diff --git a/src/testing/test_auditor_api.c b/src/testing/test_auditor_api.c
index cf2354bd8..38b1b1abe 100644
--- a/src/testing/test_auditor_api.c
+++ b/src/testing/test_auditor_api.c
@@ -682,7 +682,7 @@ int
 main (int argc,
       char *const *argv)
 {
-  const char *cipher;
+  char *cipher;
 
   (void) argc;
   /* These environment variables get in the way... */
@@ -700,6 +700,7 @@ main (int argc,
   GNUNET_asprintf (&config_file_expire_reserve_now,
                    "test_auditor_api_expire_reserve_now-%s.conf",
                    cipher);
+  GNUNET_free (cipher);
   /* Check fakebank port is available and get configuration data. */
   if (GNUNET_OK !=
       TALER_TESTING_prepare_fakebank (config_file,
diff --git a/src/testing/test_exchange_api.c b/src/testing/test_exchange_api.c
index ab56abd36..1b31b646a 100644
--- a/src/testing/test_exchange_api.c
+++ b/src/testing/test_exchange_api.c
@@ -977,7 +977,7 @@ int
 main (int argc,
       char *const *argv)
 {
-  const char *cipher;
+  char *cipher;
 
   (void) argc;
   /* These environment variables get in the way... */
@@ -994,6 +994,7 @@ main (int argc,
   GNUNET_asprintf (&config_file_expire_reserve_now,
                    "test_exchange_api_expire_reserve_now-%s.conf",
                    cipher);
+  GNUNET_free (cipher);
   /* Check fakebank port is available and get config */
   if (GNUNET_OK !=
       TALER_TESTING_prepare_fakebank (config_file,
diff --git a/src/testing/test_exchange_api_keys_cherry_picking.c b/src/testing/test_exchange_api_keys_cherry_picking.c
index ed906f95a..63114c60c 100644
--- a/src/testing/test_exchange_api_keys_cherry_picking.c
+++ b/src/testing/test_exchange_api_keys_cherry_picking.c
@@ -110,7 +110,7 @@ int
 main (int argc,
       char *const *argv)
 {
-  const char *cipher;
+  char *cipher;
 
   (void) argc;
   /* These environment variables get in the way... */
@@ -124,6 +124,7 @@ main (int argc,
   GNUNET_asprintf (&config_file,
                    "test_exchange_api_keys_cherry_picking-%s.conf",
                    cipher);
+  GNUNET_free (cipher);
   TALER_TESTING_cleanup_files (config_file);
   /* @helpers.  Run keyup, create tables, ... Note: it
    * fetches the port number from config in order to see
diff --git a/src/testing/test_exchange_api_overlapping_keys_bug.c b/src/testing/test_exchange_api_overlapping_keys_bug.c
index 8dd160062..54c552236 100644
--- a/src/testing/test_exchange_api_overlapping_keys_bug.c
+++ b/src/testing/test_exchange_api_overlapping_keys_bug.c
@@ -90,7 +90,7 @@ int
 main (int argc,
       char *const *argv)
 {
-  const char *cipher;
+  char *cipher;
 
   (void) argc;
   /* These environment variables get in the way... */
@@ -104,6 +104,7 @@ main (int argc,
   GNUNET_asprintf (&config_file,
                    "test_exchange_api_keys_cherry_picking-%s.conf",
                    cipher);
+  GNUNET_free (cipher);
   TALER_TESTING_cleanup_files (config_file);
   /* @helpers.  Run keyup, create tables, ... Note: it
    * fetches the port number from config in order to see
diff --git a/src/testing/test_exchange_api_revocation.c b/src/testing/test_exchange_api_revocation.c
index 0ca7fab3a..beb94dbaf 100644
--- a/src/testing/test_exchange_api_revocation.c
+++ b/src/testing/test_exchange_api_revocation.c
@@ -249,7 +249,7 @@ int
 main (int argc,
       char *const *argv)
 {
-  const char *cipher;
+  char *cipher;
 
   (void) argc;
   /* These environment variables get in the way... */
@@ -263,6 +263,7 @@ main (int argc,
   GNUNET_asprintf (&config_file,
                    "test_exchange_api-%s.conf",
                    cipher);
+  GNUNET_free (cipher);
   /* Check fakebank port is available and get config */
   if (GNUNET_OK !=
       TALER_TESTING_prepare_fakebank (config_file,
diff --git a/src/testing/test_exchange_api_twisted.c b/src/testing/test_exchange_api_twisted.c
index ebc9a59ce..33631764c 100644
--- a/src/testing/test_exchange_api_twisted.c
+++ b/src/testing/test_exchange_api_twisted.c
@@ -284,7 +284,7 @@ int
 main (int argc,
       char *const *argv)
 {
-  const char *cipher;
+  char *cipher;
   int ret;
 
   (void) argc;
@@ -299,6 +299,7 @@ main (int argc,
   GNUNET_asprintf (&config_file,
                    "test_exchange_api_twisted-%s.conf",
                    cipher);
+  GNUNET_free (cipher);
   if (GNUNET_OK !=
       TALER_TESTING_prepare_fakebank (config_file,
                                       "exchange-account-2",
diff --git a/src/testing/test_exchange_management_api.c b/src/testing/test_exchange_management_api.c
index 34cbbf3ed..71251a57f 100644
--- a/src/testing/test_exchange_management_api.c
+++ b/src/testing/test_exchange_management_api.c
@@ -157,7 +157,7 @@ int
 main (int argc,
       char *const *argv)
 {
-  const char *cipher;
+  char *cipher;
 
   (void) argc;
   /* These environment variables get in the way... */
@@ -172,6 +172,7 @@ main (int argc,
   GNUNET_asprintf (&config_file,
                    "test_exchange_api-%s.conf",
                    cipher);
+  GNUNET_free (cipher);
   if (GNUNET_OK !=
       TALER_TESTING_prepare_fakebank (config_file,
                                       "exchange-account-2",
diff --git a/src/util/taler-exchange-secmod-cs.c b/src/util/taler-exchange-secmod-cs.c
index 5446c70f7..17fb23b3d 100644
--- a/src/util/taler-exchange-secmod-cs.c
+++ b/src/util/taler-exchange-secmod-cs.c
@@ -43,8 +43,6 @@
 #include <poll.h>
 
 
-#define TALER_CFG_CIPHER_LEN 3
-
 /**
  * Information we keep per denomination.
  */
@@ -1383,14 +1381,12 @@ load_denominations (void *cls,
                                "CIPHER");
     return;
   }
-  if (strlen (cipher) > TALER_CFG_CIPHER_LEN)
-  {
-    return; /* Cipher length must be smaller than TALER_CFG_CIPHER_LEN */
-  }
   if (0 != strcmp (cipher, "CS"))
   {
+    GNUNET_free (cipher);
     return; /* Ignore denominations of other types than CS*/
   }
+  GNUNET_free (cipher);
 
   denom = GNUNET_new (struct Denomination);
   if (GNUNET_OK !=
diff --git a/src/util/taler-exchange-secmod-rsa.c b/src/util/taler-exchange-secmod-rsa.c
index ba6ee978f..06c42a028 100644
--- a/src/util/taler-exchange-secmod-rsa.c
+++ b/src/util/taler-exchange-secmod-rsa.c
@@ -41,7 +41,6 @@
 #include "secmod_common.h"
 #include <poll.h>
 
-#define TALER_CFG_CIPHER_LEN 3
 
 /**
  * Information we keep per denomination.
@@ -1361,14 +1360,12 @@ load_denominations (void *cls,
                                "CIPHER");
     return;
   }
-  if (strlen (cipher) > TALER_CFG_CIPHER_LEN)
-  {
-    return; /* Cipher length must be smaller than TALER_CFG_CIPHER_LEN */
-  }
   if (0 != strcmp (cipher, "RSA"))
   {
+    GNUNET_free (cipher);
     return; /* Ignore denominations of other types than CS */
   }
+  GNUNET_free (cipher);
   denom = GNUNET_new (struct Denomination);
   if (GNUNET_OK !=
       parse_denomination_cfg (ctx->cfg,