Don't combine encrypt and decrypt code paths. Zap key schedule when done. * des3.c (validate_and_schedule): Split out from old k5_des3_docrypt. (k5_des3_encrypt, k5_des3_decrypt): Call it, and krb5int_des3_cbc_encrypt or _decrypt, instead of k5_des3_docrypt. Zap key schedules before returning. To generate a diff of this commit: cvs diff -r1.21 -r1.22 krb5/src/lib/crypto/enc_provider/ChangeLog cvs diff -r1.9 -r1.10 krb5/src/lib/crypto/enc_provider/des3.c