diff --git a/lib/krb5/acache.c b/lib/krb5/acache.c
index fb38abedf..d9912eb42 100644
--- a/lib/krb5/acache.c
+++ b/lib/krb5/acache.c
@@ -116,7 +116,8 @@ init_ccapi(krb5_context context)
     if (cc_handle == NULL) {
 	HEIMDAL_MUTEX_unlock(&acc_mutex);
 	krb5_set_error_message(context, KRB5_CC_NOSUPP, 
-			       "Failed to load %s", lib);
+			       N_("Failed to load API cache module %s", "file"),
+			       lib);
 	return KRB5_CC_NOSUPP;
     }
 
@@ -124,8 +125,8 @@ init_ccapi(krb5_context context)
     HEIMDAL_MUTEX_unlock(&acc_mutex);
     if (init_func == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOSUPP,
-			       "Failed to find cc_initialize"
-			       "in %s: %s", lib, dlerror());
+			       N_("Failed to find cc_initialize"
+				 "in %s: %s", "file, error"), lib, dlerror());
 	dlclose(cc_handle);
 	return KRB5_CC_NOSUPP;
     }
@@ -133,7 +134,8 @@ init_ccapi(krb5_context context)
     return 0;
 #else
     HEIMDAL_MUTEX_unlock(&acc_mutex);
-    krb5_set_error_message(context, KRB5_CC_NOSUPP, "no support for shared object");
+    krb5_set_error_message(context, KRB5_CC_NOSUPP,
+			   N_("no support for shared object"));
     return KRB5_CC_NOSUPP;
 #endif
 }    
@@ -258,7 +260,7 @@ make_cred_from_ccred(krb5_context context,
     
 nomem:
     ret = ENOMEM;
-    krb5_set_error_message(context, ret, "malloc: out of memory");
+    krb5_set_error_message(context, ret, N_("malloc: out of memory", "malloc"));
     
 fail:
     krb5_free_cred_contents(context, cred);
@@ -626,7 +628,7 @@ acc_store_cred(krb5_context context,
     
     if (a->ccache == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
-			       "No API credential found");
+			       N_("No API credential found", ""));
 	return KRB5_CC_NOTFOUND;
     }
 
@@ -660,7 +662,7 @@ acc_get_principal(krb5_context context,
 
     if (a->ccache == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
-			       "No API credential found");
+			       N_("No API credential found", ""));
 	return KRB5_CC_NOTFOUND;
     }
 
@@ -687,7 +689,7 @@ acc_get_first (krb5_context context,
     
     if (a->ccache == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
-			       "No API credential found");
+			       N_("No API credential found", ""));
 	return KRB5_CC_NOTFOUND;
     }
 
@@ -753,7 +755,7 @@ acc_remove_cred(krb5_context context,
     
     if (a->ccache == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
-			       "No API credential found");
+			       N_("No API credential found", ""));
 	return KRB5_CC_NOTFOUND;
     }
 
@@ -806,7 +808,8 @@ acc_remove_cred(krb5_context context,
 
     if (ret)
 	krb5_set_error_message(context, ret,
-			       "Can't find credential %s in cache", server);
+			       N_("Can't find credential %s in cache",
+				 "principal"), server);
     free(server);
     free(client);
 
@@ -975,7 +978,7 @@ acc_get_default_name(krb5_context context, char **str)
     (*cc->func->release)(cc);
 
     if (*str == NULL) {
-	krb5_set_error_message(context, ENOMEM, "out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     return 0;
@@ -989,7 +992,7 @@ acc_set_default(krb5_context context, krb5_ccache id)
     
     if (a->ccache == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
-			       "No API credential found");
+			       N_("No API credential found", ""));
 	return KRB5_CC_NOTFOUND;
     }
 
diff --git a/lib/krb5/acl.c b/lib/krb5/acl.c
index 6f9eae8b7..0cad4e5e5 100644
--- a/lib/krb5/acl.c
+++ b/lib/krb5/acl.c
@@ -83,7 +83,8 @@ acl_parse_format(krb5_context context,
     for(p = format; *p != '\0'; p++) {
 	tmp = malloc(sizeof(*tmp));
 	if(tmp == NULL) {
-	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message(context, ENOMEM,
+				   N_("malloc: out of memory", ""));
 	    acl_free_list(acl, 0);
 	    return ENOMEM;
 	}
@@ -98,8 +99,9 @@ acl_parse_format(krb5_context context,
 	    tmp->u.retv = va_arg(ap, char **);
 	    *tmp->u.retv = NULL;
 	} else {
-	    krb5_set_error_message(context, EINVAL, "acl_parse_format: "
-				   "unknown format specifier %c", *p);
+	    krb5_set_error_message(context, EINVAL, 
+				   N_("Unknown format specifier %c while "
+				     "parsing ACL", "specifier"), *p);
 	    acl_free_list(acl, 0);
 	    free(tmp);
 	    return EINVAL;
@@ -220,7 +222,7 @@ krb5_acl_match_string(krb5_context context,
     if (found) {
 	return 0;
     } else {
-	krb5_set_error_message(context, EACCES, "ACL did not match");
+	krb5_set_error_message(context, EACCES, N_("ACL did not match", ""));
 	return EACCES;
     }
 }
@@ -259,7 +261,7 @@ krb5_acl_match_file(krb5_context context,
 	int save_errno = errno;
 
 	krb5_set_error_message(context, save_errno,
-			       "open(%s): %s", file,
+			       N_("open(%s): %s", "file, errno"), file,
 			       strerror(save_errno));
 	return save_errno;
     }
@@ -289,7 +291,7 @@ krb5_acl_match_file(krb5_context context,
     if (found) {
 	return 0;
     } else {
-	krb5_set_error_message(context, EACCES, "ACL did not match");
+	krb5_set_error_message(context, EACCES, N_("ACL did not match", ""));
 	return EACCES;
     }
 }
diff --git a/lib/krb5/addr_families.c b/lib/krb5/addr_families.c
index dcb9a9715..79864c39f 100644
--- a/lib/krb5/addr_families.c
+++ b/lib/krb5/addr_families.c
@@ -53,7 +53,7 @@ struct addr_operations {
     int (*free_addr)(krb5_context, krb5_address*);
     int (*copy_addr)(krb5_context, const krb5_address*, krb5_address*);
     int (*mask_boundary)(krb5_context, const krb5_address*, unsigned long, 
-				     krb5_address*, krb5_address*);
+			 krb5_address*, krb5_address*);
 };
 
 /*
@@ -203,7 +203,7 @@ ipv4_mask_boundary(krb5_context context, const krb5_address *inaddr,
 
     if (len > 32) {
 	krb5_set_error_message(context, KRB5_PROG_ATYPE_NOSUPP,
-			       "IPv4 prefix too large (%ld)", len);
+			       N_("IPv4 prefix too large (%ld)", "len"), len);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
     m = m << (32 - len);
@@ -397,13 +397,13 @@ ipv6_mask_boundary(krb5_context context, const krb5_address *inaddr,
 
     if (len > 128) {
 	krb5_set_error_message(context, KRB5_PROG_ATYPE_NOSUPP,
-			       "IPv6 prefix too large (%ld)", len);
+			       N_("IPv6 prefix too large (%ld)", "length"), len);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
 
     if (inaddr->address.length != sizeof(addr)) {
 	krb5_set_error_message(context, KRB5_PROG_ATYPE_NOSUPP,
-			       "IPv6 addr bad length");
+			       N_("IPv6 addr bad length", ""));
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
 
@@ -790,7 +790,7 @@ krb5_sockaddr2address (krb5_context context,
     struct addr_operations *a = find_af(sa->sa_family);
     if (a == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ATYPE_NOSUPP,
-				"Address family %d not supported",
+				N_("Address family %d not supported", ""),
 				sa->sa_family);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
@@ -818,7 +818,7 @@ krb5_sockaddr2port (krb5_context context,
     struct addr_operations *a = find_af(sa->sa_family);
     if (a == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ATYPE_NOSUPP,
-				"Address family %d not supported",
+				N_("Address family %d not supported", ""),
 				sa->sa_family);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
@@ -857,14 +857,15 @@ krb5_addr2sockaddr (krb5_context context,
 
     if (a == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ATYPE_NOSUPP,
-				"Address type %d not supported",
+				N_("Address type %d not supported", 
+				   "krb5_address type"),
 				addr->addr_type);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
     if (a->addr2sockaddr == NULL) {
 	krb5_set_error_message (context,
 				KRB5_PROG_ATYPE_NOSUPP,
-				"Can't convert address type %d to sockaddr",
+				N_("Can't convert address type %d to sockaddr", ""),
 				addr->addr_type);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
@@ -972,7 +973,7 @@ krb5_h_addr2addr (krb5_context context,
     struct addr_operations *a = find_af(af);
     if (a == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ATYPE_NOSUPP,
-				"Address family %d not supported", af);
+				N_("Address family %d not supported", ""), af);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
     return (*a->h_addr2addr)(haddr, addr);
@@ -1006,7 +1007,7 @@ krb5_anyaddr (krb5_context context,
 
     if (a == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ATYPE_NOSUPP,
-				"Address family %d not supported", af);
+				N_("Address family %d not supported", ""), af);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
 
@@ -1100,7 +1101,7 @@ krb5_parse_address(krb5_context context,
 		ALLOC_SEQ(addresses, 1);
 		if (addresses->val == NULL) {
 		    krb5_set_error_message(context, ENOMEM,
-					   "malloc: out of memory");
+					   N_("malloc: out of memory", ""));
 		    return ENOMEM;
 		}
 		addresses->val[0] = addr;
@@ -1126,7 +1127,7 @@ krb5_parse_address(krb5_context context,
     ALLOC_SEQ(addresses, n);
     if (addresses->val == NULL) {
 	krb5_set_error_message(context, ENOMEM, 
-			       "malloc: out of memory");
+			       N_("malloc: out of memory", ""));
 	freeaddrinfo(ai);
 	return ENOMEM;
     }
@@ -1170,7 +1171,7 @@ krb5_address_order(krb5_context context,
     a = find_atype(addr1->addr_type); 
     if(a == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ATYPE_NOSUPP,
-				"Address family %d not supported", 
+				N_("Address family %d not supported", ""), 
 				addr1->addr_type);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
@@ -1179,8 +1180,8 @@ krb5_address_order(krb5_context context,
     a = find_atype(addr2->addr_type); 
     if(a == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ATYPE_NOSUPP,
-				"Address family %d not supported", 
-			       addr2->addr_type);
+				N_("Address family %d not supported", ""),
+				addr2->addr_type);
 	return KRB5_PROG_ATYPE_NOSUPP;
     }
     if(a->order_addr != NULL) 
@@ -1366,8 +1367,8 @@ krb5_append_addresses(krb5_context context,
     if(source->len > 0) {
 	tmp = realloc(dest->val, (dest->len + source->len) * sizeof(*tmp));
 	if(tmp == NULL) {
-	    krb5_set_error_message (context, ENOMEM,
-				    "realloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM, 
+				    N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	dest->val = tmp;
@@ -1410,14 +1411,14 @@ krb5_make_addrport (krb5_context context,
     *res = malloc (sizeof(**res));
     if (*res == NULL) {
 	krb5_set_error_message (context, ENOMEM,
-				"malloc: out of memory");
+				N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     (*res)->addr_type = KRB5_ADDRESS_ADDRPORT;
     ret = krb5_data_alloc (&(*res)->address, len);
     if (ret) {
 	krb5_set_error_message (context, ret,
-				"malloc: out of memory");
+				N_("malloc: out of memory", ""));
 	free (*res);
 	*res = NULL;
 	return ret;
@@ -1478,7 +1479,8 @@ krb5_address_prefixlen_boundary(krb5_context context,
     if(a != NULL && a->mask_boundary != NULL)
 	return (*a->mask_boundary)(context, inaddr, prefixlen, low, high);
     krb5_set_error_message(context, KRB5_PROG_ATYPE_NOSUPP,
-			  "Address family %d doesn't support "
-			  "address mask operation", inaddr->addr_type);
+			   N_("Address family %d doesn't support "
+			      "address mask operation", ""), 
+			   inaddr->addr_type);
     return KRB5_PROG_ATYPE_NOSUPP;
 }
diff --git a/lib/krb5/auth_context.c b/lib/krb5/auth_context.c
index cbb186d6c..87beb176d 100644
--- a/lib/krb5/auth_context.c
+++ b/lib/krb5/auth_context.c
@@ -43,13 +43,13 @@ krb5_auth_con_init(krb5_context context,
 
     ALLOC(p, 1);
     if(!p) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memset(p, 0, sizeof(*p));
     ALLOC(p->authenticator, 1);
     if (!p->authenticator) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	free(p);
 	return ENOMEM;
     }
@@ -241,7 +241,7 @@ krb5_auth_con_getaddrs(krb5_context context,
 	krb5_free_address (context, *local_addr);
     *local_addr = malloc (sizeof(**local_addr));
     if (*local_addr == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     krb5_copy_address(context,
@@ -252,7 +252,7 @@ krb5_auth_con_getaddrs(krb5_context context,
 	krb5_free_address (context, *remote_addr);
     *remote_addr = malloc (sizeof(**remote_addr));
     if (*remote_addr == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	krb5_free_address (context, *local_addr);
 	*local_addr = NULL;
 	return ENOMEM;
@@ -452,7 +452,7 @@ krb5_auth_con_getauthenticator(krb5_context context,
 {
     *authenticator = malloc(sizeof(**authenticator));
     if (*authenticator == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
diff --git a/lib/krb5/build_auth.c b/lib/krb5/build_auth.c
index eb106dc23..3c8041649 100644
--- a/lib/krb5/build_auth.c
+++ b/lib/krb5/build_auth.c
@@ -62,7 +62,7 @@ make_etypelist(krb5_context context,
     ALLOC_SEQ(&ad, 1);
     if (ad.val == NULL) {
 	free(buf);
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -81,14 +81,14 @@ make_etypelist(krb5_context context,
 
     ALLOC(*auth_data, 1);
     if (*auth_data == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
     ALLOC_SEQ(*auth_data, 1);
     if ((*auth_data)->val == NULL) {
 	free(buf);
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -118,7 +118,7 @@ krb5_build_authenticator (krb5_context context,
 
     auth = calloc(1, sizeof(*auth));
     if (auth == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
diff --git a/lib/krb5/cache.c b/lib/krb5/cache.c
index 98dec98c4..54d3f51f2 100644
--- a/lib/krb5/cache.c
+++ b/lib/krb5/cache.c
@@ -59,9 +59,9 @@ krb5_cc_register(krb5_context context,
     for(i = 0; i < context->num_cc_ops && context->cc_ops[i].prefix; i++) {
 	if(strcmp(context->cc_ops[i].prefix, ops->prefix) == 0) {
 	    if(!override) {
-		krb5_set_error_message(context, 
+		krb5_set_error_message(context,
 				       KRB5_CC_TYPE_EXISTS,
-				       "ccache type %s already exists",
+				       N_("cache type %s already exists", "type"),
 				       ops->prefix);
 		return KRB5_CC_TYPE_EXISTS;
 	    }
@@ -73,8 +73,8 @@ krb5_cc_register(krb5_context context,
 				 (context->num_cc_ops + 1) *
 				 sizeof(*context->cc_ops));
 	if(o == NULL) {
-	    krb5_set_error_message(context, KRB5_CC_NOMEM, 
-				   "malloc: out of memory");
+	    krb5_set_error_message(context, KRB5_CC_NOMEM,
+				   N_("malloc: out of memory", ""));
 	    return KRB5_CC_NOMEM;
 	}
 	context->num_cc_ops++;
@@ -100,7 +100,8 @@ _krb5_cc_allocate(krb5_context context,
 
     p = malloc (sizeof(*p));
     if(p == NULL) {
-	krb5_set_error_message(context, KRB5_CC_NOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, KRB5_CC_NOMEM,
+			       N_("malloc: out of memory", ""));
 	return KRB5_CC_NOMEM;
     }
     p->ops = ops;
@@ -169,7 +170,7 @@ krb5_cc_resolve(krb5_context context,
 	return allocate_ccache (context, &krb5_fcc_ops, name, id);
     else {
 	krb5_set_error_message(context, KRB5_CC_UNKNOWN_TYPE,
-			       "unknown ccache type %s", name);
+			       N_("unknown ccache type %s", "name"), name);
 	return KRB5_CC_UNKNOWN_TYPE;
     }
 }
@@ -284,7 +285,7 @@ krb5_cc_get_full_name(krb5_context context,
     }
     
     if (asprintf(str, "%s:%s", type, name) == -1) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	*str = NULL;
 	return ENOMEM;
     }
@@ -356,7 +357,8 @@ _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res)
 	if (append == NULL) {
 	    free(*res);
 	    *res = NULL;
-	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message(context, ENOMEM,
+				   N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	
@@ -367,7 +369,7 @@ _krb5_expand_default_cc_name(krb5_context context, const char *str, char **res)
 	    free(*res);
 	    *res = NULL;
 	    krb5_set_error_message(context, ENOMEM, 
-				   "malloc: out of memory");
+				   N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	*res = tmp;
@@ -488,7 +490,7 @@ krb5_cc_set_default_name(krb5_context context, const char *name)
     }
 
     if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -535,7 +537,7 @@ krb5_cc_default(krb5_context context,
     const char *p = krb5_cc_default_name(context);
 
     if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     return krb5_cc_resolve(context, p, id);
@@ -907,7 +909,7 @@ krb5_cc_get_prefix_ops(krb5_context context, const char *prefix)
 
     p = strdup(prefix);
     if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return NULL;
     }
     p1 = strchr(p, ':');
@@ -960,14 +962,15 @@ krb5_cc_cache_get_first (krb5_context context,
 
     if (ops->get_cache_first == NULL) {
 	krb5_set_error_message(context, KRB5_CC_NOSUPP,
-			       "Credential cache type %s doesn't support "
-			       "iterations over caches", ops->prefix);
+			       N_("Credential cache type %s doesn't support "
+				 "iterations over caches", "type"),
+			       ops->prefix);
 	return KRB5_CC_NOSUPP;
     }
 
     *cursor = calloc(1, sizeof(**cursor));
     if (*cursor == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -1072,8 +1075,8 @@ krb5_cc_cache_match (krb5_context context,
 	krb5_unparse_name(context, client, &str);
 
 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
-			       "Principal %s not found in a "
-			       "credential cache", 
+			       N_("Principal %s not found in a "
+				  "credential cache", ""), 
 			       str ? str : "<out of memory>");
 	if (str)
 	    free(str);
@@ -1105,8 +1108,8 @@ krb5_cc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
 
     if (strcmp(from->ops->prefix, to->ops->prefix) != 0) {
 	krb5_set_error_message(context, KRB5_CC_NOSUPP,
-			       "Moving credentials between diffrent "
-			       "types not yet supported");
+			       N_("Moving credentials between diffrent "
+				 "types not yet supported", ""));
 	return KRB5_CC_NOSUPP;
     }
 
diff --git a/lib/krb5/changepw.c b/lib/krb5/changepw.c
index d57ed9e3b..2f150aeee 100644
--- a/lib/krb5/changepw.c
+++ b/lib/krb5/changepw.c
@@ -312,7 +312,7 @@ process_reply (krb5_context context,
 	}
 	if (len == sizeof(reply)) {
 	    krb5_set_error_message(context, ENOMEM,
-				   "message too large from %s",
+				   N_("Message too large from %s", "host"),
 				   host);
 	    return ENOMEM;
 	}
@@ -662,8 +662,8 @@ change_password_loop (krb5_context	context,
     if (ret == KRB5_KDC_UNREACH) {
 	krb5_set_error_message(context,
 			       ret,
-			       "unable to reach any changepw server "
-			       " in realm %s", realm);
+			       N_("Unable to reach any changepw server "
+				 " in realm %s", "realm"), realm);
 	*result_code = KRB5_KPASSWD_HARDERROR;
     }
     return ret;
diff --git a/lib/krb5/context.c b/lib/krb5/context.c
index 358ab2034..cff75d8c3 100644
--- a/lib/krb5/context.c
+++ b/lib/krb5/context.c
@@ -68,7 +68,7 @@ set_etypes (krb5_context context,
 	etypes = malloc((i+1) * sizeof(*etypes));
 	if (etypes == NULL) {
 	    krb5_config_free_strings (etypes_str);
-	    krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	for(j = 0, k = 0; j < i; j++) {
@@ -564,7 +564,7 @@ default_etypes(krb5_context context, krb5_enctype **etype)
 	ep = realloc(e, (n + 2) * sizeof(*e));
 	if (ep == NULL) {
 	    free(e);
-	    krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	e = ep;
@@ -606,7 +606,7 @@ krb5_set_default_in_tkt_etypes(krb5_context context,
 	++i;
 	ALLOC(p, i);
 	if(!p) {
-	    krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	memmove(p, etypes, i * sizeof(krb5_enctype));
@@ -644,7 +644,7 @@ krb5_get_default_in_tkt_etypes(krb5_context context,
 	++i;
 	ALLOC(p, i);
 	if(!p) {
-	    krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	memmove(p, context->etypes, i * sizeof(krb5_enctype));
@@ -788,7 +788,7 @@ krb5_set_extra_addresses(krb5_context context, const krb5_addresses *addresses)
     if(context->extra_addresses == NULL) {
 	context->extra_addresses = malloc(sizeof(*context->extra_addresses));
 	if(context->extra_addresses == NULL) {
-	    krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
     }
@@ -870,7 +870,7 @@ krb5_set_ignore_addresses(krb5_context context, const krb5_addresses *addresses)
     if(context->ignore_addresses == NULL) {
 	context->ignore_addresses = malloc(sizeof(*context->ignore_addresses));
 	if(context->ignore_addresses == NULL) {
-	    krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
     }
diff --git a/lib/krb5/convert_creds.c b/lib/krb5/convert_creds.c
index d74f12120..ebf42c8dd 100644
--- a/lib/krb5/convert_creds.c
+++ b/lib/krb5/convert_creds.c
@@ -97,7 +97,7 @@ krb524_convert_creds_kdc(krb5_context context,
     sp = krb5_storage_from_mem(reply.data, reply.length);
     if(sp == NULL) {
 	ret = ENOMEM;
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	goto out2;
     }
     krb5_ret_int32(sp, &tmp);
@@ -132,7 +132,9 @@ krb524_convert_creds_kdc(krb5_context context,
 	    goto out;
 	memcpy(v4creds->session, v5_creds->session.keyvalue.data, 8);
     } else {
-	krb5_set_error_message (context, ret, "converting credentials: %s", 
+	krb5_set_error_message (context, ret,
+				N_("converting credentials: %s",
+				  "already localized"),
 				krb5_get_err_text(context, ret));
     }
 out:
diff --git a/lib/krb5/copy_host_realm.c b/lib/krb5/copy_host_realm.c
index db06e56fb..8a5d3728f 100644
--- a/lib/krb5/copy_host_realm.c
+++ b/lib/krb5/copy_host_realm.c
@@ -61,7 +61,8 @@ krb5_copy_host_realm(krb5_context context,
 
     *to = calloc (n, sizeof(**to));
     if (*to == NULL) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, 
+				N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -69,7 +70,8 @@ krb5_copy_host_realm(krb5_context context,
 	(*to)[i] = strdup(*p);
 	if ((*to)[i] == NULL) {
 	    krb5_free_host_realm (context, *to);
-	    krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message (context, ENOMEM,
+				    N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
     }
diff --git a/lib/krb5/creds.c b/lib/krb5/creds.c
index d19404176..10aaf8d0c 100644
--- a/lib/krb5/creds.c
+++ b/lib/krb5/creds.c
@@ -156,7 +156,8 @@ krb5_copy_creds (krb5_context context,
 
     c = malloc (sizeof (*c));
     if (c == NULL) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM,
+				N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memset (c, 0, sizeof(*c));
diff --git a/lib/krb5/crypto.c b/lib/krb5/crypto.c
index d0b0e1589..9ff7fb402 100644
--- a/lib/krb5/crypto.c
+++ b/lib/krb5/crypto.c
@@ -181,7 +181,7 @@ static HEIMDAL_MUTEX crypto_mutex = HEIMDAL_MUTEX_INITIALIZER;
 
 static void
 krb5_DES_random_key(krb5_context context,
-	       krb5_keyblock *key)
+		    krb5_keyblock *key)
 {
     DES_cblock *k = key->keyvalue.data;
     do {
@@ -214,16 +214,16 @@ krb5_DES_schedule_old(krb5_context context,
  */
 static void
 krb5_DES_AFS3_CMU_string_to_key (krb5_data pw,
-			    krb5_data cell,
-			    DES_cblock *key)
+				 krb5_data cell,
+				 DES_cblock *key)
 {
     char  password[8+1];	/* crypt is limited to 8 chars anyway */
     int   i;
     
     for(i = 0; i < 8; i++) {
 	char c = ((i < pw.length) ? ((char*)pw.data)[i] : 0) ^
-		 ((i < cell.length) ?
-		  tolower(((unsigned char*)cell.data)[i]) : 0);
+	    ((i < cell.length) ?
+	     tolower(((unsigned char*)cell.data)[i]) : 0);
 	password[i] = c ? c : 'X';
     }
     password[8] = '\0';
@@ -243,8 +243,8 @@ krb5_DES_AFS3_CMU_string_to_key (krb5_data pw,
  */
 static void
 krb5_DES_AFS3_Transarc_string_to_key (krb5_data pw,
-				 krb5_data cell,
-				 DES_cblock *key)
+				      krb5_data cell,
+				      DES_cblock *key)
 {
     DES_key_schedule schedule;
     DES_cblock temp_key;
@@ -335,11 +335,11 @@ DES_string_to_key_int(unsigned char *data, size_t length, DES_cblock *key)
 
 static krb5_error_code
 krb5_DES_string_to_key(krb5_context context,
-		  krb5_enctype enctype,
-		  krb5_data password,
-		  krb5_salt salt,
-		  krb5_data opaque,
-		  krb5_keyblock *key)
+		       krb5_enctype enctype,
+		       krb5_data password,
+		       krb5_salt salt,
+		       krb5_data opaque,
+		       krb5_keyblock *key)
 {
     unsigned char *s;
     size_t len;
@@ -358,7 +358,7 @@ krb5_DES_string_to_key(krb5_context context,
     len = password.length + salt.saltvalue.length;
     s = malloc(len);
     if(len > 0 && s == NULL) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memcpy(s, password.data, password.length);
@@ -440,7 +440,7 @@ DES3_string_to_key(krb5_context context,
     len = password.length + salt.saltvalue.length;
     str = malloc(len);
     if(len != 0 && str == NULL) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memcpy(str, password.data, password.length);
@@ -454,7 +454,7 @@ DES3_string_to_key(krb5_context context,
 	if (ret) {
 	    memset(str, 0, len);
 	    free(str);
-	    krb5_set_error_message (context, ret, "malloc: out of memory");
+	    krb5_set_error_message (context, ret, N_("malloc: out of memory", ""));
 	    return ret;
 	}
 	
@@ -502,7 +502,7 @@ DES3_string_to_key_derived(krb5_context context,
 
     s = malloc(len);
     if(len != 0 && s == NULL) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memcpy(s, password.data, password.length);
@@ -566,11 +566,11 @@ ARCFOUR_schedule(krb5_context context,
 
 static krb5_error_code
 ARCFOUR_string_to_key(krb5_context context,
-		  krb5_enctype enctype,
-		  krb5_data password,
-		  krb5_salt salt,
-		  krb5_data opaque,
-		  krb5_keyblock *key)
+		      krb5_enctype enctype,
+		      krb5_data password,
+		      krb5_salt salt,
+		      krb5_data opaque,
+		      krb5_keyblock *key)
 {
     krb5_error_code ret;
     uint16_t *s = NULL;
@@ -580,7 +580,7 @@ ARCFOUR_string_to_key(krb5_context context,
     m = EVP_MD_CTX_create();
     if (m == NULL) {
 	ret = ENOMEM;
-	krb5_set_error_message(context, ret, "Malloc: out of memory");
+	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 	goto out;
     }
 
@@ -594,7 +594,7 @@ ARCFOUR_string_to_key(krb5_context context,
 	
     s = malloc (len * sizeof(s[0]));
     if (len != 0 && s == NULL) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	ret = ENOMEM;
 	goto out;
     }
@@ -617,12 +617,12 @@ ARCFOUR_string_to_key(krb5_context context,
     key->keytype = enctype;
     ret = krb5_data_alloc (&key->keyvalue, 16);
     if (ret) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	goto out;
     }
     EVP_DigestFinal_ex (m, key->keyvalue.data, NULL);
 
-out:
+ out:
     EVP_MD_CTX_destroy(m);
     if (s)
 	memset (s, 0, len);
@@ -665,13 +665,13 @@ AES_string_to_key(krb5_context context,
     kd.schedule = NULL;
     ALLOC(kd.key, 1);
     if(kd.key == NULL) {
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     kd.key->keytype = enctype;
     ret = krb5_data_alloc(&kd.key->keyvalue, et->keytype->size);
     if (ret) {
-	krb5_set_error_message (context, ret, "malloc: out of memory");
+	krb5_set_error_message (context, ret, N_("malloc: out of memory", ""));
 	return ret;
     }
 
@@ -931,7 +931,7 @@ krb5_salttype_to_string (krb5_context context,
 	    *string = strdup (st->name);
 	    if (*string == NULL) {
 		krb5_set_error_message (context, ENOMEM,
-					"malloc: out of memory");
+					N_("malloc: out of memory", ""));
 		return ENOMEM;
 	    }
 	    return 0;
@@ -1141,7 +1141,7 @@ krb5_enctype_keybits(krb5_context context,
     if(et == NULL) {
 	krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
 			       "encryption type %d not supported",
-			      type);
+			       type);
 	return KRB5_PROG_ETYPE_NOSUPP;
     }
     *keybits = et->keytype->bits;
@@ -1187,7 +1187,7 @@ _key_schedule(krb5_context context,
 	return 0;
     ALLOC(key->schedule, 1);
     if(key->schedule == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     ret = krb5_data_alloc(key->schedule, kt->schedule_size);
@@ -1264,7 +1264,7 @@ des_checksum(krb5_context context,
 
     m = EVP_MD_CTX_create();
     if (m == NULL) {
-	krb5_set_error_message(context, ENOMEM, "Malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -1297,7 +1297,7 @@ des_verify(krb5_context context,
 
     m = EVP_MD_CTX_create();
     if (m == NULL) {
-	krb5_set_error_message(context, ENOMEM, "Malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -1498,7 +1498,7 @@ krb5_hmac(krb5_context context,
 	krb5_free_data(context, kd.schedule);
 
     return ret;
- }
+}
 
 static krb5_error_code
 SP_HMAC_SHA1_checksum(krb5_context context,
@@ -1548,7 +1548,7 @@ HMAC_MD5_checksum(krb5_context context,
 
     m = EVP_MD_CTX_create();
     if (m == NULL) {
-	krb5_set_error_message(context, ENOMEM, "Malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     ksign_c.checksum.length = sizeof(ksign_c_data);
@@ -1735,7 +1735,7 @@ get_checksum_key(krb5_context context,
 
 	*key = _new_derived_key(crypto, 0xff/* KRB5_KU_RFC1510_VARIANT */);
 	if(*key == NULL) {
-	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	ret = krb5_copy_keyblock(context, crypto->key.key, &(*key)->key);
@@ -1852,7 +1852,7 @@ verify_checksum(krb5_context context,
     if (ct == NULL || (ct->flags & F_DISABLED)) {
 	krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
 				"checksum type %d not supported",
-			       cksum->cksumtype);
+				cksum->cksumtype);
 	return KRB5_PROG_SUMTYPE_NOSUPP;
     }
     if(ct->checksumsize != cksum->checksum.length) {
@@ -2638,7 +2638,7 @@ krb5_enctype_to_string(krb5_context context,
     }
     *string = strdup(e->name);
     if(*string == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     return 0;
@@ -2670,7 +2670,7 @@ krb5_enctype_to_keytype(krb5_context context,
     if(e == NULL) {
 	krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
 				"encryption type %d not supported",
-			       etype);
+				etype);
 	return KRB5_PROG_ETYPE_NOSUPP;
     }
     *keytype = e->keytype->type; /* XXX */
@@ -2679,7 +2679,7 @@ krb5_enctype_to_keytype(krb5_context context,
 
 krb5_error_code KRB5_LIB_FUNCTION
 krb5_enctype_valid(krb5_context context, 
-		 krb5_enctype etype)
+		   krb5_enctype etype)
 {
     struct encryption_type *e = _find_enctype(etype);
     if(e == NULL) {
@@ -2722,10 +2722,10 @@ krb5_cksumtype_to_enctype(krb5_context context,
     for(i = 0; i < num_etypes; i++) {
 	if(etypes[i]->keyed_checksum && 
 	   etypes[i]->keyed_checksum->type == ctype)
-        {
-	    *etype = etypes[i]->type;
-	    return 0;
-	}
+	    {
+		*etype = etypes[i]->type;
+		return 0;
+	    }
     }
 
     krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
@@ -2807,7 +2807,7 @@ encrypt_internal_derived(krb5_context context,
     total_sz = block_sz + checksum_sz;
     p = calloc(1, total_sz);
     if(p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     
@@ -2871,7 +2871,7 @@ encrypt_internal(krb5_context context,
     block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
     p = calloc(1, block_sz);
     if(p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     
@@ -2933,7 +2933,7 @@ encrypt_internal_special(krb5_context context,
 
     tmp = malloc (sz);
     if (tmp == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     p = tmp;
@@ -2985,7 +2985,7 @@ decrypt_internal_derived(krb5_context context,
 
     p = malloc(len);
     if(len != 0 && p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memcpy(p, data, len);
@@ -3027,7 +3027,7 @@ decrypt_internal_derived(krb5_context context,
     result->data = realloc(p, l);
     if(result->data == NULL && l != 0) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     result->length = l;
@@ -3056,7 +3056,7 @@ decrypt_internal(krb5_context context,
     checksum_sz = CHECKSUMSIZE(et->checksum);
     p = malloc(len);
     if(len != 0 && p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memcpy(p, data, len);
@@ -3089,7 +3089,7 @@ decrypt_internal(krb5_context context,
     result->data = realloc(p, l);
     if(result->data == NULL && l != 0) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     result->length = l;
@@ -3118,7 +3118,7 @@ decrypt_internal_special(krb5_context context,
 
     p = malloc (len);
     if (p == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     memcpy(p, data, len);
@@ -3133,7 +3133,7 @@ decrypt_internal_special(krb5_context context,
     result->data = realloc(p, sz);
     if(result->data == NULL && sz != 0) {
 	free(p);
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     result->length = sz;
@@ -3537,13 +3537,24 @@ krb5_create_checksum_iov(krb5_context context,
 			 unsigned usage,
 			 krb5_crypto_iov *data,
 			 size_t num_data,
-			 Checksum *result)
+			 krb5_cksumtype *type)
 {
+    Checksum cksum;
+    krb5_crypto_iov *civ;
     krb5_error_code ret;
     unsigned int i;
     size_t len;
     char *p, *q;
 
+    if(!derived_crypto(context, crypto)) { 
+	krb5_clear_error_string(context);
+	return KRB5_CRYPTO_INTERNAL;
+    }
+
+    civ = find_iv(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
+    if (civ == NULL)
+	return KRB5_BAD_MSIZE;
+
     len = 0;
     for (i = 0; i < num_data; i++) {
 	if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
@@ -3562,10 +3573,26 @@ krb5_create_checksum_iov(krb5_context context,
 	q += data[i].data.length;
     }
 
-    ret = krb5_create_checksum(context, crypto, usage, 0,
-                               p, len, result);
+    ret = krb5_create_checksum(context, crypto, usage, 0, p, len, &cksum);
     free(p);
-    return ret;
+    if (ret)
+	return ret;
+
+    if (type)
+	*type = cksum.cksumtype;
+
+    if (cksum.checksum.length > civ->data.length) {
+	krb5_set_error_message(context, KRB5_BAD_MSIZE,
+			       N_("Checksum larger then input buffer", ""));
+	free_Checksum(&cksum);
+	return KRB5_BAD_MSIZE;
+    }
+
+    civ->data.length = cksum.checksum.length;
+    memcpy(civ->data.data, cksum.checksum.data, civ->data.length);
+    free_Checksum(&cksum);
+
+    return 0;
 }
 
 
@@ -3587,6 +3614,10 @@ krb5_crypto_length(krb5_context context,
 	return 0;
     case KRB5_CRYPTO_TYPE_TRAILER:
 	return CHECKSUMSIZE(crypto->et->keyed_checksum);
+    case KRB5_CRYPTO_TYPE_CHECKSUM:
+	if (crypto->et->keyed_checksum)
+	    return CHECKSUMSIZE(crypto->et->keyed_checksum);
+	return CHECKSUMSIZE(crypto->et->checksum);
     }
     return (size_t)-1;
 }
@@ -3718,7 +3749,7 @@ seed_something(void)
 	/* Try using egd */
 	if (!krb5_init_context(&context)) {
 	    p = krb5_config_get_string(context, NULL, "libdefaults",
-		"egd_socket", NULL);
+				       "egd_socket", NULL);
 	    if (p != NULL)
 		RAND_egd_bytes(p, ENTROPY_NEEDED);
 	    krb5_free_context(context);
@@ -3784,13 +3815,13 @@ derive_key(krb5_context context,
 	nblocks = (kt->bits + et->blocksize * 8 - 1) / (et->blocksize * 8);
 	k = malloc(nblocks * et->blocksize);
 	if(k == NULL) {
-	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	ret = _krb5_n_fold(constant, len, k, et->blocksize);
 	if (ret) {
 	    free(k);
-	    krb5_set_error_message(context, ret, "malloc: out of memory");
+	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 	    return ret;
 	}
 	for(i = 0; i < nblocks; i++) {
@@ -3807,7 +3838,7 @@ derive_key(krb5_context context,
 	size_t res_len = (kt->bits + 7) / 8;
 
 	if(len != 0 && c == NULL) {
-	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	memcpy(c, constant, len);
@@ -3815,13 +3846,13 @@ derive_key(krb5_context context,
 	k = malloc(res_len);
 	if(res_len != 0 && k == NULL) {
 	    free(c);
-	    krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	    return ENOMEM;
 	}
 	ret = _krb5_n_fold(c, len, k, res_len);
 	if (ret) {
 	    free(k);
-	    krb5_set_error_message(context, ret, "malloc: out of memory");
+	    krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 	    return ret;
 	}
 	free(c);
@@ -3917,7 +3948,7 @@ _get_derived_key(krb5_context context,
 	}
     d = _new_derived_key(crypto, usage);
     if(d == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     krb5_copy_keyblock(context, crypto->key.key, &d->key);
@@ -3937,7 +3968,7 @@ krb5_crypto_init(krb5_context context,
     krb5_error_code ret;
     ALLOC(*crypto, 1);
     if(*crypto == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     if(etype == ETYPE_NULL)
@@ -4019,7 +4050,7 @@ krb5_crypto_getenctype(krb5_context context,
 		       krb5_enctype *enctype)
 {
     *enctype = crypto->et->type;
-     return 0;
+    return 0;
 }
 
 krb5_error_code KRB5_LIB_FUNCTION
@@ -4120,7 +4151,7 @@ krb5_string_to_key_derived(krb5_context context,
     ALLOC(kd.key, 1);
     if(kd.key == NULL) {
 	krb5_set_error_message (context, ENOMEM,
-				"malloc: out of memory");
+				N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     ret = krb5_data_alloc(&kd.key->keyvalue, et->keytype->size);
@@ -4132,13 +4163,13 @@ krb5_string_to_key_derived(krb5_context context,
     tmp = malloc (keylen);
     if(tmp == NULL) {
 	krb5_free_keyblock(context, kd.key);
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     ret = _krb5_n_fold(str, len, tmp, keylen);
     if (ret) {
 	free(tmp);
-	krb5_set_error_message (context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
 	return ret;
     }
     kd.schedule = NULL;
@@ -4311,7 +4342,7 @@ _krb5_pk_octetstring2key(krb5_context context,
 
     keydata = malloc(keylen);
     if (keydata == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -4460,11 +4491,11 @@ _krb5_pk_kdf(krb5_context context,
     if (ai->parameters != NULL &&
 	(ai->parameters->length != 2 || 
 	 memcmp(ai->parameters->data, "\x05\x00", 2) != 0)) 
-    {
-	krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
-			       "kdf params not NULL or the NULL-type");
-	return KRB5_PROG_ETYPE_NOSUPP;
-    }
+	{
+	    krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
+				   "kdf params not NULL or the NULL-type");
+	    return KRB5_PROG_ETYPE_NOSUPP;
+	}
 
     et = _find_enctype(enctype);
     if(et == NULL) {
@@ -4477,7 +4508,7 @@ _krb5_pk_kdf(krb5_context context,
 
     keydata = malloc(keylen);
     if (keydata == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -4582,7 +4613,7 @@ krb5_keytype_to_enctypes_default (krb5_context context,
 	;
     ret = malloc (n * sizeof(*ret));
     if (ret == NULL && n != 0) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     for (i = 0; i < n; ++i)
@@ -4606,7 +4637,7 @@ krb5_keytype_to_string(krb5_context context,
     }
     *string = strdup(kt->name);
     if(*string == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     return 0;
@@ -4657,7 +4688,7 @@ krb5_keytype_to_enctypes (krb5_context context,
     }
     ret = malloc(n * sizeof(*ret));
     if (ret == NULL && n != 0) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     n = 0;
diff --git a/lib/krb5/krb5.h b/lib/krb5/krb5.h
index 096ef9bc3..a1b9533d5 100644
--- a/lib/krb5/krb5.h
+++ b/lib/krb5/krb5.h
@@ -778,6 +778,8 @@ typedef struct krb5_crypto_iov {
 #define KRB5_CRYPTO_TYPE_PADDING	4
    /* OUT krb5_crypto_length(KRB5_CRYPTO_TYPE_TRAILER) */
 #define KRB5_CRYPTO_TYPE_TRAILER	5
+   /* OUT krb5_crypto_length(KRB5_CRYPTO_TYPE_CHECKSUM) */
+#define KRB5_CRYPTO_TYPE_CHECKSUM	6
     krb5_data data;
 } krb5_crypto_iov;
 
diff --git a/lib/krb5/krb5_locl.h b/lib/krb5/krb5_locl.h
index 73075bf56..02aac6f14 100644
--- a/lib/krb5/krb5_locl.h
+++ b/lib/krb5/krb5_locl.h
@@ -116,6 +116,13 @@ struct sockaddr_dl;
 #include <sys/file.h>
 #endif
 
+#if 1
+#define N_(x,y) (x)
+#else
+#define N_(x,y) dgettext("heimdal_krb5", x)
+#endif
+
+
 #ifdef HAVE_CRYPT_H
 #undef des_encrypt
 #define des_encrypt wingless_pigs_mostly_fail_to_fly
diff --git a/lib/krb5/v4_glue.c b/lib/krb5/v4_glue.c
index baa4bd689..acf41377b 100644
--- a/lib/krb5/v4_glue.c
+++ b/lib/krb5/v4_glue.c
@@ -148,8 +148,8 @@ write_v4_cc(krb5_context context, const char *tkfile,
     ret = get_krb4_cc_name(tkfile, &path);
     if (ret) {
 	krb5_set_error_message(context, ret, 
-			      "krb5_krb_tf_setup: failed getting "
-			      "the krb4 credentials cache name"); 
+			       N_("Failed getting the krb4 credentials "
+				 "cache name", "")); 
 	return ret;
     }
 
@@ -157,8 +157,9 @@ write_v4_cc(krb5_context context, const char *tkfile,
     if (fd < 0) {
 	ret = errno;
 	krb5_set_error_message(context, ret, 
-			      "krb5_krb_tf_setup: error opening file %s", 
-			      path);
+			       N_("Failed opening krb4 credential cache "
+				 "%s: %s", "path, error"),
+			       path, strerror(ret));
 	free(path);
 	return ret;
     }
@@ -166,8 +167,8 @@ write_v4_cc(krb5_context context, const char *tkfile,
 
     if (fstat(fd, &sb) != 0 || !S_ISREG(sb.st_mode)) {
 	krb5_set_error_message(context, ret, 
-			      "krb5_krb_tf_setup: tktfile %s is not a file",
-			      path);
+			       N_("krb4 credential cache %s is not a file", ""),
+			       path);
 	free(path);
 	close(fd);
 	return KRB5_FCC_PERM;
@@ -181,7 +182,7 @@ write_v4_cc(krb5_context context, const char *tkfile,
     }
     if (i == KRB5_TF_LCK_RETRY_COUNT) {
 	krb5_set_error_message(context, KRB5_FCC_PERM,
-			       "krb5_krb_tf_setup: failed to lock %s",
+			       N_("Failed to lock credentail cache %s", ""),
 			       path);
 	free(path);
 	close(fd);
@@ -193,7 +194,7 @@ write_v4_cc(krb5_context context, const char *tkfile,
 	if (ret < 0) {
 	    flock(fd, LOCK_UN);
 	    krb5_set_error_message(context, KRB5_FCC_PERM,
-				   "krb5_krb_tf_setup: failed to truncate %s",
+				   N_("Failed to truncate krb4 cc %s", ""),
 				   path);
 	    free(path);
 	    close(fd);
@@ -293,16 +294,17 @@ _krb5_krb_dest_tkt(krb5_context context, const char *tkfile)
     ret = get_krb4_cc_name(tkfile, &path);
     if (ret) {
 	krb5_set_error_message(context, ret, 
-			      "krb5_krb_tf_setup: failed getting "
-			      "the krb4 credentials cache name"); 
+			       N_("Failed getting the krb4 credentials "
+				 "cache name", "")); 
 	return ret;
     }
 
     if (unlink(path) < 0) {
 	ret = errno;
 	krb5_set_error_message(context, ret, 
-			      "krb5_krb_dest_tkt failed removing the cache "
-			      "with error %s", strerror(ret));
+			       N_("Failed removing the cache %s "
+				 "with error %s", "path, error"),
+			       path, strerror(ret));
     }
     free(path);
 
@@ -422,7 +424,7 @@ _krb5_krb_create_ticket(krb5_context context,
 
     sp = krb5_storage_emem();
     if (sp == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_BE);
@@ -449,7 +451,8 @@ _krb5_krb_create_ticket(krb5_context context,
  error:
     krb5_storage_free(sp);
     if (ret)
-	krb5_set_error_message(context, ret, "Failed to encode kerberos 4 ticket");
+	krb5_set_error_message(context, ret,
+			       N_("Failed to encode kerberos 4 ticket", ""));
 
     return ret;
 }
@@ -478,7 +481,7 @@ _krb5_krb_create_ciph(krb5_context context,
 
     sp = krb5_storage_emem();
     if (sp == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_BE);
@@ -508,7 +511,8 @@ _krb5_krb_create_ciph(krb5_context context,
  error:
     krb5_storage_free(sp);
     if (ret)
-	krb5_set_error_message(context, ret, "Failed to encode kerberos 4 ticket");
+	krb5_set_error_message(context, ret,
+			       N_("Failed to encode kerberos 4 ticket", ""));
 
     return ret;
 }
@@ -536,7 +540,7 @@ _krb5_krb_create_auth_reply(krb5_context context,
 
     sp = krb5_storage_emem();
     if (sp == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_BE);
@@ -560,7 +564,8 @@ _krb5_krb_create_auth_reply(krb5_context context,
  error:
     krb5_storage_free(sp);
     if (ret)
-	krb5_set_error_message(context, ret, "Failed to encode kerberos 4 ticket");
+	krb5_set_error_message(context, ret,
+			       N_("Failed to encode kerberos 4 ticket", ""));
 	
     return ret;
 }
@@ -591,7 +596,7 @@ _krb5_krb_cr_err_reply(krb5_context context,
 
     sp = krb5_storage_emem();
     if (sp == NULL) {
-	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
     krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_BE);
@@ -770,7 +775,7 @@ _krb5_krb_rd_req(krb5_context context,
 
     sp = krb5_storage_from_data(authent);
     if (sp == NULL) {
-	krb5_set_error_message(context, ENOMEM, "alloc: out of memory");
+	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
 	return ENOMEM;
     }
 
@@ -778,19 +783,19 @@ _krb5_krb_rd_req(krb5_context context,
 
     ret = krb5_ret_int8(sp, &pvno);
     if (ret) {
-	krb5_set_error_message(context, ret, "Failed reading v4 pvno");
+	krb5_set_error_message(context, ret, N_("Failed reading v4 pvno", ""));
 	goto error;
     }
 
     if (pvno != KRB_PROT_VERSION) {
 	ret = KRB4ET_RD_AP_VERSION;
-	krb5_set_error_message(context, ret, "Failed v4 pvno not 4");
+	krb5_set_error_message(context, ret, N_("Failed v4 pvno not 4", ""));
 	goto error;
     }
 
     ret = krb5_ret_int8(sp, &type);
     if (ret) {
-	krb5_set_error_message(context, ret, "Failed readin v4 type");
+	krb5_set_error_message(context, ret, N_("Failed readin v4 type", ""));
 	goto error;
     }
 
@@ -799,7 +804,8 @@ _krb5_krb_rd_req(krb5_context context,
     
     if(type != AUTH_MSG_APPL_REQUEST && type != AUTH_MSG_APPL_REQUEST_MUTUAL) {
 	ret = KRB4ET_RD_AP_MSG_TYPE;
-	krb5_set_error_message(context, ret, "Not a valid v4 request type");
+	krb5_set_error_message(context, ret,
+			       N_("Not a valid v4 request type", ""));
 	goto error;
     }
 
@@ -812,7 +818,7 @@ _krb5_krb_rd_req(krb5_context context,
     size = krb5_storage_read(sp, ticket.data, ticket.length);
     if (size != ticket.length) {
 	ret = KRB4ET_INTK_PROT;
-	krb5_set_error_message(context, ret, "Failed reading v4 ticket");
+	krb5_set_error_message(context, ret, N_("Failed reading v4 ticket", ""));
 	goto error;
     }
 
@@ -827,7 +833,8 @@ _krb5_krb_rd_req(krb5_context context,
     size = krb5_storage_read(sp, eaut.data, eaut.length);
     if (size != eaut.length) {
 	ret = KRB4ET_INTK_PROT;
-	krb5_set_error_message(context, ret, "Failed reading v4 authenticator");
+	krb5_set_error_message(context, ret,
+			       N_("Failed reading v4 authenticator", ""));
 	goto error;
     }
 
@@ -841,7 +848,7 @@ _krb5_krb_rd_req(krb5_context context,
     sp = krb5_storage_from_data(&aut);
     if (sp == NULL) {
 	ret = ENOMEM;
-	krb5_set_error_message(context, ret, "alloc: out of memory");
+	krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 	goto error;
     }
 
@@ -862,13 +869,14 @@ _krb5_krb_rd_req(krb5_context context,
 	strcmp(ad->pinst, r_instance) != 0 ||
 	strcmp(ad->prealm, r_realm) != 0) {
 	ret = KRB4ET_RD_AP_INCON;
-	krb5_set_error_message(context, ret, "v4 principal mismatch");
+	krb5_set_error_message(context, ret, N_("v4 principal mismatch", ""));
 	goto error;
     }
     
     if (from_addr && ad->address && from_addr != ad->address) {
 	ret = KRB4ET_RD_AP_BADD;
-	krb5_set_error_message(context, ret, "v4 bad address in ticket");
+	krb5_set_error_message(context, ret,
+			       N_("v4 bad address in ticket", ""));
 	goto error;
     }
 
@@ -876,7 +884,7 @@ _krb5_krb_rd_req(krb5_context context,
     delta_t = abs((int)(tv.tv_sec - r_time_sec));
     if (delta_t > CLOCK_SKEW) {
         ret = KRB4ET_RD_AP_TIME;
-	krb5_set_error_message(context, ret, "v4 clock skew");
+	krb5_set_error_message(context, ret, N_("v4 clock skew", ""));
 	goto error;
     }
 
@@ -886,13 +894,14 @@ _krb5_krb_rd_req(krb5_context context,
     
     if ((tkt_age < 0) && (-tkt_age > CLOCK_SKEW)) {
         ret = KRB4ET_RD_AP_NYV;
-	krb5_set_error_message(context, ret, "v4 clock skew for expiration");
+	krb5_set_error_message(context, ret,
+			       N_("v4 clock skew for expiration", ""));
 	goto error;
     }
 
     if (tv.tv_sec > _krb5_krb_life_to_time(ad->time_sec, ad->life)) {
 	ret = KRB4ET_RD_AP_EXP;
-	krb5_set_error_message(context, ret, "v4 ticket expired");
+	krb5_set_error_message(context, ret, N_("v4 ticket expired", ""));
 	goto error;
     }