidOperationException("Cannot finalize twice without reinitializing."); }
         Validation.EqualToSize(nameof(tag), tag.Length, TagSize);
         _finalized = true;
-        fixed (byte* t = tag)
-        {
-            int ret = crypto_onetimeauth_final(ref _state, t);
-            if (ret != 0) { throw new CryptographicException("Error finalizing message authentication code."); }
-        }
+        int ret = crypto_onetimeauth_final(ref _state, tag);
+        if (ret != 0) { throw new CryptographicException("Error finalizing message authentication code."); }
     }
 
     public bool FinalizeAndVerify(ReadOnlySpan<byte> tag)
diff --git a/src/Geralt/Crypto/IncrementalXChaCha20Poly1305.cs b/src/Geralt/Crypto/IncrementalXChaCha20Poly1305.cs
index be22786..907d96e 100644
--- a/src/Geralt/Crypto/IncrementalXChaCha20Poly1305.cs
+++ b/src/Geralt/Crypto/IncrementalXChaCha20Poly1305.cs
@@ -27,19 +27,16 @@ public IncrementalXChaCha20Poly1305(bool decryption, Span<byte> header, ReadOnly
         Reinitialize(decryption, header, key);
     }
 
-    public unsafe void Reinitialize(bool decryption, Span<byte> header, ReadOnlySpan<byte> key)
+    public void Reinitialize(bool decryption, Span<byte> header, ReadOnlySpan<byte> key)
     {
         Validation.EqualToSize(nameof(header), header.Length, HeaderSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         _decryption = decryption;
         _finalized = false;
-        fixed (byte* h = header, k = key)
-        {
-            int ret = _decryption
-                ? crypto_secretstream_xchacha20poly1305_init_pull(ref _state, h, k)
-                : crypto_secretstream_xchacha20poly1305_init_push(ref _state, h, k);
-            if (ret != 0) { throw new CryptographicException(_decryption ? "Error initializing stream decryption." : "Error initializing stream encryption."); }
-        }
+        int ret = _decryption
+            ? crypto_secretstream_xchacha20poly1305_init_pull(ref _state, header, key)
+            : crypto_secretstream_xchacha20poly1305_init_push(ref _state, header, key);
+        if (ret != 0) { throw new CryptographicException(_decryption ? "Error initializing stream decryption." : "Error initializing stream encryption."); }
     }
 
     public void Push(Span<byte> ciphertextChunk, ReadOnlySpan<byte> plaintextChunk, ChunkFlag chunkFlag = ChunkFlag.Message)
@@ -47,32 +44,26 @@ public void Push(Span<byte> ciphertextChunk, ReadOnlySpan<byte> plaintextChunk,
         Push(ciphertextChunk, plaintextChunk, associatedData: default, chunkFlag);
     }
 
-    public unsafe void Push(Span<byte> ciphertextChunk, ReadOnlySpan<byte> plaintextChunk, ReadOnlySpan<byte> associatedData, ChunkFlag chunkFlag = ChunkFlag.Message)
+    public void Push(Span<byte> ciphertextChunk, ReadOnlySpan<byte> plaintextChunk, ReadOnlySpan<byte> associatedData, ChunkFlag chunkFlag = ChunkFlag.Message)
     {
         if (_decryption) { throw new InvalidOperationException("Cannot push into a decryption stream."); }
         if (_finalized) { throw new InvalidOperationException("Cannot push after the final chunk without reinitializing."); }
         Validation.EqualToSize(nameof(ciphertextChunk), ciphertextChunk.Length, plaintextChunk.Length + TagSize);
         if (chunkFlag == ChunkFlag.Final) { _finalized = true; }
-        fixed (byte* c = ciphertextChunk, p = plaintextChunk, ad = associatedData)
-        {
-            int ret = crypto_secretstream_xchacha20poly1305_push(ref _state, c, out _, p, (ulong)plaintextChunk.Length, ad, (ulong)associatedData.Length, (byte)chunkFlag);
-            if (ret != 0) { throw new CryptographicException("Error encrypting plaintext chunk."); }
-        }
+        int ret = crypto_secretstream_xchacha20poly1305_push(ref _state, ciphertextChunk, out _, plaintextChunk, (ulong)plaintextChunk.Length, associatedData, (ulong)associatedData.Length, (byte)chunkFlag);
+        if (ret != 0) { throw new CryptographicException("Error encrypting plaintext chunk."); }
     }
 
-    public unsafe ChunkFlag Pull(Span<byte> plaintextChunk, ReadOnlySpan<byte> ciphertextChunk, ReadOnlySpan<byte> associatedData = default)
+    public ChunkFlag Pull(Span<byte> plaintextChunk, ReadOnlySpan<byte> ciphertextChunk, ReadOnlySpan<byte> associatedData = default)
     {
         if (!_decryption) { throw new InvalidOperationException("Cannot pull from an encryption stream."); }
         if (_finalized) { throw new InvalidOperationException("Cannot pull after the final chunk without reinitializing."); }
         Validation.NotLessThanMin(nameof(ciphertextChunk), ciphertextChunk.Length, TagSize);
         Validation.EqualToSize(nameof(plaintextChunk), plaintextChunk.Length, ciphertextChunk.Length - TagSize);
-        fixed (byte* p = plaintextChunk, c = ciphertextChunk, ad = associatedData)
-        {
-            int ret = crypto_secretstream_xchacha20poly1305_pull(ref _state, p, out _, out byte chunkFlag, c, (ulong)ciphertextChunk.Length, ad, (ulong)associatedData.Length);
-            if (ret != 0) { throw new CryptographicException("Error decrypting ciphertext chunk."); }
-            if (chunkFlag == (byte)ChunkFlag.Final) { _finalized = true; }
-            return (ChunkFlag)chunkFlag;
-        }
+        int ret = crypto_secretstream_xchacha20poly1305_pull(ref _state, plaintextChunk, out _, out byte chunkFlag, ciphertextChunk, (ulong)ciphertextChunk.Length, associatedData, (ulong)associatedData.Length);
+        if (ret != 0) { throw new CryptographicException("Error decrypting ciphertext chunk."); }
+        if (chunkFlag == (byte)ChunkFlag.Final) { _finalized = true; }
+        return (ChunkFlag)chunkFlag;
     }
 
     public void Rekey()
diff --git a/src/Geralt/Crypto/Padding.cs b/src/Geralt/Crypto/Padding.cs
index 78bd980..def0837 100644
--- a/src/Geralt/Crypto/Padding.cs
+++ b/src/Geralt/Crypto/Padding.cs
@@ -4,16 +4,13 @@ namespace Geralt;
 
 public static class Padding
 {
-    public static unsafe void Pad(Span<byte> buffer, ReadOnlySpan<byte> data, int blockSize)
+    public static void Pad(Span<byte> buffer, ReadOnlySpan<byte> data, int blockSize)
     {
         Validation.EqualToSize(nameof(buffer), buffer.Length, GetPaddedLength(data.Length, blockSize));
         Sodium.Initialize();
         data.CopyTo(buffer);
-        fixed (byte* b = buffer)
-        {
-            int ret = sodium_pad(out nuint _, b, (nuint)data.Length, (nuint)blockSize, (nuint)buffer.Length);
-            if (ret != 0) { throw new ArgumentOutOfRangeException(nameof(buffer), $"{nameof(buffer)} is not large enough."); }
-        }
+        int ret = sodium_pad(out nuint _, buffer, (nuint)data.Length, (nuint)blockSize, (nuint)buffer.Length);
+        if (ret != 0) { throw new ArgumentOutOfRangeException(nameof(buffer), $"{nameof(buffer)} is not large enough."); }
     }
 
     public static int GetPaddedLength(int unpaddedLength, int blockSize)
@@ -31,16 +28,13 @@ public static void Fill(Span<byte> buffer)
         Pad(buffer, ReadOnlySpan<byte>.Empty, buffer.Length);
     }
 
-    public static unsafe int GetUnpaddedLength(ReadOnlySpan<byte> paddedData, int blockSize)
+    public static int GetUnpaddedLength(ReadOnlySpan<byte> paddedData, int blockSize)
     {
         Validation.NotEmpty(nameof(paddedData), paddedData.Length);
         Validation.GreaterThanZero(nameof(blockSize), blockSize);
         Sodium.Initialize();
-        fixed (byte* p = paddedData)
-        {
-            int ret = sodium_unpad(out nuint unpaddedLength, p, (nuint)paddedData.Length, (nuint)blockSize);
-            if (ret != 0) { throw new FormatException("Incorrect padding."); }
-            return (int)unpaddedLength;
-        }
+        int ret = sodium_unpad(out nuint unpaddedLength, paddedData, (nuint)paddedData.Length, (nuint)blockSize);
+        if (ret != 0) { throw new FormatException("Incorrect padding."); }
+        return (int)unpaddedLength;
     }
 }
diff --git a/src/Geralt/Crypto/Poly1305.cs b/src/Geralt/Crypto/Poly1305.cs
index b7b0db5..5195d89 100644
--- a/src/Geralt/Crypto/Poly1305.cs
+++ b/src/Geralt/Crypto/Poly1305.cs
@@ -8,24 +8,20 @@ public static class Poly1305
     public const int KeySize = crypto_onetimeauth_KEYBYTES;
     public const int TagSize = crypto_onetimeauth_BYTES;
 
-    public static unsafe void ComputeTag(Span<byte> tag, ReadOnlySpan<byte> message, ReadOnlySpan<byte> oneTimeKey)
+    public static void ComputeTag(Span<byte> tag, ReadOnlySpan<byte> message, ReadOnlySpan<byte> oneTimeKey)
     {
         Validation.EqualToSize(nameof(tag), tag.Length, TagSize);
         Validation.EqualToSize(nameof(oneTimeKey), oneTimeKey.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* t = tag, m = message, k = oneTimeKey)
-        {
-            int ret = crypto_onetimeauth(t, m, (ulong)message.Length, k);
-            if (ret != 0) { throw new CryptographicException("Error computing tag."); }
-        }
+        int ret = crypto_onetimeauth(tag, message, (ulong)message.Length, oneTimeKey);
+        if (ret != 0) { throw new CryptographicException("Error computing tag."); }
     }
 
-    public static unsafe bool VerifyTag(ReadOnlySpan<byte> tag, ReadOnlySpan<byte> message, ReadOnlySpan<byte> oneTimeKey)
+    public static bool VerifyTag(ReadOnlySpan<byte> tag, ReadOnlySpan<byte> message, ReadOnlySpan<byte> oneTimeKey)
     {
         Validation.EqualToSize(nameof(tag), tag.Length, TagSize);
         Validation.EqualToSize(nameof(oneTimeKey), oneTimeKey.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* t = tag, m = message, k = oneTimeKey)
-            return crypto_onetimeauth_verify(t, m, (ulong)message.Length, k) == 0;
+        return crypto_onetimeauth_verify(tag, message, (ulong)message.Length, oneTimeKey) == 0;
     }
 }
diff --git a/src/Geralt/Crypto/SecureRandom.cs b/src/Geralt/Crypto/SecureRandom.cs
index c5aa08f..d589d73 100644
--- a/src/Geralt/Crypto/SecureRandom.cs
+++ b/src/Geralt/Crypto/SecureRandom.cs
@@ -18,21 +18,19 @@ public static class SecureRandom
     public const int MinWordCount = 4;
     public const int MaxWordCount = 20;
 
-    public static unsafe void Fill(Span<byte> buffer)
+    public static void Fill(Span<byte> buffer)
     {
         Validation.NotEmpty(nameof(buffer), buffer.Length);
         Sodium.Initialize();
-        fixed (byte* b = buffer)
-            randombytes_buf(b, (nuint)buffer.Length);
+        randombytes_buf(buffer, (nuint)buffer.Length);
     }
 
-    public static unsafe void FillDeterministic(Span<byte> buffer, ReadOnlySpan<byte> seed)
+    public static void FillDeterministic(Span<byte> buffer, ReadOnlySpan<byte> seed)
     {
         Validation.NotEmpty(nameof(buffer), buffer.Length);
         Validation.EqualToSize(nameof(seed), seed.Length, SeedSize);
         Sodium.Initialize();
-        fixed (byte* b = buffer, s = seed)
-            randombytes_buf_deterministic(b, (nuint)buffer.Length, s);
+        randombytes_buf_deterministic(buffer, (nuint)buffer.Length, seed);
     }
 
     public static int GetInt32(int upperBound)
diff --git a/src/Geralt/Crypto/X25519.cs b/src/Geralt/Crypto/X25519.cs
index cfe2ef7..920b950 100644
--- a/src/Geralt/Crypto/X25519.cs
+++ b/src/Geralt/Crypto/X25519.cs
@@ -14,44 +14,35 @@ public static class X25519
     public const int MinPreSharedKeySize = BLAKE2b.MinKeySize;
     public const int MaxPreSharedKeySize = BLAKE2b.MaxKeySize;
 
-    public static unsafe void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey)
+    public static void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey)
     {
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         Sodium.Initialize();
-        fixed (byte* pk = publicKey, sk = privateKey)
-        {
-            int ret = crypto_kx_keypair(pk, sk);
-            if (ret != 0) { throw new CryptographicException("Unable to generate key pair."); }
-        }
+        int ret = crypto_kx_keypair(publicKey, privateKey);
+        if (ret != 0) { throw new CryptographicException("Unable to generate key pair."); }
     }
 
-    public static unsafe void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey, ReadOnlySpan<byte> seed)
+    public static void GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey, ReadOnlySpan<byte> seed)
     {
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         Validation.EqualToSize(nameof(seed), seed.Length, SeedSize);
         Sodium.Initialize();
-        fixed (byte* pk = publicKey, sk = privateKey, s = seed)
-        {
-            int ret = crypto_kx_seed_keypair(pk, sk, s);
-            if (ret != 0) { throw new CryptographicException("Unable to generate key pair from seed."); }
-        }
+        int ret = crypto_kx_seed_keypair(publicKey, privateKey, seed);
+        if (ret != 0) { throw new CryptographicException("Unable to generate key pair from seed."); }
     }
 
-    public static unsafe void ComputePublicKey(Span<byte> publicKey, ReadOnlySpan<byte> privateKey)
+    public static void ComputePublicKey(Span<byte> publicKey, ReadOnlySpan<byte> privateKey)
     {
         Validation.EqualToSize(nameof(publicKey), publicKey.Length, PublicKeySize);
         Validation.EqualToSize(nameof(privateKey), privateKey.Length, PrivateKeySize);
         Sodium.Initialize();
-        fixed (byte* pk = publicKey, sk = privateKey)
-        {
-            int ret = crypto_scalarmult_base(pk, sk);
-            if (ret != 0) { throw new CryptographicException("Unable to compute public key from private key."); }
-        }
+        int ret = crypto_scalarmult_base(publicKey, privateKey);
+        if (ret != 0) { throw new CryptographicException("Unable to compute public key from private key."); }
     }
 
-    public static unsafe void DeriveSenderSharedKey(Span<byte> sharedKey, ReadOnlySpan<byte> senderPrivateKey, ReadOnlySpan<byte> recipientPublicKey, ReadOnlySpan<byte> preSharedKey = default)
+    public static void DeriveSenderSharedKey(Span<byte> sharedKey, ReadOnlySpan<byte> senderPrivateKey, ReadOnlySpan<byte> recipientPublicKey, ReadOnlySpan<byte> preSharedKey = default)
     {
         Validation.EqualToSize(nameof(sharedKey), sharedKey.Length, SharedKeySize);
         Validation.EqualToSize(nameof(senderPrivateKey), senderPrivateKey.Length, PrivateKeySize);
@@ -69,7 +60,7 @@ public static unsafe void DeriveSenderSharedKey(Span<byte> sharedKey, ReadOnlySp
         CryptographicOperations.ZeroMemory(sharedSecret);
     }
 
-    public static unsafe void DeriveRecipientSharedKey(Span<byte> sharedKey, ReadOnlySpan<byte> recipientPrivateKey, ReadOnlySpan<byte> senderPublicKey, ReadOnlySpan<byte> preSharedKey = default)
+    public static void DeriveRecipientSharedKey(Span<byte> sharedKey, ReadOnlySpan<byte> recipientPrivateKey, ReadOnlySpan<byte> senderPublicKey, ReadOnlySpan<byte> preSharedKey = default)
     {
         Validation.EqualToSize(nameof(sharedKey), sharedKey.Length, SharedKeySize);
         Validation.EqualToSize(nameof(recipientPrivateKey), recipientPrivateKey.Length, PrivateKeySize);
@@ -87,16 +78,13 @@ public static unsafe void DeriveRecipientSharedKey(Span<byte> sharedKey, ReadOnl
         CryptographicOperations.ZeroMemory(sharedSecret);
     }
 
-    public static unsafe void ComputeSharedSecret(Span<byte> sharedSecret, ReadOnlySpan<byte> senderPrivateKey, ReadOnlySpan<byte> recipientPublicKey)
+    public static void ComputeSharedSecret(Span<byte> sharedSecret, ReadOnlySpan<byte> senderPrivateKey, ReadOnlySpan<byte> recipientPublicKey)
     {
         Validation.EqualToSize(nameof(sharedSecret), sharedSecret.Length, SharedSecretSize);
         Validation.EqualToSize(nameof(senderPrivateKey), senderPrivateKey.Length, PrivateKeySize);
         Validation.EqualToSize(nameof(recipientPublicKey), recipientPublicKey.Length, PublicKeySize);
         Sodium.Initialize();
-        fixed (byte* s = sharedSecret, sk = senderPrivateKey, pk = recipientPublicKey)
-        {
-            int ret = crypto_scalarmult(s, sk, pk);
-            if (ret != 0) { throw new CryptographicException("Invalid public key."); }
-        }
+        int ret = crypto_scalarmult(sharedSecret, senderPrivateKey, recipientPublicKey);
+        if (ret != 0) { throw new CryptographicException("Invalid public key."); }
     }
 }
diff --git a/src/Geralt/Crypto/XChaCha20.cs b/src/Geralt/Crypto/XChaCha20.cs
index bbd4b03..75ed2d6 100644
--- a/src/Geralt/Crypto/XChaCha20.cs
+++ b/src/Geralt/Crypto/XChaCha20.cs
@@ -9,45 +9,36 @@ public static class XChaCha20
     public const int NonceSize = crypto_stream_xchacha20_NONCEBYTES;
     public const int BlockSize = 64;
 
-    public static unsafe void Fill(Span<byte> buffer, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key)
+    public static void Fill(Span<byte> buffer, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key)
     {
         Validation.NotEmpty(nameof(buffer), buffer.Length);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* b = buffer, n = nonce, k = key)
-        {
-            int ret = crypto_stream_xchacha20(b, (ulong)buffer.Length, n, k);
-            if (ret != 0) { throw new CryptographicException("Error computing pseudorandom bytes."); }
-        }
+        int ret = crypto_stream_xchacha20(buffer, (ulong)buffer.Length, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Error computing pseudorandom bytes."); }
     }
 
-    public static unsafe void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ulong counter = 0)
+    public static void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ulong counter = 0)
     {
         Validation.EqualToSize(nameof(ciphertext), ciphertext.Length, plaintext.Length);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         ThrowIfCounterOverflow(plaintext.Length, counter);
         Sodium.Initialize();
-        fixed (byte* c = ciphertext, p = plaintext, n = nonce, k = key)
-        {
-            int ret = crypto_stream_xchacha20_xor_ic(c, p, (ulong)plaintext.Length, n, counter, k);
-            if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
-        }
+        int ret = crypto_stream_xchacha20_xor_ic(ciphertext, plaintext, (ulong)plaintext.Length, nonce, counter, key);
+        if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
     }
 
-    public static unsafe void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ulong counter = 0)
+    public static void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ulong counter = 0)
     {
         Validation.EqualToSize(nameof(plaintext), plaintext.Length, ciphertext.Length);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         ThrowIfCounterOverflow(ciphertext.Length, counter);
         Sodium.Initialize();
-        fixed (byte* p = plaintext, c = ciphertext, n = nonce, k = key)
-        {
-            int ret = crypto_stream_xchacha20_xor_ic(p, c, (ulong)ciphertext.Length, n, counter, k);
-            if (ret != 0) { throw new CryptographicException("Error decrypting ciphertext."); }
-        }
+        int ret = crypto_stream_xchacha20_xor_ic(plaintext, ciphertext, (ulong)ciphertext.Length, nonce, counter, key);
+        if (ret != 0) { throw new CryptographicException("Error decrypting ciphertext."); }
     }
 
     private static void ThrowIfCounterOverflow(int messageSize, ulong counter)
diff --git a/src/Geralt/Crypto/XChaCha20Poly1305.cs b/src/Geralt/Crypto/XChaCha20Poly1305.cs
index 08ab7f2..90bdb02 100644
--- a/src/Geralt/Crypto/XChaCha20Poly1305.cs
+++ b/src/Geralt/Crypto/XChaCha20Poly1305.cs
@@ -9,30 +9,24 @@ public static class XChaCha20Poly1305
     public const int NonceSize = crypto_aead_xchacha20poly1305_ietf_NPUBBYTES;
     public const int TagSize = crypto_aead_xchacha20poly1305_ietf_ABYTES;
 
-    public static unsafe void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Encrypt(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.EqualToSize(nameof(ciphertext), ciphertext.Length, plaintext.Length + TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* c = ciphertext, p = plaintext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_xchacha20poly1305_ietf_encrypt(c, ciphertextLength: out _, p, (ulong)plaintext.Length, ad, (ulong)associatedData.Length, nsec: null, n, k);
-            if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
-        }
+        int ret = crypto_aead_xchacha20poly1305_ietf_encrypt(ciphertext, ciphertextLength: out _, plaintext, (ulong)plaintext.Length, associatedData, (ulong)associatedData.Length, nsec: null, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Error encrypting plaintext."); }
     }
 
-    public static unsafe void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
+    public static void Decrypt(Span<byte> plaintext, ReadOnlySpan<byte> ciphertext, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> associatedData = default)
     {
         Validation.NotLessThanMin(nameof(ciphertext), ciphertext.Length, TagSize);
         Validation.EqualToSize(nameof(plaintext), plaintext.Length, ciphertext.Length - TagSize);
         Validation.EqualToSize(nameof(nonce), nonce.Length, NonceSize);
         Validation.EqualToSize(nameof(key), key.Length, KeySize);
         Sodium.Initialize();
-        fixed (byte* p = plaintext, c = ciphertext, n = nonce, k = key, ad = associatedData)
-        {
-            int ret = crypto_aead_xchacha20poly1305_ietf_decrypt(p, plaintextLength: out _, nsec: null, c, (ulong)ciphertext.Length, ad, (ulong)associatedData.Length, n, k);
-            if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
-        }
+        int ret = crypto_aead_xchacha20poly1305_ietf_decrypt(plaintext, plaintextLength: out _, nsec: null, ciphertext, (ulong)ciphertext.Length, associatedData, (ulong)associatedData.Length, nonce, key);
+        if (ret != 0) { throw new CryptographicException("Invalid authentication tag for the given inputs."); }
     }
 }
diff --git a/src/Geralt/Helpers/Encodings.cs b/src/Geralt/Helpers/Encodings.cs
index 4bfe07c..4ef2175 100644
--- a/src/Geralt/Helpers/Encodings.cs
+++ b/src/Geralt/Helpers/Encodings.cs
@@ -16,16 +16,13 @@ public enum Base64Variant
         UrlNoPadding = 7
     }
 
-    public static unsafe string ToHex(ReadOnlySpan<byte> data)
+    public static string ToHex(ReadOnlySpan<byte> data)
     {
         Validation.NotEmpty(nameof(data), data.Length);
         Sodium.Initialize();
-        ReadOnlySpan<byte> hex = stackalloc byte[data.Length * 2 + 1];
-        fixed (byte* h = hex, d = data)
-        {
-            IntPtr ret = sodium_bin2hex(h, (nuint)hex.Length, d, (nuint)data.Length);
-            return Marshal.PtrToStringAnsi(ret) ?? throw new FormatException("Error converting bytes to hex.");
-        }
+        Span<byte> hex = stackalloc byte[data.Length * 2 + 1];
+        IntPtr ret = sodium_bin2hex(hex, (nuint)hex.Length, data, (nuint)data.Length);
+        return Marshal.PtrToStringAnsi(ret) ?? throw new FormatException("Error converting bytes to hex.");
     }
 
     public static byte[] FromHex(string hex, string ignoreChars = HexIgnoreChars)
@@ -39,17 +36,14 @@ public static byte[] FromHex(string hex, string ignoreChars = HexIgnoreChars)
         return binary;
     }
 
-    public static unsafe string ToBase64(ReadOnlySpan<byte> data, Base64Variant variant = Base64Variant.Original)
+    public static string ToBase64(ReadOnlySpan<byte> data, Base64Variant variant = Base64Variant.Original)
     {
         Validation.NotEmpty(nameof(data), data.Length);
         Sodium.Initialize();
         int base64MaxLength = sodium_base64_encoded_len((nuint)data.Length, (int)variant);
         Span<byte> base64 = stackalloc byte[base64MaxLength];
-        fixed (byte* b = base64, d = data)
-        {
-            IntPtr ret = sodium_bin2base64(b, (nuint)base64MaxLength, d, (nuint)data.Length, (int)variant);
-            return Marshal.PtrToStringAnsi(ret) ?? throw new FormatException("Error converting bytes to Base64.");
-        }
+        IntPtr ret = sodium_bin2base64(base64, (nuint)base64MaxLength, data, (nuint)data.Length, (int)variant);
+        return Marshal.PtrToStringAnsi(ret) ?? throw new FormatException("Error converting bytes to Base64.");
     }
 
     public static byte[] FromBase64(string base64, Base64Variant variant = Base64Variant.Original, string ignoreChars = Base64IgnoreChars)
diff --git a/src/Geralt/Interop/Interop.AEGIS128L.cs b/src/Geralt/Interop/Interop.AEGIS128L.cs
index 07472ca..26f88c5 100644
--- a/src/Geralt/Interop/Interop.AEGIS128L.cs
+++ b/src/Geralt/Interop/Interop.AEGIS128L.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -8,10 +9,12 @@ internal static partial class Libsodium
         internal const int crypto_aead_aegis128l_NPUBBYTES = 16;
         internal const int crypto_aead_aegis128l_ABYTES = 32;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_aegis128l_encrypt(byte* ciphertext, out ulong ciphertextLength, byte* plaintext, ulong plaintextLength, byte* associatedData, ulong associatedDataLength, byte* nsec, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_aegis128l_encrypt(Span<byte> ciphertext, out ulong ciphertextLength, ReadOnlySpan<byte> plaintext, ulong plaintextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_aegis128l_decrypt(byte* plaintext, out ulong plaintextLength, byte* nsec, byte* ciphertext, ulong ciphertextLength, byte* associatedData, ulong associatedDataLength, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_aegis128l_decrypt(Span<byte> plaintext, out ulong plaintextLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> ciphertext, ulong ciphertextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
     }
 }
diff --git a/src/Geralt/Interop/Interop.AEGIS256.cs b/src/Geralt/Interop/Interop.AEGIS256.cs
index cfadc1c..65cef1f 100644
--- a/src/Geralt/Interop/Interop.AEGIS256.cs
+++ b/src/Geralt/Interop/Interop.AEGIS256.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -8,10 +9,12 @@ internal static partial class Libsodium
         internal const int crypto_aead_aegis256_NPUBBYTES = 32;
         internal const int crypto_aead_aegis256_ABYTES = 32;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_aegis256_encrypt(byte* ciphertext, out ulong ciphertextLength, byte* plaintext, ulong plaintextLength, byte* associatedData, ulong associatedDataLength, byte* nsec, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_aegis256_encrypt(Span<byte> ciphertext, out ulong ciphertextLength, ReadOnlySpan<byte> plaintext, ulong plaintextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_aegis256_decrypt(byte* plaintext, out ulong plaintextLength, byte* nsec, byte* ciphertext, ulong ciphertextLength, byte* associatedData, ulong associatedDataLength, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_aegis256_decrypt(Span<byte> plaintext, out ulong plaintextLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> ciphertext, ulong ciphertextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
     }
 }
diff --git a/src/Geralt/Interop/Interop.Argon2id.cs b/src/Geralt/Interop/Interop.Argon2id.cs
index 463c7ef..f676036 100644
--- a/src/Geralt/Interop/Interop.Argon2id.cs
+++ b/src/Geralt/Interop/Interop.Argon2id.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -12,16 +13,20 @@ internal static partial class Libsodium
         internal const int crypto_pwhash_argon2id_OPSLIMIT_MIN = 1;
         internal const string crypto_pwhash_argon2id_STRPREFIX = "$argon2id$";
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_pwhash(byte* hash, ulong hashLength, byte* password, ulong passwordLength, byte* salt, ulong iterations, nuint memorySize, int algorithm);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_pwhash(Span<byte> hash, ulong hashLength, ReadOnlySpan<byte> password, ulong passwordLength, ReadOnlySpan<byte> salt, ulong iterations, nuint memorySize, int algorithm);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_pwhash_str_alg(byte* hash, byte* password, ulong passwordLength, ulong iterations, nuint memorySize, int algorithm);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_pwhash_str_alg(Span<byte> hash, ReadOnlySpan<byte> password, ulong passwordLength, ulong iterations, nuint memorySize, int algorithm);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_pwhash_str_verify(byte* hash, byte* password, ulong passwordLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_pwhash_str_verify(ReadOnlySpan<byte> hash, ReadOnlySpan<byte> password, ulong passwordLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_pwhash_str_needs_rehash(byte* hash, ulong iterations, nuint memorySize);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_pwhash_str_needs_rehash(ReadOnlySpan<byte> hash, ulong iterations, nuint memorySize);
     }
 }
diff --git a/src/Geralt/Interop/Interop.BLAKE2b.cs b/src/Geralt/Interop/Interop.BLAKE2b.cs
index aa013a1..5cdcc68 100644
--- a/src/Geralt/Interop/Interop.BLAKE2b.cs
+++ b/src/Geralt/Interop/Interop.BLAKE2b.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -13,24 +14,27 @@ internal static partial class Libsodium
         internal const int crypto_generichash_blake2b_SALTBYTES = 16;
         internal const int crypto_generichash_blake2b_PERSONALBYTES = 16;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_generichash_blake2b(byte* hash, nuint hashLength, byte* message, ulong messageLength, byte* key, nuint keyLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_generichash_blake2b(Span<byte> hash, nuint hashLength, ReadOnlySpan<byte> message, ulong messageLength, ReadOnlySpan<byte> key, nuint keyLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_generichash_blake2b_salt_personal(byte* hash, nuint hashLength, byte* message, ulong messageLength, byte* key, nuint keyLength, byte* salt, byte* personal);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_generichash_blake2b_salt_personal(Span<byte> hash, nuint hashLength, ReadOnlySpan<byte> message, ulong messageLength, ReadOnlySpan<byte> key, nuint keyLength, ReadOnlySpan<byte> salt, ReadOnlySpan<byte> personalization);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_generichash_init(ref crypto_generichash_blake2b_state state, byte* key, nuint keyLength, nuint hashLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_generichash_init(ref crypto_generichash_blake2b_state state, ReadOnlySpan<byte> key, nuint keyLength, nuint hashLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_generichash_update(ref crypto_generichash_blake2b_state state, byte* message, ulong messageLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_generichash_update(ref crypto_generichash_blake2b_state state, ReadOnlySpan<byte> message, ulong messageLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_generichash_final(ref crypto_generichash_blake2b_state state, byte* hash, nuint hashLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_generichash_final(ref crypto_generichash_blake2b_state state, Span<byte> hash, nuint hashLength);
 
         [StructLayout(LayoutKind.Explicit, Size = 384)]
-        internal struct crypto_generichash_blake2b_state
-        {
-        }
+        internal struct crypto_generichash_blake2b_state;
     }
 }
diff --git a/src/Geralt/Interop/Interop.ChaCha20.cs b/src/Geralt/Interop/Interop.ChaCha20.cs
index a53dc5e..a5051b3 100644
--- a/src/Geralt/Interop/Interop.ChaCha20.cs
+++ b/src/Geralt/Interop/Interop.ChaCha20.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -7,10 +8,12 @@ internal static partial class Libsodium
         internal const int crypto_stream_chacha20_ietf_KEYBYTES = 32;
         internal const int crypto_stream_chacha20_ietf_NONCEBYTES = 12;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_stream_chacha20_ietf(byte* ciphertext, ulong ciphertextLength, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_stream_chacha20_ietf(Span<byte> ciphertext, ulong ciphertextLength, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_stream_chacha20_ietf_xor_ic(byte* ciphertext, byte* plaintext, ulong plaintextLength, byte* nonce, uint counter, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_stream_chacha20_ietf_xor_ic(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ulong plaintextLength, ReadOnlySpan<byte> nonce, uint counter, ReadOnlySpan<byte> key);
     }
 }
diff --git a/src/Geralt/Interop/Interop.ChaCha20Poly1305.cs b/src/Geralt/Interop/Interop.ChaCha20Poly1305.cs
index 28f04c9..ee0e61a 100644
--- a/src/Geralt/Interop/Interop.ChaCha20Poly1305.cs
+++ b/src/Geralt/Interop/Interop.ChaCha20Poly1305.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -8,10 +9,12 @@ internal static partial class Libsodium
         internal const int crypto_aead_chacha20poly1305_IETF_NPUBBYTES = 12;
         internal const int crypto_aead_chacha20poly1305_IETF_ABYTES = 16;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_chacha20poly1305_ietf_encrypt(byte* ciphertext, out ulong ciphertextLength, byte* plaintext, ulong plaintextLength, byte* associatedData, ulong associatedDataLength, byte* nsec, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_chacha20poly1305_ietf_encrypt(Span<byte> ciphertext, out ulong ciphertextLength, ReadOnlySpan<byte> plaintext, ulong plaintextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_chacha20poly1305_ietf_decrypt(byte* plaintext, out ulong plaintextLength, byte* nsec, byte* ciphertext, ulong ciphertextLength, byte* associatedData, ulong associatedDataLength, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_chacha20poly1305_ietf_decrypt(Span<byte> plaintext, out ulong plaintextLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> ciphertext, ulong ciphertextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
     }
 }
diff --git a/src/Geralt/Interop/Interop.ConstantTime.cs b/src/Geralt/Interop/Interop.ConstantTime.cs
index fb55cfe..d2de223 100644
--- a/src/Geralt/Interop/Interop.ConstantTime.cs
+++ b/src/Geralt/Interop/Interop.ConstantTime.cs
@@ -1,25 +1,32 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
     internal static partial class Libsodium
     {
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int sodium_memcmp(byte* a, byte* b, nuint length);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_memcmp(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b, nuint length);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe void sodium_increment(byte* buffer, nuint bufferLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial void sodium_increment(Span<byte> buffer, nuint bufferLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe void sodium_add(byte* a, byte* b, nuint length);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial void sodium_add(Span<byte> a, ReadOnlySpan<byte> b, nuint length);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe void sodium_sub(byte* a, byte* b, nuint length);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial void sodium_sub(Span<byte> a, ReadOnlySpan<byte> b, nuint length);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int sodium_compare(byte* a, byte* b, nuint length);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_compare(ReadOnlySpan<byte> a, ReadOnlySpan<byte> b, nuint length);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int sodium_is_zero(byte* buffer, nuint bufferLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_is_zero(ReadOnlySpan<byte> buffer, nuint bufferLength);
     }
 }
diff --git a/src/Geralt/Interop/Interop.Constants.cs b/src/Geralt/Interop/Interop.Constants.cs
index e5ea092..fa52cc6 100644
--- a/src/Geralt/Interop/Interop.Constants.cs
+++ b/src/Geralt/Interop/Interop.Constants.cs
@@ -1,6 +1,4 @@
-using System.Runtime.InteropServices;
-
-internal static partial class Interop
+internal static partial class Interop
 {
     internal static partial class Libsodium
     {
@@ -11,6 +9,5 @@ internal static partial class Libsodium
 #else
         private const string DllName = "libsodium";
 #endif
-        private const CallingConvention Convention = CallingConvention.Cdecl;
     }
 }
diff --git a/src/Geralt/Interop/Interop.Ed25519.cs b/src/Geralt/Interop/Interop.Ed25519.cs
index f3b6306..5427718 100644
--- a/src/Geralt/Interop/Interop.Ed25519.cs
+++ b/src/Geralt/Interop/Interop.Ed25519.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -9,42 +10,51 @@ internal static partial class Libsodium
         internal const int crypto_sign_SEEDBYTES = 32;
         internal const int crypto_sign_BYTES = 64;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_keypair(byte* publicKey, byte* privateKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_keypair(Span<byte> publicKey, Span<byte> privateKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_seed_keypair(byte* publicKey, byte* privateKey, byte* seed);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_seed_keypair(Span<byte> publicKey, Span<byte> privateKey, ReadOnlySpan<byte> seed);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_ed25519_sk_to_pk(byte* publicKey, byte* privateKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_ed25519_sk_to_pk(Span<byte> publicKey, ReadOnlySpan<byte> privateKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_ed25519_pk_to_curve25519(byte* X25519PublicKey, byte* Ed25519PublicKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_ed25519_pk_to_curve25519(Span<byte> x25519PublicKey, ReadOnlySpan<byte> ed25519PublicKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_ed25519_sk_to_curve25519(byte* X25519PrivateKey, byte* Ed25519PrivateKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_ed25519_sk_to_curve25519(Span<byte> x25519PrivateKey, ReadOnlySpan<byte> ed25519PrivateKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_detached(byte* signature, out ulong signatureLength, byte* message, ulong messageLength, byte* privateKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_detached(Span<byte> signature, out ulong signatureLength, ReadOnlySpan<byte> message, ulong messageLength, ReadOnlySpan<byte> privateKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_verify_detached(byte* signature, byte* message, ulong messageLength, byte* publicKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_verify_detached(ReadOnlySpan<byte> signature, ReadOnlySpan<byte> message, ulong messageLength, ReadOnlySpan<byte> publicKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int crypto_sign_init(ref crypto_sign_state state);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_init(ref crypto_sign_state state);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_update(ref crypto_sign_state state, byte* message, ulong messageLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_update(ref crypto_sign_state state, ReadOnlySpan<byte> message, ulong messageLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_final_create(ref crypto_sign_state state, byte* signature, out ulong signatureLength, byte* privateKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_final_create(ref crypto_sign_state state, Span<byte> signature, out ulong signatureLength, ReadOnlySpan<byte> privateKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_sign_final_verify(ref crypto_sign_state state, byte* signature, byte* publicKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_sign_final_verify(ref crypto_sign_state state, ReadOnlySpan<byte> signature, ReadOnlySpan<byte> publicKey);
 
         [StructLayout(LayoutKind.Explicit, Size = 208)]
-        internal struct crypto_sign_state
-        {
-        }
+        internal struct crypto_sign_state;
     }
 }
diff --git a/src/Geralt/Interop/Interop.Encodings.cs b/src/Geralt/Interop/Interop.Encodings.cs
index 51e7823..3f262a9 100644
--- a/src/Geralt/Interop/Interop.Encodings.cs
+++ b/src/Geralt/Interop/Interop.Encodings.cs
@@ -1,22 +1,28 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
     internal static partial class Libsodium
     {
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe IntPtr sodium_bin2hex(byte* hex, nuint hexMaxLength, byte* binary, nuint binaryLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial IntPtr sodium_bin2hex(Span<byte> hex, nuint hexMaxLength, ReadOnlySpan<byte> binary, nuint binaryLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int sodium_hex2bin(byte[] binary, nuint binaryMaxLength, string hex, nuint hexLength, string ignoreChars, out nuint binaryLength, string? hexEnd);
+        [LibraryImport(DllName, StringMarshalling = StringMarshalling.Utf8)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_hex2bin(Span<byte> binary, nuint binaryMaxLength, string hex, nuint hexLength, string ignoreChars, out nuint binaryLength, string? hexEnd);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int sodium_base64_encoded_len(nuint binaryLength, int variant);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_base64_encoded_len(nuint binaryLength, int variant);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe IntPtr sodium_bin2base64(byte* base64, nuint base64MaxLength, byte* binary, nuint binaryLength, int variant);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial IntPtr sodium_bin2base64(Span<byte> base64, nuint base64MaxLength, ReadOnlySpan<byte> binary, nuint binaryLength, int variant);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int sodium_base642bin(byte[] binary, nuint binaryMaxLength, string base64, nuint base64Length, string ignoreChars, out nuint binaryLength, string? base64End, int variant);
+        [LibraryImport(DllName, StringMarshalling = StringMarshalling.Utf8)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_base642bin(Span<byte> binary, nuint binaryMaxLength, string base64, nuint base64Length, string ignoreChars, out nuint binaryLength, string? base64End, int variant);
     }
 }
diff --git a/src/Geralt/Interop/Interop.HChaCha20.cs b/src/Geralt/Interop/Interop.HChaCha20.cs
index 945340d..25ae02b 100644
--- a/src/Geralt/Interop/Interop.HChaCha20.cs
+++ b/src/Geralt/Interop/Interop.HChaCha20.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -9,7 +10,8 @@ internal static partial class Libsodium
         internal const int crypto_core_hchacha20_CONSTBYTES = 16;
         internal const int crypto_core_hchacha20_OUTPUTBYTES = 32;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_core_hchacha20(byte* output, byte* nonce, byte* key, byte* constant);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_core_hchacha20(Span<byte> output, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key, ReadOnlySpan<byte> constant);
     }
 }
diff --git a/src/Geralt/Interop/Interop.Padding.cs b/src/Geralt/Interop/Interop.Padding.cs
index 53e1285..98a52f1 100644
--- a/src/Geralt/Interop/Interop.Padding.cs
+++ b/src/Geralt/Interop/Interop.Padding.cs
@@ -1,13 +1,16 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
     internal static partial class Libsodium
     {
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int sodium_pad(out nuint paddedBufferLength, byte* buffer, nuint unpaddedBufferLength, nuint blockSize, nuint maxBufferLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_pad(out nuint paddedBufferLength, Span<byte> buffer, nuint unpaddedBufferLength, nuint blockSize, nuint maxBufferLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int sodium_unpad(out nuint unpaddedBufferLength, byte* paddedBuffer, nuint paddedBufferLength, nuint blockSize);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_unpad(out nuint unpaddedBufferLength, ReadOnlySpan<byte> paddedBuffer, nuint paddedBufferLength, nuint blockSize);
     }
 }
diff --git a/src/Geralt/Interop/Interop.Poly1305.cs b/src/Geralt/Interop/Interop.Poly1305.cs
index a23b910..eeebe2a 100644
--- a/src/Geralt/Interop/Interop.Poly1305.cs
+++ b/src/Geralt/Interop/Interop.Poly1305.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -7,24 +8,27 @@ internal static partial class Libsodium
         internal const int crypto_onetimeauth_KEYBYTES = 32;
         internal const int crypto_onetimeauth_BYTES  = 16;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_onetimeauth(byte* tag, byte* message, ulong messageLength, byte* oneTimeKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_onetimeauth(Span<byte> tag, ReadOnlySpan<byte> message, ulong messageLength, ReadOnlySpan<byte> oneTimeKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_onetimeauth_verify(byte* tag, byte* message, ulong messageLength, byte* oneTimeKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_onetimeauth_verify(ReadOnlySpan<byte> tag, ReadOnlySpan<byte> message, ulong messageLength, ReadOnlySpan<byte> oneTimeKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_onetimeauth_init(ref crypto_onetimeauth_state state, byte* oneTimeKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_onetimeauth_init(ref crypto_onetimeauth_state state, ReadOnlySpan<byte> oneTimeKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_onetimeauth_update(ref crypto_onetimeauth_state state, byte* message, ulong messageLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_onetimeauth_update(ref crypto_onetimeauth_state state, ReadOnlySpan<byte> message, ulong messageLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_onetimeauth_final(ref crypto_onetimeauth_state state, byte* tag);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_onetimeauth_final(ref crypto_onetimeauth_state state, Span<byte> tag);
 
         [StructLayout(LayoutKind.Explicit, Size = 256)]
-        internal struct crypto_onetimeauth_state
-        {
-        }
+        internal struct crypto_onetimeauth_state;
     }
 }
diff --git a/src/Geralt/Interop/Interop.SecureRandom.cs b/src/Geralt/Interop/Interop.SecureRandom.cs
index 9b5503f..b858608 100644
--- a/src/Geralt/Interop/Interop.SecureRandom.cs
+++ b/src/Geralt/Interop/Interop.SecureRandom.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -6,13 +7,16 @@ internal static partial class Libsodium
     {
         internal const int randombytes_SEEDBYTES = 32;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe void randombytes_buf(byte* buffer, nuint size);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial void randombytes_buf(Span<byte> buffer, nuint size);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe void randombytes_buf_deterministic(byte* buffer, nuint size, byte* seed);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial void randombytes_buf_deterministic(Span<byte> buffer, nuint size, ReadOnlySpan<byte> seed);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int randombytes_uniform(uint upperBound);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int randombytes_uniform(uint upperBound);
     }
 }
diff --git a/src/Geralt/Interop/Interop.Sodium.cs b/src/Geralt/Interop/Interop.Sodium.cs
index 91b4085..ac5f428 100644
--- a/src/Geralt/Interop/Interop.Sodium.cs
+++ b/src/Geralt/Interop/Interop.Sodium.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -8,19 +9,24 @@ internal static partial class Libsodium
         internal const int SODIUM_LIBRARY_VERSION_MAJOR = 26;
         internal const int SODIUM_LIBRARY_VERSION_MINOR = 2;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int sodium_init();
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_init();
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int sodium_set_misuse_handler(delegate* unmanaged[Cdecl]<void> handler);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static unsafe partial int sodium_set_misuse_handler(delegate* unmanaged[Cdecl]<void> handler);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int sodium_library_version_major();
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_library_version_major();
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern int sodium_library_version_minor();
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int sodium_library_version_minor();
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern IntPtr sodium_version_string();
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial IntPtr sodium_version_string();
     }
 }
diff --git a/src/Geralt/Interop/Interop.X25519.cs b/src/Geralt/Interop/Interop.X25519.cs
index 9544eab..412f356 100644
--- a/src/Geralt/Interop/Interop.X25519.cs
+++ b/src/Geralt/Interop/Interop.X25519.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -10,16 +11,20 @@ internal static partial class Libsodium
         internal const int crypto_kx_SESSIONKEYBYTES = 32;
         internal const int crypto_scalarmult_BYTES = 32;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_kx_keypair(byte* publicKey, byte* privateKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_kx_keypair(Span<byte> publicKey, Span<byte> privateKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_kx_seed_keypair(byte* publicKey, byte* privateKey, byte* seed);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_kx_seed_keypair(Span<byte> publicKey, Span<byte> privateKey, ReadOnlySpan<byte> seed);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_scalarmult_base(byte* publicKey, byte* privateKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_scalarmult_base(Span<byte> publicKey, ReadOnlySpan<byte> privateKey);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_scalarmult(byte* sharedSecret, byte* senderPrivateKey, byte* recipientPublicKey);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_scalarmult(Span<byte> sharedSecret, ReadOnlySpan<byte> senderPrivateKey, ReadOnlySpan<byte> recipientPublicKey);
     }
 }
diff --git a/src/Geralt/Interop/Interop.XChaCha20.cs b/src/Geralt/Interop/Interop.XChaCha20.cs
index 2aa4cae..d8928e0 100644
--- a/src/Geralt/Interop/Interop.XChaCha20.cs
+++ b/src/Geralt/Interop/Interop.XChaCha20.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -7,10 +8,12 @@ internal static partial class Libsodium
         internal const int crypto_stream_xchacha20_KEYBYTES = 32;
         internal const int crypto_stream_xchacha20_NONCEBYTES = 24;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_stream_xchacha20(byte* ciphertext, ulong ciphertextLength, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_stream_xchacha20(Span<byte> ciphertext, ulong ciphertextLength, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_stream_xchacha20_xor_ic(byte* ciphertext, byte* plaintext, ulong plaintextLength, byte* nonce, ulong counter, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_stream_xchacha20_xor_ic(Span<byte> ciphertext, ReadOnlySpan<byte> plaintext, ulong plaintextLength, ReadOnlySpan<byte> nonce, ulong counter, ReadOnlySpan<byte> key);
     }
 }
diff --git a/src/Geralt/Interop/Interop.XChaCha20Poly1305.cs b/src/Geralt/Interop/Interop.XChaCha20Poly1305.cs
index 6666678..6c4f808 100644
--- a/src/Geralt/Interop/Interop.XChaCha20Poly1305.cs
+++ b/src/Geralt/Interop/Interop.XChaCha20Poly1305.cs
@@ -1,4 +1,5 @@
-using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
 
 internal static partial class Interop
 {
@@ -17,30 +18,35 @@ internal static partial class Libsodium
         internal const byte crypto_secretstream_xchacha20poly1305_TAG_REKEY = 0x02;
         internal const byte crypto_secretstream_xchacha20poly1305_TAG_FINAL = 0x03;
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_xchacha20poly1305_ietf_encrypt(byte* ciphertext, out ulong ciphertextLength, byte* plaintext, ulong plaintextLength, byte* associatedData, ulong associatedDataLength, byte* nsec, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_xchacha20poly1305_ietf_encrypt(Span<byte> ciphertext, out ulong ciphertextLength, ReadOnlySpan<byte> plaintext, ulong plaintextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_aead_xchacha20poly1305_ietf_decrypt(byte* plaintext, out ulong plaintextLength, byte* nsec, byte* ciphertext, ulong ciphertextLength, byte* associatedData, ulong associatedDataLength, byte* nonce, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_aead_xchacha20poly1305_ietf_decrypt(Span<byte> plaintext, out ulong plaintextLength, ReadOnlySpan<byte> nsec, ReadOnlySpan<byte> ciphertext, ulong ciphertextLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, ReadOnlySpan<byte> nonce, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_secretstream_xchacha20poly1305_init_push(ref crypto_secretstream_xchacha20poly1305_state state, byte* header, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_secretstream_xchacha20poly1305_init_push(ref crypto_secretstream_xchacha20poly1305_state state, Span<byte> header, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_secretstream_xchacha20poly1305_init_pull(ref crypto_secretstream_xchacha20poly1305_state state, byte* header, byte* key);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_secretstream_xchacha20poly1305_init_pull(ref crypto_secretstream_xchacha20poly1305_state state, ReadOnlySpan<byte> header, ReadOnlySpan<byte> key);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_secretstream_xchacha20poly1305_push(ref crypto_secretstream_xchacha20poly1305_state state, byte* ciphertextChunk, out ulong ciphertextChunkLength, byte* plaintextChunk, ulong plaintextChunkLength, byte* associatedData, ulong associatedDataLength, byte chunkFlag);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_secretstream_xchacha20poly1305_push(ref crypto_secretstream_xchacha20poly1305_state state, Span<byte> ciphertextChunk, out ulong ciphertextChunkLength, ReadOnlySpan<byte> plaintextChunk, ulong plaintextChunkLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength, byte chunkFlag);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern unsafe int crypto_secretstream_xchacha20poly1305_pull(ref crypto_secretstream_xchacha20poly1305_state state, byte* plaintext, out ulong plaintextLength, out byte chunkFlag, byte* ciphertextChunk, ulong ciphertextChunkLength, byte* associatedData, ulong associatedDataLength);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial int crypto_secretstream_xchacha20poly1305_pull(ref crypto_secretstream_xchacha20poly1305_state state, Span<byte> plaintext, out ulong plaintextLength, out byte chunkFlag, ReadOnlySpan<byte> ciphertextChunk, ulong ciphertextChunkLength, ReadOnlySpan<byte> associatedData, ulong associatedDataLength);
 
-        [DllImport(DllName, CallingConvention = Convention)]
-        internal static extern void crypto_secretstream_xchacha20poly1305_rekey(ref crypto_secretstream_xchacha20poly1305_state state);
+        [LibraryImport(DllName)]
+        [UnmanagedCallConv(CallConvs = [typeof(CallConvCdecl)])]
+        internal static partial void crypto_secretstream_xchacha20poly1305_rekey(ref crypto_secretstream_xchacha20poly1305_state state);
 
         [StructLayout(LayoutKind.Explicit, Size = 52)]
-        internal struct crypto_secretstream_xchacha20poly1305_state
-        {
-        }
+        internal struct crypto_secretstream_xchacha20poly1305_state;
     }
 }