diff --git a/lib/hdb/hdb.c b/lib/hdb/hdb.c
index e6ccb51c4..e0e819d5c 100644
--- a/lib/hdb/hdb.c
+++ b/lib/hdb/hdb.c
@@ -88,108 +88,6 @@ hdb_enctype2key(krb5_context context,
     return hdb_next_enctype2key(context, e, enctype, key);
 }
 
-/* this is a bit ugly, but will get better when the crypto framework
-   gets fixed */
-
-krb5_error_code
-hdb_process_master_key(krb5_context context, EncryptionKey key, 
-		       krb5_data *schedule)
-{
-    krb5_error_code ret;
-
-    if(key.keytype != ETYPE_DES_CBC_MD5)
-	return KRB5_PROG_KEYTYPE_NOSUPP;
-
-    ret = krb5_data_alloc (schedule, sizeof(des_key_schedule));
-    if (ret)
-	return ret;
-
-    des_set_key((des_cblock*)key.keyvalue.data, schedule->data);
-    return 0;
-}
-
-krb5_error_code
-hdb_read_master_key(krb5_context context, const char *filename, 
-		    EncryptionKey *key)
-{
-    FILE *f;
-    unsigned char buf[256];
-    size_t len;
-    krb5_error_code ret;
-    if(filename == NULL)
-	filename = HDB_DB_DIR "/m-key";
-    f = fopen(filename, "r");
-    if(f == NULL)
-	return errno;
-    len = fread(buf, 1, sizeof(buf), f);
-    if(ferror(f))
-	ret = errno;
-    else
-	ret = decode_EncryptionKey(buf, len, key, &len);
-    fclose(f);
-    memset(buf, 0, sizeof(buf));
-    return ret;
-}
-
-void
-_hdb_unseal_keys_int(hdb_entry *ent, int key_version, krb5_data schedule)
-{
-    int i;
-    for(i = 0; i < ent->keys.len; i++){
-	des_cblock iv;
-	int num = 0;
-	if(ent->keys.val[i].mkvno == NULL)
-	    continue;
-	if(*ent->keys.val[i].mkvno != key_version)
-	    ;
-	memset(&iv, 0, sizeof(iv));
-	
-	des_cfb64_encrypt(ent->keys.val[i].key.keyvalue.data, 
-			  ent->keys.val[i].key.keyvalue.data, 
-			  ent->keys.val[i].key.keyvalue.length, 
-			  schedule.data, &iv, &num, 0);
-	free(ent->keys.val[i].mkvno);
-	ent->keys.val[i].mkvno = NULL;
-    }
-}
-
-void
-hdb_unseal_keys(HDB *db, hdb_entry *ent)
-{
-    if (db->master_key_set == 0)
-	return;
-    _hdb_unseal_keys_int(ent, db->master_key_version, db->master_key);
-}
-
-void
-_hdb_seal_keys_int(hdb_entry *ent, int key_version, krb5_data schedule)
-{
-    int i;
-    for(i = 0; i < ent->keys.len; i++){
-	des_cblock iv;
-	int num = 0;
-
-	if(ent->keys.val[i].mkvno != NULL)
-	    continue;
-	memset(&iv, 0, sizeof(iv));
-	des_cfb64_encrypt(ent->keys.val[i].key.keyvalue.data, 
-			  ent->keys.val[i].key.keyvalue.data, 
-			  ent->keys.val[i].key.keyvalue.length, 
-			  schedule.data, &iv, &num, 1);
-	ent->keys.val[i].mkvno = malloc(sizeof(*ent->keys.val[i].mkvno));
-	*ent->keys.val[i].mkvno = key_version;
-    }
-}
-
-void
-hdb_seal_keys(HDB *db, hdb_entry *ent)
-{
-    if (db->master_key_set == 0)
-	return;
-    
-    _hdb_seal_keys_int(ent, db->master_key_version, db->master_key);
-}
-
 void
 hdb_free_key(Key *key)
 {
@@ -339,53 +237,3 @@ hdb_create(krb5_context context, HDB **db, const char *filename)
 	krb5_errx(context, 1, "No database support! (hdb_create)");
     return (*h->create)(context, db, residual);
 }
-
-krb5_error_code
-hdb_set_master_key (krb5_context context,
-		    HDB *db,
-		    EncryptionKey key)
-{
-    krb5_error_code ret;
-
-    ret = hdb_process_master_key(context, key, &db->master_key);
-    if (ret)
-	return ret;
-#if 0 /* XXX - why? */
-    des_set_random_generator_seed(key.keyvalue.data);
-#endif
-    db->master_key_set = 1;
-    db->master_key_version = 0; /* XXX */
-    return 0;
-}
-
-krb5_error_code
-hdb_set_master_keyfile (krb5_context context,
-			HDB *db,
-			const char *keyfile)
-{
-    EncryptionKey key;
-    krb5_error_code ret;
-
-    ret = hdb_read_master_key(context, keyfile, &key);
-    if (ret) {
-	if (ret != ENOENT)
-	    return ret;
-	return 0;
-    }
-    ret = hdb_set_master_key(context, db, key);
-    memset(key.keyvalue.data, 0, key.keyvalue.length);
-    free_EncryptionKey(&key);
-    return ret;
-}
-
-krb5_error_code
-hdb_clear_master_key (krb5_context context,
-		      HDB *db)
-{
-    if (db->master_key_set) {
-	memset(db->master_key.data, 0, db->master_key.length);
-	krb5_data_free(&db->master_key);
-	db->master_key_set = 0;
-    }
-    return 0;
-}