diff --git a/chacha20poly1305/chacha20poly1305.go b/chacha20poly1305/chacha20poly1305.go
index 0d7bac3..93da732 100644
--- a/chacha20poly1305/chacha20poly1305.go
+++ b/chacha20poly1305/chacha20poly1305.go
@@ -26,6 +26,10 @@
 	// NonceSizeX is the size of the nonce used with the XChaCha20-Poly1305
 	// variant of this AEAD, in bytes.
 	NonceSizeX = 24
+
+	// Overhead is the size of the Poly1305 authentication tag, and the
+	// difference between a ciphertext length and its plaintext.
+	Overhead = 16
 )
 
 type chacha20poly1305 struct {
@@ -47,7 +51,7 @@
 }
 
 func (c *chacha20poly1305) Overhead() int {
-	return 16
+	return Overhead
 }
 
 func (c *chacha20poly1305) Seal(dst, nonce, plaintext, additionalData []byte) []byte {
diff --git a/chacha20poly1305/chacha20poly1305_generic.go b/chacha20poly1305/chacha20poly1305_generic.go
index fe191d3..96b2fd8 100644
--- a/chacha20poly1305/chacha20poly1305_generic.go
+++ b/chacha20poly1305/chacha20poly1305_generic.go
@@ -8,8 +8,8 @@
 	"encoding/binary"
 
 	"golang.org/x/crypto/chacha20"
+	"golang.org/x/crypto/internal/poly1305"
 	"golang.org/x/crypto/internal/subtle"
-	"golang.org/x/crypto/poly1305"
 )
 
 func writeWithPadding(p *poly1305.MAC, b []byte) {
diff --git a/chacha20poly1305/xchacha20poly1305.go b/chacha20poly1305/xchacha20poly1305.go
index d9d46b9..1cebfe9 100644
--- a/chacha20poly1305/xchacha20poly1305.go
+++ b/chacha20poly1305/xchacha20poly1305.go
@@ -35,7 +35,7 @@
 }
 
 func (*xchacha20poly1305) Overhead() int {
-	return 16
+	return Overhead
 }
 
 func (x *xchacha20poly1305) Seal(dst, nonce, plaintext, additionalData []byte) []byte {
diff --git a/poly1305/bits_compat.go b/internal/poly1305/bits_compat.go
similarity index 100%
rename from poly1305/bits_compat.go
rename to internal/poly1305/bits_compat.go
diff --git a/poly1305/bits_go1.13.go b/internal/poly1305/bits_go1.13.go
similarity index 100%
rename from poly1305/bits_go1.13.go
rename to internal/poly1305/bits_go1.13.go
diff --git a/poly1305/mac_noasm.go b/internal/poly1305/mac_noasm.go
similarity index 100%
rename from poly1305/mac_noasm.go
rename to internal/poly1305/mac_noasm.go
diff --git a/poly1305/poly1305.go b/internal/poly1305/poly1305.go
similarity index 97%
rename from poly1305/poly1305.go
rename to internal/poly1305/poly1305.go
index 9d7a6af..4aaea81 100644
--- a/poly1305/poly1305.go
+++ b/internal/poly1305/poly1305.go
@@ -15,7 +15,7 @@
 // used with a fixed key in order to generate one-time keys from an nonce.
 // However, in this package AES isn't used and the one-time key is specified
 // directly.
-package poly1305 // import "golang.org/x/crypto/poly1305"
+package poly1305
 
 import "crypto/subtle"
 
diff --git a/poly1305/poly1305_test.go b/internal/poly1305/poly1305_test.go
similarity index 100%
rename from poly1305/poly1305_test.go
rename to internal/poly1305/poly1305_test.go
diff --git a/poly1305/sum_amd64.go b/internal/poly1305/sum_amd64.go
similarity index 100%
rename from poly1305/sum_amd64.go
rename to internal/poly1305/sum_amd64.go
diff --git a/poly1305/sum_amd64.s b/internal/poly1305/sum_amd64.s
similarity index 100%
rename from poly1305/sum_amd64.s
rename to internal/poly1305/sum_amd64.s
diff --git a/poly1305/sum_generic.go b/internal/poly1305/sum_generic.go
similarity index 100%
rename from poly1305/sum_generic.go
rename to internal/poly1305/sum_generic.go
diff --git a/poly1305/sum_ppc64le.go b/internal/poly1305/sum_ppc64le.go
similarity index 100%
rename from poly1305/sum_ppc64le.go
rename to internal/poly1305/sum_ppc64le.go
diff --git a/poly1305/sum_ppc64le.s b/internal/poly1305/sum_ppc64le.s
similarity index 100%
rename from poly1305/sum_ppc64le.s
rename to internal/poly1305/sum_ppc64le.s
diff --git a/poly1305/sum_s390x.go b/internal/poly1305/sum_s390x.go
similarity index 100%
rename from poly1305/sum_s390x.go
rename to internal/poly1305/sum_s390x.go
diff --git a/poly1305/sum_s390x.s b/internal/poly1305/sum_s390x.s
similarity index 100%
rename from poly1305/sum_s390x.s
rename to internal/poly1305/sum_s390x.s
diff --git a/poly1305/vectors_test.go b/internal/poly1305/vectors_test.go
similarity index 100%
rename from poly1305/vectors_test.go
rename to internal/poly1305/vectors_test.go
diff --git a/nacl/secretbox/secretbox.go b/nacl/secretbox/secretbox.go
index a98d1bd..a2973e6 100644
--- a/nacl/secretbox/secretbox.go
+++ b/nacl/secretbox/secretbox.go
@@ -35,8 +35,8 @@
 package secretbox // import "golang.org/x/crypto/nacl/secretbox"
 
 import (
+	"golang.org/x/crypto/internal/poly1305"
 	"golang.org/x/crypto/internal/subtle"
-	"golang.org/x/crypto/poly1305"
 	"golang.org/x/crypto/salsa20/salsa"
 )
 
diff --git a/poly1305/poly1305.go b/poly1305/poly1305_compat.go
similarity index 80%
copy from poly1305/poly1305.go
copy to poly1305/poly1305_compat.go
index 9d7a6af..dd975a3 100644
--- a/poly1305/poly1305.go
+++ b/poly1305/poly1305_compat.go
@@ -15,27 +15,32 @@
 // used with a fixed key in order to generate one-time keys from an nonce.
 // However, in this package AES isn't used and the one-time key is specified
 // directly.
+//
+// Deprecated: Poly1305 as implemented by this package is a cryptographic
+// building block that is not safe for general purpose use.
+// For encryption, use the full ChaCha20-Poly1305 construction implemented by
+// golang.org/x/crypto/chacha20poly1305. For authentication, use a general
+// purpose MAC such as HMAC implemented by crypto/hmac.
 package poly1305 // import "golang.org/x/crypto/poly1305"
 
-import "crypto/subtle"
+import "golang.org/x/crypto/internal/poly1305"
 
 // TagSize is the size, in bytes, of a poly1305 authenticator.
+//
+// For use with golang.org/x/crypto/chacha20poly1305, chacha20poly1305.Overhead
+// can be used instead.
 const TagSize = 16
 
 // Sum generates an authenticator for msg using a one-time key and puts the
 // 16-byte result into out. Authenticating two different messages with the same
 // key allows an attacker to forge messages at will.
 func Sum(out *[16]byte, m []byte, key *[32]byte) {
-	h := New(key)
-	h.Write(m)
-	h.Sum(out[:0])
+	poly1305.Sum(out, m, key)
 }
 
 // Verify returns true if mac is a valid authenticator for m with the given key.
 func Verify(mac *[16]byte, m []byte, key *[32]byte) bool {
-	var tmp [16]byte
-	Sum(&tmp, m, key)
-	return subtle.ConstantTimeCompare(tmp[:], mac[:]) == 1
+	return poly1305.Verify(mac, m, key)
 }
 
 // New returns a new MAC computing an authentication
@@ -48,9 +53,7 @@
 // two different messages with the same key allows an attacker
 // to forge messages at will.
 func New(key *[32]byte) *MAC {
-	m := &MAC{}
-	initialize(key, &m.macState)
-	return m
+	return &MAC{mac: poly1305.New(key)}
 }
 
 // MAC is an io.Writer computing an authentication tag
@@ -61,9 +64,7 @@
 // Therefore writing data to a running MAC after calling
 // Sum or Verify causes it to panic.
 type MAC struct {
-	mac // platform-dependent implementation
-
-	finalized bool
+	mac *poly1305.MAC
 }
 
 // Size returns the number of bytes Sum will return.
@@ -74,26 +75,17 @@
 //
 // It must not be called after the first call of Sum or Verify.
 func (h *MAC) Write(p []byte) (n int, err error) {
-	if h.finalized {
-		panic("poly1305: write to MAC after Sum or Verify")
-	}
 	return h.mac.Write(p)
 }
 
 // Sum computes the authenticator of all data written to the
 // message authentication code.
 func (h *MAC) Sum(b []byte) []byte {
-	var mac [TagSize]byte
-	h.mac.Sum(&mac)
-	h.finalized = true
-	return append(b, mac[:]...)
+	return h.mac.Sum(b)
 }
 
 // Verify returns whether the authenticator of all data written to
 // the message authentication code matches the expected value.
 func (h *MAC) Verify(expected []byte) bool {
-	var mac [TagSize]byte
-	h.mac.Sum(&mac)
-	h.finalized = true
-	return subtle.ConstantTimeCompare(expected, mac[:]) == 1
+	return h.mac.Verify(expected)
 }
diff --git a/ssh/cipher.go b/ssh/cipher.go
index 8bd6b3d..bddbde5 100644
--- a/ssh/cipher.go
+++ b/ssh/cipher.go
@@ -18,7 +18,7 @@
 	"io/ioutil"
 
 	"golang.org/x/crypto/chacha20"
-	"golang.org/x/crypto/poly1305"
+	"golang.org/x/crypto/internal/poly1305"
 )
 
 const (