diff --git a/lib/kadm5/create_s.c b/lib/kadm5/create_s.c
index 56d0a2ae5..9bfacd4ec 100644
--- a/lib/kadm5/create_s.c
+++ b/lib/kadm5/create_s.c
@@ -159,21 +159,9 @@ kadm5_s_create_principal(void *server_handle,
     if(ret)
 	goto out;
 
-    /* XXX this should be fixed */
-    ent.keys.len = 4;
-    ent.keys.val = calloc(ent.keys.len, sizeof(*ent.keys.val));
-    ent.keys.val[0].key.keytype = ETYPE_DES_CBC_CRC;
-    /* flag as version 4 compatible salt; ignored by _kadm5_set_keys
-       if we don't want to be compatible */
-    ent.keys.val[0].salt = calloc(1, sizeof(*ent.keys.val[0].salt));
-    ent.keys.val[0].salt->type = hdb_pw_salt;
-    ent.keys.val[1].key.keytype = ETYPE_DES_CBC_MD4;
-    ent.keys.val[1].salt = calloc(1, sizeof(*ent.keys.val[1].salt));
-    ent.keys.val[1].salt->type = hdb_pw_salt;
-    ent.keys.val[2].key.keytype = ETYPE_DES_CBC_MD5;
-    ent.keys.val[2].salt = calloc(1, sizeof(*ent.keys.val[2].salt));
-    ent.keys.val[2].salt->type = hdb_pw_salt;
-    ent.keys.val[3].key.keytype = ETYPE_DES3_CBC_SHA1;
+    ent.keys.len = 0;
+    ent.keys.val = NULL;
+
     ret = _kadm5_set_keys(context, &ent, password);
     if (ret)
 	goto out;
@@ -189,7 +177,7 @@ kadm5_s_create_principal(void *server_handle,
 	goto out;
     ret = context->db->hdb_store(context->context, context->db, 0, &ent);
     context->db->hdb_close(context->context, context->db);
-out:
+ out:
     hdb_free_entry(context->context, &ent);
     return _kadm5_error_code(ret);
 }