diff --git a/lib/gssapi/get_mic.c b/lib/gssapi/get_mic.c
index a5c78e521..7ad1fbbb1 100644
--- a/lib/gssapi/get_mic.c
+++ b/lib/gssapi/get_mic.c
@@ -89,7 +89,7 @@ OM_uint32 gss_get_mic
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->local_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->local_subkey->keyvalue.data,
 	  sizeof(key));
   des_set_key (&key, schedule);
   des_cbc_cksum ((des_cblock *)hash,
diff --git a/lib/gssapi/krb5/get_mic.c b/lib/gssapi/krb5/get_mic.c
index a5c78e521..7ad1fbbb1 100644
--- a/lib/gssapi/krb5/get_mic.c
+++ b/lib/gssapi/krb5/get_mic.c
@@ -89,7 +89,7 @@ OM_uint32 gss_get_mic
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->local_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->local_subkey->keyvalue.data,
 	  sizeof(key));
   des_set_key (&key, schedule);
   des_cbc_cksum ((des_cblock *)hash,
diff --git a/lib/gssapi/krb5/unwrap.c b/lib/gssapi/krb5/unwrap.c
index 485b088a9..931862a0f 100644
--- a/lib/gssapi/krb5/unwrap.c
+++ b/lib/gssapi/krb5/unwrap.c
@@ -88,7 +88,7 @@ OM_uint32 gss_unwrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->remote_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->remote_subkey->keyvalue.data,
 	  sizeof(key));
   for (i = 0; i < sizeof(key); ++i)
     key[i] ^= 0xf0;
@@ -123,7 +123,7 @@ OM_uint32 gss_unwrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->remote_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->remote_subkey->keyvalue.data,
 	  sizeof(key));
   des_set_key (&key, schedule);
   des_cbc_cksum ((des_cblock *)hash,
diff --git a/lib/gssapi/krb5/verify_mic.c b/lib/gssapi/krb5/verify_mic.c
index 25e62a285..dc20c18a2 100644
--- a/lib/gssapi/krb5/verify_mic.c
+++ b/lib/gssapi/krb5/verify_mic.c
@@ -84,7 +84,7 @@ OM_uint32 gss_verify_mic
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->remote_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->remote_subkey->keyvalue.data,
 	  sizeof(key));
 
   des_set_key (&key, schedule);
diff --git a/lib/gssapi/krb5/wrap.c b/lib/gssapi/krb5/wrap.c
index e6de7f8e2..a2d132568 100644
--- a/lib/gssapi/krb5/wrap.c
+++ b/lib/gssapi/krb5/wrap.c
@@ -122,7 +122,7 @@ OM_uint32 gss_wrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->local_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->local_subkey->keyvalue.data,
 	  sizeof(key));
   des_set_key (&key, schedule);
   des_cbc_cksum ((des_cblock *)hash,
@@ -159,7 +159,7 @@ OM_uint32 gss_wrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->local_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->local_subkey->keyvalue.data,
 	  sizeof(key));
   for (i = 0; i < sizeof(key); ++i)
     key[i] ^= 0xf0;
diff --git a/lib/gssapi/unwrap.c b/lib/gssapi/unwrap.c
index 485b088a9..931862a0f 100644
--- a/lib/gssapi/unwrap.c
+++ b/lib/gssapi/unwrap.c
@@ -88,7 +88,7 @@ OM_uint32 gss_unwrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->remote_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->remote_subkey->keyvalue.data,
 	  sizeof(key));
   for (i = 0; i < sizeof(key); ++i)
     key[i] ^= 0xf0;
@@ -123,7 +123,7 @@ OM_uint32 gss_unwrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->remote_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->remote_subkey->keyvalue.data,
 	  sizeof(key));
   des_set_key (&key, schedule);
   des_cbc_cksum ((des_cblock *)hash,
diff --git a/lib/gssapi/verify_mic.c b/lib/gssapi/verify_mic.c
index 25e62a285..dc20c18a2 100644
--- a/lib/gssapi/verify_mic.c
+++ b/lib/gssapi/verify_mic.c
@@ -84,7 +84,7 @@ OM_uint32 gss_verify_mic
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->remote_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->remote_subkey->keyvalue.data,
 	  sizeof(key));
 
   des_set_key (&key, schedule);
diff --git a/lib/gssapi/wrap.c b/lib/gssapi/wrap.c
index e6de7f8e2..a2d132568 100644
--- a/lib/gssapi/wrap.c
+++ b/lib/gssapi/wrap.c
@@ -122,7 +122,7 @@ OM_uint32 gss_wrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->local_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->local_subkey->keyvalue.data,
 	  sizeof(key));
   des_set_key (&key, schedule);
   des_cbc_cksum ((des_cblock *)hash,
@@ -159,7 +159,7 @@ OM_uint32 gss_wrap
   memcpy (&key, context_handle->auth_context->key.keyvalue.data,
 	  sizeof(key));
 #endif
-  memcpy (&key, context_handle->auth_context->local_subkey.keyvalue.data,
+  memcpy (&key, context_handle->auth_context->local_subkey->keyvalue.data,
 	  sizeof(key));
   for (i = 0; i < sizeof(key); ++i)
     key[i] ^= 0xf0;
diff --git a/lib/krb5/get_for_creds.c b/lib/krb5/get_for_creds.c
index ba6e8b9bf..20fcc3df7 100644
--- a/lib/krb5/get_for_creds.c
+++ b/lib/krb5/get_for_creds.c
@@ -101,7 +101,7 @@ krb5_get_forwarded_creds (krb5_context	    context,
 	enctype = auth_context->enctype;
     else {
 	ret = krb5_keytype_to_etype (context,
-				     auth_context->local_subkey.keytype,
+				     auth_context->local_subkey->keytype,
 				     &enctype);
 	if (ret)
 	    return ret;
@@ -228,7 +228,7 @@ krb5_get_forwarded_creds (krb5_context	    context,
 				      len,
 				      enctype,
 				      0,
-				      &auth_context->local_subkey,
+				      auth_context->local_subkey,
 				      &cred.enc_part);
     if (ret) {
 	free_KRB_CRED(&cred);
diff --git a/lib/krb5/mk_priv.c b/lib/krb5/mk_priv.c
index 5174f3cc1..6cc9bf475 100644
--- a/lib/krb5/mk_priv.c
+++ b/lib/krb5/mk_priv.c
@@ -61,10 +61,10 @@ krb5_mk_priv(krb5_context context,
 
   /* XXX - Is this right? */
 
-  if (auth_context->local_subkey.keytype)
-      key = &auth_context->local_subkey;
-  else if (auth_context->remote_subkey.keytype)
-      key = &auth_context->remote_subkey;
+  if (auth_context->local_subkey->keytype)
+      key = auth_context->local_subkey;
+  else if (auth_context->remote_subkey->keytype)
+      key = auth_context->remote_subkey;
   else
       key = auth_context->keyblock;
 
diff --git a/lib/krb5/rd_cred.c b/lib/krb5/rd_cred.c
index 97ffdc5dd..7749808f0 100644
--- a/lib/krb5/rd_cred.c
+++ b/lib/krb5/rd_cred.c
@@ -72,7 +72,7 @@ krb5_rd_cred (krb5_context      context,
 			cred.enc_part.cipher.data,
 			cred.enc_part.cipher.length,
 			cred.enc_part.etype,
-			&auth_context->remote_subkey,
+			auth_context->remote_subkey,
 			&enc_krb_cred_part_data);
     if (ret)
 	goto out;
diff --git a/lib/krb5/rd_priv.c b/lib/krb5/rd_priv.c
index eff1d5700..cb07b6b7c 100644
--- a/lib/krb5/rd_priv.c
+++ b/lib/krb5/rd_priv.c
@@ -68,10 +68,10 @@ krb5_rd_priv(krb5_context context,
 
   /* XXX - Is this right? */
 
-  if (auth_context->local_subkey.keytype)
-      key = &auth_context->local_subkey;
-  else if (auth_context->remote_subkey.keytype)
-      key = &auth_context->remote_subkey;
+  if (auth_context->local_subkey->keytype)
+      key = auth_context->local_subkey;
+  else if (auth_context->remote_subkey->keytype)
+      key = auth_context->remote_subkey;
   else
       key = auth_context->keyblock;
 
diff --git a/lib/krb5/rd_req.c b/lib/krb5/rd_req.c
index c36c9f634..0ad8024e3 100644
--- a/lib/krb5/rd_req.c
+++ b/lib/krb5/rd_req.c
@@ -238,8 +238,9 @@ krb5_verify_ap_req(krb5_context context,
     /* And where should it be stored? */
 
     if (ac->authenticator->subkey) {
-	copy_EncryptionKey (ac->authenticator->subkey,
-			    &ac->remote_subkey);
+	krb5_copy_keyblock(context, 
+			   ac->authenticator->subkey,
+			   &ac->remote_subkey);
     }
 
     if (ap_req_options) {