diff --git a/include/odp/api/spec/crypto.h b/include/odp/api/spec/crypto.h
index d30f050..181c0cc 100644
--- a/include/odp/api/spec/crypto.h
+++ b/include/odp/api/spec/crypto.h
@@ -15,6 +15,8 @@
 #define ODP_API_CRYPTO_H_
 #include <odp/visibility_begin.h>
 
+#include <odp/api/deprecated.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -82,10 +84,10 @@ typedef enum {
 	ODP_CIPHER_ALG_AES_GCM,
 
 	/** @deprecated  Use ODP_CIPHER_ALG_AES_CBC instead */
-	ODP_CIPHER_ALG_AES128_CBC,
+	ODP_DEPRECATE(ODP_CIPHER_ALG_AES128_CBC),
 
 	/** @deprecated  Use ODP_CIPHER_ALG_AES_GCM instead */
-	ODP_CIPHER_ALG_AES128_GCM
+	ODP_DEPRECATE(ODP_CIPHER_ALG_AES128_GCM)
 
 } odp_cipher_alg_t;
 
@@ -127,13 +129,14 @@ typedef enum {
 	ODP_AUTH_ALG_AES_GCM,
 
 	/** @deprecated  Use ODP_AUTH_ALG_MD5_HMAC instead */
-	ODP_AUTH_ALG_MD5_96,
+	ODP_DEPRECATE(ODP_AUTH_ALG_MD5_96),
 
 	/** @deprecated  Use ODP_AUTH_ALG_SHA256_HMAC instead */
-	ODP_AUTH_ALG_SHA256_128,
+	ODP_DEPRECATE(ODP_AUTH_ALG_SHA256_128),
 
 	/** @deprecated  Use ODP_AUTH_ALG_AES_GCM instead */
-	ODP_AUTH_ALG_AES128_GCM
+	ODP_DEPRECATE(ODP_AUTH_ALG_AES128_GCM)
+
 } odp_auth_alg_t;
 
 /**
@@ -158,10 +161,11 @@ typedef union odp_crypto_cipher_algos_t {
 		uint32_t aes_gcm     : 1;
 
 		/** @deprecated  Use aes_cbc instead */
-		uint32_t aes128_cbc  : 1;
+		uint32_t ODP_DEPRECATE(aes128_cbc) : 1;
 
 		/** @deprecated  Use aes_gcm instead */
-		uint32_t aes128_gcm  : 1;
+		uint32_t ODP_DEPRECATE(aes128_gcm) : 1;
+
 	} bit;
 
 	/** All bits of the bit field structure
@@ -196,13 +200,14 @@ typedef union odp_crypto_auth_algos_t {
 		uint32_t aes_gcm     : 1;
 
 		/** @deprecated  Use md5_hmac instead */
-		uint32_t md5_96      : 1;
+		uint32_t ODP_DEPRECATE(md5_96)     : 1;
 
 		/** @deprecated  Use sha256_hmac instead */
-		uint32_t sha256_128  : 1;
+		uint32_t ODP_DEPRECATE(sha256_128) : 1;
 
 		/** @deprecated  Use aes_gcm instead */
-		uint32_t aes128_gcm  : 1;
+		uint32_t ODP_DEPRECATE(aes128_gcm) : 1;
+
 	} bit;
 
 	/** All bits of the bit field structure
@@ -317,7 +322,7 @@ typedef struct odp_crypto_session_param_t {
 } odp_crypto_session_param_t;
 
 /** @deprecated  Use odp_crypto_session_param_t instead */
-typedef odp_crypto_session_param_t odp_crypto_session_params_t;
+typedef odp_crypto_session_param_t ODP_DEPRECATE(odp_crypto_session_params_t);
 
 /**
  * Crypto API per packet operation parameters
@@ -373,7 +378,7 @@ typedef struct odp_crypto_op_param_t {
 } odp_crypto_op_param_t;
 
 /** @deprecated  Use odp_crypto_op_param_t instead */
-typedef odp_crypto_op_param_t odp_crypto_op_params_t;
+typedef odp_crypto_op_param_t ODP_DEPRECATE(odp_crypto_op_params_t);
 
 /**
  * Crypto API session creation return code
diff --git a/platform/linux-generic/odp_crypto.c b/platform/linux-generic/odp_crypto.c
index 2ba504b..228e598 100644
--- a/platform/linux-generic/odp_crypto.c
+++ b/platform/linux-generic/odp_crypto.c
@@ -644,12 +644,13 @@ int odp_crypto_capability(odp_crypto_capability_t *capa)
 	capa->auths.bit.sha512_hmac  = 0;
 	capa->auths.bit.aes_gcm      = 1;
 
-	/* Deprecated */
+#if ODP_DEPRECATED_API
 	capa->ciphers.bit.aes128_cbc = 1;
 	capa->ciphers.bit.aes128_gcm = 1;
 	capa->auths.bit.md5_96       = 1;
 	capa->auths.bit.sha256_128   = 1;
 	capa->auths.bit.aes128_gcm   = 1;
+#endif
 
 	capa->max_sessions = MAX_SESSIONS;
 
@@ -740,6 +741,7 @@ odp_crypto_session_create(odp_crypto_session_param_t *param,
 {
 	int rc;
 	odp_crypto_generic_session_t *session;
+	int aes_gcm = 0;
 
 	/* Default to successful result */
 	*status = ODP_CRYPTO_SES_CREATE_ERR_NONE;
@@ -782,17 +784,21 @@ odp_crypto_session_create(odp_crypto_session_param_t *param,
 		rc = process_des_param(session);
 		break;
 	case ODP_CIPHER_ALG_AES_CBC:
-	     /* deprecated */
+#if ODP_DEPRECATED_API
 	case ODP_CIPHER_ALG_AES128_CBC:
+#endif
 		rc = process_aes_param(session);
 		break;
-	case ODP_CIPHER_ALG_AES_GCM:
-	     /* deprecated */
+#if ODP_DEPRECATED_API
 	case ODP_CIPHER_ALG_AES128_GCM:
+		if (param->auth_alg == ODP_AUTH_ALG_AES128_GCM)
+			aes_gcm = 1;
+		/* Fallthrough */
+#endif
+	case ODP_CIPHER_ALG_AES_GCM:
 		/* AES-GCM requires to do both auth and
 		 * cipher at the same time */
-		if (param->auth_alg == ODP_AUTH_ALG_AES_GCM ||
-		    param->auth_alg == ODP_AUTH_ALG_AES128_GCM)
+		if (param->auth_alg == ODP_AUTH_ALG_AES_GCM || aes_gcm)
 			rc = process_aes_gcm_param(session);
 		else
 			rc = -1;
@@ -807,6 +813,8 @@ odp_crypto_session_create(odp_crypto_session_param_t *param,
 		return -1;
 	}
 
+	aes_gcm = 0;
+
 	/* Process based on auth */
 	switch (param->auth_alg) {
 	case ODP_AUTH_ALG_NULL:
@@ -814,22 +822,27 @@ odp_crypto_session_create(odp_crypto_session_param_t *param,
 		rc = 0;
 		break;
 	case ODP_AUTH_ALG_MD5_HMAC:
-	     /* deprecated */
+#if ODP_DEPRECATED_API
 	case ODP_AUTH_ALG_MD5_96:
+#endif
 		rc = process_md5_param(session, 96);
 		break;
 	case ODP_AUTH_ALG_SHA256_HMAC:
-	     /* deprecated */
+#if ODP_DEPRECATED_API
 	case ODP_AUTH_ALG_SHA256_128:
+#endif
 		rc = process_sha256_param(session, 128);
 		break;
-	case ODP_AUTH_ALG_AES_GCM:
-	     /* deprecated */
+#if ODP_DEPRECATED_API
 	case ODP_AUTH_ALG_AES128_GCM:
+		if (param->cipher_alg == ODP_CIPHER_ALG_AES128_GCM)
+			aes_gcm = 1;
+		/* Fallthrough */
+#endif
+	case ODP_AUTH_ALG_AES_GCM:
 		/* AES-GCM requires to do both auth and
 		 * cipher at the same time */
-		if (param->cipher_alg == ODP_CIPHER_ALG_AES_GCM ||
-		    param->cipher_alg == ODP_CIPHER_ALG_AES128_GCM) {
+		if (param->cipher_alg == ODP_CIPHER_ALG_AES_GCM || aes_gcm) {
 			session->auth.func = null_crypto_routine;
 			rc = 0;
 		} else {
@@ -854,10 +867,14 @@ odp_crypto_session_create(odp_crypto_session_param_t *param,
 int odp_crypto_session_destroy(odp_crypto_session_t session)
 {
 	odp_crypto_generic_session_t *generic;
+	int aes_gcm = 0;
 
 	generic = (odp_crypto_generic_session_t *)(intptr_t)session;
-	if (generic->p.cipher_alg == ODP_CIPHER_ALG_AES128_GCM ||
-	    generic->p.cipher_alg == ODP_CIPHER_ALG_AES_GCM)
+#if ODP_DEPRECATED_API
+	if (generic->p.cipher_alg == ODP_CIPHER_ALG_AES128_GCM)
+		aes_gcm = 1;
+#endif
+	if (generic->p.cipher_alg == ODP_CIPHER_ALG_AES_GCM || aes_gcm)
 		EVP_CIPHER_CTX_free(generic->cipher.data.aes_gcm.ctx);
 	memset(generic, 0, sizeof(*generic));
 	free_session(generic);
